Spring Boot 4.0.8 and 4.1.1 Available Now
The Spring team released Spring Boot 4.0.8 and 4.1.1 on the same day, keeping both the 4.0.x and 4.1.x lines current with bug fixes, documentation improvements, and dependency upgrades. Spring Boot 4.0.8 bundles 77 fixed issues, while 4.1.1 — the first patch release on top of June's 4.1.0 — bundles 98.
Neither release introduces new features, which is expected for point releases in Spring's versioning scheme; feature work goes into minor releases like 4.1.0 (gRPC auto-configuration, SSRF mitigation, Kotlin 2.3 support) and 4.2, which was tracking 91% complete as of this release with 165 of 181 planned issues closed. Teams on either the 4.0 or 4.1 line should apply these patches during normal maintenance windows — full details of the individual fixes are in the linked GitHub release notes rather than the announcement post itself.
Spring AI 2.0.1 Fixes Seven CVEs and Adds Agentic Loop Protection
Spring AI 2.0.1, the first maintenance release on top of the 2.0.0 GA line, resolves more than 80 issues and pull requests gathered from teams that moved production applications onto 2.0 in the weeks since its release. Most significantly, the release closes seven CVEs spanning PDF document reading, ONNX model caching, session allocation, file operations, semantic caching, Redis repositories, and tool dispatching — a broad enough spread that any team running Spring AI 2.0 in production should treat this as a priority upgrade rather than routine maintenance.
On the feature side, 2.0.1 adds configurable tool call limits to prevent infinite agentic loops, a practical safeguard for teams building autonomous agents on top of Spring AI's tool-calling abstractions. It also adds OpenAI audio streaming with improved transcription options, Google GenAI tool choice support and image generation, and PDF page range selection for ingesting only part of a document instead of the whole file.
Reliability fixes round out the release: streaming tool-call delta merging, HTTP response leak prevention, and Redis chat memory fixes covering atomic timestamp reservation, proper clearing, and special-character escaping. Vector store integrations for Milvus, OpenSearch, PgVector, and Couchbase also received fixes, and MCP annotation support for GraalVM native images was restored after regressing in 2.0.0.
Teams upgrading should note several breaking changes: Mistral AI model support is deprecated, the Redis auto-configuration module was renamed, OpenAI strict mode now defaults to false, Media builders are now typed, and Couchbase client integration changed. Dependency bumps include Milvus 2.6.21, Pinecone 6.2.0, and Qdrant 1.18.0.
Links & Sources
You May Also Enjoy
