Migrate from Java 11 to Java 21 with Spring Boot 3.5.6

[devin-ai-integration]

Migrate from Java 11 to Java 21 with Spring Boot 3.5.6

Summary

Complete migration of the Spring Boot RealWorld Example Application from Java 11 + Spring Boot 2.6.3 to Java 21 + Spring Boot 3.5.6. This is a major upgrade that includes:

• Java: 11 → 21
• Spring Boot: 2.6.3 → 3.5.6
• Jakarta EE namespace migration: All javax.* imports → jakarta.* (23+ files affected)
• Spring Security 6 refactoring: WebSecurityConfigurerAdapter → SecurityFilterChain bean approach
• Netflix DGS: 4.9.21 → 10.4.0 with artifact name change (graphql-dgs-spring-boot-starter → graphql-dgs-spring-graphql-starter)
• JJWT: 0.11.2 → 0.13.0 with breaking API changes
• MyBatis: 2.2.2 → 3.0.5
• Rest Assured: 4.5.1 → 5.5.0
• Gradle: 7.4 → 8.10.2

All tests pass locally (70/70) and CI checks pass ✅

Review & Testing Checklist for Human

⚠️ Critical items to verify (in order of importance):

• Test GraphQL API endpoints with real clients, especially paginated queries (articles feed, comments). The PageInfo type changed from graphql.relay.DefaultPageInfo to generated io.spring.graphql.types.PageInfo, which could break existing clients if they rely on the response structure.

• Verify JWT authentication flows: Test login, token generation, and protected endpoints. JJWT 0.13.0 has breaking API changes:

  • Parser changed from parserBuilder().setSigningKey() to parser().verifyWith()
  • Signing now requires explicit algorithm specification
  • Ensure existing JWT tokens (if any) still work or document the breaking change

• Test error handling: Verify that REST API and GraphQL error responses maintain the expected format for clients. Both CustomizeExceptionHandler and GraphQLCustomizeExceptionHandler were modified, and the GraphQL handler now uses async API (CompletableFuture).

• Security configuration review: Validate that all endpoints have correct authentication requirements:

  • /graphiql and /graphql should be public
  • /articles/feed (GET) requires authentication
  • /users and /users/login (POST) should be public
  • All other endpoints require authentication

Test Plan Recommendation

1. Run the application locally and test the GraphQL playground at /graphiql
2. Execute a full authentication flow: register user → login → access protected endpoints
3. Test paginated GraphQL queries (articles, comments) and verify response structure
4. Verify CORS configuration still works for frontend clients
5. Test error scenarios (invalid JWT, validation errors) to ensure error responses are correct

Notes

• Deprecated @MockBean warnings: Tests show 23 deprecation warnings for @MockBean annotations marked for removal in future Java versions. This doesn't affect functionality now but will need addressing in a future migration.
• Netflix DGS artifact name change: In DGS 10.x, the artifact name changed from graphql-dgs-spring-boot-starter to graphql-dgs-spring-graphql-starter. Make sure any documentation or deployment scripts are updated.
• Spring Security 6: Completely refactored from WebSecurityConfigurerAdapter pattern to component-based SecurityFilterChain bean. Logic should be equivalent but worth double-checking security behavior.

---

Link to Devin run: https://app.devin.ai/sessions/51ca1f399821411bb7547217f2f98ad7
Requested by: Abhay Aggarwal (@abhay-codeium)

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment and CI monitoring