Spring Boot
Production-grade Spring applications
The Lens
By Erik Loyd, SaaS CEO and former COO/CFO of an AWS Premier Partner.
Updated Oct 2026
Spring Boot takes the Spring Framework, Java's big enterprise toolkit, and removes most of the setup. You get opinionated defaults, auto-configuration and an embedded web server, so a service starts with java -jar instead of a pile of XML. It's Apache 2.0 and free, maintained by Broadcom's Spring team.
Setup is a Spring Initializr download or a few Maven or Gradle lines. Security, metrics, health checks and external config come in as starters, add-on dependencies that wire themselves up. Running it is ordinary JVM hosting: a container, a VM or a PaaS.
There's no paid tier for features. The money is in support windows. Each minor version gets about 13 months of free fixes: 4.0.x ends December 2026, and 3.5.x already ended in June. After that, patches come from TrueSource Spring Enterprise, Broadcom's paid subscription, quote-only. Solo and small teams: free, stay current. Large teams pinned to old branches: budget for the subscription or for upgrades.
The catch: that treadmill has teeth. In March, an Actuator auth bypass got free fixes for 4.0 and 3.5 while the 3.4 fix shipped Enterprise Support Only. Fall a minor version behind and security costs money.
Free vs Self-Hosted vs Paid
fully freeFree: Everything in the framework. Spring Boot is Apache 2.0, as are the starters (security, metrics, health checks, externalized config) and Actuator. OSS releases get roughly 13 months of free support per minor version: 4.1.x (released 2026-06) until 2027-07, 4.0.x until 2026-12, and 4.2.x (due 2026-11) until 2027-12. 3.5.x OSS support ended 2026-06 and 3.4.x ended 2025-12.
Self-hosted: Runs anywhere a JVM runs, as a java -jar executable or a traditional WAR. No server component of its own. The real ops work is keeping up with minor-version upgrades so you stay inside the free patch window.
Paid: TrueSource Spring Enterprise (Broadcom, formerly sold under VMware Tanzu) sells extended support past OSS end dates, Day 0 access to patches, 24x7 support for 50+ Spring projects plus OpenJDK and Tomcat, Application Advisor automated upgrades, enterprise Spring Boot extensions (FIPS, SBOM, compliance starters) and Tanzu tc Server. Enterprise support runs a year past OSS for most branches, and much longer for 3.5.x (2032-06) and 2.7.x (2029-06). Some security fixes ship only to subscribers: CVE-2026-22731's fix for 3.4.x (3.4.15) is "Enterprise Support Only". No public price; contact sales.
Free under Apache 2.0 as long as you stay on a supported minor version, about 13 months each. Run an old branch past its OSS end date and security fixes come only through Broadcom's quote-only TrueSource Spring Enterprise subscription.
What to do by team size
- Solo
- free; start on the current 4.1.x line
- Small team
- free; plan one minor-version upgrade a year to stay in the OSS patch window
- Medium team
- free if you upgrade yearly; TrueSource Spring Enterprise only if you can't
- Large team
- TrueSource Spring Enterprise for extended support, Day 0 patches and 24x7 support across Spring, OpenJDK and Tomcat; quote-only
Get tools like this every Wednesday
One featured tool, three on the radar. No fluff.
Similar Tools
A low score is not a verdict on quality. Young and niche tools start low by design. How we calculate scores
Trust Signals
About
- Stars
- 81,738
- Forks
- 43,449
Explore Further
More tools in the directory
rea
Reverse engineer anything with agents, from app behavior down to native binaries.
435.8k ★openclaw
Your own personal AI assistant. Any OS. Any Platform. The lobster way. 🦞
394.0k ★everything-claude-code
The agent harness performance optimization system. Skills, instincts, memory, security, and research-first development for Claude Code, Codex, Opencode, Cursor and beyond.
298.1k ★