spring-projects/spring-boot
Spring Boot helps you to create Spring-powered, production-grade applications and services with absolute minimum fuss.
How spring-boot is put together
This is the Spring Boot monorepo: a multi-module Gradle project that builds the Spring Boot framework itself — the core auto-configuration engine, dozens of technology-specific integration modules, build tooling (Gradle/Maven plugins and Antlib), the executable jar loader, CLI, configuration metadata processors, test support, smoke tests, and documentation generated with Antora/Asciidoctor. The primary language is Java (with Groovy for Gradle build logic), targeting Java 17+. There is no single runnable application; instead each module ships libraries consumed by downstream applications, with data flow defined by Spring's dependency-injection and auto-configuration model rather than explicit request handlers in this repository.
Languages
Frameworks
Infrastructure
Major components
core/
Core framework modules: spring-boot runtime, spring-boot-autoconfigure, test/test-autoconfigure, docker-compose support, properties migrator, and annotation processors.
module/
Per-technology auto-configuration modules (web servers Tomcat/Jetty/Netty, data stores like JPA/R2DBC/Redis/Cassandra/MongoDB, messaging Kafka/AMQP/Pulsar, security OAuth2/SAML2, observability Micrometer/OpenTelemetry, etc.).
buildSrc/
Custom Gradle convention and build plugins (BOM management, starters, deployed publishing, architecture checks via ArchUnit, checkstyle/javaformat, test slicing).
build-plugin/
Shipped build tools: spring-boot-gradle-plugin, spring-boot-maven-plugin, and spring-boot-antlib for packaging/repackaging applications.
loader/
Executable jar infrastructure: spring-boot-loader (nested-jar classloader), loader-tools, and jarmode-tools.
cli/spring-boot-cli
The Spring Boot command-line interface, including Homebrew packaging and shell completion scripts.
smoke-test/
Small end-to-end sample applications per integration (e.g., ActiveMQ, RestClient) used to validate auto-configurations.
integration-test/ & documentation/
Cross-module integration test suites (server, SNI/TLS certs, actuator, loader) plus Antora/Asciidoctor reference documentation.
A steady week of community-contributed fixes and docs, plus early groundwork for Java 27 support.
5 weeksWeek of 2026-08-24
Week of 2026-08-24latest
A steady week of community-contributed fixes and docs, plus early groundwork for Java 27 support.
Week of 2026-08-17
A lighter week centered on restoring GitHub workflows after some housekeeping, dependency bumps from Dependabot, and a few targeted fixes.
Week of 2026-08-10
A busy dependency-upgrade week across all supported branches, alongside a Kafka security fix and several library refreshes.
Week of 2026-08-03
The biggest week of the period: coordinated dependency upgrades across three release branches as part of preparing the 4.2.0-M1 milestone.
Week of 2026-07-27
Release preparation dominated the week, with branches cut for 4.2.0-M1, 4.1.1, and 4.0.8, plus Forwarded-header refinements and test reliability work.
Over the past five weeks the Spring Boot team prepared and shipped milestone releases (4.2.0-M1 plus patch releases 4.0.8 and 4.1.1), then spent the following weeks upgrading dependencies across the board and merging community contributions. Notable user-facing work included fixes for a JMS health-check thread leak, better handling of database connection wrappers, new documentation for tracing keys and OTLP settings, and early groundwork for Java 27 support. The final week of August was quieter, focused on small fixes, documentation, and continuous integration improvements.
Week by week
2026-08-24A steady week of community-contributed fixes and docs, plus early groundwork for Java 27 support.latest6 changes
Feature
Configurable Micrometer Tracing MDC keys
Developers can now customize which log context keys Spring Boot uses when correlating traces with application logs.
Fix
JMS health check thread leak fixed
A background watchdog thread no longer stays behind when the JMS health indicator fails to start, preventing resource leaks.
Fix
Root DataSource resolution honors wrappers
When a database connection pool wraps another data source, Spring Boot now looks through the wrapper to find the real underlying one.
Docs
SAML2 back-off documented for WebFlux
The security documentation now explains how to disable SAML2 auto-configuration in reactive applications.
Docs
OTLP common properties documented
New documentation covers the shared OpenTelemetry export settings that individual signal types can fall back to.
Chore
Java 27 build support added
Continuous integration now builds against Java 27, with version detection updated to recognize it.
