Skip to content

Update dependency org.springframework.boot:spring-boot-dependencies to v3.5.3#103

Merged
JohannesRabauer merged 1 commit into
developfrom
renovate/org.springframework.boot-spring-boot-dependencies-3.x
Jul 24, 2025
Merged

Update dependency org.springframework.boot:spring-boot-dependencies to v3.5.3#103
JohannesRabauer merged 1 commit into
developfrom
renovate/org.springframework.boot-spring-boot-dependencies-3.x

Conversation

@xdev-renovate

@xdev-renovate xdev-renovate commented May 21, 2025 •
edited
Loading

Copy link
Copy Markdown
Member

This PR contains the following updates:

Package Type Update Change
org.springframework.boot:spring-boot-dependencies (source) import minor 3.2.2 -> 3.5.3

Release Notes

spring-projects/spring-boot (org.springframework.boot:spring-boot-dependencies)

v3.5.3

Compare Source

🐞 Bug Fixes
  • Binder context does not restore previous source causing missing data on Spring Boot 3.5 or above #​46040

v3.5.2

Compare Source

🐞 Bug Fixes
  • IllegalArgumentException: 'name' must not be null thrown when property source filtering applied twice #​46032

v3.5.1

Compare Source

⚠️ Noteworthy Changes
  • This release upgrades to Tomcat 10.1.42 which has introduced limits for part count and header size in multipart/form-data requests. These limits can be customized using server.tomcat.max-part-count and server.tomcat.max-part-header-size respectively.
⭐ New Features
  • Allow Specifying ConfigData.Options On ConfigDataEnvironmentContributors #​42932
🐞 Bug Fixes
  • Executable JAR application class encounters performance issues when classpath URLs reference a host #​46028
  • Loading from spring.factories may fail with a ClassNotFoundException when the TCCL changes between calls #​46019
  • spring.couchbase.authentication.jks.private-key-password has no effect #​46006
  • Actuator heapdump endpoint is failing on modern OpenJ9 JVMs #​46005
  • UnboundConfigurationPropertiesException is no longer thrown from IndexedElementsBinder #​45994
  • DataSouceBuilder can fail with a NPE when the driver is null #​45992
  • JSON writer incorrectly escapes forward slash which can cause structure logging issues #​45980
  • ManagementContextAutoConfiguration adds a property source that degrades binding performance #​45968
  • ClientHttpConnectorAutoConfiguration fails to load when 'java.net.http.HttpClient' is unavailable #​45955
  • It is not possible to opt-out of profile validation or use profile names that contain '.' #​45947
  • GraphQlProperties.DeprecatedSse is not annotated as deprecated #​45878
  • SpringApplication.setEnvironmentPrefix is ignored when reading MANAGEMENT_SERVER_PORT #​45857
  • Write and delete operations no longer work in the Cloud Foundry actuator support with Spring Security due to CSRF protection #​45848
  • ConditionalOnAvailableEndpoint does not use the ConditionContext's ClassLoader to load exposure outcome contributors #​45803
  • Binding no longer works with sytem environment properties that are not upper case #​45741
  • ManagementWebServerFactoryCustomizer and ManagementErrorPageCustomizer should not have the same order #​45736
  • Default version of Awailitility is not compatible with Kotlin 1.9 baseline #​45673
  • Spring Boot 3.5's dependency management should have been upgraded to Lettuce 6.6.0.RELEASE #​45670
  • Spring Boot 3.5's dependency management should have been upgraded to Jedis 6.0.0 #​45669
  • SAML2 autoconfiguration is not imported by @WebMvcTest #​45666
  • Spring Boot 3.5's dependency management should have been upgraded to MongoDB 5.5.0 #​45660
📔 Documentation
  • Fix Docker security options links in Packaging OCI images sections #​46021
  • Improve documentation for configuring Spring Security with '/error' #​46009
  • Timestamps in Retrieving Audit Events examples do not match the accompanying text #​45997
  • Add SSL response structure to actuator info endpoint documentation #​45921
  • Update javadoc of test slice annotations to suggest MockitoBean rather than MockBean #​45915
  • Include configuration classes from all modules in the "Auto-configuration Classes" appendix #​45863
  • Links to Testcontainers javadoc for many classes not in the core testcontainers module do not work #​45844
  • Update documentation to reflect changes in TestRestTemplate's default redirect behavior #​45842
  • Deprecation replacement for spring.codec.* properties has a typo #​45743
  • Gradle Shadow Plugin link in the reference guide is outdated #​45740
  • Example of using prometheus-metrics-exporter-pushgateway has wrong artifactId #​45684
  • Document use of git-commit-id-maven-plugin consistently #​45683
  • Update javadoc of Configurer classes that apply sensible defaults to describe how they're typically used #​45656
🔨 Dependency Upgrades
❤️ Contributors

