Spring Boot 3.3 Boosts Performance, Security, and Observability

VMware released Spring Boot 3.3 on May 23, 2024, with significant performance, security, and observability improvements. These include Class Data Sharing (CDS) for faster startup and reduced memory usage, virtual thread support for websockets, enhanced security with JWT authentication auto-configuration, and Software Bill of Materials (SBOM) support for improved supply chain security. The upgrade also features expanded service connection options for Apache ActiveMQ and LDAP, Docker Compose support for Bitnami Container Images, and upgrades to Spring projects and third-party libraries.

The release notes include a complete list of changes and deprecations. The revamped documentation is now searchable. The minor Spring Boot 3.3.1 and 3.3.2 releases followed mid-June and mid-July, respectively.

CDS, a JVM feature that significantly reduces startup time and memory consumption, was integrated in Spring Framework 6.1 in November 2023. Spring Boot follows suit and can now easily create a CDS-friendly layout from the fat JAR with the "tools" jarmode:

java -Djarmode=tools -jar your-application.jar extract

This creates one <your-application>/<your-application>.jar and deposits all libraries as individual JARs into the your-application/lib folder. The application then runs with java -jar your-application/your-application.jar. The following command shows all layers:

java -Djarmode=tools -jar your-application.jar list-layers

The command java -Djarmode=tools -jar your-application.jar help <command> offers more details.

Virtual thread support for websockets further enhances performance. However, virtual threads may not be faster than thread pools in some situations, as a recent case study showed.

Spring Boot automatically configures an instance of the Spring Security JwtAuthenticationConverter or ReactiveJwtAuthenticationConverter classes if one of these properties is set to their respective values: spring.security.oauth2.resourceserver.jwt.authority-prefix, spring.security.oauth2.resourceserver.jwt.principal-claim-name, or spring.security.oauth2.resourceserver.jwt.authorities-claim-name.

Spring Boot removed dependency management for Dropwizard Metrics on which it never directly depended upon. Spring Boot updated to the 1.x version of the Prometheus Client, up from the 0.x of previous releases, and to Micrometer 1.13.

Spring Boot now exposes SBOM with a new actuator endpoint at META-INF/sbom/bom.json or META-INF/sbom/application.cdx.json. The spring-boot-parent-starter POM has additional options for easier SBOM plugin configuration.

The new @BatchTransactionManager annotation makes custom transaction manager configuration in Spring Batch easier. Tomcat, Netty, and Undertow support Server Name Indication (SNI) for SSL. Running mvn spring-boot:run on Windows now also works with many dependencies. And resources like SSL certificates can now be loaded directly from configuration files as Base64-encoded values:

spring:
  ssl:
    bundle:
      pem:
        mybundle:
          keystore:
            certificate: "base64:LS0tLS1CRUdJTi..."
            private-key: "base64:QmFnIEF0dHJpYn..."

Spring Boot 3.3 offers native service connection support for Apache ActiveMQ Classic and Artemis components and for LDAP. Docker Compose support now also includes Bitnami Container Images alongside official images for various technologies, including Cassandra, Elasticsearch, MariaDB, MySQL, MongoDB, Neo4j, PostgreSQL, RabbitMQ, and Redis.

This release upgrades to Flyway 10.10 for automatic database structure migrations. Flyway 10 is more modular than previous versions and moved support for several databases into database-specific modules. Spring Boot now uses Infinispan 15, which has raised its Jakarta EE baseline. That's why standard modules, such as infinispan-core, replaced several of the *-jakarta modules, such as infinispan-core-jakarta.

Other noteworthy additions include new properties for Spring Data JDBC dialect configuration (spring.data.jdbc.dialect), GraphQL websocket keep-alive configuration (spring.graphql.websocket.keep-alive), control over maximum sessions in WebFlux applications (server.reactive.session.max-sessions), and the maximum queue size of the Tomcat web server connector (server.tomcat.threads.max-queue-capacity).

Notable Spring dependency updates include Spring Security 6.3.0, Spring Session 3.3.0, Spring Data 2024.0.0, Spring GraphQL 1.3.0, Spring Integration 6.3.0, and Spring Kafka 3.2.0. Updated third-party libraries are Jackson 2.17, Hibernate 6.5, Liquibase 4.27, Oracle R2DBC 1.2.0, MySQL 8.3, Kafka 3.7, Brave 6.0, Zipkin 3.0, OpenTelemetry 1.37, and Mockito 5.11.

According to the Spring Boot release schedule, VMware plans to launch Spring Boot 3.4 on November 21, 2024, one week after the scheduled release of Spring Framework 6.2.