Bump spring-boot.version from 3.5.7 to 4.1.1

[dependabot]

Bumps spring-boot.version from 3.5.7 to 4.1.1.
Updates org.springframework.boot:spring-boot-dependencies from 3.5.7 to 4.1.1

Release notes

Sourced from org.springframework.boot:spring-boot-dependencies's releases.

v4.1.1

⚠️ Attention Required

• Spring Boot's Gradle plugin no longer automatically configures gRPC when the Protobuf plugin is applied. This behavior caused problems for those using Protobuf without gRPC. To opt in to the configuration of gRPC, configure the protobuf extension with the grpc plugin using an empty block. The Spring Boot Gradle plugin will then automatically configure the use of protoc-gen-grpc-java as before. #50822

🐞 Bug Fixes

• Kafka consumer-specific security protocol is not taken into account #51369
• Structured logging: a failed JSON encode corrupts the next log event written on the same thread #51156
• Micrometer registries pin the application context #51135
• Temporary file is not deleted when ExportedImageTar construction fails #51132
• Metadata annotation processor ignores getter-level @NestedConfigurationProperty for records #51098
• spring-boot-h2-console pulls servlet-api as transitive dependency #51095
• PropertiesLauncher does not log nested archive paths #51089
• Methods that return the result of Map#remove are not declared with a @Nullable return type #51087
• NativeImageResourceProvider flattens Flyway migration paths in subdirectories #50964
• Fix ordering of Kotlinx Serialization CodecCustomizer #50961
• JarFile is not closed when finding main class from archive #50959
• Application-managed JUL bridge handler should only be removed if installed #50950
• CloudFoundry reactive auto-configuration should not require a WebClient.Builder bean to be defined #50944
• Context refresh fails on reactive Cloud Foundry when using Actuator without spring-boot-health #50942
• Resources are not cleaned up when resolving an image that is not yet present in the builder #50941
• GraphQlWebMvcAutoConfiguration should apply customizers in order #50914
• Auto-configured RedisMessageListenerContainer does not use virtual threads when spring.threads.virtual.enabled is true #50884
• Context refresh fails when using Actuator on Jersey without spring-boot-health #50872
• Context refresh fails on Cloud Foundry when using Actuator without spring-boot-health #50871
• IllegalStateException when binding properties to a @Validated class that contains a map whose value type is a wildcard #50856
• High number of connections due to Mongo health indicator #50852
• Inconsistent handling of empty string values of spring.security.oauth2.resourceserver.jwt issuer-uri and jwk-set-uri #50849
• Return type nullability of ApplicationContextAssert's getBean methods does not indicate that bean may be null #50845
• PropertiesWebClientHttpServiceGroupConfigurer has highest precedence, preventing other configurers from being ordered ahead of it #50843
• Exposing gRPC test server port should backoff if gRPC is not present #50825
• JpaBaseConfiguration#entityManagerConfiguration can cause a dependency loop on beans declaring AsyncTaskExecutor #50801
• spring.grpc.server.health.include-overall-health is not taken into account #50799
• Setting 'server.servlet.session.cookie.partitioned' to false still emits the 'Partitioned' cookie attribute #50790
• Managed version of Prometheus Client is not aligned with Micrometer's micrometer-registry-prometheus #50780
• Map properties bound from empty strings fail with ConverterNotFoundException #50773
• Protobuf Common Protos should not be a managed dependency #50772
• An application that depends on spring-boot-security-oauth2-resource-server may fail to start with a ClassNotFoundException when Reactor is on the classpath but WebFlux is not #50764
• W3CHeaderParser's decoding is not compliant with RFC 3986 #50650

📔 Documentation

• Description of spring.graphql.websocket.connection-init-timeout does not render correctly in the reference guide #51348
• spring.profiles.group should have a 'spring-profile-name' hint provider #51284
• Remove reference to removed InfluxDB auto-configuration #51176
• Use JacksonJsonSerde in Kafka Streams documentation #51161
• Document alternatives to HttpMessageConverters #51129
• Fix stale type reference for OTLP logging transport metadata #51119
• Metadata for spring.test.mockmvc.htmlunit.url declares the wrong type #51115

... (truncated)

Commits

• 6fdf67e Release 4.1.1
• fde599b Upgrade to Spring Pulsar 2.0.7
• 9daa58f Upgrade to Spring HATEOAS 3.1.2
• 353993e Upgrade to Spring Data Bom 2026.0.1
• 24ba596 Upgrade to Spring Session 4.1.1
• 5cb5c29 Upgrade to Spring Security 7.1.1
• 4adc8eb Upgrade to Spring LDAP 4.1.1
• 4d9c19c Upgrade to Spring Kafka 4.1.1
• f30f612 Upgrade to Spring Integration 7.1.1
• b930283 Upgrade to Spring gRPC 1.1.1
• Additional commits viewable in compare view

Updates org.springframework.boot:spring-boot-maven-plugin from 3.5.7 to 4.1.1

Release notes

Sourced from org.springframework.boot:spring-boot-maven-plugin's releases.

