Milestone 4 of Spring Boot 2.0 brings important changes to the security auto-configuration provided by Spring Boot.

Problem Statement

Until Spring Boot 1.x, the default auto-configuration secured all of the application endpoints using basic authentication. If actuator was on the classpath, there was a separate security configuration that applied to the actuator endpoints. The way these two auto-configurations would turn on and off was completely independent. Because of this, users wanting to provide custom security found themselves fighting ordering issues with WebSecurityConfigurerAdapters.

Additionally, for actuator endpoints, the effects of the management.security.enabled…

The third milestone of Spring Boot 2.0 is available now from the Spring milestone repository. This milestone ensures compatibility with Spring Framework 5.0.0.RC3 and contains a number of other dependency upgrades. This release closes over 100 issues and pull requests, thanks to all that contributed!

For a complete list of changes, and upgrade instructions, see the Spring Boot 2.0.0.M3 Release Notes on the WIKI and the updated reference documentation.

If you want to get started and discover the new features, you can easily bootstrap a new project on https://start.spring.io

Project Page | GitHub | Issues | Documentation | Stack Overflow | …

Spring Boot v1.5.0.RC1 is available now from the Spring milestone repository. This release closes over 220 issues and pull requests! Thanks to everyone that has contributed!

Highlights of the new release include:

• Out of the box security for actuators
• Auto-configured @IntegrationComponentScan
• Auto-detection of spring.jpa.database
• Support for Apache Kafka
• Support for Cloud Foundry and actuator integration
• Support for embedded in-memory LDAP server and auto-configuration for any compliant LDAP server
• Upgrades to Spring Data Ingalls, Jetty 9.4, JooQ 3.9, AssertJ 2.6.0, Hikari 2.5 and Neo4J 2.1 and more
• Upgrades to several Maven plugins
…