2026-08-17A lighter week centered on restoring GitHub workflows after some housekeeping, dependency bumps from Dependabot, and a few targeted fixes.6 changes
Fix
Root DataSource unwrap honored
Connection pool wrappers are now unwrapped when Spring Boot resolves the real root data source.
Fix
AOT file comparison releases file handles
Comparing ahead-of-time processed files no longer leaves file handles open, avoiding resource leaks on Windows and elsewhere.
Feature
Warning when image stack IDs mismatch
Buildpack builds now warn you when your builder and run images come from different stacks, which can cause runtime problems.
Chore
GitHub workflows restored
Continuous integration workflows that had been temporarily removed were restored to the repository.
Docs
Stale security configuration reference removed
Documentation no longer points to a configuration class that was removed in an earlier release.
Chore
Docs tooling bumped
The Antora documentation toolchain was upgraded to its latest release candidate.
2026-08-10A busy dependency-upgrade week across all supported branches, alongside a Kafka security fix and several library refreshes.6 changes
Fix
Kafka consumer-specific security protocol
Spring Boot now applies each Kafka consumer's own security protocol setting instead of a shared one, fixing misconfigured secure connections.
Fix
Cached buffer reset before reuse
An internal byte buffer is cleared before being reused, preventing stale data from leaking between writes.
Chore
Milestone dependencies started
Builds began tracking upcoming milestones of Spring Security 7.2, Spring HATEOAS, and Spring Data to catch issues early.
Chore
Elasticsearch client upgrades
The Elasticsearch client libraries were refreshed to newer patch versions on both current branches.
Chore
MongoDB driver upgraded
The MongoDB Java driver moved up to recent versions (5.9.2 and 5.8.1 depending on branch).
Chore
gRPC and Pulsar refreshes
Supporting libraries for gRPC and Spring Pulsar messaging were upgraded across branches.
2026-08-03The biggest week of the period: coordinated dependency upgrades across three release branches as part of preparing the 4.2.0-M1 milestone.6 changes
Chore
Spring Framework 7.1 milestone adopted
The next-generation branch began building against Spring Framework 7.1.0-M1 while stable branches took 7.0.9.
Chore
Micrometer 1.18 milestone adopted
Metrics and tracing libraries moved to their next major milestones (1.18/1.7) across branches.
Chore
Reactor 2026.0 milestone adopted
The reactive programming foundation was upgraded to the Reactor 2026.0.0-M1 release train.
Chore
Spring Security 7.2 milestone adopted
Security integration was aligned with the newest Spring Security milestone, with patch updates on older branches.
Chore
Batch, Kafka, Integration, AMQP milestones
Spring's batch processing and messaging integrations all moved to their next milestone versions in lockstep.
Chore
Session, LDAP, GraphQL, gRPC updates
Smaller integrations including session management, LDAP, GraphQL, and gRPC received matching version bumps.
2026-07-27Release preparation dominated the week, with branches cut for 4.2.0-M1, 4.1.1, and 4.0.8, plus Forwarded-header refinements and test reliability work.6 changes
Chore
Release branches prepared
Dedicated branches were created to stabilize and ship the 4.2.0-M1 milestone and the 4.1.1 and 4.0.8 patch releases.
Fix
Forwarded headers refined for servers
How proxy-forwarded headers are handled was improved for Reactor Netty and Jetty web servers, keeping correct URLs behind load balancers.
Chore
Micrometer global registry disabled in tests
Tests no longer share Micrometer's global metrics registry by default, making them more isolated and reliable.
Fix
Long build paths handled via temp directory
Builds whose directory paths are too long for the OS now fall back to a temporary directory instead of failing.
Docs
Kafka Streams serialization example updated
The Kafka Streams documentation now shows the recommended Jackson-based serializer class.
Chore
Stale InfluxDB reference removed
Leftover references to the removed InfluxDB auto-configuration were cleaned out of the codebase.
Dependencies and code review
Dependency advisories
Security Watch
No known advisories across 0 scanned dependencies.
No known advisories in the scanned dependencies.
Code review
No concrete code-level issues confirmed.
Get this report every week for your repos.
GitZoid learns each repo, reports what changed, and flags what needs attention. One flat price for the whole team.
$19 a month, flat · First 10 outputs free · No card required