Spring Boot 2.7 end of life
Spring Boot 2.7 ended open-source support on 30 June 2023 and was the final 2.x line. Commercial support from Broadcom ran on beyond that under a paid Spring subscription. The last open-source release was 2.7.18. Any Spring Boot 2.x application not covered by a commercial agreement has received no upstream security patches since.
- End of life
- 30 June 2023 (OSS support)
- Released
- May 2022
- Final release
- 2.7.18
- Successor
- Spring Boot 3.5 or 4.0
Date published by Spring Boot support policy. We do not publish a lifecycle date we cannot source.
What actually stops on 30 June 2023
- Open-source patch releases on the 2.7 line. 2.7.18 was the last.
- Dependency version management for the 2.7 BOM, which is the part that bites: Spring Boot's value is the curated dependency set, and it stops being curated. Transitive CVEs in Jackson, Tomcat, Logback and Netty stop being resolved for you.
- Compatibility updates for newer Java versions. Spring Boot 2.7 supports Java 8 through 17 and will not be updated for later JDKs.
What actually breaks in the upgrade
2 to 3 is javax to jakarta, plus a Java 17 floor
Spring Boot 3 requires Java 17 as a minimum and moves to Jakarta EE, so every javax.* import in servlet, persistence and validation code becomes jakarta.*. Two breaking changes arrive together, which is why this migration stalls: teams on Java 8 have to do the JDK upgrade and the namespace migration in the same programme.
The dependency BOM is the hidden scope
Upgrading Spring Boot moves dozens of managed dependency versions at once. The Spring code change is usually small; the regression surface is every library the BOM bumps. Budget testing accordingly, and read the dependency version diff before you start, not after.
Spring Security is a separate, larger migration
Spring Security 5 to 6 removed WebSecurityConfigurerAdapter and moved wholesale to the lambda DSL. For applications with non-trivial security configuration this is frequently the single longest task in a Boot 2 to 3 upgrade, and it is worth scoping separately.
What the buyers actually say
In our own conversations, the most common position is not 'help us upgrade'. It is 'we need to check the compliance box on the version we are on'. Commercial Spring quotes at 100-core minimums price that box out of reach for mid-size estates, which is the gap extended support fills.
Your options, costed honestly
Including the ones that do not involve buying anything from us.
| Option | What it is | Effort | Cost | Our view |
|---|---|---|---|---|
| Upgrade to Spring Boot 3.5 | Java 17 floor plus the Jakarta namespace migration plus Spring Security 6. | Weeks to months | Engineering time | The right destination. Scope Spring Security separately; it is usually the long pole. |
| Commercial Spring subscription | Broadcom's paid Spring support, now part of the TrueSource and Spring Enterprise packaging. | Procurement | Core-based minimums apply | Straightforward if the estate is large enough to absorb the minimum. Frequently not, for mid-size estates. |
| Extended support on Spring Boot 2.7 | Backported CVE fixes for the Boot 2.7 line and the managed dependencies around it. | Days to onboard | Subscription per application or estate | The answer when the migration is real but will take quarters and the audit will not wait. |
| Stay unpatched | No upstream patches since mid-2023, plus an unmanaged dependency set. | None | Zero now | The transitive dependency exposure alone makes this hard to defend in any scanned environment. |
What OSSeva does for Spring Boot 2.7
OSSeva patches this line
OSSeva backports CVE fixes to Spring Boot 2.7 and to the dependency set the 2.7 BOM manages, delivered as signed Maven artifacts through your own repository manager. We are specific about scope before you buy: Spring is a very large surface, and we will tell you exactly which projects and which transitive dependencies are inside the agreement rather than selling 'Spring support' and negotiating later.
Spring Boot extended supportWhat your auditor will say
Requirement 6.3.3, applied to the application framework and every dependency it pulls. Unmanaged transitive CVEs are what scanners surface first.
CC7.1. The dependency set is the evidence problem: a Boot 2.7 application's SBOM shows dozens of components with no upstream fix path.
For EU financial entities, ICT third-party risk provisions engage when a critical application depends on software with no support arrangement in place.
Spring Boot 2.7: common questions
When did Spring Boot 2 reach end of life?
Open-source support for Spring Boot 2.7, the final 2.x line, ended on 30 June 2023. The last open-source release was 2.7.18. Commercial support from Broadcom continued beyond that under a paid subscription.
Is Spring Boot 2.7 still supported?
Not in open source. It receives no community patches. Commercial Spring support and third-party extended support are the remaining options.
What is required to upgrade from Spring Boot 2 to 3?
Java 17 as a minimum, and the Jakarta EE namespace migration from javax.* to jakarta.* across servlet, persistence and validation code. If you also use Spring Security, the 5 to 6 migration removes WebSecurityConfigurerAdapter and is usually the largest single task.
Can I get security patches for Spring Boot 2.7?
Yes. Broadcom offers commercial Spring support, and third-party providers including OSSeva, HeroDevs and TuxCare backport CVE fixes to the 2.7 line. OSSeva also covers the managed dependency set, which is where most findings actually appear.
Why do Spring Boot 2 applications show so many CVEs?
Because Spring Boot's core value is a curated dependency set, and that curation stopped. The CVEs are mostly transitive — Jackson, Netty, Logback, embedded Tomcat — rather than in Spring itself, and nobody is bumping them for you.
How much does commercial Spring support cost?
Broadcom prices Spring commercially with core-based minimums, which in the quotes we have been shown puts it out of reach for mid-size estates that only need the patches. That gap is the main reason third-party extended support exists for Spring.
Still running Spring Boot 2.7?
Tell us the versions and the estate size. We will tell you honestly whether to upgrade or to buy cover — and we say 'upgrade' more often than you would expect.