Thank you to all the contributors who worked on this release:

@​Peksa, @​Rutujakolte03, @​chanbinme, @​csbiy, @​davidlj95, @​izeye, @​juliojgd, @​ngocnhan-tran1996, @​nicolasgarea, @​nosan, @​quaff, @​shekharAggarwal, @​tanruian, and @​wonyongg

v3.5.0

Compare Source

Full release notes for Spring Boot 3.5 are available on the wiki.

⭐ New Features
  • Make heapdump endpoint restricted by default #​45624
  • Remove SSL status tag from metrics #​45602
  • Remove 'spring.http.client' deprecation and change 'spring.http.reactiveclient.settings' to 'spring.http.reactiveclient' #​45507
🐞 Bug Fixes
  • Unable to override/set nested ConfigurationProperties by passing as a system property #​45639
  • ValidationAutoConfiguration triggers early initialization of properties binding #​45618
  • Micrometer "enable" annotations property does not cover observed aspect #​45617
  • spring.graphql.sse.timeout is no longer exposed #​45613
  • SpringApplication.setEnvironmentPrefix is ignored when reading SPRING_PROFILES_ACTIVE #​45549
  • IllegalStateException when extracting using layers a module with no code of its own #​45449
  • Removed spring.batch.initialize-schema property is still considered #​45380
  • ReactorHttpClientBuilder does not offer a factory method to create the HttpClient #​45378
  • Suggested values for spring.jpa.hibernate.ddl-auto are not aligned with Hibernate #​45351
  • Custom default units declared on a field are ignored when binding properties in a native image #​45347
  • DockerRegistryConfigAuthentication uses the wrong serverUrl as a fallback for the Credentials helper #​45345
  • Various spring.datasource properties are mistakenly marked as ignored #​45342
  • JerseyWebApplicationInitializer always gets loaded, setting a ServletContext initParameter #​45297
  • DockerRegistryConfigAuthentication does not align with Docker CLI #​45292
  • Unlike the Docker CLI, "\x00" characters are not trimmed from a decoded Docker Registry password #​45290
  • CloudFoundry security matcher logs a warning due to use of the 'ignoring()' method #​32622
📔 Documentation
  • Document the java info contribution #​45634
  • Document the process info contribution #​45632
  • Document the os info contribution #​45630
  • Document typical spring.application.group and name use #​45628
  • Document that bean methods should be static when annotated with @ConfigurationPropertiesBinding #​45626
  • Document the way that primary Kotlin constructors are used when binding #​45553
  • Improve "profile" reference documentation with additional admonitions #​45551
  • Improve setEnvironmentPrefix(...) reference documentation #​45376
  • Document all the available Testcontainers integrations #​45367
  • Document when a spring.config.import value is relative and when it is fixed #​45363
  • Update org.cyclonedx.bom version in docs to 2.3.0 #​45320
  • Update link to "Parameter Name Retention" section of Spring Framework's release notes #​45299
🔨 Dependency Upgrades
❤️ Contributors

Thank you to all the contributors who worked on this release:

