Upgrade to Spring Boot 4.0, Hibernate 7, Liquibase 5, Jackson 3

server/build.gradle

@@ -5,7 +5,7 @@ plugins {
 	id "jacoco"
 	id "com.github.andygoossens.modernizer" version "1.12.0"
 	id "com.gorylenko.gradle-git-properties" version "2.5.7"
-	id "org.springframework.boot" version "3.5.10"
+	id "org.springframework.boot" version "4.0.2"
 	id "io.spring.dependency-management" version "1.1.7"
 	id "com.github.ben-manes.versions" version "0.53.0"
 	id "com.diffplug.spotless" version "8.2.1"
@@ -35,13 +35,13 @@ repositories {
 
 dependencies {
 	implementation "org.springframework.boot:spring-boot-starter-data-jpa"
-	implementation "org.springframework.boot:spring-boot-starter-web"
+	implementation "org.springframework.boot:spring-boot-starter-webmvc"
 	implementation "org.springframework.boot:spring-boot-starter-validation"
 	implementation "org.springframework.boot:spring-boot-starter-mail"
 	implementation "org.springframework.boot:spring-boot-starter-webflux"
 	implementation "org.springframework.boot:spring-boot-starter-security"
-	implementation "org.springframework.boot:spring-boot-starter-oauth2-client"
-	implementation "org.springframework.boot:spring-boot-starter-oauth2-resource-server"
+	implementation "org.springframework.boot:spring-boot-starter-security-oauth2-client"
+	implementation "org.springframework.boot:spring-boot-starter-security-oauth2-resource-server"
 	implementation "org.springframework.boot:spring-boot-starter-thymeleaf"
 	implementation "org.springframework.boot:spring-boot-starter-actuator"
 
@@ -53,7 +53,7 @@ dependencies {
 	// Avoid outdated version to prevent security issues
 	implementation("net.minidev:json-smart") { version { 				strictly "2.6.0" } }
 
-	implementation "org.liquibase:liquibase-core:4.33.0"
+	implementation "org.springframework.boot:spring-boot-starter-liquibase"
 	implementation "org.postgresql:postgresql:42.7.9"
 
 	implementation "commons-io:commons-io:2.21.0"
@@ -80,6 +80,7 @@ dependencies {
 		exclude group: "com.vaadin.external.google", module: "android-json"
 		exclude group: "org.xmlunit", module: "xmlunit-core"
 	}
+	testImplementation "org.springframework.boot:spring-boot-starter-webmvc-test"
 
 	testImplementation "org.mockito:mockito-core:5.21.0"
 	testImplementation "org.mockito:mockito-junit-jupiter:5.21.0"

server/gradle/wrapper/gradle-wrapper.properties

@@ -1,6 +1,6 @@
 distributionBase=GRADLE_USER_HOME
 distributionPath=wrapper/dists
-distributionUrl=https\://services.gradle.org/distributions/gradle-9.2.1-bin.zip
+distributionUrl=https\://services.gradle.org/distributions/gradle-9.3.1-bin.zip
 networkTimeout=10000
 validateDistributionUrl=true
 zipStoreBase=GRADLE_USER_HOME

server/src/main/java/de/tum/cit/aet/thesis/dto/ErrorDto.java

@@ -7,7 +7,7 @@ public record ErrorDto(
 	String message,
 	String exception
 ) {
-	public static ErrorDto fromRuntimeException(RuntimeException error) {
+	public static ErrorDto fromException(Exception error) {
 		return new ErrorDto(
 			Instant.now(),
 			error.getMessage(),

server/src/main/java/de/tum/cit/aet/thesis/entity/Thesis.java

@@ -80,7 +80,7 @@ public class Thesis {
 private ThesisVisibility visibility;
 
 @JdbcTypeCode(SqlTypes.ARRAY)
-@Column(name = "keywords", columnDefinition = "text[]")
+@Column(name = "keywords", columnDefinition = "text[]", nullable = false)
 private Set<String> keywords = new HashSet<>();
 
 @ManyToOne(fetch = FetchType.LAZY)

server/src/main/java/de/tum/cit/aet/thesis/exception/ResponseExceptionHandler.java

@@ -1,7 +1,5 @@
 package de.tum.cit.aet.thesis.exception;
 
-import com.fasterxml.jackson.core.JsonParseException;
-import com.fasterxml.jackson.core.JsonProcessingException;
 import de.tum.cit.aet.thesis.dto.ErrorDto;
 import de.tum.cit.aet.thesis.exception.request.AccessDeniedException;
 import de.tum.cit.aet.thesis.exception.request.ResourceAlreadyExistsException;
@@ -14,38 +12,38 @@
 import org.springframework.web.bind.annotation.ExceptionHandler;
 import org.springframework.web.context.request.WebRequest;
 import org.springframework.web.servlet.mvc.method.annotation.ResponseEntityExceptionHandler;
+import tools.jackson.core.JacksonException;
 
 import java.text.ParseException;
 
 @ControllerAdvice
 public class ResponseExceptionHandler extends ResponseEntityExceptionHandler {
 	@ExceptionHandler({ ResourceNotFoundException.class })
 	protected ResponseEntity<Object> handleNotFound(RuntimeException ex, WebRequest request) {
-		return handleExceptionInternal(ex, ErrorDto.fromRuntimeException(ex), new HttpHeaders(), HttpStatus.NOT_FOUND, request);
+		return handleExceptionInternal(ex, ErrorDto.fromException(ex), new HttpHeaders(), HttpStatus.NOT_FOUND, request);
 	}
 
