BlackTreeLifecycle intelligence
Evidence-linked product lifecycle intelligenceSUPPORT · SECURITY · RETIREMENT
← Lifecycle catalogue
RELEASE NOTESBROADCOMVERIFIED

PUBLISHER UPDATE · SPRING-BOOT-4.0.7

SPRING-BOOT-4.0.7 release notes and known issues

v4.0.7

Scope: Spring Boot. This update record adds version, fix and known-issue context. Its publication date is not a lifecycle boundary.

Summary

🐞 Bug Fixes MailSender auto-configuration does not enable hostname verification #50746 Artemis auto-configuration uses a predictable default location for the embedded broker's data #50744 NullPointerException in reactor-netty SniProvider and unmapped SSL bundle with RSocket #50640 SSL should not be enabled when a SSL bundle is overridden to an empty string #50634 Docker Compose support does not restore thread interrupt flag when catching InterruptedException #50617 RabbitProperties enables SSL even when spring.rabbitmq.ssl.bundle is overridden to an empty string #50611 NullPointerException in reactor-netty SniProvider when SSL bundle uses client-auth or server truststore without server-name-bundles #50609 Test auto-configuration no longer integrates Spring Security with HtmlUnitDriver #50602 Layer written outside the output location of '//' exception is thrown when using extract layers in root directory #50509 ConfigurationPropertiesReportEndpoint exposes AOP proxy internals #50416 Created StackTracePrinter instances have no access to the Environment #50413 MappingsEndpoint reports the context's own ID as parentId when a parent exists #50411 Buildpack module does not validate long-to-int casts #50409 GraphQL WebSocket support does not configure allowed origins #50393 Configuration property metadata includes incorrect class references #50375 Spring Boot Loader Does Not Support RSA and EC Signed Jars #50297 Meter registries are not removed from the global registry when the context is closed #50286 Nullable annotations from AbstractErrorController.getErrorAttributes are not aligned with implementation #50265 EndpointRequest links matcher unnecessarily matches HTTP methods other than GET #50260 Actuator's '/cloudfoundryapplication' endpoint does not work if restrictive CORS configuration is provided using a bean named corsConfigurationSource #50257 ThreadPoolTaskScheduleBuilder unnecessarily loses precision when configuring await termination time #50233 NimbusJwtDecoder silently accepts unknown values for spring.security.oauth2.resourceserver.jwt.jws-algorithms #50227 Apply HTML escaping to timestamp attribute in Whitelabel error page #50215 Setting server.servlet.session.cookie.partitioned=true has no effect when using Tomcat #50201 📔 Documentation Fix reference to Gradle documentation for module replacement #50646 Document SSL reloading with Let's Encrypt #50629 Remove the use of Optional from Data Neo4j repository examples #50621 Fix typos in documentation #50619 Clarify dependency requirement for Bean Validation support #50613 Document Java 25 requirement for AOT cache #50484 Add links for Java CAS Client Spring Boot Starter #50281 Document known testcontainers lifecycle issues #50219 Document adding multiple connectors for Jetty #50217 Polish InvalidConfigurationPropertyValueException constructor javadoc #50213 Fix typo in Spring Security OAuth2 client registration documentation #50198 🔨 Dependency Upgrades Upgrade to Caffeine 3.2.4 #50322 Upgrade to Cassandra Driver 4.19.3 #50681 Upgrade to Glassfish JAXB 4.0.9 #50682 Upgrade to Groovy 5.0.6 #50324 Upgrade to Hibernate 7.2.19.Final #50733 Upgrade to Jackson 2 Bom 2.21.4 #50684 Upgrade to Jackson Bom 3.1.4 #50685 Upgrade to Jakarta Json Bind 3.0.2 #50686 Upgrade to Jakarta XML Bind 4.0.5 #50328 Upgrade to Jaxen 2.0.6 #50717 Upgrade to Jetty 12.1.10 #50688 Upgrade to Jetty Reactive HTTPClient 4.1.5 #50718 Upgrade to jOOQ 3.19.35 #50719 Upgrade to Liquibase 5.0.3 #50554 Upgrade to Logback 1.5.34 #50689 Upgrade to Maven Enforcer Plugin 3.6.3 #50555 Upgrade to Maven Failsafe Plugin 3.5.6 #50690 Upgrade to Maven Surefire Plugin 3.5.6 #50691 Upgrade to Micrometer 1.16.6 #50535 Upgrade to Micrometer Tracing 1.6.6 #50536 Upgrade to Neo4j Java Driver 6.1.0 #50556 Upgrade to Netty 4.2.15.Final #50692 Upgrade to Postgresql 42.7.11 #50332 Upgrade to R2DBC MySQL 1.4.2 #50333 Upgrade to Reactor Bom 2025.0.6 #50537 Upgrade to SAAJ Impl 3.0.6 #50720 Upgrade to SLF4J 2.0.18 #50558 Upgrade to

