SPRING-BOOT-4.0.6 release notes and known issues

Summary

🐞 Bug Fixes Default security is misconfigured when spring-boot-actuator-autoconfigure is present and spring-boot-health is not #50188 Elasticsearch Rest5Client auto-configuration misconfigures underlying HTTP client #50187 ApplicationPidFileWriter does not handle symlinks correctly #50185 RandomValuePropertySource is not suitable for secrets #50183 Cassandra auto-configuration misconfigures CqlSessionBuilder #50180 ApplicationTemp does not handle symlinks correctly #50178 Remote DevTools performs comparison incorrectly #50176 spring.rabbitmq.ssl.verify-hostname is applied inconsistently #50174 Whole number values are ignored when configuring min and max expected values and SLO boundaries for a distribution summary meter #50077 Classic starters are missing several modules #50071 Module spring-boot-resttestclient is missing from spring-boot-starter-test-classic #50069 Annotations like @Ssl don't work on @Bean methods when using @ServiceConnection #50064 EnversRevisionRepositoriesRegistrar should reuse @EnableEnversRepositories rather than configuring the JPA counterpart #50039 WebFlux Cloud Foundry links endpoint includes query string from received request in resolved links #50017 Imports on a containing test class are ignored when a nested class has imports #50012 With spring.jackson.use-jackson2-defaults set to true, FAIL_ON_UNKNOWN_PROPERTIES is enabled #49951 500 response from env endpoint when supplied pattern is invalid #49946 Reactive MongoDB starter has a transitive dependency on the synchronous MongoDB driver #49945 HTTP method is lost when configuring excludes in EndpointRequest #49943 Honor HttpMethod for reactive additional endpoint paths #49880 Docker Compose support doesn't work with apache/artemis image #49869 Docker Compose support doesn't work with apache/activemq image #49866 Spring Security's PathPatternRequestMatcher.Builder is not auto-configured when using WebMvcTest and spring-boot-security-test #49854 API versioning path strategy should be applied path last as it is not meant to yield #49800 📔 Documentation Update docs to encourage Java fundamentals for beginners that prefer to learn that way #50146 HTTP Service Interface Clients still document that API versioning can be configured via properties #50126 Link to the observability section of the Lettuce documentation is broken #50097 Javadoc for StaticResourceLocation.FAVICON doesn't describe icons location #50085 MySamlRelyingPartyConfiguration is missing a Kotlin sample #50024 Incorrect default value for management.httpexchanges.recording.include in configuration metadata #50019 Link to the Kubernetes documentation when discussing startup probes #50015 Typo in JdbcSessionAutoConfiguration Javadoc #49873 Clarify that configuration property default values are not available through the Environment #49851 Document the need for Liquibase and Flyway starters #49839 Kafka documentation refers to deprecated JSON serializer and deserializer classes #49826 🔨 Dependency Upgrades Upgrade to Elasticsearch Client 9.2.8 #50027 Upgrade to Groovy 5.0.5 #49911 Upgrade to Hibernate 7.2.12.Final #50134 Upgrade to Jackson Bom 3.1.2 #50051 Upgrade to Jaxen 2.0.1 #50104 Upgrade to Jaybird 6.0.5 #49914 Upgrade to Jetty 12.1.8 #49915 Upgrade to jOOQ 3.19.32 #50105 Upgrade to Log4j2 2.25.4 #49916 Upgrade to Lombok 1.18.46 #50150 Upgrade to MariaDB 3.5.8 #49917 Upgrade to Micrometer 1.16.5 #49972 Upgrade to Micrometer Tracing 1.6.5 #49973 Upgrade to MongoDB 5.6.5 #50028 Upgrade to MySQL 9.7.0 #50159 Upgrade to Neo4j Java Driver 6.0.5 #50075 Upgrade to Reactor Bom 2025.0.5 #49974 Upgrade to Spring AMQP 4.0.3 #49975 Upgrade to Spring Data Bom 2025.1.5 #49976 Upgrade to Spring Framework 7.0.7 #49977 Upgrade to Spring GraphQL 2.0.3 #49978 Upgrade to Spring Kafka 4.0.5 #49979 Upgrade to Spring LDAP 4.0.3 #49980 Upgrade to Spring Pulsar 2.0.5 #49981 Upgrade to Spring Security 7.0.5 #49982 Upgrade to Spring Session 4.0.3 #49983 Upgrade to Testcontainers 2.0.5 #50135 Upgrade to Thymeleaf 3

