Skip to content

Upgrading org.springframework.boot:spring-boot-starter-actuator 2 to 3

Breaking2.7.18 → 3.5.16Breaking2Security2Deprecated4New20Changed2351Fixed1080Other876

Full comparisonBack to org.springframework.boot:spring-boot-starter-actuator
BreakingUpgrade verdict

2 breaking changes and 2 security fixes.

In plain terms
  • The old spring.http.client properties are gone, and the reactive client settings properties moved to a shorter prefix.
  • Two starters no longer pull in AOP support automatically, so projects relying on it must add it themselves.
  • Spring Boot has an Authentication Bypass under Actuator CloudFoundry endpoints
  • Spring Boot has an Authentication Bypass under Actuator Health groups paths
Must act Top 5 of 8 that need code or config changes

Adds io.micrometer:micrometer-jakarta9 1.15.12, io.micrometer:micrometer-observation 1.15.12.

Drops io.micrometer:micrometer-core.

Installs 30 packages in all (was 27).

What you must change

Breaking2
Removes the 'spring.http.client' deprecation and renames 'spring.http.reactiveclient.settings' to 'spring.http.reactiveclient'.
spring.http.clientspring.http.reactiveclient.settingsspring.http.reactiveclient
3.5.0GitHub ReleaseSummarizedView source
Removes spring-boot-starter-aop dependency from spring-boot-starter-data-jpa and spring-boot-starter-integration.
spring-boot-starter-aopspring-boot-starter-data-jpaspring-boot-starter-integration
3.4.0GitHub ReleaseSummarizedView source
Security2
Spring Boot has an Authentication Bypass under Actuator CloudFoundry endpoints
High · CVSS 8.2
3.5.12GitHub AdvisoryOriginalView source
Spring Boot has an Authentication Bypass under Actuator Health groups paths
High · CVSS 8.2
3.5.12GitHub AdvisoryOriginalView source

Deprecations to plan for

Deprecated4
Adapts the deprecation level for management.health.influxdb.enabled.
management.health.influxdb.enabled
3.5.5GitHub ReleaseSummarizedView source
Adapts the deprecation level for management.health.influxdb.enabled.
management.health.influxdb.enabled
3.4.9GitHub ReleaseSummarizedView source
Deprecates remaining @ControllerEndpoint and @RestControllerEndpoint infrastructure.
@ControllerEndpoint@RestControllerEndpoint
3.3.5GitHub ReleaseSummarizedView source
Deprecates remaining @ControllerEndpoint and @RestControllerEndpoint infrastructure.
@ControllerEndpoint@RestControllerEndpoint
3.3.3GitHub ReleaseSummarizedView source