Virtual threads / Project Loom and Spring Boot 4 / Framework 7 migration
Key Questions
What are the key security fixes in Spring Boot 4.0.6 GA?
Spring Boot 4.0.6 GA addresses nine 9.1 CVSS CVEs, including actuator authentication bypass, DevTools RCE, and session hijacks. It also includes patches for Framework 7.0.7/6.2.18 DoS issues and SCG CVE with timeouts.
Does Spring Boot 4.0 support Java 25?
Yes, Spring Boot 4.0 provides first-class support for Java 25 while maintaining Java 17 compatibility. It also supports modular JARs, JSpecify, Servlet 6.1, GraalVM 25+, Jakarta 11, Jackson 3, and HTTP/3 QUIC.
What is the difference between @Bean, @Component, and @Configuration in Spring Boot?
@Configuration classes use full proxying for bean definitions via @Bean methods, suitable for complex configurations. @Component enables component scanning for simpler beans, while @Bean is used within @Configuration for explicit bean definitions.
What issues arise when migrating to Jakarta Persistence 3.2.0?
Jakarta Persistence 3.2.0 introduces breakage in 'like' specification predicates compared to 3.1.0, affecting queries in Spring Boot migrations from 3.5.10 to 4.0.5.
What performance benchmarks are highlighted for Spring Boot 4?
Production performance reaches 1M RPS with Java 26, UUID optimizations, and HTTP/3. Benchmarks include airline/insurance/MCP/Redpanda/OTel scenarios and microservices patterns.
What are common pains in Spring Boot 3 migrations?
Spring Boot 3 broke many expectations, requiring significant adjustments as detailed in brutally honest reviews. Users face challenges adapting to new patterns and dependencies.
What is new in Spring Data 2026 RC?
Spring Data 2026 RC includes Redis/JSONB support and AOT Repositories, enabling ahead-of-time optimization for repositories like UserRepository.
How do UUIDs impact performance in Spring Boot?
UUIDs can hurt performance more than sequential IDs in bulk inserts with MySQL, as shown in benchmarks comparing ID strategies in Spring Boot services.
Boot 4.0.6 GA (fixes 9.1 CVSS CVEs: actuator bypass/DevTools RCE/session hijacks; Java 25, modular JARs/JSpecify/Servlet 6.1/GraalVM 25+/Jakarta 11/Jackson 3/HTTP/3 QUIC); Framework 7.0.7/6.2.18 DoS patches; Spring Data 2026 RC Redis/JSONB/AOT Repos; Spring Shell 4.0.2; Jakarta Persistence 3.2.0 breakage; Micrometer 1.17 RC JDK26/27; SCG CVE/timeouts; prod perf (1M RPS/Java26/UUID/HTTP3); airline/insurance/MCP/Redpanda/OTel benchmarks; microservices patterns; Boot3 pains.