Upgrading org.springframework.boot:spring-boot-starter 2 to 3
Breaking2.7.18 → 3.5.16Breaking2Security2Deprecated3New21Changed2372Fixed1078Other855
BreakingUpgrade verdict
2 breaking changes and 2 security fixes.
In plain terms
- Removes the 'spring.http.client' deprecation and renames 'spring.http.reactiveclient.settings' to 'spring.http.reactiveclient'.
- Two starters no longer pull in AOP support automatically, so projects relying on it transitively must add it themselves.
- Email sending now verifies the server's hostname, making connections safer.
- The error page now escapes the timestamp to prevent HTML injection.
Must act Top 5 of 7 that need code or config changes
Installs 19 packages in all (was 17).
What you must change
Breaking2
Removes the 'spring.http.client' deprecation and renames 'spring.http.reactiveclient.settings' to 'spring.http.reactiveclient'.
spring.http.clientspring.http.reactiveclient.settingsspring.http.reactiveclientRemoves spring-boot-starter-aop dependency from spring-boot-starter-data-jpa and spring-boot-starter-integration.
spring-boot-starter-aopspring-boot-starter-data-jpaspring-boot-starter-integrationSecurity2
MailSender auto-configuration now enables hostname verification.
Applies HTML escaping to the timestamp attribute in the Whitelabel error page.
Deprecations to plan for
Deprecated3
Adapts the deprecation level for management.health.influxdb.enabled.
management.health.influxdb.enabledDeprecates remaining @ControllerEndpoint and @RestControllerEndpoint infrastructure.
@ControllerEndpoint@RestControllerEndpointDeprecates remaining @ControllerEndpoint and @RestControllerEndpoint infrastructure.
@ControllerEndpoint@RestControllerEndpoint