Spring Boot 4.1 Managed Dependency Versions and BOM

Spring Boot’s dependency management system removes the burden of choosing compatible library versions for your project. By inheriting from spring-boot-starter-parent (or importing the spring-boot-dependencies BOM), you get a curated set of dependency versions that have been tested together — covering everything from the Spring Framework itself to Jackson, Hibernate, Kafka, and hundreds of other libraries. You only need to declare a dependency’s group ID and artifact ID; the version is resolved automatically from the BOM.

How dependency management is applied

Maven (parent POM)
Maven (BOM import)
Gradle

<parent>
  <groupId>org.springframework.boot</groupId>
  <artifactId>spring-boot-starter-parent</artifactId>
  <version>4.1.0</version>
</parent>

<dependencies>
  <!-- Version is managed by the parent — no <version> needed -->
  <dependency>
    <groupId>com.fasterxml.jackson.core</groupId>
    <artifactId>jackson-databind</artifactId>
  </dependency>
</dependencies>

<dependencyManagement>
  <dependencies>
    <dependency>
      <groupId>org.springframework.boot</groupId>
      <artifactId>spring-boot-dependencies</artifactId>
      <version>4.1.0</version>
      <type>pom</type>
      <scope>import</scope>
    </dependency>
  </dependencies>
</dependencyManagement>

plugins {
  id("org.springframework.boot") version "4.1.0"
  id("io.spring.dependency-management") version "1.1.7"
}

// Dependency versions are now managed — no version needed:
dependencies {
  implementation("com.fasterxml.jackson.core:jackson-databind")
}

Overriding a managed version

You can override any managed dependency version in your own project without forking the BOM.

Maven property
Gradle ext property

<properties>
  <!-- Override the managed Jackson version -->
  <jackson-bom.version>2.18.0</jackson-bom.version>
</properties>

Each managed dependency has a corresponding version property you can override. Browse the full list with:

mvn dependency:tree -Dincludes=com.fasterxml.jackson

extra["jackson-bom.version"] = "2.18.0"

To inspect resolved versions in Gradle:

./gradlew dependencies --configuration compileClasspath

Overriding a managed version bypasses Spring Boot’s compatibility testing for that library. Test your application thoroughly after any version override, especially for transitive dependencies that may also be affected.

Inspecting the full BOM

To see all dependency versions managed for your project:

# Maven — show all resolved dependencies
mvn dependency:tree

# Maven — show effective POM with all managed versions
mvn help:effective-pom

# Gradle — show resolved versions for a configuration
./gradlew dependencies --configuration runtimeClasspath

You can also browse the spring-boot-dependencies BOM source directly on GitHub to see the full list of managed coordinates and their versions.

Managed dependency versions in Spring Boot 4.1

The versions below are read directly from gradle.properties and the spring-boot-dependencies BOM in the Spring Boot 4.1.0-SNAPSHOT source tree.

Spring ecosystem

Library	Version	Notes
Spring Framework	`7.0.7`	Core dependency — includes WebMVC, WebFlux, JDBC, etc.
Spring Boot	`4.1.0-SNAPSHOT`	This release.
Spring Security	`7.1.0-RC1`	Servlet and reactive security.
Spring Data BOM	`2026.0.0-RC1`	JPA, MongoDB, Redis, JDBC, R2DBC, and more.
Spring AMQP	`4.1.0-RC1`	RabbitMQ support.
Spring Kafka	`4.1.0-RC1`	Apache Kafka support.
Spring Batch	`6.0.3`	Batch processing framework.
Spring Integration	`7.1.0-RC1`	Enterprise integration patterns.
Spring HATEOAS	`3.1.0-RC1`	Hypermedia support for REST.
Spring Session	`4.1.0-RC1`	HTTP session management.
Spring LDAP	`4.1.0-RC1`	LDAP/Active Directory support.
Spring GraphQL	`2.0.4-SNAPSHOT`	GraphQL over HTTP and WebSocket.
Spring gRPC	`1.1.0-RC1`	gRPC server and client support.
Spring WS	`5.0.1`	Web Services (SOAP) support.
Spring RESTDocs	`4.0.0`	API documentation from tests.
Spring Pulsar	`2.0.5`	Apache Pulsar messaging.

JSON and serialization

Library	Version	Notes
Jackson BOM (Jackson 3)	`3.1.3`	Default Jackson version for Spring Boot 4.1.
Jackson 2 BOM	`2.21.3`	Legacy Jackson 2 support.
Gson	`2.13.2`	Google’s JSON library.
SnakeYAML	`2.6`	YAML parser used by Spring Boot configuration.
Yasson	`3.0.4`	JSON-B reference implementation.

