NextStack
EN 中

spring-boot v4.2.0-M2

pre-release PublishedSep 24, 2026 Sourcespring-projects/spring-boot

spring-boot v4.2.0-M2

:star: New Features

  • Deprecate AppOptics as it has retired #51810
  • Improve classpath entry lookup performance during jar creation and extraction #51787
  • Add spring.kafka.listener.await-async-results-on-stop property #51774
  • Rationalize Kafka configuration outside of KafkaProperties #51769
  • Make the active Observation LongTaskTimer on the auto-configured DefaultMeterObservationHandler opt-in #51762
  • Configure allowed HTTP methods in GraphQL transports #51732
  • Allow to use Mongo JobRepository with any PlatformTransactionManager #51725
  • Resolve property placeholders in constructor binding default values #51661
  • Add auto-configured BaggageTaggingSpanProcessor for OpenTelemetry tag fields #51656
  • Improve the performance of layer index creation #51654
  • Speed up layer lookups when extracting a layered jar #51653
  • Move Tomcat’s servlet-specific properties beneath server.tomcat.servlet #51603
  • Align handling of null and empty values in SPRING_APPLICATION_JSON with YAML processing #51583
  • Remove Dependency Management for Janino #51567
  • Add jarmode tools command to print / export the SBOM #51505
  • Pick up all @TypeExcludeFilters annotations on test classes #51489
  • Make it easier to map MessageSourceProperties onto a user-provided AbstractResourceBasedMessageSource #51484
  • Support multi-segment additional health endpoint paths #51470
  • Honor spring.ldap.* properties in the Embedded LDAP server #51465
  • Add a configuration property for configuring embedded LDAP operation types that require authentication #51461
  • Add TWENTY_SEVEN to JavaVersion enum #51427
  • Automatically filter additional configuration metadata from Spring Boot-built archives #51386
  • Add SSL bundle support to LDAP auto-configuration #51382
  • Align the default for server.tomcat.use-relative-redirects with Tomcat’s default #51173
  • Allow configuring Micrometer Tracing MDC keys #50595
  • Add common OTLP configuration for endpoint, compression and headers #50461
  • Retain probe defaults when configuring other properties on probe health groups #50296
  • Include security error body in WebFlux Cloud Foundry endpoint responses #50256
  • Provide a configuration property to switch from Micrometer to OpenTelemetry semantic conventions #49241
  • Support listener and template specific Kafka Admin properties #38830

:lady_beetle: Bug Fixes

  • spring.http.clients.cookie-handling has no effect when using a reactive client backed by an HttpComponents connector #51767
  • NullPointerException can be thrown when using uber jars due to a race condition in NestedJarFileResources #51746
  • Connection fails when rabbitmq Docker Compose service is configured to use SSL #51668
  • SBOM-related manifest attributes are missing from Maven-packaged wars #51652
  • When server.reactive.session.cookie.same-site is not set, session cookies have no SameSite attribute #51640
  • OAuth2 resource server ignores authorities-claim-delimiter when set on its own #51631
  • developmentOnly and testAndDevelopmentOnly configurations do not specify any attributes causing potential resolution problems #51624
  • In a reactive web application, Cloud Foundry security integration returns a 500 rather than a 503 when the cloud controller URL is unavailable #51615
  • ReactiveOAuth2ResourceServerWebSecurityAutoConfiguration annotated with wrong condition #51588
  • WritableJson.toByteArray() may corrupt supplementary characters #51586
  • Layer temp file is not deleted when layer creation fails #51582
  • Docker Compose integration for RabbitMQ skips credential fallbacks when an environment variable has no value #51579
  • Some assertion messages name the wrong parameter #51575
  • OAuth2ResourceServerProperties.Jwt has a setter that does not match its getter #51566
  • jarmode tools commands print stacktrace instead of an error message #51548
  • Docker Compose ProcessRunner can hang or leave orphan processes #51539
  • NestedByteChannel.read(ByteBuffer) incorrectly returns 0 when buffer could not be filled #51521
  • Customizer null checks in HTTP client builders assert the wrong attribute #51514
  • SSL host config customizations may be lost during Tomcat initialization #51512
  • SQL Server Docker Compose integration may duplicate the JDBC URL’s encrypt parameter #51482
  • SSL host config customizations are lost when reloading SSL bundles #51458
  • OAuth2ClientProperties are not available when a user-defined ClientRegistrationRepository bean is provided #51451
  • LdapHealthIndicator reports UNKNOWN instead of UP when LDAP server doesn’t expose a protocol version #51442
  • JmsHealthIndicator leaks watchdog threads if start fails immediately #51434
  • Honour a wrapper’s unwrap when resolving the root DataSource #51420
  • Source is not closed consistently by all JSON marshal testers #51419
  • File handle in SpringBootJoranConfigurator should be closed #51416
  • Validation of deprecated io.buildpacks.stack.id is too aggressive #51401

:notebook_with_decorative_cover: Documentation

  • Document support for Java 27 #51826
  • Fix broken links from reference documentation to external Javadoc #51821
  • Remove reference to AppOptics in the reference guide as it has retired #51809
  • Fix broken links #51803
  • Update Spring Framework reference links #51772
  • Update testcontainers javadoc links #51766
  • Maven plugin documentation incorrectly references remote restart property #51748
  • Fix documented default of spring.test.database.replace #51729
  • Fix ActiveMQContainer Javadoc link in Testcontainers documentation #51723
  • Correct Jackson 3 Javadoc links #51664
  • Document baggage propagation over gRPC #51657
  • Fix typo in deprecated Pushgateway base-url property metadata #51633
  • Remove references to Spring Data Geode #51565
  • Fix typos in service containers javadoc and reference documentation #51446
  • Document SAML2 back-off in WebFlux security documentation #51436
  • Remove reference to removed SpringBootWebSecurityConfiguration #51414

:hammer: Dependency Upgrades

:heart: Contributors

Thank you to all the contributors who worked on this release:

@2heunxun, @CHISANW, @COBI-98, @DevJunz, @JunggiKim, @MacAlsandair, @SebTardif, @Wanbinyu, @basteez, @dhruv9b, @dlwhdgus0810, @dlwldn30, @fabio-grassi, @henriquejsza, @hjm12223, @htjworld, @icikle, @jjh75607, @kdomo, @msridhar, @ngocnhan-tran1996, @nikita-kibitkin, @noojung, @nosan, @o-shevchenko, @ohchanKyu, @philsttr, @piyushrajyadav, @quaff, @scottfrederick, @seanxuu, @shakuzen, @somiljain2006, @vlsi, @xoruddl, @xxxxxxjun, and @yyuneu

Source spring-projects/spring-boot · v4.2.0-M2 · 2026-09-24 · upstream release

Mirrored verbatim for indexing. All rights belong to the upstream project.

Release notes are published by the upstream project and mirrored here for indexing. All rights belong to their authors.