🔒 Security

Core

• Fix XXE vulnerability in isXmlEqualTo assertion (CVE-2026-24400)
  • See GHSA-rqfh-9r24-8c9r for details; many thanks to @wxt201 and @Song-Li for responsibly reporting it!

🚫 Deprecated

Core

• Deprecate XmlStringPrettyFormatter with no replacement

🐛 Bug Fixes

Guava

• Navigation to assertj-core or guava types from assertj-guava Javadoc site has unnecessary header #3478

🔨 Dependency Upgrades

Core

• Upgrade to Byte Buddy 1.18.3
• Upgrade to JUnit BOM 5.14.1

Guava

• Upgrade to Guava 33.5.0-jre

🐛 Bug Fixes

Core

• Add missing export for org.assertj.core.annotation #3951

❤️ Contributors

Thanks to all the contributors who worked on this release:

@duponter

⚡ Improvements

Core

• ByteBuddy in AssertJ 3.27.4 not compatible with Java 25 #3946

🔨 Dependency Upgrades

Core

• Upgrade to Byte Buddy 1.17.7 #3947
• Upgrade to JUnit BOM 5.13.4 #3947

Guava

• Upgrade to Guava 33.4.8-jre #3947

🚫 Deprecated

Core

• Deprecate org.assertj.core.annotations.Beta in favor of org.assertj.core.annotation.Beta
• Deprecate org.assertj.core.util.CanIgnoreReturnValue in favor of org.assertj.core.annotation.CanIgnoreReturnValue
• Deprecate org.assertj.core.util.CheckReturnValue in favor of org.assertj.core.annotation.CheckReturnValue

🐛 Bug Fixes

Core

• Fix thread-safety in AbstractDateAssert #3874

⚡ Improvements

• Migrate to the Central Publisher Portal, enable snapshot publishing #3881

Core

• Annotate fail methods with custom @Contract #3882

❤️ Contributors

Thanks to all the contributors who worked on this release:

@kelunik

🧩 Binary Compatibility

This release is binary incompatible with the previous major version.

💥 Breaking Changes

• Raise required Java version to 17 #3447

🚫 Deprecated

• Set since = "3" and forRemoval = true for all deprecations #3762

Core

• Deprecate @VisibleForTesting for removal #3755

⚡ Improvements

• Run OpenRewrite Java 17 recipe #3759
• Add missing module descriptor to assertj-guava, adopt module-only build #3771
• Centralize maven-enforcer-plugin execution, append configurations

Core

• Replace isSealed reflection-based implementation with JDK built-in implementation #3081
• Replace isRecord reflection-based implementation with JDK built-in implementation #3079
• Add missing java.sql module dependency
• Fix typo in TemporalUnitLessThanOffset Javadoc #3783
• Move script testing to separate module, improve test portability #3785
• Abort tests when symbolic links cannot be created #3788

🔨 Dependency Upgrades

Core

• Upgrade to Byte Buddy 1.17.1 #3773
• Upgrade to JUnit BOM 5.12.0 #3779

❤️ Contributors

Thanks to all the contributors who worked on this release:

@aalmiray @RaphaelJenni @SimonHarte @etrandafir93 @fml2 @Bananeweizen @lobaorn @sormuras

💥 Breaking Changes

Core

• Revert "Propagate common basetype for the extracting method" #3737

  Details

  The enhancement introduced with #3673 breaks existing code on Kotlin 1.9; therefore, it has been reverted.

  As Spring Boot 3.4 currently supports Kotlin 1.9, we want to keep the same compatibility on AssertJ 3.x, while AssertJ 4.x will require Kotlin 2.x.

  Existing code relying on the changes introduced with #3673 will no longer compile and should be refactored.

🐛 Bug Fixes

Core

• Fix StandardRepresentation regression for unquoted strings #3735

⚡ Improvements

Core

• Add Class info to class loading strategy failures #3746

❤️ Contributors

Thanks to all the contributors who worked on this release:

@ccrvincent

🐛 Bug Fixes

Core

• Restore support for null-valued maps when ignoring fields #3723

🚫 Deprecated

Core

• Deprecate usingComparatorForFields and remove deprecated assertions from usingComparatorForType documentation #3711
• Deprecate hasCauseReference(Throwable) from Throwable assertions #3715

🐛 Bug Fixes

Core

• Fix missing introspection for record accessors #3710
• Honor assertion description in asString()
• Avoid InputStream manipulation when mark / reset are supported #3713
• NPE with custom RecursiveComparisonConfiguration on usingRecursiveFieldByFieldElementComparator #3719

