Spring Boot 4: New Features and a Practical Migration Guide from 3.x

On November 20, 2025, the Spring team released Spring Boot 4.0 — the first major update in three years since Spring Boot 3.0. Six months earlier the team had been upfront: this would not be cosmetic, it would be a "new generation." By August 2026 the first production experience has accumulated, version 4.1 is already out (June 10, 2026), and Spring Boot 3.5 has officially stopped receiving free patches. The migration conversation is no longer philosophical — it is calendar-driven.

The deadline has passed: why waiting is no longer an option

Spring Boot 3.5 reached end-of-life in June 2026. That means every 3.x branch — including the final patch 3.5.16 from June 25 — no longer receives free security updates from the Spring team. Staying on 3.x is possible only under a commercial subscription (Spring Enterprise, HeroDevs NES) — or by accepting the risk of running without patches.

The second nuance is where to land. Spring Boot 4.0 itself receives free OSS support only until December 2026 (~13 months, the standard cadence). The practical advice from the team and most engineers: target Spring Boot 4.1 directly — otherwise you will end up doing the migration twice within six months.

What actually changed: a map of the release

Spring Boot 4 sits on Spring Framework 7 and Jakarta EE 11. The changes are substantial, but the JDK minimum stayed the same — 17. Below is what teams most often discuss when evaluating the upgrade.

The overarching theme behind this table: what used to require third-party libraries in Spring 3.x is now built in. It is not always the most feature-rich option (Resilience4j is still more flexible than the built-in annotations), but it removes an entire layer of "infrastructure" dependencies.

API Versioning and HTTP Interface Clients: the biggest everyday wins

API Versioning in Spring Framework 7 addresses an old pain point: previously, versioning REST endpoints was done through a URL prefix, an Accept header, or a media type — each time with a homegrown solution. In Spring Boot 4, versioning is configured declaratively, works for both MVC and WebFlux, and request routing between versions is centralized.

HTTP Interface Clients are the second welcome addition. You declare a Java interface with @GetExchange and @PostExchange annotations — Spring generates the HTTP client for you. Conceptually this is the same thing Retrofit, Feign, and spring-cloud-openfeign did, only without external dependencies and with full support for reactive types from Reactor 2025.0.

JSpecify, modularization, Jakarta EE 11 — what is under the hood

Modularization is the most structural shift of the release. Previously, spring-boot-autoconfigure was a large monolithic jar containing auto-configuration logic for nearly the entire portfolio. In Spring Boot 4 it is split into dozens of focused modules: you include only what you actually use. In practice this is most noticeable in three scenarios: container images become more compact, native-image (GraalVM) startup time drops, and AOT processing behaves more predictably.

JSpecify is the unified portfolio-wide null-safety annotation system. All public Spring Boot APIs are marked with @NullMarked and @Nullable, and Kotlin 2.2 together with IntelliJ IDEA 2025.3 read these annotations directly. For Kotlin code this means Spring API types are now correctly understood as nullable/non-nullable without "platform" types. For Java code JSpecify is useful too — static analyzers (NullAway, Checker Framework) pick it up out of the box.

Jakarta EE 11 is the standard stack upgrade: Tomcat 11, Hibernate ORM 7, Hibernate Validator 9. On its own it rarely breaks code, but it cascades into updates of related libraries. The Kotlin baseline is raised to 2.2, Jackson to 3, JUnit to 6.

What was removed and what will break during migration

A major release without significant clean-ups would be incomplete. What Spring Boot 4 removed:

• Jackson 2. A complete switch to Jackson 3 — new packages (tools.jackson), changed semantics for some serializers, and a separate migration path for custom modules.
• JUnit 4. Only JUnit 5.13+ (in 4.1 — already JUnit 6). Old tests need to be converted or isolated through the vintage-engine on your side.
• Undertow. The embedded server has been removed from the portfolio — Tomcat 11, Jetty 12, and Netty (for reactive applications) remain.
• All Spring Boot 3 deprecations. Everything marked @Deprecated in 3.x has been cleaned out. Expect a red build on the first pass.

A separate issue is that modularization can silently break auto-configuration if your project relied on "everything being pulled in automatically." The typical symptom: tests with @AutoConfigureMockMvc stop resolving the right beans because the starter for a specific technology (Flyway, H2, MockMvc) now needs to be included explicitly.

In practice: how to move from 3.x to 4.1

The sequence that has worked for most teams over the first six months:

1. Start with Java and the build. Make sure the project builds on JDK 17+ (ideally 21 or 25) and that Maven/Gradle are updated to versions supporting Spring Boot 4. The Spring Boot Maven Plugin and Gradle Plugin — also to their latest versions.
2. An intermediate stop at 3.5.x. If you are still on 3.2–3.4, move to 3.5 first — this clears most deprecation warnings before the jump to 4.x.
3. Run OpenRewrite. Ready-made recipes (org.openrewrite.recipe:rewrite-spring) handle the bulk of the routine: updating dependencies, renaming Jackson packages, replacing deprecated APIs.
4. Target 4.1 directly. 4.0 loses OSS support in December 2026 — going through 4.0 to 4.1 saves time only on small projects. For large monorepos it is simpler to land in 4.1 once.
5. Tests and observability separately. Check custom @SpringBootTest configurations, test containers, and APM integrations (Datadog, New Relic, Grafana). OpenTelemetry instrumentation in 4.x is assembled differently from 3.x.

In terms of timeline: teams with clean code on 3.5 push the migration to prod in 1–3 weeks. Projects with heavily customized auto-configuration and a large volume of custom Jackson modules take 4–8 weeks. A separate category is services still on Spring Boot 2.x: a double migration lies ahead, starting with the switch to Jakarta EE.

What to check before rollout

Three things that most commonly surface at the staging phase:

• Spring portfolio compatibility: Spring Security 7, Spring Cloud, Spring Batch 6, and Spring Modulith 2.0 are all GA for Spring Boot 4. Spring AI as of mid-2026 ships milestone releases (GA 2.0 is expected later) — verify if you use it.
• Native image (GraalVM): modularization has improved things, but custom reflect-config.json and resource-config.json files need revisiting after the upgrade.
• Container images and dev-tools: DevTools in 4.x has been reworked — older hot-reload integrations may behave differently.

It is also worth re-reading the official migration guide from the Spring team — it is long but well-structured by area, and most known issues are already documented there.

The bottom line

Spring Boot 4 is not a cosmetic release — it is a structural shift: a modular portfolio, a unified null-safety system, built-in API Versioning, HTTP clients without external libraries, and full Java 25 support. At the same time, the baseline stayed at JDK 17, which makes the migration easier than the earlier jump from Spring Boot 2 to 3. The deadline has already passed — Spring Boot 3.x without a commercial subscription no longer receives security patches. The practical route for most teams is straightforward: get to 3.5 first, run OpenRewrite, then target 4.1 directly. Everything you used to pull in through third-party dependencies — retry, limits, HTTP clients, versioning, OTel — is now either in the core or in focused modules. This is the rare case where a major release actually shrinks the dependency surface rather than growing it.