@​ahrytsiuk, @​izeye, @​lhotari, @​ngocnhan-tran1996, @​nosan, @​quaff, @​thecooldrop, and @​yybmion

v3.4.7

Compare Source

⚠️ Noteworthy Changes
  • This release upgrades to Tomcat 10.1.42 which has introduced limits for part count and header size in multipart/form-data requests. These limits can be customized using server.tomcat.max-part-count and server.tomcat.max-part-header-size respectively.
🐞 Bug Fixes
  • Executable JAR application class encounters performance issues when classpath URLs reference a host #​46027
  • Loading from spring.factories may fail with a ClassNotFoundException when the TCCL changes between calls #​46018
  • Actuator heapdump endpoint is failing on modern OpenJ9 JVMs #​46004
  • DataSouceBuilder can fail with a NPE when the driver is null #​45991
  • JSON writer incorrectly escapes forward slash which can cause structure logging issues #​45972
  • spring.couchbase.authentication.jks.private-key-password has no effect #​45883
  • ConditionalOnAvailableEndpoint does not use the ConditionContext's ClassLoader to load exposure outcome contributors #​45800
  • ManagementWebServerFactoryCustomizer and ManagementErrorPageCustomizer should not have the same order #​45728
  • SAML2 autoconfiguration is not imported by @WebMvcTest #​45650
📔 Documentation
  • Fix Docker security options links in Packaging OCI images sections #​46020
  • Improve documentation for configuring Spring Security with '/error' #​46008
  • Timestamps in Retrieving Audit Events examples do not match the accompanying text #​45996
  • Update javadoc of test slice annotations to suggest MockitoBean rather than MockBean #​45887
  • Include configuration classes from all modules in the "Auto-configuration Classes" appendix #​45861
  • Links to Testcontainers javadoc for many classes not in the core testcontainers module do not work #​45843
  • Add SSL response structure to actuator info endpoint documentation #​45792
  • Gradle Shadow Plugin link in the reference guide is outdated #​45739
  • Document use of git-commit-id-maven-plugin consistently #​45682
  • Update javadoc of Configurer classes that apply sensible defaults to describe how they're typically used #​45655
  • Clarify the situation with support for Prometheus PushGateway and the deprecated simpleclient #​45649
🔨 Dependency Upgrades
❤️ Contributors

Thank you to all the contributors who worked on this release:

@​chanbinme, @​csbiy, @​davidlj95, @​izeye, @​ngocnhan-tran1996, @​nicolasgarea, @​nosan, @​quaff, @​shekharAggarwal, and @​wonyongg

v3.4.6

Compare Source

🐞 Bug Fixes
  • Micrometer "enable" annotations property does not cover observed aspect #​45616
  • SpringApplication.setEnvironmentPrefix is ignored when reading SPRING_PROFILES_ACTIVE #​45548
  • IllegalStateException when extracting using layers a module with no code of its own #​45448
  • Suggested values for spring.jpa.hibernate.ddl-auto are not aligned with Hibernate #​45350
  • Custom default units declared on a field are ignored when binding properties in a native image #​45346
  • JerseyWebApplicationInitializer always gets loaded, setting a ServletContext initParameter #​45296
📔 Documentation
  • Document the java info contribution #​45633
  • Document the process info contribution #​45631
  • Document the os info contribution #​45629
  • Document typical spring.application.group and name use #​45627
  • Document that bean methods should be static when annotated with @ConfigurationPropertiesBinding #​45625
  • Document the way that primary Kotlin constructors are used when binding #​45552
  • Improve "profile" reference documentation with additional admonitions #​45550
  • Improve setEnvironmentPrefix(...) reference documentation #​45375
  • Document all the available Testcontainers integrations #​45366
  • Document when a spring.config.import value is relative and when it is fixed #​45362
  • Update link to "Parameter Name Retention" section of Spring Framework's release notes #​45298
🔨 Dependency Upgrades
❤️ Contributors

Thank you to all the contributors who worked on this release:

@​ahrytsiuk, @​izeye, @​ngocnhan-tran1996, @​nosan, @​quaff, @​thecooldrop, and @​yybmion

