Micrometer 1.13 has deprecated its Jersey support in favor of Jersey’s jersey-micrometer module. If you application uses Jersey metrics, add a dependency on org.glassfish.jersey.ext:jersey-micrometer when upgrading.

To support observations with Jersey, the MetricsApplicationEventListener has been replaced with a ObservationApplicationEventListener. If you were using a JerseyTagsProvider to customize the tags, you’ll now need to implement a JerseyObservationConvention bean to do that.

Dependency management for Dropwizard Metrics has been removed. Spring Boot does not depend directly upon Dropwizard Metrics and, therefore, does not require a specific version. If your application depends on Dropwizard Metrics directly, update your build configuration to specify a version that meets its needs.

Spring Boot 3.3 includes support for the Prometheus Client 1.x. This release of the client contains some breaking changes, e.g. changes to the exported metric names. Use of the Prometheus Push Gateway is not supported with the 1.x client, until this support has been added from the Prometheus maintainers.

If you want to continue to use the 0.x version of the Prometheus client, remove io.micrometer:micrometer-registry-prometheus from your dependencies and add io.micrometer:micrometer-registry-prometheus-simpleclient instead. Spring Boot contains auto-configuration for simpleclient in a deprecated form which will be removed in Spring Boot 3.5.0.

For a more detailed migration guide, please see this section of the Micrometer wiki.

This release upgrades to Flyway 10. Flyway 10 is more modular than previous versions and support for several databases has been moved into a number of new, database-specific modules. If you are using any of the following databases, update your dependencies accordingly:

• DB2 (flyway-database-db2)

• Derby (flyway-database-derby)

• HSQLDB (flyway-database-hsqldb)

• Informix (flyway-database-informix)

• PostgreSQL (flyway-database-postgresql)

• Redshift (flyway-database-redshift)

• SAP HANA (flyway-database-saphana)

• Snowflake (flyway-database-snowflake)

• Sybase ASE (flyway-database-sybasease)

This release upgrades to Infinispan 15. Infinispan 15 has raised its Jakarta EE baseline and, as such, a number of its -jakarta modules, such as infinispan-core-jakarta, no longer exist. Use their standard alternatives, such as infinispan-core, instead.

The plugin has been upgraded to 8.0.x. As part of this upgrade, the default date format is now yyyy-MM-dd’T’HH:mm:ssXXX. This provides compatibility with Maven’s reproducible builds feature.

CDS is a JVM feature that can help reduce the startup time and memory footprint of Java applications. Spring Boot now has support for easy creation of a CDS friendly layout. This layout can be created by extracting the uber JAR with the help of the tools jarmode:

This creates a your-application/your-application.jar and the needed libraries in a your-application/lib folder. The application can then be executed with java -jar your-application/your-application.jar.

The tools jarmode supports two commands at the moment:

• extract, as shown above. This supersedes -Djarmode=layertools extract.

• list-layers, which supersedes -Djarmode=layertools list-layers.

Run

to get more details.

If you have used layers.enabled = false in your Gradle build file or <layers><enabled>false</enabled></layers> in your Maven pom.xml, please note that disabling layers no longer prevents the inclusion of the jarmode JAR. Use includeTools on the BootJar or BootWar task or <configuration><includeTools>false</includeTools></configuration> on the spring-boot-maven-plugin for that.

Observations can now be enabled for the simple, direct and stream listener and on the RabbitTemplate via properties.

Support for the Micrometer @SpanTag annotation has been added.

Added support for tagged fields for both Brave and OpenTelemetry. Support for local fields has been added for Brave.

Added a process InfoContributor, which can be enabled with management.info.process.enabled=true.

If no application name is explicitly set, unknown_service is now used for OpenTelemetry. This aligns the Spring Boot default to the OpenTelemetry specification.

There are now properties to configure cluster-level failover for Pulsar under the spring.pulsar.client.failover namespace.

A JwtAuthenticationConverter (or a ReactiveJwtAuthenticationConverter) is now auto-configured if one of the properties is set:

• spring.security.oauth2.resourceserver.jwt.authority-prefix

• spring.security.oauth2.resourceserver.jwt.principal-claim-name

• spring.security.oauth2.resourceserver.jwt.authorities-claim-name

If a AsyncTaskExecutor is available in the context, it is now registered on the websocket ChannelRegistration. If using virtual threads, this will usually be a virtual threads enabled SimpleAsyncTaskExecutor, making Websockets virtual thread capable.

A @BatchTransactionManager annotation has been introduced to make it easier to configure Spring Batch to use a custom transaction manager. See the updated documentation for more information.

Resources can now be loaded as Base64 encoded text values using a base64: prefix. This can be useful with resources such as SSL certificates, as in this example:

The spring-boot-actuator module now includes a new SBOM endpoint. By default the endpoint will serve META-INF/sbom/bom.json or META-INF/sbom/application.cdx.json files located in your jar.

