This release includes 3 breaking changes for platform teams planning a safe upgrade.
✓ No known CVEs patched in this version
Topics
+9 more
ReleasePort's take
Moderate signalThe platform upgrade moves to Spring Boot 4.1, Spring AI 2.0, Jackson 3, and JDK HttpClient while removing several deprecated dependencies.
Why it matters: Spring Boot 4.1 introduces new starter APIs; migrating to Resilience4j‑Spring‑Boot4 is required for circuit‑breaker support. Removing OkHttp eliminates a legacy transport dependency.
Summary
AI summaryUpgraded platform to Spring Boot 4.1, Spring AI 2.0, Jackson 3 and JDK HttpClient.
Changes in this release
| Type | Severity | Summary | CVE |
|---|---|---|---|
| Dependency | High |
Upgraded Spring Boot from 3.5 to 4.1 and Spring AI from 1.1 to 2.0, adopting MCP Java SDK 2.0. Upgraded Spring Boot from 3.5 to 4.1 and Spring AI from 1.1 to 2.0, adopting MCP Java SDK 2.0. Source: llm_adapter@2026-06-13 Confidence: high |
— |
| Dependency | High |
Migrated application and XML‑parsing code from Jackson 2 to Jackson 3. Migrated application and XML‑parsing code from Jackson 2 to Jackson 3. Source: llm_adapter@2026-06-13 Confidence: high |
— |
| Dependency | High |
Replaced OkHttp transport with JDK `HttpClient` for Maven Central/OSV access. Replaced OkHttp transport with JDK `HttpClient` for Maven Central/OSV access. Source: llm_adapter@2026-06-13 Confidence: high |
— |
| Dependency | High |
Switched Resilience4j integration from `resilience4j-spring-boot3` to `resilience4j-spring-boot4`. Switched Resilience4j integration from `resilience4j-spring-boot3` to `resilience4j-spring-boot4`. Source: llm_adapter@2026-06-13 Confidence: high |
— |
| Deprecation | Medium |
Removed the `logback.version=1.5.22` override; Boot 4.1 manages Logback natively. Removed the `logback.version=1.5.22` override; Boot 4.1 manages Logback natively. Source: llm_adapter@2026-06-13 Confidence: high |
— |
| Deprecation | Medium |
Removed the `okhttp-jvm` dependency and related configuration. Removed the `okhttp-jvm` dependency and related configuration. Source: llm_adapter@2026-06-13 Confidence: high |
— |
| Deprecation | Medium |
Removed the `maven.central.connection-pool-size` property (OkHttp‑specific). Removed the `maven.central.connection-pool-size` property (OkHttp‑specific). Source: llm_adapter@2026-06-13 Confidence: high |
— |
| Deprecation | Medium |
Deleted custom Jackson 2 mapper (`JacksonConfig`) and datatype modules `jackson-datatype-jdk8` / `jackson-datatype-jsr310`. Deleted custom Jackson 2 mapper (`JacksonConfig`) and datatype modules `jackson-datatype-jdk8` / `jackson-datatype-jsr310`. Source: llm_adapter@2026-06-13 Confidence: high |
— |
| Refactor | Low |
Updated `NativeImageConfiguration` for Spring Framework 7, dropping deprecated `INTROSPECT_*` categories. Updated `NativeImageConfiguration` for Spring Framework 7, dropping deprecated `INTROSPECT_*` categories. Source: llm_adapter@2026-06-13 Confidence: high |
— |
Full changelog
Spring Boot 4 Platform Migration — upgrades the runtime from Spring Boot 3.5 / Spring AI 1.1 to Spring Boot 4.1 / Spring AI 2.0 (MCP Java SDK 2.0), completes the move to Jackson 3, and replaces the OkHttp transport with the JDK HttpClient. The MCP tool surface and every JSON response shape are unchanged — this is a platform refresh, not an API change. SYNC server/client mode, the docker-profile stdio enablement, and stderr-only logging are intentionally retained (MCP SDK issue #686 and stdio JSON-RPC safety still apply).
Changed (3.1.0)
- Spring Boot 4.1.0 / Spring AI 2.0.0: upgraded the platform parent and the Spring AI BOM; Spring AI 2.0 brings MCP Java SDK 2.0. Tool definitions, response models, and both transports (stdio + streamable HTTP) are unchanged.
- Jackson 3: migrated application and XML-parsing code from Jackson 2 (
com.fasterxml.jackson.databind/dataformat) to Jackson 3 (tools.jackson.*). Jackson annotations stay undercom.fasterxml.jackson.annotation(retained by Jackson 3). Boot's auto-configured Jackson 3JsonMappernow serializes tool responses, andOptional/ Java time types are handled natively by Jackson 3 core. - HTTP transport: Maven Central / OSV access now uses the JDK
HttpClientvia Spring'sJdkClientHttpRequestFactory(HTTP/2, normal redirects, connect timeout frommaven.central.timeout, read timeout + 2s). BASIC / BEARER private-repository authentication is preserved through aRestClientrequest interceptor; connection reuse is managed internally by the JDK client and the Resilience4j retry policy is unchanged. - Resilience4j Boot 4 integration:
resilience4j-spring-boot3→resilience4j-spring-boot4; the@CircuitBreaker/@Retry/@RateLimiterAOP support moved fromspring-boot-starter-aoptospring-boot-starter-aspectj. - Native reflection hints: updated
NativeImageConfigurationfor Spring Framework 7 — field categories use theACCESS_*form and the deprecatedINTROSPECT_*member categories are dropped (invocation hints already imply introspection).
Removed (3.1.0)
- Logback native-stdio version pin: the
logback.version=1.5.22override is gone — Boot 4.1's managed Logback keeps native stdio stdout clean (verified by the nativeinitializesmoke test). - OkHttp transport: removed the
okhttp-jvmdependency, theokhttp.versionproperty, and the deprecatedOkHttp3ClientHttpRequestFactory, which is unavailable on Spring Framework 7. maven.central.connection-pool-sizeproperty: an OkHttp-specific idle-pool knob with no JDKHttpClientequivalent; removed fromapplication.yamland the configuration metadata.- Custom Jackson 2 mapper and datatype modules: deleted
JacksonConfigand thejackson-datatype-jdk8/jackson-datatype-jsr310dependencies in favor of Boot's Jackson 3 auto-configuration.
Breaking Changes
- Removed OkHttp transport (okhttp-jvm dependency, OkHttp3ClientHttpRequestFactory).
- Dropped `maven.central.connection-pool-size` property – no equivalent in JDK HttpClient.
- Custom Jackson 2 configuration and jackson-datatype modules are removed; platform now uses Jackson 3 auto‑configuration.
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
About arvindand/maven-tools-mcp
Universal Maven Central dependency intelligence for JVM build tools (Maven, Gradle, SBT, Mill). Features bulk operations, version comparison, stability filtering, dependency age analysis, release patterns, and Context7 integration for upgrade guidance.
Related context
Related tools
Earlier breaking changes
- v3.0.0 Java toolchain upgraded from Java 24 to Java 25 (LTS); builds now require Java 25.
Beta — feedback welcome: [email protected]