feature: upgrade Spring Boot 2.6.3 -> 4.1.1 (Java 17, Jakarta, Security 6, DGS 12, Jackson 3)

[devin-ai-integration]

Summary

Incremental upgrade of the app from Spring Boot 2.6.3 → 4.1.1 (GA), one version line per commit, with ./gradlew test green (68 tests) at every step. No tests were modified or disabled; test changes are limited to import/annotation migrations required by Boot 4's modular test packages.

Final versions

	Before	After
Spring Boot	2.6.3	4.1.1 (Spring Framework 7.0.9, Spring GraphQL 2.0.5, graphql-java 25.0)
Java	11	17 (Gradle toolchain)
Gradle wrapper	6.x	8.14.3
Netflix DGS	4.9.x	12.0.1 (graphql-dgs-spring-graphql-starter), codegen plugin 8.6.0
MyBatis Spring Boot	2.2.x	4.1.0
Flyway	flyway-core (Boot managed)	spring-boot-starter-flyway (Flyway 12.x, Boot managed)
Jackson	2.x (com.fasterxml)	3.1.6 (tools.jackson; Jackson 2 BOM 2.21.6 for transitive users)
Rest Assured	4.x	5.5.7

Version-by-version path (one commit each)

1. 2.6.3 → 2.7.18 – DGS 5.5.5, MyBatis 2.3.2, Gradle 7.6.4. Pinned graphql-java.version=19.2 (Boot's managed 18.x lacked RuntimeWiring.transform needed by DGS). Codegen typeMapping PageInfo -> graphql.relay.PageInfo to fix generated-type clash.

2. 2.7 → 3.0.13 – Java 17 toolchain; javax.* → jakarta.*; WebSecurityConfigurerAdapter → SecurityFilterChain bean with lambda DSL, antMatchers → requestMatchers; handleMethodArgumentNotValid(..., HttpStatusCode, ...) signature; DGS 6.0.5; MyBatis 3.0.3; Rest Assured versions delegated to Boot's BOM.

3. 3.0 → 3.1.12 – DGS 7.6.0, Gradle 8.5.

4. 3.1 → 3.2.12 – switched to graphql-dgs-spring-graphql-starter (DGS 8.7.1, DGS now runs on Spring GraphQL); DGS DataFetcherExceptionHandler.onException → async handleException returning CompletableFuture; spring.graphql.schema.inspection.enabled=false because Spring GraphQL's SchemaMappingInspector derives node type Articles from ArticlesConnection (schema type is Article) and fails startup; Spotless target 'src/**/*.java' to avoid an undeclared dependency on generateJava output.

5. 3.2 → 3.3.13 – DGS 9.2.2, MyBatis 3.0.5.

6. 3.3 → 3.4.13 – DGS 10.1.2.

7. 3.4 → 3.5.16 – DGS 10.6.0.

8. 3.5 → 4.0.8 – Gradle 8.14.3; modular starters (spring-boot-starter-webmvc, -jdbc, -flyway, -webmvc-test, -security-test, -jdbc-test); @MockBean → @MockitoBean; test imports moved to org.springframework.boot.webmvc.test.autoconfigure.*, org.springframework.boot.jdbc.test.autoconfigure.*, org.springframework.boot.validation.autoconfigure.*; explicit Rest Assured 5.5.7 (no longer Boot-managed); DGS 11.1.0 (first DGS line built for Boot 4); MyBatis 4.0.1.
   Jackson 3 migration (Boot 4 default mapper is Jackson 3, so the Jackson 2 customizations were silently ignored → 16 test failures):

   -public Module realWorldModules()            // com.fasterxml.jackson.databind.Module
   +public JacksonModule realWorldModules()     // tools.jackson.databind.JacksonModule
   -class DateTimeSerializer extends StdSerializer<DateTime> { serialize(v, gen, SerializerProvider) throws IOException }
   +class DateTimeSerializer extends StdSerializer<DateTime> { serialize(v, gen, SerializationContext) }
   -class ErrorResourceSerializer extends JsonSerializer<ErrorResource>
   +class ErrorResourceSerializer extends ValueSerializer<ErrorResource>   // writeObjectFieldStart -> writeObjectPropertyStart etc.
   -import com.fasterxml.jackson.databind.annotation.JsonSerialize;
   +import tools.jackson.databind.annotation.JsonSerialize;

   com.fasterxml.jackson.annotation.* annotations are unchanged (still the annotation package in Jackson 3).

9. 4.0 → 4.1.1 – DGS 12.0.1, codegen 8.6.0, MyBatis 4.1.0. DGS 12 has json-path {strictly 3.0.0} (Jackson 3 provider) while Boot 4.1.1 still manages json-path 2.10.0 → ClassNotFoundException: Jackson3JsonProvider in DgsQueryExecutor. Fixed with ext['json-path.version'] = '3.0.0' in build.gradle.

10. Runtime fix (bug: commit) – POST /graphql returned 400 Root name ('query') does not match expected ('SerializableGraphQlRequest'). The REST API relies on global spring.jackson.deserialization.UNWRAP_ROOT_VALUE=true, which Spring GraphQL's HTTP handler also picked up. Verified this was broken since step 4 (Boot 3.5 build reproduces it; original 2.6.3 with DGS's own endpoint works). Fix: GraphQlHttpConfig defines the GraphQlHttpHandler bean (auto-config is @ConditionalOnMissingBean) with a JacksonJsonHttpMessageConverter built from jsonMapper.rebuild().disable(UNWRAP_ROOT_VALUE).

11. Snyk fixes (bug: commit) – the Snyk PR check flagged sqlite-jdbc 3.36.0.3 (CVE-2023-32697, high) and jackson-databind 3.1.5 / 2.21.5 (CVE-2026-19032, CVE-2026-83557). Bumped sqlite-jdbc → 3.53.2.1 and pinned jackson-bom.version=3.1.6, jackson-2-bom.version=2.21.6. Local snyk_sca_scan now reports 0 issues; build/tests/runtime re-verified.

DGS compatibility

DGS releases are tied to Boot lines: 5.x (Boot 2.7), 6.x (3.0), 7.x (3.1), 8.x (3.2), 9.x (3.3), 10.x (3.4/3.5), 11.x+ (Boot 4; per DGS 11.0.0 release notes). DGS 12.0.1 (built against Boot 4.0.0 / Spring GraphQL 2.0.x) works with Boot 4.1.1 — all GraphQL tests pass and the live /graphql endpoint answers correctly. No incompatibility blocker was hit.

Verification (Boot 4.1.1)

./gradlew clean build passes (68 tests, 0 failures). App started from the built jar; banner shows Spring Boot :: (v4.1.1). Exercised via curl: POST /users → POST /users/login (JWT) → POST /articles with Authorization: Token <jwt> → GET /articles → GraphQL articles(first: 10) query on /graphql. Full log + curl output in the session's evidence file.

Notes for reviewers

• No CI workflow exists in this repo, so nothing to update for the JDK bump; CI should use JDK 17+.
• joda-time is still used for DateTime (kept to avoid unrelated refactors); serialization now goes through the Jackson 3 module.
• spring-boot-starter-hateoas pulls Rest Assured / json-path transitively; explicit versions are only where Boot 4 no longer manages them.

Devin-Org: engineering

Link to Devin session: https://app.devin.ai/sessions/52eb760e330448d7945177161dba9c06
Open in Devin Desktop: https://app.devin.ai/desktop/session/52eb760e330448d7945177161dba9c06?variant=devin
Requested by: @clivingston-cognition

---

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring

[devin-ai-integration]

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no bugs or issues to report.