Spring Boot 4.1.0 Available Now
Spring Boot 4.1.0 shipped as a general-availability release, built on Spring Framework 7 and carrying forward all bug fixes and security patches from Spring Boot 4.0.7. The headline addition is native Spring gRPC support, giving Boot applications auto-configuration for building and consuming gRPC services without hand-wiring channel and server beans — a capability previously left to third-party starters.
On the security side, the release adds InetAddressFilter to the HTTP client stack, providing built-in mitigation against server-side request forgery (SSRF) by letting applications restrict which addresses outbound HTTP clients are allowed to resolve and connect to. This closes a common gap where an application forwards a user-supplied URL to an internal HTTP client without validating that it doesn't point at internal-only infrastructure.
Observability gets an update too, with refreshed OpenTelemetry support across the auto-configured metrics and tracing paths, and Log4j gains file rotation support directly through Boot's logging auto-configuration — previously something teams had to configure manually in log4j2.xml. Jackson configuration properties were also expanded, giving more auto-configured control over JSON serialization behavior without custom ObjectMapper beans.
Spring Boot 4.1.0 requires Java 17 minimum and supports up through Java 26; active support runs through July 31, 2027.
Capstead Brings Governance and Observability to Spring AI
This Week in Spring's July 21 edition surfaced Capstead, an early-stage community project aimed at providing governance and more granular observability for AI capabilities built on top of Spring AI and Spring Boot. Created by developer Satya Anguluri, the project addresses a gap that's become increasingly visible as Spring AI adoption grows: Spring AI itself provides the building blocks for calling models and running agentic workflows, but doesn't natively answer questions like which prompts touched which data, what a chain of tool calls actually did, or how to enforce policy across an application's various AI-driven code paths.
Details on Capstead's architecture remain limited at this early stage, but its positioning — sitting above Spring AI and Spring Boot rather than replacing them — mirrors a pattern showing up across the broader AI ecosystem this year, where governance and observability tooling is increasingly built as a layer on top of existing agent frameworks rather than baked into the frameworks themselves.
The same roundup also pointed to a post from Craig Walls, author of Spring in Action, on implementing persistent chat memory in Spring AI applications — a common requirement once a Spring AI-powered chatbot or agent needs to remember context across sessions rather than just within a single request.
