⚠️ Spring® Framework 6.2 and Spring® Boot 3.5 hit end of life on June 30th. After that, the Spring® team stops issuing public security patches.
Keep Spring® Boot & Framework Secure After June 30th
June 30th marks the end of support for Spring® Boot 3.5 and Spring® Framework 6.2. Your apps keep running – but risk keeps accumulating underneath.
ELS keeps your services secure while you avoid disruptive refactoring.
Talk To Us
Get your Spring® Boot & Framework security plan in place
TuxCare will track and patch new CVEs found after June 30th – all within our rapid SLA.
Spring® Boot 3.5 and Framework® 6.2 are final minor releases, with +5 years of enterprise support beyond OSS EOL.
Spring® Boot 3.5 and Spring® Framework 6.2 reach end of open-source support in June 2026, after which the Spring® team will no longer issue public security patches – though commercial enterprise support remains available for organizations that need more time.
Keep Running. Skip the Risks.
Upgrading a Spring® Boot application in an enterprise environment is a significant undertaking – dependency conflicts, breaking API changes, Java version requirements, and the need for extensive regression testing across complex, interconnected services make this a multi-team, multi-quarter effort for many organizations.
Endless Lifecycle Support keeps your Spring® ecosystem secure and stable after the end-of-life date – so cross-team upgrades happen on your schedule.
What Does Endless Lifecycle Support Include?
Rapid CVE Response
Rapid SLA-backed security patches for as long as you need
Complete Coverage
Security fixes for both direct and transitive dependencies AT NO EXTRA COST
Preserved Compatibility
Extensively tested updates that work flawlessly with your existing code
Seamless Integration
Plug-and-play integration with your workflows and CI/CD pipelines
Secure Distribution
Signed, tamper-proof updates from TuxCare-hosted repositories you can trust
Trusted Support
24/7 expert assistance with CVE triage, patch requests and troubleshooting
How Does It Work?
We onboard new projects and enable 24/7 automated CVE tracking – monitoring the NVD, vendor, and GitHub security advisories, and other sources.
Once CVEs are detected, we backport upstream fixes using algorithmic and AI-assisted automation, with expert validation to ensure accuracy.
Patches are compiled in a binary format, extensively tested (for integrity, functionality, and regression), signed, and deployed to ELS repositories.
Your package managers, build tools, or orchestrators check for updates, then automatically pull and install them.
TuxCare has successfully resolved
more than 5,000 CVEs
in open-source software – keeping enterprise systems secure and compliant.
Secure Your Spring® Applications
Before It's Too Late
Talk to a Spring® expert about securing your services after support ends