Skip to content

chore(deps): update dependency org.springframework.boot:spring-boot-starter-actuator to v4 [security] - autoclosed#9

Closed
renovate[bot] wants to merge 1 commit intomainfrom
renovate-main/maven-org.springframework.boot-spring-boot-starter-actuator-vulnerability
Closed

chore(deps): update dependency org.springframework.boot:spring-boot-starter-actuator to v4 [security] - autoclosed#9
renovate[bot] wants to merge 1 commit intomainfrom
renovate-main/maven-org.springframework.boot-spring-boot-starter-actuator-vulnerability

Conversation

@renovate
Copy link
Copy Markdown
Contributor

@renovate renovate bot commented Mar 21, 2026 •
edited
Loading

This PR contains the following updates:

Package Change Age Adoption Passing Confidence
org.springframework.boot:spring-boot-starter-actuator (source) 3.5.10 → 4.0.3 age adoption passing confidence

Warning

Some dependencies could not be looked up. Check the warning logs for more information.

GitHub Vulnerability Alerts

CVE-2026-22731

Spring Boot applications with Actuator can be vulnerable to an "Authentication Bypass" vulnerability when an application endpoint that requires authentication is declared under a specific path, already configured for a Health Group additional path.
This issue affects Spring Boot: from 4.0 before 4.0.3, from 3.5 before 3.5.11, from 3.4 before 3.4.15.
This CVE is similar but not equivalent to CVE-2026-22733, as the conditions for exploit and vulnerable versions are different.

CVE-2026-22733

Spring Boot applications with Actuator can be vulnerable to an "Authentication Bypass" vulnerability when an application endpoint that requires authentication is declared under the path used by the CloudFoundry Actuator endpoints. This issue affects Spring Security: from 4.0.0 through 4.0.3, from 3.5.0 through 3.5.11, from 3.4.0 through 3.4.14, from 3.3.0 through 3.3.17, from 2.7.0 through 2.7.31.

Release Notes

spring-projects/spring-boot (org.springframework.boot:spring-boot-starter-actuator)

v4.0.3

⭐ New Features

  • Add TWENTY_SIX to JavaVersion enum #​49193

🐞 Bug Fixes

  • Jackson properties may not be applied correctly to RestClients #​49223
  • ClassNotFoundException when using Actuator without spring-boot-health #​49196
  • Using the OTel and Zipkin starters together creates invalid configuration #​49183
  • Whitespace can be incorrectly removed when spring-boot-configuration-processor runs on multi-line javadoc #​49060
  • Jackson2HttpMessageConvertersConfiguration uses ConditionOn Jackson3 XMLMapper class #​49015
  • server.jetty.threads.max is ignored when using virtual threads #​48989
  • Slice test includes fail to load when using spring-boot-starter-test-classic #​48981
  • Docker credential helpers with file extensions cannot be executed on Windows #​48979
  • Java version requirement check for native image is confusing if AOT didn't run #​48963
  • TestPropertyValues.Pair.fromMapEntry(Entry<String, String>) does not comply with its nullability contract #​48948

📔 Documentation

  • Couchbase and Kafka are incorrectly listed as supporting SSL with Docker Compose #​49212
  • Document that use of non idiomatic format for '@Value' still apply for environment variables #​49109
  • Document naming convention for custom test-scoped starters #​49017
  • Delay removal of Jackson 2 support until 4.3 at the earliest #​49010
  • LICENSE.txt and NOTICE.txt files have the wrong content in the latest releases #​49003
  • ApplicationContextAssert documents a non-existent assertion in getFailure() #​48977
  • Highlight the importance of the preStop hook when configuring Kubernetes probes #​48946

🔨 Dependency Upgrades

❤️ Contributors

Thank you to all the contributors who worked on this release:

@​GaetanoCerciello, @​dsyer, @​linkian209, @​nosan, @​quaff, @​scordio, and @​srt

v4.0.2

⚠️ Noteworthy Changes

  • The dependency on org.eclipse.jetty.ee11:jetty-ee11-servlets has been removed from spring-boot-jetty as it was unnecessary and unused. If your application code depends on a class from jetty-ee11-servlets, declare a dependency on it in your build configuration. #​48677

