Upgrade to Spring Boot 4.0, Hibernate 7, Liquibase 5, Jackson 3

server/build.gradle

@@ -5,7 +5,7 @@ plugins {
 	id "jacoco"
 	id "com.github.andygoossens.modernizer" version "1.12.0"
 	id "com.gorylenko.gradle-git-properties" version "2.5.7"
-	id "org.springframework.boot" version "3.5.10"
+	id "org.springframework.boot" version "4.0.2"
 	id "io.spring.dependency-management" version "1.1.7"
 	id "com.github.ben-manes.versions" version "0.53.0"
 	id "com.diffplug.spotless" version "8.2.1"
@@ -35,13 +35,13 @@ repositories {
 
 dependencies {
 	implementation "org.springframework.boot:spring-boot-starter-data-jpa"
-	implementation "org.springframework.boot:spring-boot-starter-web"
+	implementation "org.springframework.boot:spring-boot-starter-webmvc"
 	implementation "org.springframework.boot:spring-boot-starter-validation"
 	implementation "org.springframework.boot:spring-boot-starter-mail"
 	implementation "org.springframework.boot:spring-boot-starter-webflux"
 	implementation "org.springframework.boot:spring-boot-starter-security"
-	implementation "org.springframework.boot:spring-boot-starter-oauth2-client"
-	implementation "org.springframework.boot:spring-boot-starter-oauth2-resource-server"
+	implementation "org.springframework.boot:spring-boot-starter-security-oauth2-client"
+	implementation "org.springframework.boot:spring-boot-starter-security-oauth2-resource-server"
 	implementation "org.springframework.boot:spring-boot-starter-thymeleaf"
 	implementation "org.springframework.boot:spring-boot-starter-actuator"
 
@@ -53,7 +53,7 @@ dependencies {
 	// Avoid outdated version to prevent security issues
 	implementation("net.minidev:json-smart") { version { 				strictly "2.6.0" } }
 
-	implementation "org.liquibase:liquibase-core:4.33.0"
+	implementation "org.springframework.boot:spring-boot-starter-liquibase"
 	implementation "org.postgresql:postgresql:42.7.9"
 
 	implementation "commons-io:commons-io:2.21.0"
@@ -80,6 +80,7 @@ dependencies {
 		exclude group: "com.vaadin.external.google", module: "android-json"
 		exclude group: "org.xmlunit", module: "xmlunit-core"
 	}
+	testImplementation "org.springframework.boot:spring-boot-starter-webmvc-test"
 
 	testImplementation "org.mockito:mockito-core:5.21.0"
 	testImplementation "org.mockito:mockito-junit-jupiter:5.21.0"

server/gradle/wrapper/gradle-wrapper.properties

@@ -1,6 +1,6 @@
 distributionBase=GRADLE_USER_HOME
 distributionPath=wrapper/dists
-distributionUrl=https\://services.gradle.org/distributions/gradle-9.2.1-bin.zip
+distributionUrl=https\://services.gradle.org/distributions/gradle-9.3.1-bin.zip
 networkTimeout=10000
 validateDistributionUrl=true
 zipStoreBase=GRADLE_USER_HOME

server/src/main/java/de/tum/cit/aet/thesis/entity/Thesis.java

@@ -80,7 +80,7 @@ public class Thesis {
 private ThesisVisibility visibility;
 
 @JdbcTypeCode(SqlTypes.ARRAY)
-@Column(name = "keywords", columnDefinition = "text[]")
+@Column(name = "keywords", columnDefinition = "text[]", nullable = false)
 private Set<String> keywords = new HashSet<>();
 
 @ManyToOne(fetch = FetchType.LAZY)

server/src/main/java/de/tum/cit/aet/thesis/exception/ResponseExceptionHandler.java

@@ -1,7 +1,5 @@
 package de.tum.cit.aet.thesis.exception;
 
-import com.fasterxml.jackson.core.JsonParseException;
-import com.fasterxml.jackson.core.JsonProcessingException;
 import de.tum.cit.aet.thesis.dto.ErrorDto;
 import de.tum.cit.aet.thesis.exception.request.AccessDeniedException;
 import de.tum.cit.aet.thesis.exception.request.ResourceAlreadyExistsException;
@@ -14,6 +12,8 @@
 import org.springframework.web.bind.annotation.ExceptionHandler;
 import org.springframework.web.context.request.WebRequest;
 import org.springframework.web.servlet.mvc.method.annotation.ResponseEntityExceptionHandler;
+import tools.jackson.core.JacksonException;
+import tools.jackson.core.exc.StreamReadException;
 
 import java.text.ParseException;
 
