Spring Boot 4.1 Arrives With gRPC, Security and Observability Improvements

Spring Boot 4.1 brings gRPC support, SSRF protection, improved observability, Log4j file rotation and updates across the Spring ecosystem.

The Spring ecosystem continues to evolve with the release of Spring Boot 4.1, bringing improvements across HTTP communication, security, observability, logging and integration.

The release is also part of a wider Spring 2026 release train, with updates to projects including Spring Data, Spring Security, Spring Kafka, Spring Integration, Spring AI and Spring AMQP.

For developers building Java and Spring-based applications, several of these changes are particularly interesting.

Spring Boot 4.1

The headline release is Spring Boot 4.1.0.

One of the notable additions is support for gRPC, making it easier to build and test gRPC client and server applications. Developers can use standalone Netty-based servers or Servlet integration to expose gRPC services over HTTP/2.

For example, a Spring application can expose a service that looks conceptually like this:

@GrpcService

public class UserService extends UserServiceGrpc.UserServiceImplBase {

    @Override

    public void getUser(

            GetUserRequest request,

            StreamObserver<GetUserResponse> responseObserver) {

         GetUserResponse response = GetUserResponse.newBuilder()

                .setName("John Doe")

                .build();

         responseObserver.onNext(response);

        responseObserver.onCompleted();

    }

}

This makes Spring Boot more convenient for applications that need high-performance service-to-service communication.

Better Protection Against SSRF

Spring Boot 4.1 also introduces improvements for protecting applications against Server-Side Request Forgery (SSRF).

Both reactive and blocking HTTP clients can be configured with an InetAddressFilter.

This is useful when an application accepts URLs or communicates with external services and needs to prevent requests to restricted addresses.

For example, an application could prevent an HTTP client from accessing internal network addresses that should not be reachable from user-controlled requests.

This is particularly relevant for APIs, webhooks, URL fetchers and integrations with third-party services.

Observability Gets Better

Observability is another important area of the release.

Spring Boot 4.1 improves context propagation when using @Async, making it easier to retain contextual information when work moves to another thread.

The release also includes improvements around OpenTelemetry and SSL bundle support for OTLP.

For production applications, this can make tracing and diagnosing distributed systems easier.

Consider a simple asynchronous operation:

@Async

public void processOrder() {

    // Process order asynchronously

}

In a distributed application, being able to maintain the relevant tracing context across asynchronous operations can make it much easier to follow a request from one service to another.

Log4j File Rotation

Spring Boot 4.1 adds configurable file rotation support for Log4j.

Four rotation strategies are supported:

• Size-based
• Time-based
• Size-and-time based
• Cron-based

This is useful for applications that generate large amounts of log data.

Instead of allowing a single log file to grow indefinitely, applications can automatically rotate their logs based on configured conditions.

Other Spring Projects Updated

Spring Boot is only one part of the release train. Several other Spring projects have also received major updates.

Spring Data 2026.0

Spring Data introduces type-safe property paths, reducing the need to refer to entity properties using plain strings.

Spring Data JDBC and R2DBC also gain support for single-statement upserts when the identifier is already known.

MongoDB users get a multi-collection bulk write API, while Redis receives annotation-driven Pub/Sub listener endpoints.

Spring Security 7.1

Spring Security 7.1 introduces several security-related improvements.

One addition is InetAddressMatcher, which provides IP address matching capabilities.

The release also adds RestClientOpaqueTokenIntrospector for OAuth 2.0 opaque token introspection using Spring's RestClient.

WebAuthn authentication flows can now publish authentication events, making it easier for applications to react to authentication activity.

Spring Kafka 4.1

Kafka developers get more control over message acknowledgement.

The @KafkaListener annotation now supports an ackMode attribute, allowing individual listeners to override the default acknowledgement configuration.

For example:

@KafkaListener(

    topics = "orders",

    ackMode = "MANUAL"

)

public void processOrder(

        String message,

        Acknowledgment acknowledgment) {

     // Process message

     acknowledgment.acknowledge();

}

Spring Kafka 4.1 also improves error handling and asynchronous commits and adds native dead-letter queue support for Kafka Streams.

Spring Integration 7.1

Spring Integration adds support for CloudEvents and gRPC.

The new spring-integration-cloudevents module provides support for the CloudEvents specification, while spring-integration-grpc brings gRPC integration to the project.

The release also moves HTTP integration toward Spring's RestClient, with previous RestTemplate configuration being deprecated.

Spring AI 2.0

One of the more interesting releases in the ecosystem is Spring AI 2.0.

Spring AI 2.0 moves to Spring Boot 4.0 as its baseline and introduces several improvements for building AI-powered applications.

It includes improved support for:

• Tool calling
• AI agents
• Structured outputs
• Model Context Protocol (MCP)
• OpenTelemetry and tracing
• OAuth 2.0 security

The MCP support is particularly interesting for developers building applications that need AI models to interact with tools and external services.

Spring AI 2.0 introduces annotations such as:

@McpTool

public String getCustomer(String id) {

    return customerService.findById(id);

}

This provides a Spring-style programming model for exposing application functionality to AI systems.

What Does This Mean for Developers?

Spring Boot 4.1 is not simply about adding another version number to the Spring ecosystem.

The release shows several important directions for modern Java development:

Microservices: gRPC makes service-to-service communication easier.

Security: SSRF protection and Spring Security improvements address common application security concerns.

Observability: Better context propagation and OpenTelemetry integration help developers monitor distributed applications.

Cloud-native development: CloudEvents, Kafka improvements and modern HTTP clients continue to strengthen Spring's integration capabilities.

AI applications: Spring AI is becoming a significant part of the Spring ecosystem as Java developers increasingly build applications that interact with AI models and tools.

Should You Upgrade?

Developers should not upgrade a production application simply because a new version has been released.

Before upgrading, check compatibility with your existing Spring dependencies, Java version, database drivers, third-party libraries and deployment environment.

For new projects, however, Spring Boot 4.1 provides an interesting foundation, particularly for applications requiring modern communication protocols, observability, security and AI integration.

The biggest takeaway is that the Spring ecosystem is moving beyond traditional web application development. Modern Spring applications are increasingly being designed around microservices, event-driven architectures, observability, secure APIs and AI-powered capabilities.

For Java developers, Spring Boot 4.1 is another step in that direction.