feature: upgrade to Java 21 and Spring Boot 3.2

[yanmoiseev-cog]

Summary

Moves the project to Java 21 / Spring Boot 3.2.12, so it builds on a current LTS JDK. ./gradlew clean build is green: DGS codegen, compilation, spotless, and all 68 tests pass.

Version pins: Boot 3.2.12, dependency-management 1.1.7, Gradle wrapper 8.10, DGS codegen plugin 6.2.1, DGS starter 8.6.0, MyBatis Boot starter/test 3.0.4, spotless 6.25.0 (googleJavaFormat 1.22.0), rest-assured 5.4.0, jjwt 0.11.5. flyway-core (Boot-managed), sqlite-jdbc, and joda-time are unchanged — the joda-time → java.time migration is deliberately out of scope.

Non-mechanical changes beyond the javax.* → jakarta.* import sweep:

• Spring Security 6: WebSecurityConfigurerAdapter is gone, so WebSecurityConfig now exposes a SecurityFilterChain bean using the lambda DSL. Authorization rules, permitted endpoints, stateless session policy, CSRF/CORS behavior, the HttpStatusEntryPoint(UNAUTHORIZED) entry point, and JWT filter placement are all preserved (antMatchers → requestMatchers).

• DGS 8 codegen now generates its own io.spring.graphql.types.PageInfo instead of reusing graphql.relay.DefaultPageInfo, so the page-info builders in ArticleDatafetcher/CommentDatafetcher construct the generated type; cursors are plain strings rather than DefaultConnectionCursor:

  PageInfo.newBuilder()
      .startCursor(articles.getStartCursor() == null ? null : articles.getStartCursor().toString())
      .endCursor(...)
      .hasPreviousPage(articles.hasPrevious())
      .hasNextPage(articles.hasNext())
      .build();

• graphql-java: DataFetcherExceptionHandler.onException was replaced by the async handleException, so GraphQLCustomizeExceptionHandler returns CompletableFuture<DataFetcherExceptionHandlerResult>.

• CustomizeExceptionHandler uses HttpStatusCode per the Spring 6 signature change.

• spotlessJava needed explicit dependsOn(generateJava, compileJava, processResources) — Gradle 8 fails validation when a task consumes another task's output directory without a declared dependency, which the existing fileTree(rootDir) spotless target does.

Note: this branch was developed against avyshetsky/spring-boot-realworld-[REDACTED SECRET]-app, which we have no push access to, so the PR targets this fork.

Devin-Org: engineering

Link to Devin session: https://app.devin.ai/sessions/0be8eb687ed640e280a494a244b06d0a
Open in Devin Desktop: https://app.devin.ai/desktop/session/0be8eb687ed640e280a494a244b06d0a?variant=devin
Requested by: @yanmoiseev-cog

---

Devin Review

Status	Commit
⚪ Not started	—

Run Devin Review

💡 Connect your GitHub account to enable automatic code reviews.

---

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring

[devin-ai-integration]

Devin Review found 2 potential issues.