Upgrade to Java 21 and Spring Boot 3.5.5

[devin-ai-integration]

Upgrade to Java 21 and Spring Boot 3.5.5

Summary

Major upgrade of the Spring Boot RealWorld Example Application from Java 11 to Java 21, including Spring Boot 2.6.3 → 3.5.5, complete namespace migration from javax.* to jakarta.*, replacement of deprecated Joda-Time with java.time API, and modernization of Spring Security configuration.

Key Changes

• Java Runtime: 11 → 21
• Spring Boot: 2.6.3 → 3.5.5 (chose 3.5.5 over 3.2.0 as 3.2.x OSS support ended Dec 2024)
• Namespace Migration: Migrated all javax.* imports to jakarta.* (servlet, validation, crypto) across 21 files
• Joda-Time Replacement: Replaced all DateTime usage with java.time.Instant across 16 files, including:
  • Created InstantHandler (MyBatis TypeHandler)
  • Created InstantCursor for pagination
  • Updated Jackson serializer to use DateTimeFormatter.ISO_INSTANT
• Spring Security: Migrated from deprecated WebSecurityConfigurerAdapter to SecurityFilterChain bean pattern with lambda-based configuration
• Dependency Updates:
  • MyBatis: 2.2.2 → 3.0.5
  • Netflix DGS: 4.9.21 → 10.4.0 (new artifact: graphql-dgs-spring-graphql-starter)
  • DGS Codegen: 5.0.6 → 8.1.1
  • JJWT: 0.11.2 → 0.13.0
  • SQLite JDBC: 3.36.0.3 → 3.50.3.0
  • rest-assured: 4.5.1 → 5.5.0
• CI/CD: Updated to JDK 21

Review & Testing Checklist for Human

⚠️ CRITICAL: Local build failed due to Gradle cache corruption in dev environment. All changes are untested locally - CI verification is essential.

High-risk areas requiring thorough testing:

• Verify CI passes completely - All tests must pass since local testing was not possible
• Test GraphQL endpoints - Netflix DGS 10.x is a major upgrade (4.9.21 → 10.4.0) with breaking changes and new artifact name. Test all GraphQL queries and mutations work correctly.
• Test JWT authentication flow - Verify login, token generation, and authenticated requests work with jakarta.crypto and new Spring Security configuration
• Verify timestamp handling - Check that API responses show correct timestamps (migrated from Joda-Time DateTime to java.time.Instant). Both should use UTC but serialization format may differ.
• Test endpoint security - Verify all endpoints have correct access control (public vs authenticated) with new requestMatchers instead of antMatchers
• Run full integration test suite - Confirm all migrations work together correctly

Recommended Test Plan

1. Start the application and verify it boots successfully
2. Test GraphQL endpoints via /graphql and /graphiql
3. Test REST API endpoints for articles, comments, users, profiles
4. Verify user registration, login, and JWT token flow
5. Check article creation, favoriting, and commenting features
6. Verify timestamps in API responses are formatted correctly
7. Confirm all security rules (authenticated vs public endpoints)

Notes

• Spring Boot 3.5.5 chosen over 3.2.0: 3.2.x OSS support ended in December 2024, so targeting latest stable version (3.5.5) for better long-term support
• DGS artifact change: Netflix DGS 10.x uses graphql-dgs-spring-graphql-starter instead of graphql-dgs-spring-boot-starter
• Timezone handling: Migrated from Joda-Time DateTime to java.time.Instant. Both use UTC but Instant is the modern Java standard
• MyBatis TypeHandler: Replaced DateTimeHandler with InstantHandler for database timestamp mapping

---

Link to Devin run: https://app.devin.ai/sessions/50e07b749c944f39ad967a8399b45034
Requested by: @abhay-codeium

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment and CI monitoring

[osminb]

hey devin can you check this again.