Migrate from Java 11 to Java 21 and Spring Boot 2.6.3 to 3.2.0

[devin-ai-integration]

Migrate from Java 11 to Java 21 and Spring Boot 2.6.3 to 3.2.0

Summary

This PR migrates the Spring Boot RealWorld Example Application from Java 11 to Java 21, upgrading Spring Boot from version 2.6.3 to 3.2.0. This is a major version upgrade involving comprehensive changes across build configuration, dependencies, code migrations, and security configuration.

Major Changes

Build & Dependencies:

• Java 11 → 21, Gradle 7.4 → 8.5
• Spring Boot 2.6.3 → 3.2.0
• MyBatis 2.2.2 → 3.0.3
• Netflix DGS 4.9.21 → 8.2.0
• JJWT 0.11.2 → 0.12.5
• REST Assured 4.5.1 → 5.4.0
• SQLite JDBC 3.36.0.3 → 3.45.0.0
• Removed joda-time dependency (migrated to java.time)

Code Migrations:

1. Jakarta EE Namespace (21 files): All javax.* imports → jakarta.* (validation, servlet APIs)
2. Joda-Time → java.time (16 files): DateTime → Instant across entities, DTOs, services, tests; updated Jackson serialization and MyBatis type handler
3. Spring Security 6.x: Complete rewrite of WebSecurityConfig using modern lambda DSL, removed deprecated WebSecurityConfigurerAdapter
4. JJWT 0.12.5 API: Updated token generation/parsing to use new Keys.hmacShaKeyFor() and .verifyWith() APIs
5. Netflix DGS 8.2.0: Updated GraphQL exception handler to return CompletableFuture, migrated to generated PageInfo type

Testing: All 68 tests pass locally with the new configuration.

Review & Testing Checklist for Human

⚠️ This is a high-risk PR requiring thorough testing. Please verify:

• Security Configuration: Test authentication flows, verify all protected endpoints require auth, test CORS from different origins, confirm public endpoints (/users, /users/login, GraphQL endpoints) are accessible without auth
• JWT Token Compatibility: Verify existing JWT tokens still work, or document if users need to re-authenticate. Test token generation and parsing with both new and edge case scenarios
• DateTime/Instant Migration: Check API response timestamps match expected UTC format, verify database timestamp queries work correctly, test pagination with cursor-based timestamps
• GraphQL API: Test all GraphQL queries and mutations, verify exception handling works correctly (now async via CompletableFuture), check that PageInfo pagination works
• Full Integration Testing: Run complete user registration → login → article CRUD → comments → favorites flow to ensure no breaking changes in critical paths

Recommended Test Plan

1. Start the application: ./gradlew bootRun
2. Test user registration and login (REST and GraphQL)
3. Test article CRUD operations with authentication
4. Test GraphQL pagination (articles feed, comments)
5. Test error cases (invalid input, unauthorized access)
6. Verify CORS works with a frontend client
7. Check application logs for any warnings or errors

Notes

• CI/CD Updated: GitHub Actions workflow now uses JDK 21
• Documentation Updated: README.md reflects Java 21 requirement
• Code Formatting: Spotless applied to all modified files
• Migration Approach: Instant uses UTC timezone matching the original DateTime behavior with UTC_CALENDAR
• Spring Security Changes: Replaced .antMatchers() with .requestMatchers(), .authorizeRequests() with .authorizeHttpRequests() - behavior should be equivalent but needs verification

Requested by: @milind-cognition
Devin run: https://app.devin.ai/sessions/4f3bbe8e6003483a89e0469f2a89da58

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment and CI monitoring