Spring Framework 7 and Spring Boot 4: API Versioning, Resilience, and Null-Safe Annotations

Broadcom has released Spring Framework 7.0 and Spring Boot 4.0, introducing significant advancements. This new generation features first-class REST API versioning, JSpecify annotations for standardized null safety across the Spring ecosystem, and integrated resilience capabilities like retry mechanisms and concurrency throttling. Spring Boot 4 transitions to Jackson 3 for JSON processing and modularizes its autoconfigure JAR. While maintaining a JDK 17 baseline, Spring Framework 7 supports JDK 25 and adopts Jakarta EE 11 and Kotlin 2.2 as new foundational versions.

The new API versioning feature is now integrated into Spring MVC and Spring WebFlux, supporting various strategies including path, header, query parameter, and media type versioning. Controllers can be configured via ApiVersionStrategy to declare versions directly on mappings, for instance: @GetMapping(url = "/accounts/{id}", version = "1.1"). This feature also includes built-in deprecation handling aligned with RFC 9745. Clients such as RestClient, WebClient, and HTTP interface clients, alongside the new RestTestClient (in 7.0) and WebTestClient, leverage ApiVersionInserter. Both ApiVersionStrategy and ApiVersionInserter are core components of Spring Framework, available for all Spring-based libraries and applications.

Spring Framework 7 has fully transitioned to standardized JSpecify annotations, enhancing null safety across the entire Spring portfolio. The JSpecify initiative, a collaboration between OpenJDK, Broadcom, Google, JetBrains, and Sonar, provides annotations like @Nullable and @NonNull which apply to standard, generic, array, and vararg types. Kotlin 2 natively translates these JSpecify annotations into Kotlin nullability, while IntelliJ IDEA 2025.3 offers comprehensive support, including advanced data-flow analysis. Build-time nullability checks using the NullAway project currently require JDK 21, with potential future support for JDK 17.

Resilience capabilities, previously part of Spring Retry, are now integrated directly into Spring Framework 7. The @Retryable annotation offers declarative retry support, featuring automatic adaptation for reactive methods, exponential back-off, and jitter. Additionally, the @ConcurrencyLimit annotation enables declarative concurrency control, proving especially beneficial when working with Virtual Threads.

A significant breaking change in Jackson 3 is the package relocation from com.fasterxml.jackson to tools.jackson. The new recommended JSON mapper is JsonMapper, replacing ObjectMapper and offering immutability along with format-specific mappers. Default serialization behavior has been updated: MapperFeature.SORT_PROPERTIES_ALPHABETICALLY is now true, and DateTimeFeature.WRITE_DATES_AS_TIMESTAMPS is false, resulting in dates being serialized as ISO-8601 strings. Applications retain the flexibility to use the deprecated Jackson 2, or even run Jackson 2 and 3 concurrently.

Spring Boot 4 introduces modularized auto-configuration. This means that numerous technology-specific modules, such as spring-boot-starter-webmvc and spring-boot-starter-webmvc-test, now replace the previously monolithic spring-boot-autoconfigure and spring-boot-test-autoconfigure JARs. This architectural change effectively reduces the application's overall footprint and prevents IDEs from suggesting irrelevant classes or configuration properties during auto-completion.

While maintaining JDK 17 as the baseline due to its industry consensus, the new releases fully embrace JDK 25 and its latest features. The Jakarta EE baseline has been upgraded from version 9 to 11, incorporating Jakarta Servlet 6.1, Jakarta WebSocket 2.2, Jakarta Validation 3.1, and Jakarta Persistence 3.2. Support for Hibernate ORM 7.1 is also included, noting that it no longer permits reassociation of detached entities with a persistence context. It's important to note that Spring Boot 4 currently lacks support for the Undertow web server, as it is not yet compatible with Jakarta Servlet 6.1.

New HTTP Interface Groups simplify configuring multiple HTTP Interface Clients, allowing them to share a common RestClient instance. Looking ahead, Spring Framework 7.1 (scheduled for November 2026) will deprecate the RestTemplate class, promoting the RestClient interface as its preferred successor, with RestTemplate slated for removal in Spring Framework 8. Enhancements to HTTP Service Clients include the introduction of the HttpServiceProxyRegistry interface, providing an additional layer above HttpServiceProxyFactory, and the capability to configure HTTP clients for service groups using an HttpServiceGroupConfigurer bean method. The HttpStatus class has also been updated to include the latest HTTP status codes.

Further improvements in these releases include: Spring Boot 4's compatibility with Gradle 9; the introduction of multi-factor authentication in Spring Security 7; enhanced Kotlin Serialization via the new spring-boot-kotlin-serialization module and spring-boot-kotlin-serialization-starter; availability of a fluent JmsClient; Spring for Apache Kafka 4.0's new 'Share Consumer' support for Kafka Queues, which distributes records among multiple consumers within a group (contrasting traditional single-consumer partition assignment); task scheduling and execution auto-configurations now support multiple TaskDecorator beans; AntPathMatcher for HTTP request mappings is deprecated in favor of PathPattern; removal of classes, methods, and properties deprecated in Spring Boot 3.x; and the requirement to replace annotations from javax.annotation and javax.inject packages with their jakarta.annotation and jakarta.inject equivalents.

Additional notable enhancements involve application contexts pausing when inactive, optimizing memory usage in extensive test suites. Spring Framework 7 now utilizes the single-file reachability metadata format for GraalVM Native Image, while Spring Data compiles repository queries at build time to accelerate startup. MongoDB health indicators no longer depend on Spring Data MongoDB. A new spring-boot-starter-opentelemetry module provides all necessary dependencies for OTLP metrics and trace export. Furthermore, SSL Health responses now include an expiringChains entry, highlighting certificate chains with one or more certificates nearing their expiration within a configurable management.health.ssl.certificate-validity-warning-threshold.

Key third-party dependency upgrades in this release include Kotlin 2.2.20, Tomcat 11.0, Jetty 12.1, GraphQL 24, Kafka 4.1.0, Elasticsearch Client 9.1, Hibernate Validator 9.0, Commons Lang3 3.19.0, Liquibase 5.0, Flyway 11.11, MongoDB 5.6.0, Mockito 5.20, and TestContainers 2.0.

Several coordinated releases align with Spring Framework 7.0 and Spring Boot 4.0, including Spring Cloud 2025.1.0, Spring for GraphQL 2.0, Spring Shell 4.0.0, Spring REST Docs 4.0, Spring Security 7.0, Spring Data 2025.1.1.0, Spring Session 4.0.0, Spring Integration 7.0, Spring Batch 6.0, Spring AMQP 4.0, Spring for Apache Kafka 4.0, Spring for Apache Pulsar 2.0, Spring Web Services 5.0, Spring Vault 4.0, and Spring Modulith 2.0.

Developers transitioning to the new versions can consult the Spring Boot 4 Migration Guide. Spring Boot 3.5, the final Spring Boot 3 release, will receive free support until June 2026 and paid support until June 2032. Comprehensive details are available in the official release notes for Spring Framework 7 and Spring Boot 4.