There was a flurry of activity in the Spring ecosystem during the week of June 16th, 2025, highlighting: the first milestone release of Spring Vault 4.0; and point releases of of Spring Boot, Spring Security, Spring Authorization Server, Spring Session, Spring Integration, Spring Modulith, Spring REST Docs, Spring AMQP, Spring for Apache Kafka, Spring for Apache Pulsar and Spring Web Services.
Release trains for numerous Spring projects will also reach the end of OSS support on June 30, 2025.
Spring Boot
Versions 3.5.1, 3.4.7 and 3.3.13 of Spring Boot (announced here, here and here, respectively) all deliver bug fixes, improvements in documentation and dependency upgrades. New features include: the ability to customize instances of the ConfigData.Options class that are set on the ConfigDataEnvironmentContributors class; and an upgrade to Apache Tomcat 10.1.42 which has introduced limits for part count and header size in multipart/form-data requests. These limits can be customized using the server.tomcat.max-part-count and server.tomcat.max-part-header-size properties, respectively.
Versions 3.5.3 and 3.5.2 (announced here and here) were unscheduled releases to address a difficult regression that was inadvertently introduced in version 3.5.1.
More details on these releases may be found in the release notes for version 3.5.3, version 3.5.2, version 3.5.1, version 3.4.7 and version 3.3.13.
Spring Security
Spring Security 6.5.1, 6.4.7 and 6.3.10 all deliver bug fixes, dependency upgrades and new features such as: a new migration guide that describes the transition from the now defunct Spring Security SAML Extension to built-in support for SAML 2.0; and support for the AsciiDoc include-code extension. Further details on these releases may be found in the release notes for version 6.5.1, version 6.4.7 and version 6.3.10.
Spring Authorization Server
The release of Spring Authorization Server 1.5.1, 1.4.4 and 1.3.7 all ship with bug fixes, dependency upgrades and a new feature that improves logging from the doFilterInternal() method, defined in the OAuth2ClientAuthenticationFilter class, to report on issues with client credentials. More details on these releases may be found in the release notes for version 1.5.1, version 1.4.4 and version 1.3.7.
Spring Session
Spring Session 3.5.1 and 3.4.4 provide dependency upgrades and a resolution to a ClassCastException due to a race condition from integration tests that use the Redis SessionEventRegistry class as it assumes there is only one event type for each session ID. Further details on these releases may be found in the release notes for version 3.5.1 and version 3.4.4.
Spring Integration
Spring Integration 6.3.11 ships with dependency upgrades and a resolution to a NullPointerException from the private obtainFolderInstance() method, defined in the AbstractMailReceiver class, to use the getDefaultFolder() method from the Jakarta Mail Store class if the URL is not provided or null. More details on this release may be found in the release notes.
Spring Modulith
Spring Modulith 1.4.1 and 1.3.7 provide bug fixes, dependency upgrades and improvements: the addition of missing reflection metadata in the JSONPath lookup for application module identifiers when converting to native image with GraalVM; and a resolution to prevent application module misconfiguration from the getModuleForPackage() method, defined in the ApplicationModules class, depending on the order of values stored in an instance of the Java Map interface that may return invalid additional packages. Further details on these releases may be found in the release notes for version 1.4.1 and version 1.3.7.
Spring REST Docs
Spring REST Docs 3.0.4 ships with improvements in documentation and notable changes: support for the Spring Framework 6.2 release train as default version due to the Spring Framework 6.1 release train reaching end of OSS support on June 30, 2025; and a workaround to resolve a breaking change with asciidoctor-maven-plugin 3.1.0 that no longer uses relative paths to build documentation. More details on this release may be found in the release notes.
Spring AMQP
Spring AMQP 3.1.12 provides dependency upgrades and resolutions to issue such as: removal of the cancelled() method from the logic within the commitIfNecessary() method, defined in the BlockingQueueConsumer class that had been causing anomalies in the shutdown process; and an instance of the default Spring Framework ThreadPoolTaskScheduler class created in the doInitialize() method, defined in the DirectMessageListenerContainer class, does not properly shut down when the container is destroyed. Further details on this release may be found in the release notes.
Spring for Apache Kafka
The release of Spring for Apache Kafka 3.3.7 and 3.2.10 delivers bug fixes, dependency upgrades and one new feature that now propagates the trace context when asynchronously handling Kafka message failures. More details on these releases may be found in the release notes for version 3.3.7 and version 3.2.10.
Spring for Apache Pulsar
Spring for Apache Pulsar 1.2.7 and 1.1.13 ship with improvements in documentation and notable respective dependency upgrades such as: Spring Framework 6.2.8 and 6.1.21; Project Reactor 2024.0.7 and 2023.0.19; and Micrometer 1.14.8 and 1.13.15. Further details on these releases may be found in the release notes for verizon 1.2.7 and version 1.1.3.
Spring Web Services
The release of Spring Web Services 4.0.15 features dependency upgrades and a resolution to the SimpleXsdSchema class that references an instance of the Java Element interface, which is not thread safe, that has caused issues when multiple clients have simultaneously requested the schema file. More details on this release may be found in the release notes.
Spring Vault
The first milestone release of Spring Vault 4.0.0 features: an alignment with Spring Framework 7.0; support for JSpecify for improved null safety; and a new ClientConfiguration class that adds support for Reactor, Jetty and JDK HTTP implementations of the SpringFramework ClientHttpRequestFactory interface. Further details on this release may be found in the release notes.
End of OSS Support
Release trains for all of these Spring projects (plus Spring Framework), with links to their respective timelines, will reach end of OSS support on June 30, 2025:
End of enterprise support for all of these projects will reach end of life on June 30, 2026.