v4.1.1

⚠️ Attention Required

• Spring Boot's Gradle plugin no longer automatically configures gRPC when the Protobuf plugin is applied. This behavior caused problems for those using Protobuf without gRPC. To opt in to the configuration of gRPC, configure the protobuf extension with the grpc plugin using an empty block. The Spring Boot Gradle plugin will then automatically configure the use of protoc-gen-grpc-java as before. #50822

🐞 Bug Fixes

• Kafka consumer-specific security protocol is not taken into account #51369
• Structured logging: a failed JSON encode corrupts the next log event written on the same thread #51156
• Micrometer registries pin the application context #51135
• Temporary file is not deleted when ExportedImageTar construction fails #51132
• Metadata annotation processor ignores getter-level @NestedConfigurationProperty for records #51098
• spring-boot-h2-console pulls servlet-api as transitive dependency #51095
• PropertiesLauncher does not log nested archive paths #51089
• Methods that return the result of Map#remove are not declared with a @Nullable return type #51087
• NativeImageResourceProvider flattens Flyway migration paths in subdirectories #50964
• Fix ordering of Kotlinx Serialization CodecCustomizer #50961
• JarFile is not closed when finding main class from archive #50959
• Application-managed JUL bridge handler should only be removed if installed #50950
• CloudFoundry reactive auto-configuration should not require a WebClient.Builder bean to be defined #50944
• Context refresh fails on reactive Cloud Foundry when using Actuator without spring-boot-health #50942
• Resources are not cleaned up when resolving an image that is not yet present in the builder #50941
• GraphQlWebMvcAutoConfiguration should apply customizers in order #50914
• Auto-configured RedisMessageListenerContainer does not use virtual threads when spring.threads.virtual.enabled is true #50884
• Context refresh fails when using Actuator on Jersey without spring-boot-health #50872
• Context refresh fails on Cloud Foundry when using Actuator without spring-boot-health #50871
• IllegalStateException when binding properties to a @Validated class that contains a map whose value type is a wildcard #50856
• High number of connections due to Mongo health indicator #50852
• Inconsistent handling of empty string values of spring.security.oauth2.resourceserver.jwt issuer-uri and jwk-set-uri #50849
• Return type nullability of ApplicationContextAssert's getBean methods does not indicate that bean may be null #50845
• PropertiesWebClientHttpServiceGroupConfigurer has highest precedence, preventing other configurers from being ordered ahead of it #50843
• Exposing gRPC test server port should backoff if gRPC is not present #50825
• JpaBaseConfiguration#entityManagerConfiguration can cause a dependency loop on beans declaring AsyncTaskExecutor #50801
• spring.grpc.server.health.include-overall-health is not taken into account #50799
• Setting 'server.servlet.session.cookie.partitioned' to false still emits the 'Partitioned' cookie attribute #50790
• Managed version of Prometheus Client is not aligned with Micrometer's micrometer-registry-prometheus #50780
• Map properties bound from empty strings fail with ConverterNotFoundException #50773
• Protobuf Common Protos should not be a managed dependency #50772
• An application that depends on spring-boot-security-oauth2-resource-server may fail to start with a ClassNotFoundException when Reactor is on the classpath but WebFlux is not #50764
• W3CHeaderParser's decoding is not compliant with RFC 3986 #50650

📔 Documentation

• Description of spring.graphql.websocket.connection-init-timeout does not render correctly in the reference guide #51348
• spring.profiles.group should have a 'spring-profile-name' hint provider #51284
• Remove reference to removed InfluxDB auto-configuration #51176
• Use JacksonJsonSerde in Kafka Streams documentation #51161
• Document alternatives to HttpMessageConverters #51129
• Fix stale type reference for OTLP logging transport metadata #51119
• Metadata for spring.test.mockmvc.htmlunit.url declares the wrong type #51115

... (truncated)

Commits

• 6fdf67e Release 4.1.1
• fde599b Upgrade to Spring Pulsar 2.0.7
• 9daa58f Upgrade to Spring HATEOAS 3.1.2
• 353993e Upgrade to Spring Data Bom 2026.0.1
• 24ba596 Upgrade to Spring Session 4.1.1
• 5cb5c29 Upgrade to Spring Security 7.1.1
• 4adc8eb Upgrade to Spring LDAP 4.1.1
• 4d9c19c Upgrade to Spring Kafka 4.1.1
• f30f612 Upgrade to Spring Integration 7.1.1
• b930283 Upgrade to Spring gRPC 1.1.1
• Additional commits viewable in compare view

Note
Automatic rebases have been disabled on this pull request as it has been open for over 30 days.

[ramanathan1504]

@dependabot recreate

[ramanathan1504]

Closing to match apache/logging-log4j2#4308, which reverted spring-cloud-context to 4.3.0 on 2.x. log4j-spring-cloud-config-client is on the Spring Boot 3 generation,
and log4j-spring-cloud-config-sample-application depends on it, so moving the samples to Boot 4 reintroduces the enforce-upper-bound-deps failure that revert was for.
Adding a Dependabot ignore for org.springframework.boot:* at [4,) alongside it.

[dependabot]

OK, I won't notify you again about this release, but will get in touch when a new version is available. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.