Additional configuration has also been provided in the spring-boot-parent-starter POM to make SBOM plugins easier to configure. See the documentation for more details.

The Spring Boot documentation has been migrated to Antora, providing more structure as well as better search capabilities.

When configuring a Tomcat, Netty, or Undertow embedded web server with SSL/TLS, it is now possible to configure multiple hostnames with unique trust material for each to support Server Name Indication (SNI). See the updated documentation for more information on the configuration options.

Spring Boot 3.3.0 moves to new versions of several Spring projects:

• Spring Authorization Server 1.3.0

• Spring Data 2024.0.0

• Spring GraphQL 1.3.0

• Spring HATEOAS 2.3.0

• Spring Integration 6.3.0

• Spring Kafka 3.2.0

• Spring Pulsar 1.1.0

• Spring Security 6.3.0

• Spring Session 3.3.0

Numerous third-party dependencies have also been updated, some of the more noteworthy of which are the following:

• AssertJ 3.25

• Brave 6.0

• Commons DBCP2 2.12

• Elasticsearch Client 8.13

• Flyway 10.10

• Hazelcast 5.4

• Hibernate 6.5

• HikariCP 5.1.0

• Infinispan 15.0

• Jackson 2.17

• JMustache 1.16

• Kafka 3.7

• Liquibase 4.27

• Micrometer 1.13

• Micrometer Tracing 1.3.0

• Mockito 5.11

• MySQL 8.3

• OpenTelemetry 1.37

• Oracle R2DBC 1.2.0

• Rabbit AMQP Client 5.21

• Rabbit Stream Client 0.15

• REST Assured 5.4

Apart from the changes listed above, there have also been lots of minor tweaks and improvements including:

• spring.config.activate.on-cloud-platform=none will now match when the active cloud platform is null

• Added a configuration option for "path" field inclusion in error responses. This can be controlled by the server.error.include-path property. It defaults to always

• The WebFlux DefaultErrorAttributes now use request.requestPath().value() to populate path error attribute

• Added the property server.tomcat.threads.max-queue-capacity to configure the maximum queue size for the Tomcat web server connector

• The configuration processor now checks the additional-spring-configuration-metadata.json for superfluous keys and fails if it encounters any

• Added a property named spring.task.execution.pool.shutdown.accept-tasks-after-context-close to control if the ThreadPoolTaskExecutor accepts tasks after the context shutdown has been initiated

• Added the property server.reactive.session.max-sessions to control the number of maximum sessions when using WebFlux

• ExecutionContextSerializer beans are now automatically applied to the Spring Batch configuration. If none is provided, DefaultExecutionContextSerializer is used

• The started log messages produced by the four supported web servers (Jetty, Netty, Tomcat, and Undertow) are now more consistent

• Added client-id and subscription-durable properties for JMS connections

• If a class implements multiple servlet interfaces, like Filter or Servlet, it will now be registered for all of the interfaces (e.g. one registration for a filter and one for a servlet)

• The new reactive sessions actuator endpoint can now return sessions for a given username

• The environment’s default profiles are now included in the env actuator endpoint’s response

• Added the new property spring.liquibase.ui-service to specify the default UI service logger used by Liquibase

• Added the new property spring.security.saml2.relyingparty.registration.*.name-id-format to specify the NameID format of a SAML registration

• Added the new property server.mime-mappings which allows additional custom MIME type mappings to be configured

• jakarta.inject:jakarta.inject-api is now included in Spring Boot’s dependency management

• The date format of the git-commit-id-maven-plugin has been changed to yyyy-MM-dd’T’HH:mm:ssXXX to allow reproducible builds. See #39606 for details

• The spring-boot-starter-jetty no longer includes jetty-jndi by default. If you need JNDI support, please add org.eclipse.jetty:jetty-jndi to your dependencies

• On Windows it’s now possible to start the application with mvn spring-boot:run even if it has an extremely large number of dependencies. Before 3.3.0 it would fail with a "The filename or extension is too long" exception due to the length of the classpath

• The new property spring.data.jdbc.dialect can be used to set the dialect for Spring Data JDBC. If not set, the dialect will be auto-detected

• Add more gap between the orders of CloudFoundryVcapEnvironmentPostProcessor and ConfigDataEnvironmentPostProcessor

• The Cassandra driver changed coordinates from com.datastax.oss to org.apache.cassandra

• Setting the new property management.observations.long-task-timer.enabled to false now prevents the creation of a LongTaskTimer for every observation

• Beans in the infrastructure role are now automatically excluded from lazy initialization

• Spring Config now uses the conversion service from the environment when resolving properties

• Set the new property spring.docker.compose.start.skip to never to always execute the Docker Compose startup command

• A new spring.graphql.websocket.keep-alive property has been added

• JPA auto-configuration now uses a ManagedClassNameFilter bean if one is defined

• A new spring.rabbitmq.template.allow-list-patterns property has been added