Classes, methods and properties that were deprecated in Spring Boot 2.4 have been removed in this release. Please ensure that you aren’t calling deprecated methods before upgrading.

Circular references between beans are now prohibited by default. If your application fails to start due to a BeanCurrentlyInCreationException you are strongly encouraged to update your configuration to break the dependency cycle. If you are unable to do so, circular references can be allowed again by setting spring.main.allow-circular-references to true, or using the new setter methods on SpringApplication and SpringApplicationBuilder This will restore 2.5’s behaviour and automatically attempt to break the dependency cycle.

The default strategy for matching request paths against registered Spring MVC handler mappings has changed from AntPathMatcher to PathPatternParser.

If you are using Spring Security, you should review your use of mvcMatchers to ensure that your matchers continue to meet your needs. With AntPathMatcher, authorizeRequests.mvcMatchers("hello").permitAll() would grant access to /hello. The more precise matching of PathPatternParser requires the use of authorizeRequests.mvcMatchers("/hello").permitAll() (note the leading /) instead.

If you need to switch the default back to AntPathMatcher, you can set spring.mvc.pathmatch.matching-strategy to ant-path-matcher.

The actuator endpoints now also use PathPattern based URL matching. Note that the path matching strategy for actuator endpoints is not configurable via a configuration property. If you are using Actuator and Springfox, this may result in your application failing to start. Please see this Springfox issue for further details.

The env info contributor is now disabled by default. This contributor exposes any property from the Spring Environment whose name starts with info. If you have any properties starting with info and would like them to appear them in the InfoEndpoint, set management.info.env.enabled to true.

The spring.boot.application.running startup step logged to ApplicationStartup has been renamed to spring.boot.application.ready. If you are processing files generated from FlightRecorderApplicationStartup or BufferingApplicationStartup you will need to use the new name.

Injecting Resources directly no longer works as this configuration has been harmonized in WebProperties. If you need to access this information, you need to inject WebProperties instead.

JBoss Transaction SPI

Nimbus DS

HAL Browser

The property to control the version of Prometheus has changed from prometheus-pushgateway.version to prometheus-client.version. This is to reflect the fact that the property manages the version of every module in Prometheus’s client, not just the pushgateway.

To use embedded mongo, the spring.mongodb.embedded.version property must now be set. This helps to ensure that the MongoDB version that is used by the embedded support matches the MongoDB version that your application will use in production.

The dependency management for the Oracle database driver has been streamlined. If you are still relying on the old com.oracle.ojdbc groupId, you need to upgrade to the com.oracle.database.jdbc group as we have removed dependency management for the former.

The 7.12 release of Flyway moved the Vault-related settings to a closed-source extension. Unfortunately, this prevents Spring Boot from configuring them. As a result, the corresponding spring.flyway.vault-secrets, spring.flyway.vault-token, and spring.flyway.vault-url properties have been removed. If you are a Flyway Teams user, the settings can be configured via a FlywayConfigurationCustomizer bean, FluentConfigiguration.getExtensionConfiguration and the Vault ApiExtension

The spring.webflux.session property group has been deprecated and relocated to server.reactive.session. The old properties will continue to work, but you should migrate to the new ones if possible.

The configuration properties used to configure an Elasticsearch client have been consolidated. Previously, a number of common properties for configuring the blocking high-level REST client and the reactive REST client were duplicated across spring.elasticsearch.rest and spring.data.elasticsearch.clients.reactive.

If you are using the blocking REST client, the following table lists the old properties and their replacements:

To align the default behavior with Spring Data Couchbase, @Persistent-annotated types are no longer considered. If you are relying on that annotation, @Document can be used instead.

The Maven plugin’s build info support now uses the value of the project.build.outputTimestamp property as the default build time. If the property is not set, the the build session’s start time is used as it was previously. As before, the time can be disabled entirely by setting it to off.

If you are using @ConfigurationProperties with a Java 16 record and the record has a single constructor, it no longer needs to be annotated with @ConstructorBinding. If your record has multiple constructors, @ConstructorBinding should still be used to identify the constructor to use for property binding.

