Spring Boot 4.1 Lands With gRPC Auto-Configuration, HTTP-Client SSRF Mitigation, and Kotlin 2.3 Support
The June 10 release adds gRPC server and client support, an InetAddressFilter to block SSRF, and a Kotlin 2.3.21 baseline.
Overview
Spring Boot 4.1.0 has been released and is available from Maven Central, according to the Spring team’s release announcement dated June 10, 2026. The update to the most widely used Java application framework adds first-class gRPC auto-configuration, a new defense against server-side request forgery in its HTTP clients, and an upgraded Kotlin baseline. The Spring team describes the release as including “a number of improvements, new features and dependency upgrades,” noting that it “also includes all of the bug fixes, documentation improvements and security fixes from Spring Boot 4.0.7,” per the release announcement.
What We Know
gRPC moves into the core
The headline addition is built-in support for gRPC, the high-performance remote procedure call framework commonly used for service-to-service communication in microservice architectures. Spring Boot 4.1 includes Spring gRPC auto-configuration for both server and client applications, supporting standalone Netty and Servlet HTTP/2 transports, as reported by InfoQ. The framework documentation describes support for “writing and testing gRPC server and client applications,” where developers “can write both stand-alone servers (backed by Netty) or use Servlet integration and expose gRPC over HTTP/2,” according to the Spring Boot 4.1 release notes.
The gRPC integration also adds @GrpcAdvice for centralized exception handling and an auto-configured ObservationGrpcServerInterceptor that supports custom server-side observation conventions for metrics and tracing, InfoQ reported. The underlying support ships via Spring gRPC 1.1.0, one of the dependency upgrades listed in the release notes.
A built-in guard against SSRF
Spring Boot 4.1 introduces HTTP client mitigation for server-side request forgery (SSRF), a vulnerability class in which an attacker tricks a server into making outbound requests to unintended internal addresses. Both reactive and blocking HTTP clients can now be configured with an InetAddressFilter which can block outgoing requests to specific addresses, according to the release notes. The filter blocks outbound requests from reactive and blocking clients to configured address ranges through whitelisting or blacklisting, as reported by InfoQ.
Kotlin 2.3 baseline
The release moves its Kotlin baseline to version 2.3, which supports Java 25 and includes an experimental unused return value checker, per InfoQ. The specific dependency version shipped is Kotlin 2.3.21, listed among the upgrades in the release notes.
Database, async, and observability changes
Several smaller changes target performance and operability. Setting spring.datasource.connection-fetch=lazy wraps the pooled DataSource in a LazyConnectionDataSourceProxy, so that, in the release notes’ words, “a physical connection is taken from the pool only when a JDBC statement is actually needed,” according to the release notes.
The release also improves distributed tracing for asynchronous code: context can be automatically propagated to methods running on a separate thread using @Async, per the release notes. InfoQ noted that trace IDs and spans follow the work into thread-pool tasks without extra wiring. On the observability side, the new property management.opentelemetry.enabled can be used to disable the OpenTelemetry SDK, according to the release notes. The Spring announcement also lists “File Rotation Support for Log4j” among the new capabilities, per the release announcement.
Dependency baseline
Spring Boot 4.1 builds on Spring Framework 7.0.8 and Spring Security 7.1.0, the release notes state. InfoQ reported that the release maintains a Java 17 baseline and builds on the Spring Framework 7.0.x foundation.
What We Don’t Know
The Spring announcement references upgrade instructions and deprecation details in the release notes wiki but does not detail a support or end-of-life timeline for the 4.1 line in the release announcement itself. Adoption metrics for the new gRPC and SSRF features are not yet available, as the release shipped this month.
Analysis
The two marquee additions reflect where backend Java development has been heading. gRPC has long been a fixture of cloud-native, polyglot service meshes, but Spring developers previously leaned on community libraries to wire it in; folding auto-configuration into the framework lowers that barrier. The SSRF mitigation, meanwhile, addresses a vulnerability class that has featured prominently in cloud security incidents, embedding a guardrail directly into the HTTP clients that Spring applications use to call other services.