@@ -32,8 +32,8 @@ protected ResponseEntity<Object> handleAlreadyExists(RuntimeException ex, WebReq
 	@ExceptionHandler({
 			ParseException.class,
 			ResourceInvalidParametersException.class,
-			JsonParseException.class,
-			JsonProcessingException.class,
+			StreamReadException.class,
+			JacksonException.class,
 	})
 	protected ResponseEntity<Object> handleBadRequest(RuntimeException ex, WebRequest request) {
 		return handleExceptionInternal(ex, ErrorDto.fromRuntimeException(ex), new HttpHeaders(), HttpStatus.BAD_REQUEST, request);

server/src/main/java/de/tum/cit/aet/thesis/repository/ApplicationRepository.java

@@ -44,8 +44,8 @@ Page<Application> searchApplications(
 			@Param("reviewerId") UUID reviewerId,
 			@Param("searchQuery") String searchQuery,
 			@Param("states") Set<ApplicationState> states,
-			@Param("previousIds") Set<String> previousIds,
-			@Param("topics") Set<String> topics,
+			@Param("previousIds") Set<UUID> previousIds,
+			@Param("topics") Set<UUID> topics,
 			@Param("types") Set<String> types,
 			@Param("includeSuggestedTopics") boolean includeSuggestedTopics,
 			Pageable page

server/src/main/java/de/tum/cit/aet/thesis/security/JwtAuthConverter.java

@@ -1,8 +1,8 @@
 package de.tum.cit.aet.thesis.security;
 
+import org.jspecify.annotations.NonNull;
+import org.jspecify.annotations.Nullable;
 import org.springframework.core.convert.converter.Converter;
-import org.springframework.lang.NonNull;
-import org.springframework.lang.Nullable;
 import org.springframework.security.authentication.AbstractAuthenticationToken;
 import org.springframework.security.core.GrantedAuthority;
 import org.springframework.security.core.authority.SimpleGrantedAuthority;

server/src/main/java/de/tum/cit/aet/thesis/service/ApplicationService.java

@@ -38,6 +38,7 @@
 import java.util.Optional;
 import java.util.Set;
 import java.util.UUID;
+import java.util.stream.Collectors;
 
 /**
  * Handles the lifecycle of thesis applications, including creation, review, acceptance, and rejection.
@@ -130,9 +131,9 @@ public Page<Application> getAll(
 		ResearchGroup researchGroup = currentUserProvider().getResearchGroupOrThrow();
 		String searchQueryFilter = searchQuery == null || searchQuery.isEmpty() ? null : searchQuery.toLowerCase();
 		Set<ApplicationState> statesFilter = states == null || states.length == 0 ? null : new HashSet<>(Arrays.asList(states));
-		Set<String> topicsFilter = topics == null || topics.length == 0 ? null : new HashSet<>(Arrays.asList(topics));
+		Set<UUID> topicsFilter = topics == null || topics.length == 0 ? null : Arrays.stream(topics).map(UUID::fromString).collect(Collectors.toSet());
 		Set<String> typesFilter = types == null || types.length == 0 ? null : new HashSet<>(Arrays.asList(types));
-		Set<String> previousFilter = previous == null || previous.length == 0 ? null : new HashSet<>(Arrays.asList(previous));
+		Set<UUID> previousFilter = previous == null || previous.length == 0 ? null : Arrays.stream(previous).map(UUID::fromString).collect(Collectors.toSet());
 
 		return applicationRepository.searchApplications(
 				researchGroup == null ? null : researchGroup.getId(),

server/src/test/java/de/tum/cit/aet/thesis/controller/ApplicationControllerTest.java

@@ -3,7 +3,6 @@
 import static org.assertj.core.api.Assertions.assertThat;
 import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.status;
 
-import com.fasterxml.jackson.databind.JsonNode;
 import de.tum.cit.aet.thesis.constants.ApplicationRejectReason;
 import de.tum.cit.aet.thesis.constants.ApplicationReviewReason;
 import de.tum.cit.aet.thesis.constants.ApplicationState;
@@ -24,6 +23,7 @@
 import org.springframework.test.context.DynamicPropertySource;
 import org.springframework.test.web.servlet.request.MockMvcRequestBuilders;
 import org.testcontainers.junit.jupiter.Testcontainers;
+import tools.jackson.databind.JsonNode;
 
 import java.time.Instant;
 import java.util.List;
@@ -74,11 +74,11 @@ void createApplication_Success() throws Exception {
 					.andReturn().getResponse().getContentAsString();
 