 	@ExceptionHandler({ ResourceAlreadyExistsException.class })
 	protected ResponseEntity<Object> handleAlreadyExists(RuntimeException ex, WebRequest request) {
-		return handleExceptionInternal(ex, ErrorDto.fromRuntimeException(ex), new HttpHeaders(), HttpStatus.CONFLICT, request);
+		return handleExceptionInternal(ex, ErrorDto.fromException(ex), new HttpHeaders(), HttpStatus.CONFLICT, request);
 	}
 
 	@ExceptionHandler({
 			ParseException.class,
 			ResourceInvalidParametersException.class,
-			JsonParseException.class,
-			JsonProcessingException.class,
+			JacksonException.class,
 	})
-	protected ResponseEntity<Object> handleBadRequest(RuntimeException ex, WebRequest request) {
-		return handleExceptionInternal(ex, ErrorDto.fromRuntimeException(ex), new HttpHeaders(), HttpStatus.BAD_REQUEST, request);
+	protected ResponseEntity<Object> handleBadRequest(Exception ex, WebRequest request) {
+		return handleExceptionInternal(ex, ErrorDto.fromException(ex), new HttpHeaders(), HttpStatus.BAD_REQUEST, request);
 	}
 
 	@ExceptionHandler({ AccessDeniedException.class })
 	protected ResponseEntity<Object> handleAccessDenied(RuntimeException ex, WebRequest request) {
-		return handleExceptionInternal(ex, ErrorDto.fromRuntimeException(ex), new HttpHeaders(), HttpStatus.FORBIDDEN, request);
+		return handleExceptionInternal(ex, ErrorDto.fromException(ex), new HttpHeaders(), HttpStatus.FORBIDDEN, request);
 	}
 
 	@ExceptionHandler({ MailingException.class, UploadException.class })
 	protected ResponseEntity<Object> handleServerError(RuntimeException ex, WebRequest request) {
-		return handleExceptionInternal(ex, ErrorDto.fromRuntimeException(ex), new HttpHeaders(), HttpStatus.INTERNAL_SERVER_ERROR, request);
+		return handleExceptionInternal(ex, ErrorDto.fromException(ex), new HttpHeaders(), HttpStatus.INTERNAL_SERVER_ERROR, request);
 	}
 }

server/src/main/java/de/tum/cit/aet/thesis/repository/ApplicationRepository.java

@@ -44,8 +44,8 @@ Page<Application> searchApplications(
 			@Param("reviewerId") UUID reviewerId,
 			@Param("searchQuery") String searchQuery,
 			@Param("states") Set<ApplicationState> states,
-			@Param("previousIds") Set<String> previousIds,
-			@Param("topics") Set<String> topics,
+			@Param("previousIds") Set<UUID> previousIds,
+			@Param("topics") Set<UUID> topics,
 			@Param("types") Set<String> types,
 			@Param("includeSuggestedTopics") boolean includeSuggestedTopics,
 			Pageable page

server/src/main/java/de/tum/cit/aet/thesis/security/JwtAuthConverter.java

@@ -1,8 +1,8 @@
 package de.tum.cit.aet.thesis.security;
 
+import org.jspecify.annotations.NonNull;
+import org.jspecify.annotations.Nullable;
 import org.springframework.core.convert.converter.Converter;
-import org.springframework.lang.NonNull;
-import org.springframework.lang.Nullable;
 import org.springframework.security.authentication.AbstractAuthenticationToken;
 import org.springframework.security.core.GrantedAuthority;
 import org.springframework.security.core.authority.SimpleGrantedAuthority;

server/src/main/java/de/tum/cit/aet/thesis/service/ApplicationService.java

@@ -38,6 +38,7 @@
 import java.util.Optional;
 import java.util.Set;
 import java.util.UUID;
+import java.util.stream.Collectors;
 
 /**
  * Handles the lifecycle of thesis applications, including creation, review, acceptance, and rejection.
@@ -130,9 +131,21 @@ public Page<Application> getAll(
 		ResearchGroup researchGroup = currentUserProvider().getResearchGroupOrThrow();
 		String searchQueryFilter = searchQuery == null || searchQuery.isEmpty() ? null : searchQuery.toLowerCase();
 		Set<ApplicationState> statesFilter = states == null || states.length == 0 ? null : new HashSet<>(Arrays.asList(states));
-		Set<String> topicsFilter = topics == null || topics.length == 0 ? null : new HashSet<>(Arrays.asList(topics));
+		Set<UUID> topicsFilter = topics == null || topics.length == 0 ? null : Arrays.stream(topics).map(t -> {
+			try {
+				return UUID.fromString(t);
+			} catch (IllegalArgumentException e) {
+				throw new ResourceInvalidParametersException("Invalid topic ID: " + t);
+			}
+		}).collect(Collectors.toSet());
 		Set<String> typesFilter = types == null || types.length == 0 ? null : new HashSet<>(Arrays.asList(types));
-		Set<String> previousFilter = previous == null || previous.length == 0 ? null : new HashSet<>(Arrays.asList(previous));
+		Set<UUID> previousFilter = previous == null || previous.length == 0 ? null : Arrays.stream(previous).map(t -> {
+			try {
+				return UUID.fromString(t);
+			} catch (IllegalArgumentException e) {
+				throw new ResourceInvalidParametersException("Invalid application ID: " + t);
+			}
+		}).collect(Collectors.toSet());
 
 		return applicationRepository.searchApplications(
 				researchGroup == null ? null : researchGroup.getId(),