Improvements and security content

  • 🐞 Bug Fixes MailSender auto-configuration does not enable hostname verification #50746 Artemis auto-configuration uses a predictable default location for the embedded broker's data #50744 NullPointerException in reactor-netty SniProvider and unmapped SSL bundle with RSocket #50640 SSL should not be enabled when a SSL bundle is overridden to an empty string #50634 Docker Compose support does not restore thread interrupt flag when catching InterruptedException #50617 RabbitProperties enables SSL even when spring.rabbitmq.ssl.bundle is overridden to an empty string #50611 NullPointerException in reactor-netty SniProvider when SSL bundle uses client-auth or server truststore without server-name-bundles #50609 Test auto-configuration no longer integrates Spring Security with HtmlUnitDriver #50602 Layer written outside the output location of '//' exception is thrown when using extract layers in root directory #50509 ConfigurationPropertiesReportEndpoint exposes AOP proxy internals #50416 Created StackTracePrinter instances have no access to the Environment #50413 MappingsEndpoint reports the context's own ID as parentId when a parent exists #50411 Buildpack module does not validate long-to-int casts #50409 GraphQL WebSocket support does not configure allowed origins #50393 Configuration property metadata includes incorrect class references #50375 Spring Boot Loader Does Not Support RSA and EC Signed Jars #50297 Meter registries are not removed from the global registry when the context is closed #50286 Nullable annotations from AbstractErrorController.getErrorAttributes are not aligned with implementation #50265 EndpointRequest links matcher unnecessarily matches HTTP methods other than GET #50260 Actuator's '/cloudfoundryapplication' endpoint does not work if restrictive CORS configuration is provided using a bean named corsConfigurationSource #50257 ThreadPoolTaskScheduleBuilder unnecessarily loses precision when configuring await termination time #50233 NimbusJwtDecoder silently accepts unknown values for spring.security.oauth2.resourceserver.jwt.jws-algorithms #50227 Apply HTML escaping to timestamp attribute in Whitelabel error page #50215 Setting server.servlet.session.cookie.partitioned=true has no effect when using Tomcat #50201 📔 Documentation Fix reference to Gradle documentation for module replacement #50646 Document SSL reloading with Let's Encrypt #50629 Remove the use of Optional from Data Neo4j repository examples #50621 Fix typos in documentation #50619 Clarify dependency requirement for Bean Validation support #50613 Document Java 25 requirement for AOT cache #50484 Add links for Java CAS Client Spring Boot Starter #50281 Document known testcontainers lifecycle issues #50219 Document adding multiple connectors for Jetty #50217 Polish InvalidConfigurationPropertyValueException constructor javadoc #50213 Fix typo in Spring Security OAuth2 client registration documentation #50198 🔨 Dependency Upgrades Upgrade to Caffeine 3.2.4 #50322 Upgrade to Cassandra Driver 4.19.3 #50681 Upgrade to Glassfish JAXB 4.0.9 #50682 Upgrade to Groovy 5.0.6 #50324 Upgrade to Hibernate 7.2.19.Final #50733 Upgrade to Jackson 2 Bom 2.21.4 #50684 Upgrade to Jackson Bom 3.1.4 #50685 Upgrade to Jakarta Json Bind 3.0.2 #50686 Upgrade to Jakarta XML Bind 4.0.5 #50328 Upgrade to Jaxen 2.0.6 #50717 Upgrade to Jetty 12.1.10 #50688 Upgrade to Jetty Reactive HTTPClient 4.1.5 #50718 Upgrade to jOOQ 3.19.35 #50719 Upgrade to Liquibase 5.0.3 #50554 Upgrade to Logback 1.5.34 #50689 Upgrade to Maven Enforcer Plugin 3.6.3 #50555 Upgrade to Maven Failsafe Plugin 3.5.6 #50690 Upgrade to Maven Surefire Plugin 3.5.6 #50691 Upgrade to Micrometer 1.16.6 #50535 Upgrade to Micrometer Tracing 1.6.6 #50536 Upgrade to Neo4j Java Driver 6.1.0 #50556 Upgrade to Netty 4.2.15.Final #50692 Upgrade to Postgresql 42.7.11 #50332 Upgrade to R2DBC MySQL 1.4.2 #50333 Upgrade to Reactor Bom 2025.0.6 #50537 Upgrade to SAAJ Impl 3.0.6 #50720 Upgrade to SLF4J 2.0.18 #50558 Upgrade to

Known issues

Publisher statement

Not stated. The verified publisher record does not contain a known-issues statement.

Affected products and versions

Products

  • Spring Boot

Affected versions

  • 4.0.7
  • 3.2.4
  • 4.19.3
  • 4.0.9
  • 5.0.6
  • 7.2.19
  • 2.21.4
  • 3.1.4
  • 3.0.2
  • 4.0.5
  • 2.0.6
  • 12.1.10
  • 4.1.5
  • 3.19.35
  • 5.0.3
  • 1.5.34
  • 3.6.3
  • 3.5.6
  • 1.16.6
  • 1.6.6
  • 6.1.0
  • 4.2.15
  • 42.7.11
  • 1.4.2
  • 2025.0.6
  • 3.0.6
  • 2.0.18

Fixed versions or updates

  • No fixed version is stated in this record.

Recommended action

Review the official publisher document before deployment.

Official publisher evidence