Testing

Library	Version	Notes
JUnit Jupiter	`6.0.3`	JUnit 5 test engine.
Mockito	`5.23.0`	Mocking framework.
AssertJ	`3.27.7`	Fluent assertion library.
Hamcrest	`3.0`	Matcher library.
Testcontainers	`2.0.5`	Integration testing with Docker containers.
Awaitility	`4.3.0`	DSL for testing asynchronous code.
Selenium	`4.43.0`	Browser automation for UI tests.
HtmlUnit	`4.21.0`	Headless browser for web testing.
XmlUnit2	`2.11.0`	XML comparison and assertions.

Data access and databases

Library	Version	Notes
Hibernate ORM	`7.2.13.Final`	JPA provider.
HikariCP	`7.0.2`	Default JDBC connection pool.
Flyway	`12.4.0`	Database migration.
Liquibase	`—`	Database migration (managed by Liquibase BOM).
H2	`2.4.240`	Embedded database for testing.
PostgreSQL JDBC	`42.7.11`	PostgreSQL driver.
MySQL Connector/J	`9.7.0`	MySQL driver.
MariaDB Connector/J	`—`	MariaDB driver.
MSSQL JDBC	`13.4.0.jre11`	Microsoft SQL Server driver.
Cassandra Driver	`4.19.2`	DataStax Cassandra driver.
MongoDB Driver	`5.7.0-beta1`	MongoDB sync and reactive drivers.
Elasticsearch Client	`9.3.4`	Official Elasticsearch Java client.
Neo4j Java Driver	`6.0.5`	Neo4j graph database driver.
Jedis	`7.4.1`	Redis client (Jedis).
R2DBC Pool	`1.0.2.RELEASE`	Reactive connection pooling.
jOOQ	`—`	SQL DSL (version managed by jOOQ BOM).

Observability and metrics

Library	Version	Notes
Micrometer	`1.17.0-RC1`	Application metrics facade.
Micrometer Tracing	`1.7.0-RC1`	Distributed tracing abstraction.
OpenTelemetry	`1.60.1`	OpenTelemetry SDK for metrics, traces, and logs.
Brave	`6.3.1`	Zipkin tracing implementation.
Zipkin Reporter	`3.5.3`	Zipkin span reporting.
Prometheus Client	`1.5.1`	Prometheus metrics client.

Messaging

Library	Version	Notes
Rabbit AMQP Client	`5.30.0`	RabbitMQ AMQP client library.
ActiveMQ Classic	`6.2.5`	Apache ActiveMQ Classic JMS.
Artemis BOM	`2.53.0`	Apache ActiveMQ Artemis.
Apache Pulsar	`4.2.1`	Apache Pulsar client.
RSocket	`1.1.5`	RSocket protocol implementation.

Web servers and networking

Library	Version	Notes
Tomcat	`11.0.22`	Default embedded servlet container.
Netty	`4.2.13.Final`	Async networking framework used by WebFlux.
Reactor BOM	`2025.0.5`	Project Reactor (Flux, Mono, etc.).
HttpClient5	`5.6.1`	Apache HttpComponents 5 client.
Grpc Java	`1.80.0`	gRPC Java runtime.

Other languages and runtimes

Library	Version	Notes
Kotlin	`2.3.21`	Kotlin language runtime.
Groovy	`5.0.6`	Groovy scripting language.
AspectJ	`1.9.25.1`	AOP weaving support.
Caffeine	`3.2.4`	High-performance in-process cache.
Hazelcast	`5.5.0`	In-memory data grid and distributed cache.
Quartz	`2.5.2`	Job scheduling framework.
Thymeleaf	`3.1.5.RELEASE`	Server-side Java template engine.
FreeMarker	`2.3.34`	FreeMarker template engine.
SLF4J	`2.0.17`	Logging facade.
Byte Buddy	`1.18.8`	Runtime code generation (used by Mockito).
Native Build Tools	`1.1.0`	GraalVM native image build tooling.

Versions marked as -RC1, -SNAPSHOT, or -beta in the source tree will be finalized before the Spring Boot 4.1 GA release. Pin specific versions in your project if you need a stable version before GA.

Starters

Appendix

Spring Boot 4.1 Managed Dependency Versions and BOM

How dependency management is applied

Overriding a managed version

Inspecting the full BOM

Managed dependency versions in Spring Boot 4.1

Build docs developers (and LLMs) love

Starters

Appendix

Documentation Index

​How dependency management is applied

​Overriding a managed version

​Inspecting the full BOM

​Managed dependency versions in Spring Boot 4.1

Build docs developers (and LLMs) love

How dependency management is applied

Overriding a managed version

Inspecting the full BOM

Managed dependency versions in Spring Boot 4.1