Java 17 across every JVM service; report-service and legacy-portal to Spring Boot 3.2.5

[devin-ai-integration]

Summary

Brings every JVM service in the repo to Java 17 (build file + Dockerfile + CI pin) and the two Spring Boot 2.x services to Spring Boot 3.2.5. Inventory in docs/java17-migration-intake.yaml; per-service detail, runtime results and follow-ups in MIGRATION_NOTES.md.

Service	Before	After
report-service (Maven)	Java 8 · Boot 2.5.15 · temurin-8/8-jre · CI '8'	Java 17 · Boot 3.2.5 · maven:3.9-eclipse-temurin-17/17-jre-jammy · CI '17'
legacy-portal (Maven)	Java 11 · Boot 2.7.18 · temurin-11/11-jre-jammy · CI '11'	Java 17 · Boot 3.2.5 · maven:3.9-eclipse-temurin-17/17-jre-jammy · CI '17'
auth-service (Gradle)	Java 17 · Boot 3.2.4	verified, unchanged
notification-service (Kotlin/Ktor)	jvmToolchain(17)	verified, unchanged
analytics-service (Scala/sbt)	JDK 17 images	verified, unchanged

Each migrate service was done by its own subsession (OpenRewrite UpgradeSpringBoot_3_2 first, hand-fixes after) on a branch scoped to that service directory; shared files (CI workflows, deps-remediation harness, README, notes) are lead-only commits.

What the recipe could not do (hand-fixed)

report-service:

• WebSecurityConfigurerAdapter → SecurityFilterChain bean. Added dispatcherTypeMatchers(DispatcherType.ERROR).permitAll() — Security 6 authorizes the ERROR dispatch too, so without it every 400/404 came back as an empty 403.
• SpringFox 3 → springdoc 2.5 (Docket → OpenAPI bean, @ApiModel* → @Schema); docs move to /v3/api-docs + /swagger-ui.html.
• Hibernate 6: @Lob String errorMessage → + @JdbcTypeCode(SqlTypes.LONGVARCHAR) so the Postgres column stays varchar, not oid (verified against Postgres 15).
• HttpClient 4 → 5 for the RestTemplate factory; read timeout via SocketConfig.
• Kept on purpose: commons-text 1.9 (CVE-2022-42889 lab fixture), POI 4, iText 5, Guava 28.

legacy-portal: coming from 11 there was only the javax→jakarta namespace change, the Boot 3 profile-document split (application-postgres.yml) and dropping explicit Hibernate dialects.

No --add-opens, no module-info.java, no plugin versions pinned over the Boot parent. Tests: report-service 50/0/1 skipped (JUnit 4 → 5), legacy-portal 16/0/1 skipped — identical before and after.

Shared changes

• ci.yml / docker-build.yml: both Maven jobs on Temurin 17 with cache: maven.
• deps-remediation.yml, security/deps/modules.yaml, dependency-cve-remediation skill: the CVE harness now measures the Maven modules on JDK 17 (follow-up: regenerate expected transcripts — the script: case that resolved via Nashorn on 11 is unresolved on 17).

Verification

• Repo-wide sweeps return nothing: import javax\. (outside the allowed packages), temurin-8|temurin:8|temurin-11|temurin:11|openjdk:8|openjdk:11 in Dockerfiles, java-version: '8'|'11' in workflows.
• Both apps booted on JDK 17 against Postgres 15 with no spring-boot-properties-migrator findings; primary read + write endpoints exercised (details in MIGRATION_NOTES.md). Behaviour deltas vs main: trailing-slash URLs and unmatched report-service paths now 404/403 — neither is used by the gateway or frontends.
• Frontend walkthrough recording: to follow in a PR comment.

Related

Earlier attempts at the same migration exist and are left untouched: #17, #74, #6, #273, #274 and branch devin/java17-boot3. This PR is an independent run on a fresh branch.

Link to Devin session: https://app.devin.ai/sessions/3edf13eff1e74d39b2ccfdfb547b77ed
Open in Devin Desktop: https://app.devin.ai/desktop/session/3edf13eff1e74d39b2ccfdfb547b77ed?variant=devin
Requested by: @TheWuster935

---

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring

[devin-ai-integration]

E2E frontend verification — report-service & legacy-portal on Java 17 / Boot 3.2.5

Ran the client-app (:3000) against a local compose stack with the migrated services built from this branch (jars from f9a55dcb; MANIFEST Spring-Boot-Version: 3.2.5, Build-Jdk-Spec: 17). Frontend behaves identically; the report-service contract through the gateway is unchanged.

Frontend write path (register → browse → upload)

• Register via UI → /dashboard (201); Files/Documents/Recent/Shared/Notifications/Settings all render, gateway log shows only 2xx.
• Upload boot3-smoke.txt → 201, file listed and persists after reload.

report-service via gateway (UI JWT): GET /api/v1/reports 200 → POST 202 (id:2 PENDING) → GET /2 200 COMPLETED rowCount:25 → download 200 text/csv.

springdoc Swagger UI (replaces SpringFox)

legacy-portal + Boot 3 deltas

• :8095/health → {"status":"UP","service":"legacy-portal"}; :8095/api/announcements → 200 JSON array.
• :8091/api/v1/reports/ (trailing slash) → 404; :8091/nope → 403 (direct only — through the gateway an unmatched /api/v1/reports/** path is 404); blank reportName → 400.

Caveat: the Docker images for report-service/legacy-portal could not be built on the test box — mvn dependency:go-offline in the temurin-17 builder stage got HTTP 429 from Maven Central — so the services ran as host jars with the gateway pointed at them. The temurin-17 Dockerfile stages are exercised by the docker-build CI jobs rather than here.

Screen recording of the walkthrough is attached to the session's final message.