v3.4.5

Compare Source

🐞 Bug Fixes
  • Spring Boot with native image container image build fails on podman due to directory permissions #​45256
  • Neo4jReactiveDataAutoConfiguration assumes that certain beans are available #​45235
  • Wrong jOOQ exception translator with empty db name #​45219
  • MessageSourceMessageInterpolator does not replace a parameter when the message matches its code #​45213
  • IntegrationMbeanExporter is not eligible for getting processed by all BeanPostProcessors warnings are shown when using JMX #​45194
  • OAuth2AuthorizationServerJwtAutoConfiguration uses @ConditionalOnClass incorrectly #​45178
  • MongoDB's dependency management is missing Kotlin coroutine driver modules #​45159
  • ImagePlatform can cause "OS must not be empty" IllegalArgumentException #​45153
  • TypeUtils does not handle generics with identical names in different positions #​45039
  • HttpClient5 5.4.3 breaks local Docker transport #​45028
  • spring.datasource.hikari.data-source-class-name cannot be used as a driver class name is always required and Hikari does not accept both #​45002
  • Post-processing to apply custom JdbcConnectionDetails triggers an NPE in Hikari if the JDBC URL is for an unknown driver #​44998
  • DataSourceBuilder triggers an NPE in Hikari when trying to build a DataSource with a JDBC URL for an unknown driver #​44995
  • SSL config does not watch for symlink file changes #​44887
  • EmbeddedLdapAutoConfiguration should not rely on PreDestroy #​44874
  • DataSourceTransactionManagerAutoConfiguration should run after DataSourceAutoConfiguration #​44819
  • JsonValueWriter can throw StackOverflowError on deeply nested items #​44627
  • In a reactive web app, SslBundle can no longer open store file locations without using a 'file:' prefix #​44535
  • Logging a Path object using structured logging throws StackOverflowError #​44507
📔 Documentation
  • Make @Component a javadoc link #​45258
  • Fix documentation links to buildpacks.io #​45241
  • Clarify the use of multiple profile expressions with "spring.config.activate.on-profile" #​45224
  • Show the use of token properties in authorization server clients configuration example #​45176
  • Add details of the purpose of the metrics endpoint #​45047
  • Escape the asterisk in spring-application.adoc #​45033
  • Add reference to Styra (OPA) Spring Boot SDK #​44976
  • Update CDS documentation to cover AOTCache #​44970
  • WebFlux security documentation incorrectly links to servlet classes #​44966
  • Replace mentions of deprecated MockBean annotation #​44947
  • TaskExecution documentation should describe what happens when multiple Executor beans are present #​44908
  • Documentation lists coordinates for some dependencies that are not actually managed #​44879
  • Polish javadoc of SpringProfileAction #​44826
🔨 Dependency Upgrades
❤️ Contributors

Thank you to all the contributors who worked on this release:

@​EvaristeGalois11, @​MelleD, @​aahlenst, @​ali-jalaal, @​erichaagdev, @​florgust, @​geniusYoo, @​izeye, @​jonatan-ivanov, @​nenros, @​nevenc, @​ngocnhan-tran1996, @​nosan, @​quaff, and @​rainboyan

v3.4.4

Compare Source

❗ Noteworthy Changes

Tomcat APR support is now disabled by default if you are using Java 24 or higher. This change has been made to prevent JDK from issuing warnings.

Please see the updated release notes for details.

🐞 Bug Fixes
  • Actuator throws an exception when using prototype scoped DataSource bean #​44706
  • Docker API error message is missing in some cases #​44630
  • DefaultJmsListenerContainerFactoryConfigurer#setObservationRegistry should not be public #​44585
  • When an application contains multiple DataSource beans, EntityManagerFactoryBuilder will default ddl-auto to a value that may only be appropriate for the primary DataSource #​44516
  • When the main class is not proxied, native testing that uses the application's main method does not work #​44481
  • When loading configuration from a Resource, Log4J2LoggingSystem may not close the InputStream #​44473
  • When loading from a resource, PemContent does not close the InputStream #​44454
  • ResourceBanner does not close the InputStream used to read the banner #​44452
  • ConfigDataLocationResolvers and PropertySourceLoaders are loaded using a potentially different class loader #​44450
  • Kafka message sending fails with 'class SslBundleSslEngineFactory could not be found' #​44437
  • Kafka in native-image fails when using SSL bundles #​44436
  • Nested test classes don't inherit properties from @DataJpaTest on enclosing class #​44407
  • Failure diagnostics are poor when trying to use an image platform that is not supported by the builder #​44059
  • Checking if APR is available logs a warning on Java 24 #​44033
📔 Documentation
  • Multiline properties in documentation are missing backslashes #​44790
  • Polish javadoc of SqlR2dbcScriptDatabaseInitializer #​44764
  • Document support for Java 24 #​44754
  • Remove OpenShift link that 404s #​44748
  • Fix link to javadoc for JavaExec.setArgsString #​44536
  • Fix typo in documentation #​44523
  • Update descriptions of properties that no longer require Flyway Teams #​44483
  • Fix typo in javadoc of CommonStructuredLogFormat#ELASTIC_COMMON_SCHEMA #​44469
  • Samples for metadata annotation processers have invalid fold attribute #​44420
  • Clarify which Mongo properties are ignored when URI property is set #​44404
  • Adapt Javadoc reference of JooqExceptionTranslator to use ExceptionTranslatorExecuteListener #​44402
🔨 Dependency Upgrades
❤️ Contributors

