According to the Spring Boot wiki, major versions are supported for at least three years from release, but you must run a supported minor version. Minor versions are supported for at least 12 months. New major or minor versions arrive every six months, in May and November, so plan to upgrade at least yearly.
What the policy says
The Spring Boot Supported Versions page says the project follows the VMware Tanzu open source support policy for critical bugs and security issues. Three claims matter for planning:
- Major versions get at least three years of support from the release date, with the condition that you run a supported minor.
- Minor versions get at least 12 months.
- Commercial support with an extended period is also available, from the same page.
The release schedule on that page is a new major or minor version every six months, May and November, with patch releases as needed. The page recommends migrating to the latest supported release where possible. The page was last edited in December 2023, so confirm the current list of supported versions through the link it provides.
The trap: major support is not minor support
It is easy to read three years and relax. The condition is the catch. Fixes land on supported minor lines. If you sit on an old minor of a supported major, you may be outside support even though the major looks healthy.
| What you run | Where you stand |
|---|---|
| Latest minor of a supported major | Supported |
| An older minor past its 12 months | Likely unsupported, check the list |
| A major past three years | Unsupported without commercial arrangements |
Because minors arrive twice a year and each lasts at least 12 months, a team that upgrades every year stays inside the window with room to spare. A team that upgrades every two years does not.
A yearly rhythm that works
- Put the supported versions page on your calendar, once per release cycle.
- After each May or November release, check where your services sit.
- Upgrade one minor at a time in a branch. Read the release notes for each, run tests, and fix deprecation warnings before they become removals.
- Keep the framework and its managed library versions together. Pinning one library away from the managed version is a reason a later upgrade hurts.
- Record the next support end date in the service catalog entry.
When a service cannot move in time, write down an exception with an owner, a date and a compensating control, rather than letting it drift.
Security notes
Supported lines receive fixes for critical bugs and security issues. Unsupported lines do not, and an advisory database may show nothing for a version because no one is looking at it anymore. No advisory is not the same as no flaw.
Quick check
If my major version is supported, am I covered?
Only if you run a supported minor of that major. Check the current list.
How often should I upgrade a Spring Boot service?
At least once a year keeps you inside the 12 month minor window, with margin for slippage.
Safeguard scans your dependency tree, flags end of support components, and keeps SBOM evidence of what you ran. Start with the free scan at gold.safeguard.sh/scan.
Sources
Last reviewed: 19 October 2026.
