SPRING-BOOT-4.1.1 release notes and known issues

Summary

⚠️ Attention Required Spring Boot's Gradle plugin no longer automatically configures gRPC when the Protobuf plugin is applied. This behavior caused problems for those using Protobuf without gRPC. To opt in to the configuration of gRPC, configure the protobuf extension with the grpc plugin using an empty block. The Spring Boot Gradle plugin will then automatically configure the use of protoc-gen-grpc-java as before. #50822 🐞 Bug Fixes Kafka consumer-specific security protocol is not taken into account #51369 Structured logging: a failed JSON encode corrupts the next log event written on the same thread #51156 Micrometer registries pin the application context #51135 Temporary file is not deleted when ExportedImageTar construction fails #51132 Metadata annotation processor ignores getter-level @NestedConfigurationProperty for records #51098 spring-boot-h2-console pulls servlet-api as transitive dependency #51095 PropertiesLauncher does not log nested archive paths #51089 Methods that return the result of Map#remove are not declared with a @Nullable return type #51087 NativeImageResourceProvider flattens Flyway migration paths in subdirectories #50964 Fix ordering of Kotlinx Serialization CodecCustomizer #50961 JarFile is not closed when finding main class from archive #50959 Application-managed JUL bridge handler should only be removed if installed #50950 CloudFoundry reactive auto-configuration should not require a WebClient.Builder bean to be defined #50944 Context refresh fails on reactive Cloud Foundry when using Actuator without spring-boot-health #50942 Resources are not cleaned up when resolving an image that is not yet present in the builder #50941 GraphQlWebMvcAutoConfiguration should apply customizers in order #50914 Auto-configured RedisMessageListenerContainer does not use virtual threads when spring.threads.virtual.enabled is true #50884 Context refresh fails when using Actuator on Jersey without spring-boot-health #50872 Context refresh fails on Cloud Foundry when using Actuator without spring-boot-health #50871 IllegalStateException when binding properties to a @Validated class that contains a map whose value type is a wildcard #50856 High number of connections due to Mongo health indicator #50852 Inconsistent handling of empty string values of spring.security.oauth2.resourceserver.jwt issuer-uri and jwk-set-uri #50849 Return type nullability of ApplicationContextAssert's getBean methods does not indicate that bean may be null #50845 PropertiesWebClientHttpServiceGroupConfigurer has highest precedence, preventing other configurers from being ordered ahead of it #50843 Exposing gRPC test server port should backoff if gRPC is not present #50825 JpaBaseConfiguration#entityManagerConfiguration can cause a dependency loop on beans declaring AsyncTaskExecutor #50801 spring.grpc.server.health.include-overall-health is not taken into account #50799 Setting 'server.servlet.session.cookie.partitioned' to false still emits the 'Partitioned' cookie attribute #50790 Managed version of Prometheus Client is not aligned with Micrometer's micrometer-registry-prometheus #50780 Map properties bound from empty strings fail with ConverterNotFoundException #50773 Protobuf Common Protos should not be a managed dependency #50772 An application that depends on spring-boot-security-oauth2-resource-server may fail to start with a ClassNotFoundException when Reactor is on the classpath but WebFlux is not #50764 W3CHeaderParser's decoding is not compliant with RFC 3986 #50650 📔 Documentation Description of spring.graphql.websocket.connection-init-timeout does not render correctly in the reference guide #51348 spring.profiles.group should have a 'spring-profile-name' hint provider #51284 Remove reference to removed InfluxDB auto-configuration #51176 Use JacksonJsonSerde in Kafka Streams documentation #51161 Document alternatives to HttpMessageConverters #51129 Fix stale type reference for OTLP logging transport metadata #51119 Metadata for spri

Improvements and security content

• ⚠️ Attention Required Spring Boot's Gradle plugin no longer automatically configures gRPC when the Protobuf plugin is applied. This behavior caused problems for those using Protobuf without gRPC. To opt in to the configuration of gRPC, configure the protobuf extension with the grpc plugin using an empty block. The Spring Boot Gradle plugin will then automatically configure the use of protoc-gen-grpc-java as before. #50822 🐞 Bug Fixes Kafka consumer-specific security protocol is not taken into account #51369 Structured logging: a failed JSON encode corrupts the next log event written on the same thread #51156 Micrometer registries pin the application context #51135 Temporary file is not deleted when ExportedImageTar construction fails #51132 Metadata annotation processor ignores getter-level @NestedConfigurationProperty for records #51098 spring-boot-h2-console pulls servlet-api as transitive dependency #51095 PropertiesLauncher does not log nested archive paths #51089 Methods that return the result of Map#remove are not declared with a @Nullable return type #51087 NativeImageResourceProvider flattens Flyway migration paths in subdirectories #50964 Fix ordering of Kotlinx Serialization CodecCustomizer #50961 JarFile is not closed when finding main class from archive #50959 Application-managed JUL bridge handler should only be removed if installed #50950 CloudFoundry reactive auto-configuration should not require a WebClient.Builder bean to be defined #50944 Context refresh fails on reactive Cloud Foundry when using Actuator without spring-boot-health #50942 Resources are not cleaned up when resolving an image that is not yet present in the builder #50941 GraphQlWebMvcAutoConfiguration should apply customizers in order #50914 Auto-configured RedisMessageListenerContainer does not use virtual threads when spring.threads.virtual.enabled is true #50884 Context refresh fails when using Actuator on Jersey without spring-boot-health #50872 Context refresh fails on Cloud Foundry when using Actuator without spring-boot-health #50871 IllegalStateException when binding properties to a @Validated class that contains a map whose value type is a wildcard #50856 High number of connections due to Mongo health indicator #50852 Inconsistent handling of empty string values of spring.security.oauth2.resourceserver.jwt issuer-uri and jwk-set-uri #50849 Return type nullability of ApplicationContextAssert's getBean methods does not indicate that bean may be null #50845 PropertiesWebClientHttpServiceGroupConfigurer has highest precedence, preventing other configurers from being ordered ahead of it #50843 Exposing gRPC test server port should backoff if gRPC is not present #50825 JpaBaseConfiguration#entityManagerConfiguration can cause a dependency loop on beans declaring AsyncTaskExecutor #50801 spring.grpc.server.health.include-overall-health is not taken into account #50799 Setting 'server.servlet.session.cookie.partitioned' to false still emits the 'Partitioned' cookie attribute #50790 Managed version of Prometheus Client is not aligned with Micrometer's micrometer-registry-prometheus #50780 Map properties bound from empty strings fail with ConverterNotFoundException #50773 Protobuf Common Protos should not be a managed dependency #50772 An application that depends on spring-boot-security-oauth2-resource-server may fail to start with a ClassNotFoundException when Reactor is on the classpath but WebFlux is not #50764 W3CHeaderParser's decoding is not compliant with RFC 3986 #50650 📔 Documentation Description of spring.graphql.websocket.connection-init-timeout does not render correctly in the reference guide #51348 spring.profiles.group should have a 'spring-profile-name' hint provider #51284 Remove reference to removed InfluxDB auto-configuration #51176 Use JacksonJsonSerde in Kafka Streams documentation #51161 Document alternatives to HttpMessageConverters #51129 Fix stale type reference for OTLP logging transport metadata #51119 Metadata for spri

Affected products and versions

Recommended action

Review the official publisher document before deployment.

Official publisher evidence