Spring Boot 2.7 has upgraded to H2 2.1.120. H2 2.x is backwards incompatible and fixes a number of security vulnerabilities. See the H2 changelog and migration guide for details of the changes and how to handle the upgrade.

As OkHttp 3 is no longer being maintained, Spring Boot 2.7 has upgraded to OkHTTP 4. As part of this upgrade, the property used to control OkHttp’s version has changed from okhttp3.version to okhttp.version.

OkHttp 4 is intended to be backwards compatible with OkHttp 3. If this is not the case in your application or wish to continue using OkHttp 3 for another reason, configure the okttp.version property in your build.

Separate dependency management for netty-tcnative has been removed in favor of the dependency management provided by Netty’s bom. This ensures that the version of netty-tcnative will align with the version that Netty uses by default. As a result of this change, the netty-tcnative.version property can no longer be used to override the version of netty-tcnative. The version can still be overridden by providing your own dependency management but it is recommended that it remains aligned with Netty’s default version.

None.

If you are using opaque token introspection in your OAuth2 resource server, the auto-configured introspector no longer requires a dependency on com.nimbusds:oauth2-oidc-sdk. Depending on other usages of the SDK, you may be able to remove the dependency from your application.

A new @DataCouchbaseTest annotation for testing applications that use Spring Data Couchbase has been introduced. See the updated reference documentation for details.

A new @DataElasticsearchTest annotation for testing applications that use Spring Data Elasticsearch has been introduced. See the updated reference documentation for details.

If you have created your own test-slices, you should move the registration from spring.factories to the new place under META-INF/spring/<name of your test slice annotation>.imports. The format is the same as the new file described in the "Auto-configuration Registration" section, see above.

See the included test slices for an example.

FailureAnalyzer implementations can now get access to the BeanFactory and Environment of the current application context by providing a constructor that takes one or both of these values as a parameter. Support for injecting the BeanFactory by implementing BeanFactoryAware and injecting the Environment by implementing EnvironmentAware in a FailureAnalyzer is deprecated and will be removed in a future release.

Support for specifying a username for authenticating to Sentinel(s) has been added using the spring.redis.sentinel.username property.

Spring Boot 2.7.0-M2 moves to new versions of several Spring projects:

• Micrometer 1.9.0-M3

• Spring Data 2021.2.0-M3

• Spring HATEOAS 1.5.0-M2

• Spring LDAP 2.4.0-M2

• Spring Security 5.7.0-M2

Numerous third-party dependencies have also been updated, some of the more noteworthy of which are the following:

• Elasticsearch 7.17

• Flyway 8.5

• H2 2.1

• Json 2.9

• Json Path 2.7

• Kafka 3.1

• MariaDB 3.0

• MongoDB 4.5

• OkHTTP 4.9

• REST Assured 4.5

Apart from the changes listed above, there have also been lots of minor tweaks and improvements including:

• The InputStream returned by RandomAccessDataFile in spring-boot-loader now implements available().

• Spring Kafka’s immediateStop is configurable using the spring.kafka.listener.immediate-stop property.