spring

1. Spring Configuration improvements

All old security configurations need to be updated

For java this means that we should migrate as en example from something like this:

Example 1

public class Flash16ConfigurationAdapter {
    @Bean
    public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
        return http.authenticationProvider(new Flash16AuthenticationProvider())
                .authorizeRequests()
                .requestMatchers(new AntPathRequestMatcher("/**")).hasRole("ADMIN")
                .anyRequest()
                .authenticated()
                .and()
                .formLogin().and().build();
    }
}

to this

public class Flash16ConfigurationAdapter {
    @Bean
    public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
        return http
                .authenticationProvider(new Flash16AuthenticationProvider())
                .authorizeHttpRequests(auth -> auth
                        .anyRequest().hasRole("ADMIN")
                )
                .formLogin(Customizer.withDefaults())
                .build();
    }
}

Example 2

Migrate from this:

public class Flash17ConfigurationAdapter {
    @Bean
    public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
        return http
                .userDetailsService(jdbcUserDetailsManager)
                .authorizeRequests()
                .requestMatchers(new AntPathRequestMatcher("/open/**"))
                .permitAll()
                .requestMatchers(new AntPathRequestMatcher("/**")).hasRole("ADMIN")
                .anyRequest()
                .authenticated()
                .and()
                .formLogin()
                .and().csrf().disable().build();
    }
}

to this

public class Flash17ConfigurationAdapter {
    @Bean
    public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
        return http.userDetailsService(jdbcUserDetailsManager)
                .authorizeHttpRequests(auth -> auth
                        .requestMatchers("/open/**").permitAll()
                        .requestMatchers("/**").hasRole("ADMIN")
                        .anyRequest().authenticated()
                )
                .formLogin(Customizer.withDefaults())
                .csrf(AbstractHttpConfigurer::disable)
                .build();
}

2. Replace usage of NestedServletException with ServletException

NestedServletException has been deprecated. This means that all usages of org.springframework.web.util.NestedServletException should be replaced with jakarta.servlet.ServletException in all test classes.

3. The toByteBuffer() function with no params has been deprecated.

This means that all usages of org.springframework.core.io.buffer.DataBuffer.toByteBuffer should be replaced with another way to get the byte array.

Example 1

Replace this:

@RestController
@RequestMapping("images")
internal class StaCoImageController(
    val s3AsyncClient: S3AsyncClient
) {
    @PostMapping("/save/{id}")
    fun saveUser(
        @RequestPart(value = "image", required = false) filePartMono: Mono<FilePart>,
        @PathVariable("id") uuid: UUID
    ): Mono<Void> {
        return filePartMono.flatMapMany {
            it.content()
        }.map {
            val putObjectRequest =
                PutObjectRequest.builder().bucket(IMAGES_BUCKET).key("staco-image-$uuid.png").build()
            s3AsyncClient.putObject(
                putObjectRequest,
                AsyncRequestBody.fromBytes(it.asByteBuffer().array())
            )
        }.then()
    }
}

with this:

@RestController
@RequestMapping("images")
internal class StaCoImageController(
    val s3AsyncClient: S3AsyncClient
) {
    @PostMapping("/save/{id}")
    fun saveUser(
        @RequestPart(value = "image", required = false) filePartMono: Mono<FilePart>,
        @PathVariable("id") uuid: UUID
    ): Mono<Void> {
        return filePartMono.flatMapMany {
            it.content()
        }.map {
            val putObjectRequest =
                PutObjectRequest.builder().bucket(IMAGES_BUCKET).key("staco-image-$uuid.png").build()
            val bytes = ByteArray(it.readableByteCount())
            it.read(bytes)
            s3AsyncClient.putObject(
                putObjectRequest,
                AsyncRequestBody.fromBytes(bytes)
            )
        }.then()
    }
}

Essentially, this means replacing calls to it.asByteBuffer().array() with a more explicit way of creating a ByteBuffer, writing the data into it, and then flipping it before getting the byte array.

4. Follow OAuth2 Guidelines for dependencies coming from deprecated org.springframework.security.oauth2 package

OAuth2 from dependencies org.springframework.security.oauth2 has been deprecated. There is a guideline manual located at: https://github.com/spring-projects/spring-security/wiki/OAuth-2.0-Migration-Guide Please make sure that the new code follows the guidelines. Make the eventual necessary changes to the pom.xml files, code, en what may be necessary.

5. ApplicationArguments cannot be null anymore and args has to be a list of non-null Strings

please replace override fun run(args: ApplicationArguments?) with override fun run(args: ApplicationArguments?) please replace return CommandLineRunner { args: Array<String?>? with return CommandLineRunner { args: Array<String>

6. import org.springframework.boot.env.EnvironmentPostProcessor needs to be replaced by import org.springframework.boot.EnvironmentPostProcessor

The EnvironmentPostProcessor is now part of the import org.springframework.boot package.

7. Make sure to use classes for @Entity with primary constructor

Good practices mean that classes for entities should be created by declaring a primary constructor with all of the properties.

Example 1

Replace this:

@Entity
@Table(name = "users")
@Profile("localprod && !test")
class ApplicationUser {
    @Id
    @Column(unique = true)
    @GeneratedValue(strategy = GenerationType.UUID)
    var uuid: UUID? = null

    @Column
    var email: String? = null

    @Column
    var name: String? = null

    @Column
    var password: String? = null

    @Column
    var role: String? = null

    @get:Nullable
    @Column
    @Nullable
    var date: Timestamp? = null
}

with this:

@Entity
@Table(name = "users")
@Profile("localprod && !test")
class ApplicationUser(
    @Id
    @Column(unique = true)
    @GeneratedValue(strategy = GenerationType.UUID)
    var uuid: UUID? = null,

    @Column
    val email: String? = null,

    @Column
    var name: String? = null,

    @Column
    var password: String? = null,

    @Column
    val role: String? = null,

    @get:Nullable
    @Column
    @Nullable
    var date: Timestamp? = null
)

8. @Nullable needs to be used from another package

The org.springframework.lang.Nullable is deprecated, please use org.jspecify.annotations.Nullable instead.

9. management.metrics.export.statsd.host does not exist

Replace all usages of management.metrics.export.statsd.host with management.statsd.metrics.export.host

10. There should be no open use when the spring kotlin plugin is being used

Since the spring, or the all-open plugins make methods, functions, and classes open by default, the open keyword should not be used.

11. Migrate to the latest version of spring-boot

In maven projects, there should be a node called spring-boot-starter-parent.version in the pom.xml or something similar that indicates the parent version of spring-boot it is being used. That version should match the latest stable version. Make sure to follow the migration rules to migrate to the latest version of spring-boot. If the axon framework is being used, make sure to migrate it to be compatible with the latest spring version.

For reference, please follow the following documents:

1. https://github.com/spring-projects/spring-boot/wiki/Spring-Boot-3.5-Release-Notes
2. https://github.com/spring-projects/spring-boot/wiki/Spring-Boot-4.0-Migration-Guide
3. https://github.com/spring-projects/spring-boot/wiki/Spring-Boot-4.1-Release-Notes
4. https://docs.axoniq.io/axon-framework-reference/5.2/migration/

12. Checklist

[ ] All old security configurations have been updated to the new style. [ ] All usages of NestedServletException have been replaced with ServletException. [ ] All usages of DataBuffer.toByteBuffer have been replaced with a more explicit ay of creating a ByteBuffer and getting the byte array. [ ] There should be no override fun run(args: ApplicationArguments?) left [ ] There should be no import org.springframework.boot.env.EnvironmentPostProcessor left [ ] There should be no usage of the keyword open, when using plugins spring or all-open