Upgrading org.springframework.boot:spring-boot-starter-web 3 to 4
Breaking3.5.16 → 4.1.2Breaking50Security1Platform5Deprecated11New210Changed1013Fixed506Other309
BreakingUpgrade verdict
50 breaking changes and 5 platform requirement changes and a security fix.
In plain terms
- If your project uses Protobuf and gRPC with Gradle, the gRPC setup is no longer done for you automatically. You now have to turn it on yourself.
- A library that Spring Boot used to pull in automatically is no longer included. If your app uses classes from it, add it to your own build file.
- Removes support for the deprecated layertools jar mode.
- Removes support for deprecated Logback properties.
Must act Top 5 of 67 that need code or config changes
org.springframework.boot:spring-boot-starter-web publishes an official migration guide for version 4. It covers more than the release notes do.
A migration guide ↗Adds org.springframework.boot:spring-boot-http-converter 4.1.2, org.springframework.boot:spring-boot-starter-jackson 4.1.2, org.springframework.boot:spring-boot-webmvc 4.1.2.
Drops org.springframework.boot:spring-boot-starter, org.springframework.boot:spring-boot-starter-json, org.springframework:spring-web, org.springframework:spring-webmvc.
Installs 38 packages in all (was 33).
What you must change
Breaking50
Spring Boot's Gradle plugin no longer automatically configures gRPC when the Protobuf plugin is applied.
protobufgrpcprotoc-gen-grpc-javaRemoves the unused jetty-ee11-servlets dependency from spring-boot-jetty; applications using its classes must declare it explicitly.
org.eclipse.jetty.ee11:jetty-ee11-servletsspring-boot-jettyRemoves support for the deprecated layertools jar mode.
layertoolsRemoves support for deprecated Logback properties.
LogbackRemoves the unused dependency on org.eclipse.jetty.ee11:jetty-ee11-servlets from spring-boot-jetty.
org.eclipse.jetty.ee11:jetty-ee11-servletsspring-boot-jettyRemoves support for Spring Pulsar Reactive.
Removes ConcurrentReferenceCachingMetadataReaderFactory.
ConcurrentReferenceCachingMetadataReaderFactoryRemoves integration for REST Docs' REST Assured support until REST Assured supports Groovy 5.
Removes support for embedded jar launch scripts.
Removes support for Spring Session Data MongoDB.
Removes support for Spring Session Hazelcast.
Drops Spock until it supports Groovy 5.
Renames Jackson-specific Json… annotations and classes to Jackson….
Renames spring-boot-tx module to spring-boot-transaction.
spring-boot-txspring-boot-transactionRenames SharedObjectMapper to SharedJsonMapper.
SharedObjectMapperSharedJsonMapperRemoves the SQL and Reactor starters as they are only used transitively.
Renames Spring Session properties that depend on Spring Data.
Renames JsonMapper-specific properties to make clear they are JSON-specific.
JsonMapperRemoves Bitnami support.
Renames …DataAutoConfiguration to Data…AutoConfiguration.
DataAutoConfigurationDrops spring-boot-loader-classic support.
spring-boot-loader-classicRemoves auto-configuration support for '@HttpServiceClient'.
@HttpServiceClientRenames spring.mongodb.uuid-representation.
spring.mongodb.uuid-representationRemoves GridFs from MongoConnectionDetails.
GridFsMongoConnectionDetailsRenames *DataProperties classes to Data*Properties.
*DataPropertiesData*PropertiesRenames ConditionalOnEnabledTracing to ConditionalOnEnabledTracingExport.
ConditionalOnEnabledTracingConditionalOnEnabledTracingExportDrops support for Jersey, at least until it supports JAX-RS 4 (Jakarta EE 11).
JerseyJAX-RS 4Renames ScheduledTasksObservabilityAutoConfiguration to ScheduledTasksObservationAutoConfiguration.