 			JsonNode json = objectMapper.readTree(response);
-			assertThat(json.get("thesisTitle").asText()).isEqualTo("Test Thesis");
-			assertThat(json.get("thesisType").asText()).isEqualTo("MASTER");
-			assertThat(json.get("motivation").asText()).isEqualTo("Test motivation");
-			assertThat(json.get("state").asText()).isEqualTo(ApplicationState.NOT_ASSESSED.getValue());
-			assertThat(json.get("applicationId").asText()).isNotBlank();
+			assertThat(json.get("thesisTitle").asString()).isEqualTo("Test Thesis");
+			assertThat(json.get("thesisType").asString()).isEqualTo("MASTER");
+			assertThat(json.get("motivation").asString()).isEqualTo("Test motivation");
+			assertThat(json.get("state").asString()).isEqualTo(ApplicationState.NOT_ASSESSED.getValue());
+			assertThat(json.get("applicationId").asString()).isNotBlank();
 
 			assertThat(applicationRepository.count()).isEqualTo(1);
 		}
@@ -103,8 +103,8 @@ void createApplication_WithTopic_Success() throws Exception {
 
 			JsonNode json = objectMapper.readTree(response);
 			assertThat(json.get("topic")).isNotNull();
-			assertThat(json.get("motivation").asText()).isEqualTo("Motivation for topic");
-			assertThat(json.get("state").asText()).isEqualTo(ApplicationState.NOT_ASSESSED.getValue());
+			assertThat(json.get("motivation").asString()).isEqualTo("Motivation for topic");
+			assertThat(json.get("state").asString()).isEqualTo(ApplicationState.NOT_ASSESSED.getValue());
 		}
 
 		@Test
@@ -167,7 +167,7 @@ void createApplication_VerifyDatabaseState() throws Exception {
 					.andExpect(status().isOk())
 					.andReturn().getResponse().getContentAsString();
 
-			UUID applicationId = UUID.fromString(objectMapper.readTree(response).get("applicationId").asText());
+			UUID applicationId = UUID.fromString(objectMapper.readTree(response).get("applicationId").asString());
 
 			var application = applicationRepository.findById(applicationId).orElseThrow();
 			assertThat(application.getThesisTitle()).isEqualTo("Database Check Thesis");
@@ -228,6 +228,46 @@ void getApplications_FilterByState() throws Exception {
 			assertThat(jsonEmpty.get("content").size()).isZero();
 		}
 
+		@Test
+		void getApplications_FilterByPreviousIds() throws Exception {
+			String studentAuth = createRandomAuthentication("student");
+			UUID applicationId = createTestApplication(studentAuth, "Previous App");
+
+			// Reject the application so it no longer matches NOT_ASSESSED state
+			createTestEmailTemplate("APPLICATION_REJECTED");
+			RejectApplicationPayload rejectPayload = new RejectApplicationPayload(
+					ApplicationRejectReason.GENERAL, false
+			);
+			mockMvc.perform(MockMvcRequestBuilders.put("/v2/applications/{applicationId}/reject", applicationId)
+							.header("Authorization", createRandomAdminAuthentication())
+							.contentType(MediaType.APPLICATION_JSON)
+							.content(objectMapper.writeValueAsString(rejectPayload)))
+					.andExpect(status().isOk());
+
+			// Without previous param, filtering by NOT_ASSESSED should return nothing
+			String responseWithout = mockMvc.perform(MockMvcRequestBuilders.get("/v2/applications")
+							.header("Authorization", createRandomAdminAuthentication())
+							.param("fetchAll", "true")
+							.param("state", "NOT_ASSESSED"))
+					.andExpect(status().isOk())
+					.andReturn().getResponse().getContentAsString();
+
+			assertThat(objectMapper.readTree(responseWithout).get("content").size()).isZero();
+
+			// With previous param, the rejected application should still be included
+			String responseWith = mockMvc.perform(MockMvcRequestBuilders.get("/v2/applications")
+							.header("Authorization", createRandomAdminAuthentication())
+							.param("fetchAll", "true")
+							.param("state", "NOT_ASSESSED")
+							.param("previous", applicationId.toString()))
+					.andExpect(status().isOk())
+					.andReturn().getResponse().getContentAsString();
+
+			JsonNode json = objectMapper.readTree(responseWith);
+			assertThat(json.get("content").size()).isEqualTo(1);
+			assertThat(json.get("content").get(0).get("applicationId").asString()).isEqualTo(applicationId.toString());
+		}
+
 		@Test
 		void getApplications_AsStudent_ReturnsOwnOnly() throws Exception {
 			String studentAuth = createRandomAuthentication("student");
@@ -243,7 +283,7 @@ void getApplications_AsStudent_ReturnsOwnOnly() throws Exception {
 
 			JsonNode json = objectMapper.readTree(response);
 			assertThat(json.get("content").size()).isEqualTo(1);
-			assertThat(json.get("content").get(0).get("thesisTitle").asText()).isEqualTo("Student Application");
+			assertThat(json.get("content").get(0).get("thesisTitle").asString()).isEqualTo("Student Application");
 		}
 
 		@Test
@@ -279,9 +319,9 @@ void getApplication_Success() throws Exception {
 					.andReturn().getResponse().getContentAsString();
 
