Upgrading org.springframework.boot:spring-boot-starter-security 2 to 3
Breaking2.7.18 → 3.5.16Breaking2Security2Deprecated3New22Changed2355Fixed1077Other872
BreakingUpgrade verdict
2 breaking changes and 2 security fixes.
In plain terms
- Two HTTP client configuration properties change: one deprecated property is gone and another is renamed.
- Projects relying on AOP support pulled in transitively by these starters must now add the AOP starter themselves.
- Mail sending configuration now enables hostname verification so the mail server's certificate is checked against its hostname.
- The timestamp shown on the default error page is now HTML-escaped to prevent injection.
Must act Top 5 of 7 that need code or config changes
Installs 25 packages in all (was 23).
What you must change
Breaking2
Removes the 'spring.http.client' deprecation and renames 'spring.http.reactiveclient.settings' to 'spring.http.reactiveclient'.
spring.http.clientspring.http.reactiveclient.settingsspring.http.reactiveclientRemoves spring-boot-starter-aop dependency from spring-boot-starter-data-jpa and spring-boot-starter-integration.
spring-boot-starter-aopspring-boot-starter-data-jpaspring-boot-starter-integrationSecurity2
MailSender auto-configuration does not enable hostname verification.
Applies HTML escaping to the timestamp attribute in the Whitelabel error page.
Deprecations to plan for
Deprecated3
Adapts the deprecation level for management.health.influxdb.enabled.
management.health.influxdb.enabledDeprecates remaining @ControllerEndpoint and @RestControllerEndpoint infrastructure.
@ControllerEndpoint@RestControllerEndpointDeprecates remaining @ControllerEndpoint and @RestControllerEndpoint infrastructure.
@ControllerEndpoint@RestControllerEndpoint