ScheduledTasksObservabilityAutoConfigurationScheduledTasksObservationAutoConfigurationRemoves dependency management for Spring Retry in favor of spring-core's new retry support.
Spring Retryspring-coreRemoves isImmutable and getPrefix from OriginLookup.
OriginLookupisImmutablegetPrefixRenames spring-boot-starter-aop to spring-boot-starter-aspectj.
spring-boot-starter-aopspring-boot-starter-aspectjRenames MongoDB properties that do not require Spring Data MongoDB.
MongoDBRenames metrics, observation, and tracing modules to include micrometer in their names and packages.
Drops support for Undertow because it is not Servlet 6.1 compatible.
UndertowDrops Actuator endpoint parameter support for javax.annotations.NonNull.
javax.annotations.NonNullRemoves StreamBuilderFactoryBeanCustomizer in favor of Spring Kafka's StreamsBuilderFactoryBeanConfigurer.
StreamBuilderFactoryBeanCustomizerStreamsBuilderFactoryBeanConfigurerMakes auto-configurations final and removes public members.
Drops support for Wavefront.
WavefrontRemoves APIs that were deprecated for removal in 4.0 or earlier.
Renames spring-boot-starter-kotlin-serialization to spring-boot-starter-kotlinx-serialization-json and its test starter accordingly.
spring-boot-starter-kotlin-serializationspring-boot-starter-kotlinx-serialization-jsonspring-boot-starter-kotlin-serialization-testspring-boot-starter-kotlinx-serialization-json-testUsing TestRestTemplate now requires a dependency on spring-boot-restclient.
TestRestTemplatespring-boot-restclientRationalizes endpoint packages.
Refactors spring-boot-cloudfoundry package structure.
spring-boot-cloudfoundryMoves spring.jackson.datetime.<feature-name> to spring.jackson.datatype.datetime<feature-name>.
spring.jackson.datetime.<feature-name>spring.jackson.datatype.datetime<feature-name>Makes all type exclude filters package-private.
Makes ConfigDataLocation.of non-nullable.
ConfigDataLocation.ofMakes SanitizableData.key non-nullable.
SanitizableData.keyAlways uses mongodb rather than mongo in MongoDB-related configuration properties.
Replaces @OptionalParameter with JSpecify's @Nullable.
@OptionalParameter@NullableReplaces ClientHttpRequestFactorySettings.Redirects with HttpRedirects.
ClientHttpRequestFactorySettings.RedirectsHttpRedirectsSecurity1
Applies HTML escaping to the timestamp attribute in the Whitelabel error page.
Platform5
Upgrades to jOOQ 3.20 and requires Java 21 to use it.
jOOQUpdates Neo4j support to require Neo4j Java Driver 6.0.0.
Raises the minimum supported version of the CycloneDX Gradle Plugin to 3.0.0.
Raises the minimum supported version of Gradle to 8.14.
GradleSupports Gradle 9.
GradleDeprecations to plan for
Deprecated11
Deprecates SpringJtaPlatform, which should have been deprecated since 4.1.0-M3.
SpringJtaPlatformDeprecates OpenTelemetry's ZipkinSpanExporter, with support to be removed in Spring Boot 4.2.
ZipkinSpanExporterDeprecates LiveReload support for removal.
Deprecates RootUriTemplateHandler in favor of DefaultUriBuilderFactory.
RootUriTemplateHandlerDefaultUriBuilderFactoryDelays removal of Jackson 2 support until 4.3 at the earliest.
Deprecates Derby support since Apache Derby is retired.
DerbyDeprecates OpenTelemetry's ZipkinSpanExporter, with support to be removed in Spring Boot 4.2.
ZipkinSpanExporterDelays removal of Jackson 2 support until 4.3 at the earliest.
Reintroduces the previous EnvironmentPostProcessor in deprecated form.
EnvironmentPostProcessorDeprecates JUnit 4 integration.
JUnit 4Deprecates ANT_PATH_MATCHER.
ANT_PATH_MATCHER