For a resource server application using spring-security-oauth2-resource-server which is configured with an OpenID connect issuer-uri, Spring Boot now auto-configures a SupplierJwtDecoder instead of a NimbusJwtDecoder. This enables Spring Security’s lazy OIDC discovery support which improves startup time. Similarly, for reactive applications, a ReactiveSupplierJwtDecoder is auto-configured.

None.

You can now configure SameSite attributes on session cookies for servlet applications using the server.servlet.session.cookie.same-site property. This works with auto-configured Tomcat, Jetty and Undertow servers.

In addition, the CookieSameSiteSupplier interface can be used if you want to apply a SameSite attribute to other cookies. See the updated documentation for more details and some example code.

The session properties supported for reactive servers (previously under spring.webflux.session) have been expanded with this release. The new properties are available under server.reactive.session and now offer parity with the servlet versions.

Spring Boot sanitizes sensitive values present in the /env and /configprops endpoints. While it was possible to configure which properties get sanitized via configuration properties, users might want to apply sanitization rules based on which PropertySource the property originated from. For example, Spring Cloud Vault uses vault to store encrypted values and load them into the Spring environment. Since all values are encrypted, it would make sense to blank the values of every key in an entire property source. Such sanitization customizations can be configured by adding a @Bean of type SanitizingFunction.

The info endpoint can now expose Java Runtime information under the java key, as shown in the following example:

To expose this information in the info endpoint’s response, set the management.info.java.enabled property to true.

It’s now possible to exclude specific properties from being added to the build-info.properties file generated by the Spring Boot Maven or Gradle plugin.

Maven users can exclude the standard group, artifact, name, version or time properties using the <excludeInfoProperties> tag. For example, to exclude the version property the following configuration can be used:

Gradle users can use null values with the properties block of the DSL:

Additional Path on Main or Management Port

Health groups can be configured to include/exclude parts of a CompositeHealthContributor. This can be done by specifying the fully qualified path to the component. For example, a component spring which is nested inside a composite named test, can be included using test/spring.

Auto-configuration exposes two metrics related to application startup:

• application.started.time: time taken to start the application.

• application.ready.time: time taken for the application to be ready to service requests.

Disk Space

Task Execution and Scheduling

Jetty Connection and SSL

Exporting to the Dynatrace v2 API

Additional Image Tags

Network Configuration

Cache Configuration

Auto-configuration for Spring Data Envers is now provided. To use it, add a dependency on org.springframework.data:spring-data-envers and update your JPA repositories to extend from RevisionRepository.

Redis (both Jedis and Lettuce) will now automatically enable pooling when commons-pool2 is on the classpath. Set spring.redis.jedis.pool.enabled or spring.redis.lettuce.pool.enabled to false to disable pooling if required.

Auto-configuration for Spring AMQP’s new spring-rabbit-stream module has been added. A StreamListenerContainer is auto-configured when the spring.rabbitmq.listener.type property is set to stream. The spring.rabbitmq.stream.* properties can be used to configure access to the broker and spring.rabbitmq.listener.stream.native-listener can be used to enable native listener support.

Previously, Kafka only supported file-based key and trust stores for SSL. With KIP-651, it is now possible to use the PEM format. Spring Boot has added the following properties that allow configuring SSL certificates and private keys using the PEM format:

• spring.kafka.ssl.key-store-key

• spring.kafka.ssl.key-store-certificate-chain

• spring.kafka.ssl.trust-store-certificates

The Maven Plugin’s start goal has been made more configurable from the command line. Its wait and maxAttempts properties can be specified using spring-boot.start.wait and spring-boot.start.maxAttempts respectively.

A new annotation, @WebServiceServerTest, that can be used to test Web Service @Endpoint beans has been introduced. The annotation creates a test slice containing @Endpoint beans and auto-configures a MockWebServiceClient bean that can be used to test your web service endpoints.

The application’s MessageSource is now used when resolving {parameters} in constraint messages. This allows you to use your application’s messages.properties files for Bean Validation messages. Once the parameters have been resolved, message interpolation is completed using Bean Validation’s default interpolator.

