Upgrading org.springframework.boot:spring-boot-starter-security 3 to 4
Breaking3.5.16 → 4.1.2Breaking47Security2Platform5Deprecated11New208Changed973Fixed466Other294
BreakingUpgrade verdict
47 breaking changes and 5 platform requirement changes and 2 security fixes.
In plain terms
- If your project uses Protobuf with gRPC, the build tool no longer sets up gRPC support for you automatically. You now have to turn it on yourself.
- The Jetty starter no longer pulls in a servlet library it did not use. If your code uses classes from that library, add it to your build yourself.
- Removes support for the deprecated layertools jar mode.
- Removes support for deprecated Logback properties.
Must act Top 5 of 65 that need code or config changes
org.springframework.boot:spring-boot-starter-security publishes an official migration guide for version 4. It covers more than the release notes do.
A migration guide ↗Adds org.springframework.boot:spring-boot-security 4.1.2.
Drops org.springframework.security:spring-security-config, org.springframework.security:spring-security-web.
Installs 27 packages in all (was 25).
What you must change
Breaking47
Spring Boot's Gradle plugin no longer automatically configures gRPC when the Protobuf plugin is applied.
protobufgrpcprotoc-gen-grpc-javaRemoves the unused jetty-ee11-servlets dependency from spring-boot-jetty; applications using its classes must declare it.
org.eclipse.jetty.ee11:jetty-ee11-servletsspring-boot-jettyRemoves support for the deprecated layertools jar mode.
layertoolsRemoves support for deprecated Logback properties.
LogbackRemoves the unused dependency on org.eclipse.jetty.ee11:jetty-ee11-servlets from spring-boot-jetty.
org.eclipse.jetty.ee11:jetty-ee11-servletsspring-boot-jettyRemoves support for Spring Pulsar Reactive.
Removes ConcurrentReferenceCachingMetadataReaderFactory.
ConcurrentReferenceCachingMetadataReaderFactoryRemoves integration for REST Docs' REST Assured support until REST Assured supports Groovy 5.
Removes support for embedded jar launch scripts.
Removes support for Spring Session Data MongoDB.
Removes support for Spring Session Hazelcast.
Drops Spock until it supports Groovy 5.
Renames Jackson-specific Json… annotations and classes to Jackson….
Renames spring-boot-tx module to spring-boot-transaction.
spring-boot-txspring-boot-transactionRenames SharedObjectMapper to SharedJsonMapper.
SharedObjectMapperSharedJsonMapperRemoves the SQL and Reactor starters as they are only used transitively.
Renames Spring Session properties that depend on Spring Data.
Renames JsonMapper-specific properties to make clear they are JSON-specific.
JsonMapperRemoves Bitnami support.
Renames …DataAutoConfiguration to Data…AutoConfiguration.
…DataAutoConfigurationData…AutoConfigurationDrops spring-boot-loader-classic support.
spring-boot-loader-classicRemoves auto-configuration support for '@HttpServiceClient'.
@HttpServiceClientRenames spring.mongodb.uuid-representation.
spring.mongodb.uuid-representationRemoves GridFs from MongoConnectionDetails.
MongoConnectionDetailsGridFsRenames *DataProperties classes to Data*Properties.
*DataPropertiesData*PropertiesDrops support for Jersey until it supports JAX-RS 4 (Jakarta EE 11).
JerseyJAX-RS 4Removes dependency management for Spring Retry in favor of spring-core's new retry support.
Spring Retryspring-coreRemoves isImmutable and getPrefix from OriginLookup.
OriginLookupisImmutablegetPrefixRenames spring-boot-starter-aop to spring-boot-starter-aspectj.
spring-boot-starter-aopspring-boot-starter-aspectjRenames MongoDB properties that do not require Spring Data MongoDB.
MongoDBRenames metrics, observation, and tracing modules to include micrometer in their names and packages.
Drops support for Undertow as it is not Servlet 6.1 compatible.
UndertowDrops Actuator endpoint parameter support for javax.annotations.NonNull.
javax.annotations.NonNullRemoves StreamBuilderFactoryBeanCustomizer in favor of Spring Kafka's StreamsBuilderFactoryBeanConfigurer.
StreamBuilderFactoryBeanCustomizerStreamsBuilderFactoryBeanConfigurerMakes auto-configurations final and removes public members.
Drops support for Wavefront.
WavefrontRemoves APIs that were deprecated for removal in 4.0 or earlier.
Uses Charset instead of String for Mustache template encoding.
CharsetStringRenames spring-boot-starter-kotlin-serialization to spring-boot-starter-kotlinx-serialization-json and its test starter accordingly.
spring-boot-starter-kotlin-serializationspring-boot-starter-kotlinx-serialization-jsonspring-boot-starter-kotlin-serialization-testspring-boot-starter-kotlinx-serialization-json-testUsing TestRestTemplate now requires a dependency on spring-boot-restclient.
TestRestTemplatespring-boot-restclientMoves spring.jackson.datetime.<feature-name> to spring.jackson.datatype.datetime<feature-name>.
spring.jackson.datetime.<feature-name>spring.jackson.datatype.datetime<feature-name>Makes all type exclude filters package-private.
Makes ConfigDataLocation.of non-nullable.
ConfigDataLocation.ofMakes SanitizableData.key non-nullable.
SanitizableData.keyAlways uses mongodb rather than mongo in MongoDB-related configuration properties.
Replaces @OptionalParameter with JSpecify's @Nullable.
@OptionalParameter@NullableReplaces ClientHttpRequestFactorySettings.Redirects with HttpRedirects.
ClientHttpRequestFactorySettings.RedirectsHttpRedirectsSecurity2
Applies HTML escaping to the timestamp attribute in the Whitelabel error page.
Applies HTML escaping to the timestamp attribute in the Whitelabel error page.
Platform5
Upgrades to jOOQ 3.20 and requires Java 21 to use it.
jOOQUpdates Neo4j support to require Neo4j Java Driver 6.0.0.
Raises the minimum supported version of the CycloneDX Gradle Plugin to 3.0.0.
CycloneDX Gradle PluginRaises the minimum supported version of Gradle to 8.14.
GradleSupports Gradle 9.
GradleDeprecations to plan for
Deprecated11
Deprecates SpringJtaPlatform, which should have been deprecated since 4.1.0-M3.
SpringJtaPlatformDeprecates OpenTelemetry's ZipkinSpanExporter, with support to be removed in Spring Boot 4.2.
ZipkinSpanExporterDeprecates LiveReload support for removal.
Deprecates RootUriTemplateHandler in favor of DefaultUriBuilderFactory.
RootUriTemplateHandlerDefaultUriBuilderFactoryDelays removal of Jackson 2 support until 4.3 at the earliest.
Deprecates Derby support since Apache Derby is retired.
DerbyDeprecates OpenTelemetry's ZipkinSpanExporter, with support to be removed in Spring Boot 4.2.
ZipkinSpanExporterDelays removal of Jackson 2 support until 4.3 at the earliest.
Reintroduces the previous EnvironmentPostProcessor in deprecated form.
EnvironmentPostProcessorDeprecates JUnit 4 integration.
Deprecates ANT_PATH_MATCHER.
ANT_PATH_MATCHER