⚡ Improvements

• Declare license using SPDX identifier #3718

❤️ Contributors

Thanks to all the contributors who worked on this release:

@Bananeweizen @jessicant @nith2001

💥 Breaking Changes

Core

• Propagate common basetype for extracting(Function...) #3673

  Details

  Before this change, extracting(Function...) changed actual to a list of Object instances, even in cases where the resulting objects could have had a more specific common supertype. With this change, the element type of the returned list is narrowed down to the common supertype of the resulting elements, allowing the compiler to accept chained assertions specific to the common supertype.

  However, this can break existing code, like in #3709. Such cases do not justify reverting the change. Therefore, the affected code should be refactored accordingly, given that contains for list assertions already follows the same semantic.

  In addition, this can break existing code based on Kotlin 1.9, like in #3728. In such cases, either upgrade Kotlin to 2.x or upgrade AssertJ to 3.27.3, which restores compatibility with Kotlin 1.9.

🚫 Deprecated

Core

• Deprecate ClassBasedNavigableIterableAssert and ClassBasedNavigableListAssert #3529

✨ New Features

Core

• Add actual() to access the object under test #3489
• Add isCompletedWithValueMatchingWithin to CompletableFuture assertions #3506
• Add completesExceptionallyWithin to CompletableFuture assertions #3597
• Add inBinary to CharSequence assertions #3600
• Support for Assertions.byLessThan(Duration) and Assertions.within(Duration) #3486
• Add standard representation for CharSequence #3617
• Add predicate descriptions overloads to anyMatch and noneMatch #3639
• Add doesNotMatch(Predicate) #3684
• Add usingEquals accepting a BiPredicate and an optional description to provide a custom comparison in assertions #3678

Guava

• Add isNotEmpty to Table assertions #3559

🐛 Bug Fixes

Core

• Recursive assertion hasNoNullFields throws NPE with fields of anonymous and local types #3534
• Fix incorrect mutation of actualElementsGroupedByHashCode in recursive comparison
• Recursive comparison ignoringFields not working properly with maps #2988
• Custom representation ignored when describing expected items not in the actual list #3646
• hasFieldOrPropertyWithValue swallows exceptions thrown by getters, and reports non-existent property instead #3563
• satisfies() with nested assertions obscures stack trace #2542
• Recursive comparison fails if ignored fields are not found in expected #3226

⚡ Improvements

Core

• Report all failing conditions when using satisfies(allOf(Condition...)) #3537
• Fix Unicode escapes in inUnicode() Javadoc
• Show error differences if values were compared with equals in recursive comparison #3209
• Add throwable stacktrace to ShouldNotContainCharSequence
• Remove unused code and other minor cleanup #3683
• Simplify comparison strategy isLessThan and isLessThanOrEqualTo in AbstractComparisonStrategy #3694
• Update AbstractCharSequenceAssert.java reference #3700
• Include stack trace of internal errors in all/any satisfy assertions

🔨 Dependency Upgrades

Core

• Upgrade to Byte Buddy 1.15.11 #3703
• Upgrade to JUnit BOM 5.11.4 #3702

Guava

• Upgrade to Guava 33.4.0-jre #3705

❤️ Contributors

Thanks to all the contributors who worked on this release:

@JunHyungJang @mipo256 @vladykin @Marcono1234 @sunaleed @etrandafir93 @FlorianCousin @OlivierCavadenti @jh-instant @patrickuhlmann @IvoHD @alexandra-junghans @fmbenhassine @etrandafir93 @shaikhu @cookieMr @emmanuel-ferdman @mk868

🧩 Binary Compatibility

The release is:

• Binary compatible with the previous minor version.
• Binary incompatible with the previous patch version.

💥 Breaking Changes

Core

• Replace assertThat(Temporal) with assertThatTemporal(Temporal) #3519

🐛 Bug Fixes

Core

• Fix Javadoc rendering on FactoryBasedNavigableListAssert::assertThat
• Allow ComparingNormalizedFields instances to be reused across different assertions #3493

🔨 Dependency Upgrades

Core

• Upgrade to Byte Buddy 1.14.18 #3531
• Upgrade to JUnit BOM 5.10.3 #3525

Guava

• Upgrade to Guava 33.2.1-jre #3499

❤️ Contributors

Thanks to all the contributors who worked on this release:

@genuss