Broadcom released Spring Boot 4.1 on June 10, 2026, to deliver gRPC auto-configuration, HTTP-client SSRF mitigation, and upgrades to Kotlin 2.3. It also brings lazy datasource connections, async context propagation for @Async methods, and improved OpenTelemetry support. Broadcom moved the releases twice, first from May 11-22 to June 1-5, then to June 8-12. This is the first delay since Spring Boot settled into a twice-yearly cadence of May and November back in May 2020.
Spring Boot 4.0, released in November 2025 alongside Spring Framework 7.0, was a generational reset: a Jakarta EE 11 baseline, Jackson 3, split auto-configured JARs, null safety with JSpecify, API versioning, and Gradle 9 support. The Spring team's Q&A with InfoQ delivers background on the 4.0 generation. Spring Boot 4.1 is incremental, building on Spring Framework 7.0.x. While Spring Boot 4 maintains the JDK 17 baseline from Spring Boot 3, one new feature in Spring Boot 4.1 requires Java 21: jOOQ 3.20.
Spring Boot 4.1 includes Spring gRPC auto-configuration for both server and client applications. It supports standalone Netty and Servlet HTTP/2 transports. The release adds @GrpcAdvice for centralized exception handling and an auto-configured ObservationGrpcServerInterceptor that supports custom server-side observation conventions for metrics and tracing. Applications previously had to wire gRPC manually or rely on third-party starters.
HTTP client SSRF (server-side request forgery) mitigation is new in version 4.1. An InetAddressFilter blocks outbound requests from reactive and blocking clients to configured address ranges through whitelisting or blacklisting. This reduces the risk of an application being used as a proxy for internal network attacks.
The Kotlin baseline moves from version 2.2 to version 2.3, which supports Java 25 and includes an experimental unused return value checker.
Setting spring.datasource.connection-fetch=lazy wraps the pooled DataSource in a LazyConnectionDataSourceProxy. This defers the physical database connection until a SQL statement actually runs, resulting in faster startup and lower connection pool pressure.
@Async methods now propagate Micrometer context across threads automatically. Trace IDs and spans follow the work into thread-pool tasks without extra wiring. The new spring.jpa.bootstrap property enables an asynchronous background Spring Data JPA bootstrap, which can reduce startup time for applications with large JPA models.
OpenTelemetry support gains several improvements: it adds a management.opentelemetry.enabled property that may be toggled between true and false, supports OTLP exemplars, and allows SSL bundles for OTLP exporters. Spring Boot 4.1 also reads most of the OpenTelemetry environment variables.
Spring Boot 4.1 auto-configures Spring Data Redis listener endpoints, registering a default RedisMessageListenerContainer when none is present. The /actuator/info endpoint's ProcessInfo section gains six new fields: uptime, startTime, currentTime, timezone, locale, and workingDirectory. Jackson property behavior is now configurable via spring.jackson.read.* and spring.jackson.write.* for CBOR, JSON, and XML formats. The Maven plugin now requires maven.test.skip=true to skip AOT processing of tests, as -DskipTests no longer works for that purpose. Empty YAML objects are now retained in PropertySource, and the Reactor client builder no longer sets proxyWithSystemProperties by default.
Spring Boot 4.1 removes all APIs deprecated in 4.0, including the layertools JAR mode (use tools mode instead). New deprecations include Apache Derby support (this project is now retired), Dynatrace V1 API properties (in favor of V2), and DevTools LiveReload (no replacement).
Spring Boot 4.1 includes updated Spring dependencies: Micrometer 1.17, Reactor 2025.0.6, and Spring GraphQL 2.0.4. Third-party upgrades include gRPC Java 1.80.0, Hibernate Validator 9.1, MySQL 9.7.0, MongoDB 5.8.0, Flyway 12.4.0, OpenTelemetry 1.62, and Mockito 5.22.0.
Most Spring projects ship releases alongside Spring Boot 4.1: Spring AI 2.0, Spring Modulith 2.1.0, Spring Security 7.1.0, Spring LDAP 4.1.0, Spring Integration 7.1.0, Spring Data 2026.0.0, Spring for Apache Kafka 4.1.0, Spring AMQP 4.1.0, Spring Session 4.1.0, Spring Vault 4.1.0, Spring HATEOAS 3.1.0, and Spring Cloud 2025.1.2.
The release notes describe all of these changes.
Spring Boot 4.2 is expected to be released in November 2026. It is scheduled to deliver the spring-boot-amqp module and its related starters, which were originally intended for Spring Boot 4.1 but pulled in the milestone 4 release. The module will support AMQP 1.0 via QPid Proton.