Skip to content

Upgrading org.springframework.boot:spring-boot-starter-actuator 3 to 4

Breaking3.5.16 → 4.1.2Breaking5Security4Platform1Deprecated3New331Changed978Fixed506Other279

Full comparisonBack to org.springframework.boot:spring-boot-starter-actuator
BreakingUpgrade verdict

5 breaking changes and a platform requirement change and 4 security fixes.

In plain terms
  • If your build uses Protobuf and gRPC, the build tool no longer sets up gRPC for you automatically; you must opt in explicitly.
  • OpenTelemetry's ZipkinSpanExporter has been deprecated and its support will be removed in Spring Boot 4.2.
  • The Jetty starter no longer pulls in a servlet library it did not use. If your own code uses classes from that library, you must add it yourself.
  • Two Kotlin serialization starter packages have new names that match their modules, so build files must use the new names.
Must act Top 5 of 13 that need code or config changes

org.springframework.boot:spring-boot-starter-actuator publishes an official migration guide for version 4. It covers more than the release notes do.

A migration guide ↗

Adds org.springframework.boot:spring-boot-health 4.1.2, org.springframework.boot:spring-boot-starter-micrometer-metrics 4.1.2.

What you must change

Breaking5
Spring Boot's Gradle plugin no longer automatically configures gRPC when the Protobuf plugin is applied.
protobufgrpcprotoc-gen-grpc-java
4.1.1GitHub ReleaseSummarizedView source
OpenTelemetry's ZipkinSpanExporter has been deprecated and its support will be removed in Spring Boot 4.2.
4.1.0-M3GitHub ReleaseOriginalView source
Removes the unnecessary and unused jetty-ee11-servlets dependency from spring-boot-jetty.
org.eclipse.jetty.ee11:jetty-ee11-servletsspring-boot-jetty
4.0.2GitHub ReleaseSummarizedView source
Renames spring-boot-starter-kotlin-serialization to spring-boot-starter-kotlinx-serialization-json and its test starter to spring-boot-starter-kotlinx-serialization-json-test.
spring-boot-starter-kotlin-serializationspring-boot-starter-kotlinx-serialization-jsonspring-boot-starter-kotlin-serialization-testspring-boot-starter-kotlinx-serialization-json-test
4.0.1GitHub ReleaseSummarizedView source
Using TestRestTemplate now requires a dependency on spring-boot-restclient.
TestRestTemplatespring-boot-restclient
4.0.1GitHub ReleaseSummarizedView source
Security4
Applies HTML escaping to the timestamp attribute in the Whitelabel error page.
4.1.0GitHub ReleaseSummarizedView source
Applies HTML escaping to the timestamp attribute in the Whitelabel error page.
4.0.7GitHub ReleaseSummarizedView source
Spring Boot has an Authentication Bypass under Actuator CloudFoundry endpoints
High · CVSS 8.2
4.0.4GitHub AdvisoryOriginalView source
Spring Boot has an Authentication Bypass under Actuator Health groups paths
High · CVSS 8.2
4.0.4GitHub AdvisoryOriginalView source
Platform1
Upgrade to jOOQ 3.20 and require Java 21 to use it.
4.1.0-M1GitHub ReleaseOriginalView source

Deprecations to plan for

Deprecated3
Deprecates SpringJtaPlatform, which should have been deprecated since 4.1.0-M3.
SpringJtaPlatform
4.1.0GitHub ReleaseSummarizedView source
Deprecates OpenTelemetry's ZipkinSpanExporter, with support to be removed in Spring Boot 4.2.
ZipkinSpanExporter
4.0.4GitHub ReleaseSummarizedView source
Delays removal of Jackson 2 support until 4.3 at the earliest.
4.0.3GitHub ReleaseSummarizedView source