Everything in this guide was tested on Spring Boot 4.0.0, Spring Framework 7.0.0, Spring Security 7.0.0, and Java 21.0.3 (Eclipse Temurin). Behaviour details may differ on milestone or RC builds of Boot 4 — check the release notes if you are running a pre-GA version.
TL;DR
- Spring Boot 4 requires Java 21 minimum — Java 17 is no longer supported.
- All APIs deprecated in Boot 3.x are removed in Boot 4. There are no grace periods.
- Virtual threads are enabled by default; this changes how you reason about concurrency bugs.
- Spring Security’s
HttpSecuritylambda DSL is now the only supported approach — method chaining is gone. - Auto-configuration loading moves from
spring.factoriestoAutoConfiguration.imports— third-party starters will break silently if not updated. - The Observation API (Micrometer) replaces the legacy metrics and tracing wiring — expect startup failures if your custom metrics code isn’t updated.