🐞 Bug Fixes

  • No TransactionAutoConfiguration with spring-boot-starter-kafka for Spring Boot 4 #​48880
  • Evaluation of bean conditions unnecessarily queries the bean factory for types that are not present #​48840
  • When a bean condition references a type that is not present, it appears as ? in the condition evaluation report #​48838
  • SessionAutoConfiguration creates a DefaultCookieSerializer with a default SameSite of null instead of Lax #​48830
  • Setting graphql schema location to "classpath*:graphql/**/" causes failure due to incorrectly packaged test resource #​48829
  • Message interpolation by MVC and WebFlux's Validators does not work correctly in a native image #​48828
  • CloudFoundry integration fails in Servlet-based web app without a dependency on spring-boot-starter-restclient #​48826
  • RestTestClientAutoConfiguration and TestRestTemplateAutoConfiguration should be package-private #​48820
  • SSL metrics are no longer auto-configured #​48819
  • Actuator /info endpoint fails in Java 25 Native Image (VirtualThreadSchedulerMXBean support) #​48812
  • DataSourceBuilder cannot create oracle.ucp.jdbc.PoolDataSourceImpl in a native image #​48703
  • The spring-boot-cloudfoundry module should only have an optional dependency on spring-boot-security #​48685
  • Application JAR created by extract command is not reproductible #​48678
  • AOT processing of tests should not be disabled when 'skipTests' is set #​48662
  • @SpringBootTest(webEnvironment = WebEnvironment.RANDOM_PORT) is no longer applied to the management server #​48653
  • Fix zero-length byte buffer in InspectedContent #​48650
  • Can no longer override JacksonJsonHttpMessageConverter with ServerHttpMessageConvertersCustomizer #​48635
  • HttpServiceClientProperties incorrectly uses the @ConfigurationProperties annotation on a LinkedHashMap class #​48616
  • spring-boot-micrometer-tracing-opentelemetry fails if spring-boot-opentelemetry isn't there #​48585
  • App fails to start with starter-webmvc and starter-zipkin #​48581
  • Micrometer test modules should have an api dependency on micrometer-observation-test #​48386

📔 Documentation

  • Fix typo in REST client documentation #​48907
  • Remove duplicate word #​48874
  • Document support for configuring arguments passed to Docker Compose #​48806
  • The documentation related to EnvironmentPostProcessor links to deprecated interface #​48803
  • Update documentation for Buildpack's AOT Cache support #​48769
  • Correct docs to use new location for error handling configuration properties #​48767
  • Document spring-boot-starter-cloudfoundry on Cloud Foundry Support Page #​48675
  • Clarify javadoc to make it clear that HazelcastConfigCustomizer beans are only applied if Hazelcast is configured via a config file #​48659
  • Example using excludeDevtools property should document that optional dependencies should be enabled #​48641
  • Fix grammar and typos in the reference guide #​48601
  • Update Tracing section for Spring Boot 4's modularity #​48576

🔨 Dependency Upgrades

❤️ Contributors

Thank you to all the contributors who worked on this release:

@​GaoSSR, @​ShaunHaldane, @​Zuohuang-Cai, @​izeye, @​mspiess, @​ngocnhan-tran1996, and @​philipbolting

v4.0.1

⚠️ Noteworthy Changes

  • Hibernate has been upgraded to 7.2.0.Final in response to Hibernate 7.1 moving to limited support
  • spring-boot-starter-kotlin-serialization has been renamed to to spring-boot-starter-kotlinx-serialization-json and spring-boot-starter-kotlin-serialization-test has been renamed to spring-boot-starter-kotlinx-serialization-json-test. This change aligns the starters' names with those of their respective modules
  • Using TestRestTemplate now requires a dependency on spring-boot-restclient

🐞 Bug Fixes

  • JsonMixinModuleEntriesBeanRegistrationAotProcessor does not handle deprecated code #​48564
  • JdbcSessionAutoConfiguration may not match when using the auto-configured DataSource #​48552
  • @ServiceConnection for LgtmStackContainer fails when logging endpoint is configured due to multiple OtlpLoggingConnectionDetails beans #​48536
  • WebApplicationType does not consider modules when deduced from classpath #​48517
  • Spring Session auto-configuration fails in a war deployment as ServerProperties is not available #​48493
  • Opentelemetry logging export requires actuator module #​48488
  • RabbitHealthIndicator reports an error when version is missing from the connection's server properties #​48487
  • Actuator Info class has inconsistent nullability annotations and cannot be built with null value #​48480
  • Profiles retained during AOT processing are not configured in a native image #​48476
  • Security matchers and WebServerNamespace resolution can fail with NoClassDefFoundError when used in a traditional WAR deployment #​48388
  • HealthEndpointGroupMembershipValidator does not consider reactive health indicators causing NoSuchHealthContributorException to be thrown #​48387
  • spring.jackson.default-property-inclusion is not applied to content inclusion #​48343
  • TestRestTemplate.getRootUri() returns empty string #​48330
  • Redis health check reports an error when redis_version is missing from the INFO response #​48328
  • Parent's MeterRegistry beans are closed when child context closes #​48325
  • HttpMessageConverters picks up converter beans for both client and server #​48310
  • Conditions to auto-configure a RestClient are outdated with the modularization #​48308
  • A custom JwtTypeValidator that replaces the default can no longer be configured #​48301
  • PropertiesRestClientHttpServiceGroupConfigurer has highest precedence, preventing other configurers from being ordered ahead of it #​48296
  • SpringBootTest.UseMainMethod.WHEN_AVAILABLE and ALWAYS are incompatible with package-private or parameter-less main method #​48275
  • Conditions to auto-configure RestClient-based HTTP service clients are outdated with the modularization #​48274
  • Starter for Kotlinx Serialization Json is misnamed #​48262
  • ApplicationServletEnvironment is no longer configured in war deployments #​48254
  • RestClient.Builder bean present in @SpringBootTest due to spring-boot-starter-webmvc-test, but missing at runtime without restclient starter #​48253
  • ProblemDetail is rendered to XML incorrectly #​48222

