chore(backend): Upgrade spring boot from v3.5 to v4, exposed from v0.61 to v1

[tombch]

Still a work in progress and some further testing required for this!

Sources used:

https://github.com/spring-projects/spring-boot/wiki/Spring-Boot-4.0-Migration-Guide
https://github.com/spring-projects/spring-boot/wiki/Spring-Boot-3.4-Release-Notes
https://spring.io/blog/2025/10/07/introducing-jackson-3-support-in-spring#keep-using-jackson-2-support-temporarily
https://www.jetbrains.com/help/exposed/migration-guide-1-0-0.html

Screenshot

PR Checklist

• All necessary documentation has been adapted.
• The implemented feature is covered by appropriate, automated tests.
• Any manual testing that has been done is documented (i.e. what exactly was tested?)

🚀 Preview: Add preview label to enable

[claude]

This PR may be related to: #5735, #5754

[corneliusroemer]

Good job getting CI green!

I've had a go at the same migration in December - might be useful to cross-check what I did back then - maybe with Claude Code :)

https://github.com/loculus-project/loculus/pull/5736/changes

[corneliusroemer]

I'll have a look, as I had a go at the spring boot part last dec already.

Wondering what the reason is to do spring boot v3->v4 and exposed v0->v1 in one go rather than split up in 2. Is this necessary or did you think it would be good to get the 2 big migrations out together to do the testing just once?

Exposed 1 theoretically supports v3 spring boot per:

Version 1.0.0 maintains compatibility with Spring Framework 6 and Spring Boot 3 via the original exposed-spring-boot-starter artifact (and its spring-transaction dependency).
https://www.jetbrains.com/help/exposed/migration-guide-1-0-0.html?utm_source=chatgpt.com#spring-dependencies

So one could do exposed v1 first.

[tombch]

Thanks! Yeah there was no particular reason to do this all in one PR - it seemed to be working so I opened it as one, but everything up to commit ecbbc18 should cover the exposed upgrade. So I could split them out if that makes it easier to review / more thorough for testing?

Compared to your PR, I guess the main things this PR is lacking currently is there's no upgrade to Jackson 3 yet but this is not required for the minimum Spring boot 4 (i haven't tried the latest Spring boot 4 yet)