Query around release cadence for 4.0.X

[gmcallister-r7]

Hi folks 👋

I'm trying to gather information around the current release cadence for spring boot.
I'll be direct for efficiency... The TLDR here is:

When is the next release?
Why isn't the release scheduled in the calendar?
Will the calendar still be useful going forward?

i know previously it was pretty much guaranteed that the release would be "The Thursday after the 3rd Monday of the month" but given that the may release train slipped, we didn't see a release at the end of June.

I'm a bit concerned because the current 4.0.8 and 4.1.X milestones don't have a due date set on GitHub and the community calendar i usually consult for this has no mention of any spring boot releases going forward.

Is it possible to get some information about the process to aid in planning? i previously scheduled a task for my team based off the old cadence to update spring boot, but haven't been able to do that now since may.

Thanks!
Glenn

[wilkinsona]

Sorry for the inconvenience. Unfortunately, our usually predictable release schedule is still in a state of flux while we adjust to the significant change in the security landscape. The current tentative plan is to ship another round of 4.0.x and 4.1.x releases in early August. When these plans become more definite, we'll set due dates on all the relevant milestones. These dates will then be reflected in the release calendar as usual. Thank you for your patience in the meantime.

[gmcallister-r7]

Thank you for the update @wilkinsona, I can plan overrides for dependency issues in that case in the meantime.

Much appreciated.

[octopus431]

@wilkinsona Please would you able to confirm if there will be another release from 3.5.x stream? I see the support ended in June per https://spring.io/projects/spring-boot#support .

So just wanted to make sure if 3.5.16 is the last release from it or will there be additional releases to back port the security fixes etc in the future?

[bclozel]

@octopus431 that page is up-to-date and future 3.5.x releases will be available to commercial customers only.

[rhanton]

@octopus431 The lack of any more 3.5.x releases was also brought up in https://springofficehours.io/episodes/s5e17-spring-boot-4-1-with-phil-webb where Phil Webb pointed out that 3.5.16 was perhaps not supposed to happen, but we got it as a freebie (b/c technically the overlap from the 4.1.0 release means that the team was supporting 3 minor releases at once rather than the normal 2). I'm excited for 4.x, but agree that major version upgrades is a bug hump to get over / wish we had a bit more runway typically.

[breun]

I understand that the security landscape has changed significantly in these times of AI, and that Spring may need time to adjust to this, but it seems strange to me that the result of this is that there are no patch updates scheduled between June 10 (4.0.7/4.1.0) and August 20 (4.0.8/4.1.1), meaning that the latest Spring Boot releases come with managed versions of Tomcat, Jackson, Netty, etc. with known vulnerabilities for quite some time. If security has such a high priority, wouldn't it have been possible to stick with the release schedule, even if those patch releases would only contain dependency bumps?

I'm glad I noticed the lapse in the release schedule myself, and for now I'm overriding Spring Boot version properties to deal with the vulnerable dependencies, but I feel the whole Spring Boot world is put at risk by not releasing any patch updates for this longer period of time and frankly I don't really understand why the 4.0.8/4.1.1 patch releases were postponed.

[bclozel]

Thank you for flagging this and for the careful attention to security. The entire Spring team is indeed fully focused on reworking our release schedule and infrastructure to adapt to the new security realities we’re facing. Given our limited bandwidth, we had hoped the community could tolerate a short gap in the release train while we finalize these changes, but we’re nearly done, and the new process will help us avoid similar lapses in the future. In the meantime, we appreciate your proactive workaround and will continue to prioritize getting this resolved.

[octopus431]

Hi, Could someone please update the milestone dates for next 4.0.x release? https://github.com/spring-projects/spring-boot/milestones.
Last release was 3 weeks back. It would be great if we could stick to the monthly release schedule which we used to follow for the 3.5.X stream.

[wilkinsona]

It would be great if we could stick to the monthly release schedule

That is our goal too.

Could someone please update the milestone dates for next 4.0.x release

We will do so as soon as we have that information.

[knoobie]

Blog post about the upcoming changes in the release train: https://spring.io/blog/2026/09/21/releasing-spring-for-modern-challenges

Thanks for all your hard work over the last weeks 🙇

[octopus431]

Blog post about the upcoming changes in the release train: https://spring.io/blog/2026/09/21/releasing-spring-for-modern-challenges

Thanks for all your hard work over the last weeks 🙇

Thanks for sharing. So the 4.0.9 release is going to be on October 22 nd?

In an effort to prepare for how our new release trains will work, this month we will be only doing Milestone releases that are part of the work towards our November feature releases. We will begin doing patch releases in our new normal format on October 22nd.