📔 Documentation

  • Harmonize Kotlin example for HTTP Service client support #​48577
  • Document HttpMessageConverters detection changes in 4.0.1 #​48574
  • Improve javadoc for when to use class names rather than class references #​48569
  • Documentation has an outdated reference to the Jackson Kotlin Module #​48534
  • Caching documentation should clarify how to use a no-op implementation to run a test suite #​48532
  • Document that the default rolling policy for Log4j2 requires logging.file.path to be set #​48527
  • Review documentation and migration guide about changes in @AutoConfigureCache #​48522
  • License header in build samples is displayed in the reference documentation #​48478
  • Configuring Two DataSources How-To code sample is inconsistent #​48449
  • Fix links to source files on GitHub #​48398
  • Documentation contains broken links to GitHub source files #​48394
  • Document that org.aspectj.weaver.Advice must be on the classpath to enable support for Micrometer's annotations #​48360
  • Correct the annotation in the Kotlin @ConfigurationPropertiesSource example #​48357
  • Polish TestRestTemplate examples in the reference guide #​48336
  • Documentation missing for LocalTestWebServer #​48333
  • Update "Creating Your Own Starter" following modularisation #​48317
  • Fix links to javadoc in the reference documentation #​48300
  • Update references for RestTemplateCustomizer and RestTemplateBuilder classes in documentation #​48295
  • Remove modules section of the README following modularisation #​48291
  • Wrong number in Graceful Shutdown chapter #​48284
  • Mention new spring-boot-h2console module when describing how to use H2 Console #​48278
  • Clarify that @EnableBatchProcessing turns off all batch auto-configuration, including schema initialization #​48266
  • Documented replacements for spring.jackson.generator and spring.jackson.parser are inverted #​48255
  • Document the need for a JdbcDialect bean when using Spring Data JDBC and AOT #​48240
  • Update reference documentation as Spring Batch's resourceless infrastructure means that it no longer always requires a DataSource #​48233
  • Kotlin auto-configuration examples are not annotated with @AutoConfiguration #​48228
  • Revise "Use Liquibase for test-only migrations" section in reference manual #​48219
  • Infinispan Cache Documentation is outdated #​48218
  • Removed max-attempts properties metadata don't have replacement #​48206
  • Polish documentation on testing web applications and the various testing clients that are available #​47948

🔨 Dependency Upgrades

❤️ Contributors

Thank you to all the contributors who worked on this release:

@​Nhahan, @​arey, @​banseok1216, @​berry120, @​candrews, @​dmitrysulman, @​geopark021, @​hktechn0, @​igslznev, @​jwalter, @​kzander91, @​michaldo, @​mzeijen, @​ngocnhan-tran1996, @​noojung, @​scottfrederick, @​vpavic, and @​youngledo

v4.0.0

Full release notes for Spring Boot 4.0 are available on the wiki. There is also a migration guide to help you upgrade from Spring Boot 3.5.

⭐ New Features

  • Change tomcat and jetty runtime modules to starters #​48175
  • Rename spring-boot-kotlin-serialization to align with the name of the Kotlinx module that it pulls in #​48076

