What Spring Boot 4.1 Changes for Enterprise Java Teams
Spring Boot 4.1 is an incremental but important release that adds gRPC auto-configuration, HTTP-client SSRF mitigation, Kotlin 2.3 support and performance-focused tweaks, helping enterprise Java teams modernize microservices communication and security without rewriting their existing applications. Released on June 10, 2026, Spring Boot 4.1 builds on the 4.0 generational reset that introduced a Jakarta EE 11 baseline, Jackson 3 and split auto-configured JARs. Broadcom moved the planned May window twice, eventually shipping during the June 8–12 period, marking the first delay since Spring Boot adopted a twice-yearly cadence in 2020. While the JDK 17 baseline remains, one feature, jOOQ 3.20, now requires Java 21. The release also improves OpenTelemetry integration, Micrometer context propagation and database startup behavior, positioning Spring Boot 4.1 as a refinement cycle aimed at production hardening rather than a disruptive platform shift.
gRPC Auto-Configuration: From DIY Wiring to First-Class Support
Spring Boot 4.1’s gRPC auto-configuration removes much of the boilerplate that previously made HTTP/2-based RPC adoption harder in Spring microservices. Server and client applications now gain ready-made configuration for Spring gRPC with support for both standalone Netty and Servlet HTTP/2 transports, so teams can align gRPC transport choices with existing infrastructure. The framework introduces @GrpcAdvice for centralized exception handling, mirroring the familiar @ControllerAdvice model from Spring MVC. It also auto-configures an ObservationGrpcServerInterceptor, allowing custom observation conventions for metrics and tracing without low-level wiring. Before this release, many teams either wrote custom configuration or depended on third-party starters to integrate gRPC. Now, gRPC auto-configuration is part of the core Spring Boot experience, making it easier to standardize on a single framework for REST, gRPC and observability across large application portfolios.
SSRF Mitigation and Safer HTTP Clients by Default
The new HTTP-client SSRF mitigation in Spring Boot 4.1 targets server-side request forgery, an increasingly common attack on cloud-hosted microservices. The release introduces an InetAddressFilter that can block outbound requests from both reactive and blocking HTTP clients to configured address ranges. Teams can apply either whitelisting or blacklisting strategies, reducing the chance that a vulnerable component becomes a proxy into internal networks or metadata services. This feature complements broader security improvements across the Spring ecosystem, including updates in Spring Security 7.1 and Spring Session 4.1, which align with the Spring Boot 4.1 baseline. For security-conscious enterprises, SSRF mitigation security controls are now part of the platform rather than an add-on library, making it easier to enforce consistent policies across services and avoid one-off custom filters that are hard to audit and maintain.
Kotlin 2.3 Support, Lazy Datasource Connections and Async Context
Spring Boot 4.1 moves its Kotlin baseline from 2.2 to Kotlin 2.3, aligning with Spring Data 2026.0.0’s support for Kotlin 2.3.20 and improving language interoperability for mixed Java–Kotlin codebases. Kotlin 2.3 adds support for Java 25 and introduces an experimental unused return value checker, which can help teams catch logic bugs earlier. On the runtime side, setting spring.datasource.connection-fetch=lazy wraps the connection pool in a LazyConnectionDataSourceProxy so the physical database connection is opened only when a SQL statement executes, easing startup and reducing pressure on database resources. @Async methods now propagate Micrometer context across threads, so trace IDs and spans follow work into thread pools without extra configuration. Combined with improved OpenTelemetry support, including an on/off management.opentelemetry.enabled flag and OTLP exemplars, these changes make Spring Boot 4.1 more observability-friendly for modern, asynchronous, polyglot services.
Part of a Wider Spring Ecosystem Refresh
The Spring Boot 4.1 release lands amid a broader wave of ecosystem updates that keep the Spring stack aligned for enterprise adoption. Spring Security 7.1.0 introduces enhancements such as the InetAddressMatcher functional interface and a new anyOf method in AllRequiredFactorsAuthorizationManager for more flexible multi-factor authorization logic. Spring Session 4.1.0 updates its dependencies to the Spring Boot 4.1.0 baseline, while Spring Integration 7.1.0 refines cross-origin handling and message processor constructors. Spring Modulith 2.1.0 adds features like Namastack outbox support, JobRunr integration and a @ModuleSlicing annotation for better modular testing. In parallel, Spring AI 2.0.0 and Spring Data 2026.0.0 ship with their own upgrades, including new Google GenAI model handling and compatibility with Kotlin 2.3.20. Together, these releases show a coordinated push to modern protocols, stronger security and better modular design across the Spring ecosystem.