Thank you to all the contributors who worked on this release:

@​KmYgJn, @​bekoenig, @​bernie-schelberg-invicara, @​dmitrysulman, @​izeye, @​metters, @​ngocnhan-tran1996, @​nosan, and @​quaff

v3.4.3

Compare Source

⚠️ Noteworthy
⭐ New Features
  • Add TWENTY_FOUR to JavaVersion enum #​44209
🐞 Bug Fixes
  • Console output may be lost when using Log4j2 with something that replaces System.out #​44380
  • Maven plugin does not consistently use ArgFile for classpath argument on Windows #​44328
  • Reactive Jetty web server does not fail fast when configured to use a server name bundle which Jetty does not support #​44319
  • When web server application context refresh fails, the original failure is lost if stopping or destroying the web server throws an exception #​44317
  • View resolver for Thymeleaf should back off if spring-webmvc is not present #​44296
  • WebServer is not destroyed when ReactiveWebServerApplicationContext refresh fails #​44294
  • Non-default DataSource candidates are not considered in H2ConsoleAutoConfiguration #​44293
  • Banner placeholder and defaults do not work during development #​44255
  • Mustache templates return with ISO-8859-1 charset rather than UTF-8 in Content-Type response header [#​44193](https:

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR has been generated by Renovate Bot.

@xdev-renovate xdev-renovate force-pushed the renovate/org.springframework.boot-spring-boot-dependencies-3.x branch from d1c468f to c109679 Compare May 23, 2025 04:15
@xdev-renovate xdev-renovate changed the title Update dependency org.springframework.boot:spring-boot-dependencies to v3.4.5 Update dependency org.springframework.boot:spring-boot-dependencies to v3.5.0 May 23, 2025
@xdev-renovate xdev-renovate force-pushed the renovate/org.springframework.boot-spring-boot-dependencies-3.x branch from c109679 to 8273deb Compare May 26, 2025 04:17
@xdev-renovate xdev-renovate force-pushed the renovate/org.springframework.boot-spring-boot-dependencies-3.x branch 2 times, most recently from 88f52e4 to b755b6d Compare June 20, 2025 04:16
@xdev-renovate xdev-renovate changed the title Update dependency org.springframework.boot:spring-boot-dependencies to v3.5.0 Update dependency org.springframework.boot:spring-boot-dependencies to v3.5.2 Jun 20, 2025
@xdev-renovate xdev-renovate force-pushed the renovate/org.springframework.boot-spring-boot-dependencies-3.x branch from b755b6d to 9a0312e Compare June 21, 2025 04:14
@xdev-renovate xdev-renovate changed the title Update dependency org.springframework.boot:spring-boot-dependencies to v3.5.2 Update dependency org.springframework.boot:spring-boot-dependencies to v3.5.3 Jun 21, 2025
@xdev-renovate xdev-renovate force-pushed the renovate/org.springframework.boot-spring-boot-dependencies-3.x branch from 9a0312e to 0ccc3a9 Compare June 23, 2025 04:23
@xdev-renovate xdev-renovate force-pushed the renovate/org.springframework.boot-spring-boot-dependencies-3.x branch from 0ccc3a9 to 6499c9f Compare June 30, 2025 04:24
@xdev-renovate xdev-renovate force-pushed the renovate/org.springframework.boot-spring-boot-dependencies-3.x branch from 6499c9f to b88b0d5 Compare July 18, 2025 08:15
@JohannesRabauer JohannesRabauer merged commit dd330aa into develop Jul 24, 2025
4 checks passed
@JohannesRabauer JohannesRabauer deleted the renovate/org.springframework.boot-spring-boot-dependencies-3.x branch July 24, 2025 10:03
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@xdev-renovate @JohannesRabauer