 			JsonNode json = objectMapper.readTree(response);
-			assertThat(json.get("applicationId").asText()).isEqualTo(applicationId.toString());
-			assertThat(json.get("thesisTitle").asText()).isEqualTo("Test Application");
-			assertThat(json.get("state").asText()).isEqualTo(ApplicationState.NOT_ASSESSED.getValue());
+			assertThat(json.get("applicationId").asString()).isEqualTo(applicationId.toString());
+			assertThat(json.get("thesisTitle").asString()).isEqualTo("Test Application");
+			assertThat(json.get("state").asString()).isEqualTo(ApplicationState.NOT_ASSESSED.getValue());
 		}
 
 		@Test
@@ -361,10 +401,10 @@ void updateApplication_Success() throws Exception {
 					.andReturn().getResponse().getContentAsString();
 
 			JsonNode json = objectMapper.readTree(response);
-			assertThat(json.get("thesisTitle").asText()).isEqualTo("Updated Thesis");
-			assertThat(json.get("thesisType").asText()).isEqualTo("BACHELOR");
-			assertThat(json.get("motivation").asText()).isEqualTo("Updated motivation");
-			assertThat(json.get("state").asText()).isEqualTo(ApplicationState.NOT_ASSESSED.getValue());
+			assertThat(json.get("thesisTitle").asString()).isEqualTo("Updated Thesis");
+			assertThat(json.get("thesisType").asString()).isEqualTo("BACHELOR");
+			assertThat(json.get("motivation").asString()).isEqualTo("Updated motivation");
+			assertThat(json.get("state").asString()).isEqualTo(ApplicationState.NOT_ASSESSED.getValue());
 
 			var application = applicationRepository.findById(applicationId).orElseThrow();
 			assertThat(application.getThesisTitle()).isEqualTo("Updated Thesis");
@@ -435,7 +475,7 @@ void updateComment_Success() throws Exception {
 					.andReturn().getResponse().getContentAsString();
 
 			JsonNode json = objectMapper.readTree(response);
-			assertThat(json.get("comment").asText()).isEqualTo("Management comment");
+			assertThat(json.get("comment").asString()).isEqualTo("Management comment");
 
 			var application = applicationRepository.findById(applicationId).orElseThrow();
 			assertThat(application.getComment()).isEqualTo("Management comment");
@@ -496,7 +536,7 @@ void reviewApplication_Success() throws Exception {
 					.andReturn().getResponse().getContentAsString();
 
 			JsonNode json = objectMapper.readTree(response);
-			assertThat(json.get("applicationId").asText()).isEqualTo(applicationId.toString());
+			assertThat(json.get("applicationId").asString()).isEqualTo(applicationId.toString());
 
 			assertThat(applicationReviewerRepository.count()).isEqualTo(1);
 		}
@@ -584,7 +624,7 @@ void acceptApplication_Success() throws Exception {
 
 			boolean hasAccepted = false;
 			for (JsonNode app : json) {
-				if (app.get("state").asText().equals(ApplicationState.ACCEPTED.getValue())) {
+				if (app.get("state").asString().equals(ApplicationState.ACCEPTED.getValue())) {
 					hasAccepted = true;
 				}
 			}
@@ -689,7 +729,7 @@ void rejectApplication_Success() throws Exception {
 
 			boolean hasRejected = false;
 			for (JsonNode app : json) {
-				if (app.get("state").asText().equals(ApplicationState.REJECTED.getValue())) {
+				if (app.get("state").asString().equals(ApplicationState.REJECTED.getValue())) {
 					hasRejected = true;
 				}
 			}
@@ -755,7 +795,7 @@ void rejectApplication_FailedStudentRequirements_RejectsAllPending() throws Exce
 							.content(objectMapper.writeValueAsString(payload1)))
 					.andExpect(status().isOk())
 					.andReturn().getResponse().getContentAsString();
-			UUID appId1 = UUID.fromString(objectMapper.readTree(response1).get("applicationId").asText());
+			UUID appId1 = UUID.fromString(objectMapper.readTree(response1).get("applicationId").asString());
 
 			CreateApplicationPayload payload2 = new CreateApplicationPayload(
 					topicId2, null, "MASTER", Instant.now(), "Motivation 2", null
@@ -766,7 +806,7 @@ void rejectApplication_FailedStudentRequirements_RejectsAllPending() throws Exce
 							.content(objectMapper.writeValueAsString(payload2)))
 					.andExpect(status().isOk())
 					.andReturn().getResponse().getContentAsString();
-			UUID appId2 = UUID.fromString(objectMapper.readTree(response2).get("applicationId").asText());
+			UUID appId2 = UUID.fromString(objectMapper.readTree(response2).get("applicationId").asString());
 
 			createTestEmailTemplate("APPLICATION_REJECTED_STUDENT_REQUIREMENTS");