My Release Notes

by Tiny Tools

/spring-projects/spring-boot/v4.0.7
v4.0.7
v4.0.7
View on GitHubView PackagePublished: Jun 10, 2026

Release Notes

:lady_beetle: Bug Fixes

  • MailSender auto-configuration does not enable hostname verification #50746
  • Artemis auto-configuration uses a predictable default location for the embedded broker's data #50744
  • NullPointerException in reactor-netty SniProvider and unmapped SSL bundle with RSocket #50640
  • SSL should not be enabled when a SSL bundle is overridden to an empty string #50634
  • Docker Compose support does not restore thread interrupt flag when catching InterruptedException #50617
  • RabbitProperties enables SSL even when spring.rabbitmq.ssl.bundle is overridden to an empty string #50611
  • NullPointerException in reactor-netty SniProvider when SSL bundle uses client-auth or server truststore without server-name-bundles #50609
  • Test auto-configuration no longer integrates Spring Security with HtmlUnitDriver #50602
  • Layer written outside the output location of '//' exception is thrown when using extract layers in root directory #50509
  • ConfigurationPropertiesReportEndpoint exposes AOP proxy internals #50416
  • Created StackTracePrinter instances have no access to the Environment #50413
  • MappingsEndpoint reports the context's own ID as parentId when a parent exists #50411
  • Buildpack module does not validate long-to-int casts #50409
  • GraphQL WebSocket support does not configure allowed origins #50393
  • Configuration property metadata includes incorrect class references #50375
  • Spring Boot Loader Does Not Support RSA and EC Signed Jars #50297
  • Meter registries are not removed from the global registry when the context is closed #50286
  • Nullable annotations from AbstractErrorController.getErrorAttributes are not aligned with implementation #50265
  • EndpointRequest links matcher unnecessarily matches HTTP methods other than GET #50260
  • Actuator's '/cloudfoundryapplication' endpoint does not work if restrictive CORS configuration is provided using a bean named corsConfigurationSource #50257
  • ThreadPoolTaskScheduleBuilder unnecessarily loses precision when configuring await termination time #50233
  • NimbusJwtDecoder silently accepts unknown values for spring.security.oauth2.resourceserver.jwt.jws-algorithms #50227
  • Apply HTML escaping to timestamp attribute in Whitelabel error page #50215
  • Setting server.servlet.session.cookie.partitioned=true has no effect when using Tomcat #50201

:notebook_with_decorative_cover: Documentation

  • Fix reference to Gradle documentation for module replacement #50646
  • Document SSL reloading with Let's Encrypt #50629
  • Remove the use of Optional from Data Neo4j repository examples #50621
  • Fix typos in documentation #50619
  • Clarify dependency requirement for Bean Validation support #50613
  • Document Java 25 requirement for AOT cache #50484
  • Add links for Java CAS Client Spring Boot Starter #50281
  • Document known testcontainers lifecycle issues #50219
  • Document adding multiple connectors for Jetty #50217
  • Polish InvalidConfigurationPropertyValueException constructor javadoc #50213
  • Fix typo in Spring Security OAuth2 client registration documentation #50198

:hammer: Dependency Upgrades

:heart: Contributors

Thank you to all the contributors who worked on this release:

@Abdlatif-nabgha, @DragonFSKY, @Kapil-chn7, @Kimgyuilli, @SJvaca30, @SebTardif, @ares333, @codingkiddo, @dlwldnjs1009, @henriquejsza, @igormukhin, @johnnypwong, @kwondh5217, @leestana01, @mheath, @mmoayyed, @msridhar, @ngocnhan-tran1996, @nosan, @quaff, @scordio, @vinhhieu21, @won-seoop, and @zxuhan