Spring Boot Versioning and Alternatives to spring-boot-parent for Security Patches

Products

• VMware Tanzu Spring Runtime

Issue/Introduction

Customers may ask if there is a consolidated Bill of Materials (BOM) like a "spring-boot" version or a spring-boot-parent (such as v3.5.14.1) that pulls in all required security patches for dependencies like spring-boot-actuator. The goal is to only have to update the spring-boot-parent version to incorporate all necessary security fixes.

Cause

The artifact spring-boot-parent is no longer in use. This confusion is often compounded by how Spring Boot manages dependency versions, especially during hotfix releases

Resolution

The artifacts that manage Spring Boot dependency versions are spring-boot-starter-parent and spring-boot-dependencies. Users should look for the security patch versions of these artifacts which should already be available.

Spring Boot is designed to manage the versions of many other Spring projects, automatically incorporating the latest versions before each Boot release. 

 

Additional Information

You can discover all libraries managed by Spring Boot via external dependency repository sites. For example: https://mvnrepository.com/artifact/org.springframework.boot/spring-boot-dependencies/4.0.6/dependencies