Migrate from Java 11 to Java 21 with Spring Boot 3.2.0

[devin-ai-integration]

Migrate from Java 11 to Java 21 with Spring Boot 3.2.0

Summary

This PR migrates the Spring Boot RealWorld Example Application from Java 11 to Java 21, upgrading Spring Boot from version 2.6.3 to 3.2.0. This is a major version upgrade that includes three main code migrations:

1. Jakarta EE Namespace Migration - Replaced all javax.* imports with jakarta.* (affecting validation and servlet APIs across 19 files)
2. Joda-Time to java.time Migration - Replaced Joda-Time's DateTime with Java's Instant API (affecting 16 files including serialization, MyBatis handlers, and domain entities)
3. Spring Security 6.x Migration - Refactored WebSecurityConfig from deprecated WebSecurityConfigurerAdapter to the new SecurityFilterChain pattern with lambda DSL

Build Configuration Changes

• Java: 11 → 21
• Spring Boot: 2.6.3 → 3.2.0
• MyBatis: 2.2.2 → 3.0.3
• DGS Framework: 4.9.21 → 8.2.0 (starter), 5.0.6 → 8.1.1 (codegen plugin)
• JWT: 0.11.2 → 0.12.5
• Removed: joda-time dependency (replaced with java.time)
• Updated GitHub Actions workflow to use JDK 21

Review & Testing Checklist for Human

⚠️ Critical: I encountered a persistent Gradle cache corruption issue during local development that prevented me from verifying the build locally. All code changes follow standard migration patterns and look correct, but I could not run tests or compile locally. This PR requires thorough CI and integration testing before merging.

• Verify CI build passes completely - Check that all tests pass and the application compiles successfully
• Test authentication and authorization - Manually verify all endpoints still have correct access control (especially /articles/feed, /users, /users/login, GraphQL endpoints). The Spring Security configuration was completely refactored and needs validation.
• Verify API response formats - Confirm that timestamp fields in API responses are still in ISO-8601 format (e.g., 2023-12-07T10:30:00.000Z). The DateTime → Instant migration should preserve format, but needs verification.
• Test GraphQL API - Verify GraphQL queries and mutations work correctly after DGS framework upgrade (4.9.21 → 8.2.0)
• Integration testing - Deploy to test environment and run smoke tests on core functionality (create article, add comment, favorite article, follow user)
• Database date/time operations - Verify that date/time fields are correctly saved to and retrieved from the SQLite database

Notes

• The Spring Security configuration in WebSecurityConfig.java has been completely refactored from the deprecated WebSecurityConfigurerAdapter pattern to the new SecurityFilterChain bean approach with lambda DSL. While this follows Spring's official migration guide, it's the highest risk change and requires careful review of authorization rules.
• All timestamps now use java.time.Instant instead of Joda-Time's DateTime. Jackson serialization uses DateTimeFormatter.ISO_INSTANT which should produce the same format as the old ISODateTimeFormat.dateTime().withZoneUTC().print().
• The MyBatis DateTimeHandler now uses Timestamp.from(instant) and timestamp.toInstant() for SQL conversion, maintaining UTC timezone handling.
• The DateTimeCursor pagination still uses epoch milliseconds (Instant.toEpochMilli()) for backward compatibility.
• Minor version mismatch: DGS codegen plugin is 8.1.1 (latest available) while DGS starter is 8.2.0. This should be compatible but worth monitoring.

Link to Devin run: https://app.devin.ai/sessions/d946d4f51bd2439db061dbf370041c87
Requested by: @milind-cognition

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment and CI monitoring