Developers could use WebTestClient to test WebFlux apps in mock environments, or any Spring web app against live servers. This change also enables WebTestClient for Spring MVC in mock environments: classes annotated with @AutoConfigureMockMvc can get injected a WebTestClient. This makes our support complete, you can now use a single API to drive all your web tests!

Spring Integration PollerMetadata (poll unbounded number of messages every second) can now be customized with spring.integration.poller.* configuration properties.

Log4j2’s composite configuration is now supported. To use it, configure the logging.log4j2.config.override property with a comma-separated list of secondary configuration files that will override the main configuration. The main configuration is sourced from Spring Boot’s defaults, a well-known standard location such as log4j2.xml, or the location specified by the logging.config property as before.

Spring Boot 2.6 moves to new versions of several Spring projects:

• Spring Security 5.6

• Spring Data 2021.1

• Spring HATEOAS 1.4

• Spring Kafka 2.8

• Spring AMQP 2.4

• Spring Session 2021.1.0

Numerous third-party dependencies have also been updated, some of the more noteworthy of which are the following:

• Apache Kafka 3.0

• Artemis 2.19

• Cassandra Driver 4.13

• Commons DBCP 2.9

• Commons Pool 2.11

• Couchbase Client 3.2.2

• Elasticsearch 7.15

• Flyway 8.0.5

• Hibernate 5.6

• JUnit Jupiter 5.8

• Jedis 3.7

• Kafka 3.0

• Kotlin 1.6

• Liquibase 4.5

• Micrometer 1.8

• Mockito 4.0

• MongoDB 4.4

• Postgresql 42.3

• QueryDSL 5.0

• SnakeYAML 1.29

• Thymeleaf Layout Dialect 3.0

Apart from the changes listed above, there have also been lots of minor tweaks and improvements including:

• The failure analysis for a NoSuchMethodError now includes information about the location from which the calling class was loaded.

• A ClientResourcesBuilderCustomizer bean can now be defined to customize Lettuce’s ClientResources will retaining the default auto-configuration.

• Configuration properties for Flyway’s detectEncoding, failOnMissingLocations, and ignoreMigrationPatterns configuration settings have been added.

• A custom ResourceLoader to be used by the application can be provided when creating a SpringApplicationBulder.

• A WebSessionIdResolver can now be defined to customize the resolver that will be used by the auto-configured WebSessionManager.

• Any RSocketConnectorConfigurer beans are now automatically applied to the auto-configured RSocketRequester.Builder.

• spring-boot-configuration-processor can now generate metadata for classes annotated with Lombok’s @Value.

• A new server.tomcat.reject-illegal-header configuration property can be set to true to configure Tomcat to accept illegal headers.

• When using Stackdriver, labels can now be configured on the monitor resource by setting management.metrics.export.stackdriver.resource-labels.* configuration properties.

• @EntityScan now supports comma-separated values in its basePackages attribute.

• A new configuration property, server.netty.idle-timeout, that can be used to control Reactor Netty’s idle timeout has been added.

• The location from which Devtools loads its global settings can now be configured using the spring.devtools.home system property or the SPRING_DEVTOOLS_HOME environment variable.

• The setter methods on RabbitTemplateConfigurer are now public

• The heapdump endpoint is now supported on OpenJ9 where it will produce a heap dump in PHD format.

• New configuration properties are now supported for multipart support in WebFlux, under spring.webflux.multipart.*

• Any ContainerCustomizer bean is now called to configure the auto-configured Spring AMQP MessageListenerContainer

• Jackson’s default leniency can be configured using the spring.jackson.default-leniency property.

• Distribution statistic’s expiry and buffer length are now configurable.

• Command Latency metrics for Lettuce are now auto-configured.

• Disk space metrics can be configured with one or more paths using the management.metrics.system.diskspace.paths property.

• Users can take control over the Redis auto-configuration by providing a RedisStandaloneConfiguration bean.

• The URLs of all available data sources is now logged when the H2 console is auto-configured.

• A new configuration property, spring.integration.management.default-logging-enabled, can be used to disable Spring Integration’s default logging by setting its value to false.

• Auto-configuration for UserDetailsService will now back off in the presence of an AuthenticationManagerProvider bean.