Improvements and security content

• 🐞 Bug Fixes Default security is misconfigured when spring-boot-actuator-autoconfigure is present and spring-boot-health is not #50188 Elasticsearch Rest5Client auto-configuration misconfigures underlying HTTP client #50187 ApplicationPidFileWriter does not handle symlinks correctly #50185 RandomValuePropertySource is not suitable for secrets #50183 Cassandra auto-configuration misconfigures CqlSessionBuilder #50180 ApplicationTemp does not handle symlinks correctly #50178 Remote DevTools performs comparison incorrectly #50176 spring.rabbitmq.ssl.verify-hostname is applied inconsistently #50174 Whole number values are ignored when configuring min and max expected values and SLO boundaries for a distribution summary meter #50077 Classic starters are missing several modules #50071 Module spring-boot-resttestclient is missing from spring-boot-starter-test-classic #50069 Annotations like @Ssl don't work on @Bean methods when using @ServiceConnection #50064 EnversRevisionRepositoriesRegistrar should reuse @EnableEnversRepositories rather than configuring the JPA counterpart #50039 WebFlux Cloud Foundry links endpoint includes query string from received request in resolved links #50017 Imports on a containing test class are ignored when a nested class has imports #50012 With spring.jackson.use-jackson2-defaults set to true, FAIL_ON_UNKNOWN_PROPERTIES is enabled #49951 500 response from env endpoint when supplied pattern is invalid #49946 Reactive MongoDB starter has a transitive dependency on the synchronous MongoDB driver #49945 HTTP method is lost when configuring excludes in EndpointRequest #49943 Honor HttpMethod for reactive additional endpoint paths #49880 Docker Compose support doesn't work with apache/artemis image #49869 Docker Compose support doesn't work with apache/activemq image #49866 Spring Security's PathPatternRequestMatcher.Builder is not auto-configured when using WebMvcTest and spring-boot-security-test #49854 API versioning path strategy should be applied path last as it is not meant to yield #49800 📔 Documentation Update docs to encourage Java fundamentals for beginners that prefer to learn that way #50146 HTTP Service Interface Clients still document that API versioning can be configured via properties #50126 Link to the observability section of the Lettuce documentation is broken #50097 Javadoc for StaticResourceLocation.FAVICON doesn't describe icons location #50085 MySamlRelyingPartyConfiguration is missing a Kotlin sample #50024 Incorrect default value for management.httpexchanges.recording.include in configuration metadata #50019 Link to the Kubernetes documentation when discussing startup probes #50015 Typo in JdbcSessionAutoConfiguration Javadoc #49873 Clarify that configuration property default values are not available through the Environment #49851 Document the need for Liquibase and Flyway starters #49839 Kafka documentation refers to deprecated JSON serializer and deserializer classes #49826 🔨 Dependency Upgrades Upgrade to Elasticsearch Client 9.2.8 #50027 Upgrade to Groovy 5.0.5 #49911 Upgrade to Hibernate 7.2.12.Final #50134 Upgrade to Jackson Bom 3.1.2 #50051 Upgrade to Jaxen 2.0.1 #50104 Upgrade to Jaybird 6.0.5 #49914 Upgrade to Jetty 12.1.8 #49915 Upgrade to jOOQ 3.19.32 #50105 Upgrade to Log4j2 2.25.4 #49916 Upgrade to Lombok 1.18.46 #50150 Upgrade to MariaDB 3.5.8 #49917 Upgrade to Micrometer 1.16.5 #49972 Upgrade to Micrometer Tracing 1.6.5 #49973 Upgrade to MongoDB 5.6.5 #50028 Upgrade to MySQL 9.7.0 #50159 Upgrade to Neo4j Java Driver 6.0.5 #50075 Upgrade to Reactor Bom 2025.0.5 #49974 Upgrade to Spring AMQP 4.0.3 #49975 Upgrade to Spring Data Bom 2025.1.5 #49976 Upgrade to Spring Framework 7.0.7 #49977 Upgrade to Spring GraphQL 2.0.3 #49978 Upgrade to Spring Kafka 4.0.5 #49979 Upgrade to Spring LDAP 4.0.3 #49980 Upgrade to Spring Pulsar 2.0.5 #49981 Upgrade to Spring Security 7.0.5 #49982 Upgrade to Spring Session 4.0.3 #49983 Upgrade to Testcontainers 2.0.5 #50135 Upgrade to Thymeleaf 3

Affected products and versions

Recommended action

Review the official publisher document before deployment.

Official publisher evidence