The June 30 Spring Wave: Boot 3.5, Framework 6.2, Security 6.5 & Cloud All EOL

On June 30, 2026, open-source support ended simultaneously for Spring Boot 3.5, Spring Framework 6.2, Spring Security 6.5, and Spring Cloud 2025.0. That's not a coincidence — the Spring portfolio synchronizes its release trains — but it means that on June 30, 2026 JVM teams didn't lose support for a library; they lost the entire supported generation of their application stack at once. Eleven days later, search traffic tells us plenty of teams are only now finding out.

Key Dates at a Glance

Spring Boot 4.0: OSS support ends 2026-12-31; commercial support ends 2027-12-31
Spring Boot 3.5: OSS support ends 2026-06-30; commercial support ends 2032-06-30
Spring Boot 3.3: OSS support ends 2025-06-30; commercial support ends 2026-06-30
Spring Boot 3.2: OSS support ends 2024-12-31; commercial support ends 2025-12-31

Why one day took out the whole stack

Spring's projects version together: a Boot release binds specific Framework, Security, and Cloud lines, and their open-source support windows end together. Under the current policy, each Spring Boot minor receives roughly 13 months of open-source support; when 3.5's window closed on June 30, the coordinated lines closed with it. The successors — Spring Boot 4.0 and Spring Framework 7.0, released November 2025 — are now the only fully supported open-source generation.

Running Spring Boot past end of life?

Extended support past the official EOL date exists for many products in this position — whether it covers Spring Boot is exactly what we check. Tell us where to reach you and we’ll reply with matched options and pricing guidance — or an honest “no vendor covers this.” Free, no obligation.

What makes this one bigger than usual

Spring Boot 3.5 wasn't just another minor: it was the final release of the 3.x line. There is no 3.6 to slide onto. Staying supported on open source means crossing a major version boundary — Boot 3.x → 4.0 rides on Framework 6.x → 7.0 — and major-boundary migrations are where framework upgrades stop being version bumps and start being projects. As we covered in how CVEs hit frameworks differently, framework code parses your inbound traffic: when the next serious advisory lands (Spring's history includes Spring4Shell-class events), 3.x users won't be patching — they'll be migrating under fire.

The quiet part

From July 1, newly disclosed vulnerabilities in Framework 6.2 / Boot 3.5 and earlier get no open-source fix. Your dependency scanner won't flag anything today — the findings arrive with the next CVE, retroactively, for a version you can no longer patch.

Your options, ranked

1. Migrate to Boot 4.0 / Framework 7.0. The documented path, and the earlier you start the calmer it is. Teams on 3.5 with current dependencies have the shortest crossing; teams still on 3.2/3.3 (we see you in the search logs) should go straight to 4.0 rather than hopping through dead minors.

2. Commercial support for the 3.x line. Broadcom's enterprise subscriptions extend 3.x support well past the open-source cutoff — the official paid bridge. Independent extended-support vendors also cover Spring lines, often at different price points. Tell us your stack and constraints and we'll match you with the right option — free, one business day.

3. Accept and contain — briefly. A documented, time-boxed exposure window while migration is scheduled is defensible. An open-ended one, on the component that parses your public traffic, is how Equifax happened.

Check where you actually stand

Every Spring line's dates are on the live pages: Spring Boot, Spring Framework, Spring Security, Spring Cloud — or get an instant answer for any product with the EOL Checker. June 30 was the Spring ecosystem's biggest EOL day of 2026; the next generation's clock (Boot 4.0's open-source window runs to the end of 2026) is already ticking.

Frequently Asked Questions

Is Spring Boot 3.5 still supported?

Not on open source. Spring Boot 3.5’s OSS support ended 2026-06-30, and it was the last 3.x minor, so there is no 3.6 to move to. Commercial support for 3.5 runs to 2032-06-30 through Broadcom’s enterprise subscription; the open-source path is Spring Boot 4.0.

Which Spring projects went end of life on June 30, 2026?

Four lines at once: Spring Boot 3.5, Spring Framework 6.2, Spring Security 6.5 and Spring Cloud 2025.0 all ended OSS support on 2026-06-30. They version together, so a Boot 3.5 application lost its whole supported generation on one day rather than one library.

When does Spring Boot 4.0 reach end of life?

Spring Boot 4.0’s open-source support ends 2026-12-31, with commercial support to 2027-12-31. Spring Framework 7.0 runs longer — OSS to 2027-07-31 — but a Boot 4.0 application follows Boot’s window, so plan the 4.1 step before the end of the year.

Is Spring Framework 6.2 end of life?

Yes, for open source: Spring Framework 6.2’s OSS support ended 2026-06-30 (6.1’s ended 2025-06-30). Commercial support for 6.2 is listed to 2032-06-30. Framework 7.0, released 2025-11-30, is the supported open-source line.

Is there extended support for Spring Boot 3.x after June 30?

Yes, two kinds. Broadcom sells commercial Spring support that extends the 3.x lines well past the OSS cutoff, and independent extended-support vendors cover Spring lines as well, usually at different price points and scopes. Tell us your stack via the form on this page and we will match you with the right option — free, within one business day.

What happens to a Spring Boot 3.x application that stays put?

Nothing visible at first, which is the trap. From July 1, 2026 newly disclosed vulnerabilities in Boot 3.5 / Framework 6.2 and earlier get no open-source fix, so the next advisory arrives as a finding against a version you can no longer patch. Because framework code parses inbound traffic, that exposure sits on the public edge of the application.