English static mirror for SEO/GEO · AI-assisted translation · Read Chinese original
智柴网 中文原文

Spring Boot 4.1.0 Deep Dive: Official gRPC Support, Built-in SSRF Protection, and OpenTelemetry Enhancements

Forum topic · 小凯 · 2026-06-18

Summary

Spring Boot 4.1.0 (released June 2026) is positioned as an incremental patch to 4.0, not an architectural overhaul. It is built on Spring Framework 7.0.8 and Spring Security 7.1, with JDK 17 as the baseline and JDK 21 required for jOOQ 3.20. The release introduces three official gRPC starters (server, client, and servlet HTTP/2), replacing third-party solutions like grpc-spring-boot-starter, with first-class support for @GrpcService, @GrpcClient, and @GrpcExceptionHandler annotations. A new framework-level InetAddressFilter provides SSRF protection, blocking requests to private subnets and cloud metadata addresses before DNS resolution. OpenTelemetry support is expanded with standard environment variable alignment, gzip OTLP metric compression, and automatic assembly of observation conventions for Kafka, RabbitMQ, and JVM metrics. Additional improvements include lazy connection fetching for DataSource, deprecated Apache Derby, enhanced Log4j2 file rotation via YAML, OAuth2 SpEL-based authority extraction, and Spock 2.4 support.

Key points

  • Release baseline: Spring Framework 7.0.8, Spring Security 7.1, JDK 17 baseline, JDK 21 required for jOOQ 3.20. Build on Jakarta EE 11 from 4.0, with no architectural breaking changes.
  • Official gRPC support: Three starters provided (spring-boot-starter-grpc-server, spring-boot-starter-grpc-client), using @GrpcService, @GrpcClient, and @GrpcExceptionHandler annotations. Supports both standalone Netty and Servlet HTTP/2 transports with auto-registered ObservationGrpcServerInterceptor for Micrometer/OpenTelemetry.
  • Framework-level SSRF protection: New InetAddressFilter intercepts requests before DNS resolution (blocking DNS rebinding). Default-deny logic with allow/deny IP subnet lists; applies to both RestClient and WebClient.
  • OpenTelemetry completion: Standard OTEL_* environment variable support, management.opentelemetry.enabled switch, sampling/limits configuration, gzip OTLP metric compression, and automatic observation convention beans for Kafka, RabbitMQ (including Streams), and JVM metrics.
  • Data access changes: New spring.datasource.connection-fetch: lazy mode (proxy initialization deferred to first statement execution). Apache Derby marked @Deprecated; H2 or HSQL recommended. JPA bootstrap-mode behaviors for deferred and lazy modes tightened.
  • Operations improvements: YAML-based Log4j2 file rotation (size/time/cron strategies), Maven layers loaded from classpath (META-INF/spring/layers/<name>.xml), Gradle bootBuildImage --environment CLI flag, Docker Compose auto-logging on failure, Optional binding for @ConfigurationProperties, new @AutoConfigureWebServer test annotation.
  • Security/testing: OAuth2 resource server supports SpEL expressions for JWT authority extraction. Spock 2.4 auto-configuration restored for Groovy 5. @RedisListener auto-registration added.

    • Who should upgrade

  • Upgrade now: Existing 4.0.x projects (incremental cost), teams adopting gRPC, security-sensitive applications, microservices needing faster startup via lazy DataSource.
  • Wait: Projects still on 3.x must complete Jakarta migration first; heavy jOOQ users on JDK 17 must move to JDK 21.

    • Migration checklist (must handle)

  • Replace all 4.0 deprecation warnings
  • Confirm JDK 21+ for jOOQ 3.20
  • Migrate from Derby to H2/HSQL
  • Use -Dmaven.test.skip instead of -DskipTests to skip AOT processing

Tags

#spring-boot#grpc#ssrf-protection#opentelemetry#java#jpa#log4j2#microservices

This page is an English static mirror generated for search and AI citation. It may be a full translation or structured summary of the Chinese original. Canonical interactive discussion lives on the Chinese page: https://zhichai.net/topic/177981475