🐞 Bug Fixes

  • Error properties are a general web concern and should not be located beneath server.* #​48201
  • With both Jackson 2 and 3 on the classpath, @JsonTest fails due to duplicate jacksonTesterFactoryBean #​48198
  • Gradle war task does not exclude starter POMs from lib-provided #​48197
  • spring.test.webclient.mockrestserviceserver.enabled is not aligned with its module's name #​48193
  • SslMeterBinder doesn't register metrics for dynamically added bundles if no bundles exist at bind time #​48182
  • Properties bound in the child management context ignore the parent's environment prefix #​48177
  • ssl.chain.expiry metrics doesn't update for dynamically registered SSL bundles #​48171
  • Starter for spring-boot-micrometer-metrics is missing #​48161
  • Elasticsearch client's sniffer functionality should not be enabled by default #​48155
  • spring-boot-starter-elasticsearch should depend on elasticsearch-java #​48141
  • Auto-configuration exclusions are checked using a different class loader to the one that loads auto-configuration classes #​48132
  • New arm64 macbooks fail to bootBuildImage due to incorrect platform image #​48128
  • Properties for configuring an isolated JsonMapper or ObjectMapper are incorrectly named #​48116
  • Buildpack fails with recent Docker installs due to hardcoded version in URL #​48103
  • Image building may fail when specifying a platform if an image has already been built with a different platform #​48099
  • Default values of Kotlinx Serialization JSON configuration properties are not documented #​48097
  • Custom XML converters should override defaults in HttpMessageConverters #​48096
  • Kotlin serialization is used too aggressively when other JSON libraries are available #​48070
  • PortInUseException incorrectly thrown on failure to bind port due to Netty IP misconfiguration #​48059
  • Auto-configured JCacheMetrics cannot be customized #​48057
  • WebSecurityCustomizer beans are excluded by WebMvcTest #​48055
  • Deprecated EnvironmentPostProcessor does not resolve arguments #​48047
  • RetryPolicySettings should refer to maxRetries, not maxAttempts #​48023
  • Devtools Restarter does not work with a parameterless main method #​47996
  • Dependency management for Kafka should not manage Scala 2.12 libraries #​47991
  • spring-boot-mail should depend on jakarta.mail:jakarta.mail-api and org.eclipse.angus:angus-mail instead of org.eclipse.angus:jakarta.mail #​47983
  • spring-boot-starter-data-mongodb-reactive has dependency on reactor-test #​47982
  • Support for ReactiveElasticsearchClient is in the wrong module #​47848

📔 Documentation

  • Removed property spring.test.webclient.register-rest-template is still documented #​48199
  • Mention support for detecting AWS ECS in "Deploying to the Cloud" #​48170
  • Revise AWS section of "Deploying to the Cloud" in reference manual #​48163
  • Fix typo in PortInUseException Javadoc #​48134
  • Correct section about required setters in "Type-safe Configuration Properties" #​48131
  • Use since attribute in configuration properties deprecation consistently #​48122
  • Document EndpointJsonMapper and management.endpoints.jackson.isolated-json-mapper #​48115
  • Document support for configuring servlet context init parameters using properties #​48112
  • Some configuration properties are not documented in the appendix #​48095
  • Clarify how warnings about soon-to-expire SSL certificates are reported #​48063
  • Document how to use ContextPropagatingTaskDecorator for propagating trace context over thread boundaries #​48053
  • Document the level of support for the OpenTelemetry APIs #​47960
  • Document that you need to build with Java 25 for buildpack build-image Graal support #​45501

🔨 Dependency Upgrades

❤️ Contributors

Thank you to all the contributors who worked on this release:

@​K-jun98, @​TerryTaoYY, @​filiphr, @​hojooo, @​linw-bai, @​nosan, @​scottfrederick, @​stevearmstrong-dev, @​stewue, and @​vpavic

v3.5.12

v3.5.11

🐞 Bug Fixes

  • Whitespace can be incorrectly removed when spring-boot-configuration-processor runs on multi-line javadoc #​49039
  • server.jetty.threads.max is ignored when using virtual threads #​48982
  • Docker credential helpers with file extensions cannot be executed on Windows #​48965

📔 Documentation

  • Couchbase and Kafka are incorrectly listed as supporting SSL with Docker Compose #​49211
  • Document that use of non idiomatic format for '@Value' still apply for environment variables #​49054
  • Document naming convention for custom test-scoped starters #​49014
  • LICENSE.txt and NOTICE.txt files have the wrong content in the latest releases #​48996
  • ApplicationContextAssert documents a non-existent assertion in getFailure() #​48973
  • Highlight the importance of the preStop hook when configuring Kubernetes probes #​48936

🔨 Dependency Upgrades

❤️ Contributors

Thank you to all the contributors who worked on this release:

@​dsyer, @​linkian209, @​nosan, @​quaff, @​scordio, and @​srt

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate renovate bot requested a review from lis0x90 as a code owner March 21, 2026 00:52
@renovate renovate bot changed the title chore(deps): update dependency org.springframework.boot:spring-boot-starter-actuator to v4 [security] chore(deps): update dependency org.springframework.boot:spring-boot-starter-actuator to v4 [security] - autoclosed Mar 23, 2026
@renovate renovate bot closed this Mar 23, 2026
@renovate renovate bot deleted the renovate-main/maven-org.springframework.boot-spring-boot-starter-actuator-vulnerability branch March 23, 2026 11:54
@github-actions github-actions bot locked and limited conversation to collaborators Mar 23, 2026
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.

Reviewers

@lis0x90 lis0x90 Awaiting requested review from lis0x90 lis0x90 is a code owner

Assignees

@lis0x90 lis0x90

Labels

branch:main renovate:core security

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@lis0x90