Spring Boot Verify

Spring Boot 4.x Project Verification

Analyzes Spring Boot projects for dependency compatibility, configuration correctness, and migration readiness.

Verification Workflow

1. Detect Build System → Find pom.xml or build.gradle, extract Spring Boot version 2. Analyze Dependencies → Check versions, find deprecated libraries, validate compatibility 3. Validate Configuration → Check application.yml/properties, security config, actuator settings 4. Generate Report → Structured markdown with severity levels and remediation code 5. Lookup Docs → Use Exa MCP to fetch latest Spring Boot 4.x documentation when needed

Dependency Quick Reference

Configuration Quick Reference

Jakarta Namespace Migration

Critical for Spring Boot 3+: All javax.* packages must migrate to jakarta.*:

Use Grep to find: import\s+javax\.

Spring Boot 4 New Features

JSpecify Annotations

Spring Framework 7 uses JSpecify for null-safety:

@NullMarked  // Package or class level - all parameters/returns non-null by default
package com.example.myapp;

import org.jspecify.annotations.Nullable;

public class UserService {
    // @Nullable for parameters/returns that can be null
    public @Nullable User findById(Long id) { ... }
}

Tools to Use

1. Glob → Find **/pom.xml, **/build.gradle*, **/application.{yml,properties} 2. Grep → Search for deprecated patterns (@MockBean, com.fasterxml, .and(), import javax.) 3. Read → Inspect build files and configuration 4. Exa MCP → Fetch latest Spring Boot 4.x docs: mcp__exa__web_search_exa

Output Format

Generate verification reports with this structure:

## Spring Boot 4.x Verification Report

### Summary
- **Project**: {name}
- **Boot Version**: {detected version}
- **Issues Found**: {n} Critical, {n} Errors, {n} Warnings

### Critical Issues / Errors / Warnings
[Issue details with code remediation]

Detailed References

• Workflow: See WORKFLOW.md for step-by-step verification process
• Migration Guide: See MIGRATION_GUIDE.md for step-by-step migration from Boot 3.x to 4.0 (also referenced from WORKFLOW.md)
• Examples: See EXAMPLES.md for sample verification outputs
• Troubleshooting: See TROUBLESHOOTING.md for detection issues
• Dependencies: See references/DEPENDENCIES.md for complete version matrix
• Configuration: See references/CONFIGURATION.md for validation rules

Critical Reminders

1. Check Spring Boot version first — Many issues are version-specific 2. Jakarta namespace migration — javax.* to jakarta.* (required for Boot 3+) 3. Jackson 3 namespace change — com.fasterxml.jackson to tools.jackson 4. Security 7 Lambda DSL — and() method removed, closures required 5. Testing annotations changed — @MockBean to @MockitoBean 6. Virtual Threads — Enable with spring.threads.virtual.enabled=true for Java 21+ 7. Gradle 8.14+ — Required for Kotlin 2.2 and Spring Boot 4 support 8. Use official docs — https://docs.spring.io/spring-boot/documentation.html

Related Skills

• spring-boot-security — Deep security configuration verification
• spring-boot-testing — Testing patterns and coverage analysis
• spring-boot-observability — Actuator, metrics, and tracing setup
• spring-boot-modulith — Module structure verification
• domain-driven-design — DDD architecture patterns

Spring Boot Verification Examples

Complete verification examples demonstrating all output patterns.

Table of Contents

• Maven Project Verification
• Gradle Project Verification
• Configuration Verification
• Security Configuration Audit
• Migration Readiness Assessment

---

Maven Project Verification

Example: Spring Boot 3.x Project Needing Migration

Input: pom.xml with Spring Boot 3.x dependencies

Verification Output:

## Spring Boot 4.x Verification Report

**Generated**: 2025-12-22T10:30:00Z
**Project**: my-application
**Location**: /Users/dev/projects/my-application

---

### Summary

| Severity | Count |
|----------|-------|
| CRITICAL | 2 |
| ERROR | 3 |
| WARNING | 2 |

**Status**: BLOCKED - Critical issues must be resolved before upgrading

---

### Critical Issues

#### [1] Spring Boot Version Outdated
- **Severity**: CRITICAL
- **Category**: Dependencies
- **Current**: 3.2.5
- **Required**: 4.0.0+

**Remediation**:

<parent> <groupId>org.springframework.boot</groupId> <artifactId>spring-boot-starter-parent</artifactId> <version>4.0.1</version> </parent>

#### [2] Jackson 2.x Detected
- **Severity**: CRITICAL
- **Category**: Dependencies
- **Issue**: Using `com.fasterxml.jackson` namespace
- **Impact**: Jackson 3 uses `tools.jackson` namespace

**Files affected**:
- `src/main/java/com/example/config/JacksonConfig.java`
- `src/main/java/com/example/util/JsonUtils.java`

**Remediation**:
Update all imports:

// Before import com.fasterxml.jackson.databind.ObjectMapper; import com.fasterxml.jackson.core.JsonProcessingException;

// After import tools.jackson.databind.json.JsonMapper; import tools.jackson.core.JacksonException;

---

### Errors

#### [3] @MockBean Usage Detected
- **Severity**: ERROR
- **Category**: Testing
- **Location**: `src/test/java/com/example/UserServiceTest.java:25`

**Before**:

@MockBean private UserRepository userRepository;

**After**:

@MockitoBean private UserRepository userRepository;

#### [4] WebSecurityConfigurerAdapter Detected
- **Severity**: ERROR
- **Category**: Security
- **Location**: `src/main/java/com/example/config/SecurityConfig.java:15`

**Before**:

public class SecurityConfig extends WebSecurityConfigurerAdapter { @Override protected void configure(HttpSecurity http) throws Exception { // ... } }

**After**:

@Configuration @EnableWebSecurity public class SecurityConfig { @Bean public SecurityFilterChain filterChain(HttpSecurity http) throws Exception { // Lambda DSL configuration return http.build(); } }

#### [5] Java Version Below Minimum
- **Severity**: ERROR
- **Category**: Dependencies
- **Current**: 11
- **Required**: 17 (minimum)

**Remediation**:

<properties> <java.version>17</java.version> </properties>

---

### Warnings

#### [6] Using spring-boot-starter-web
- **Severity**: WARNING
- **Category**: Dependencies
- **Issue**: Modular starters available in Boot 4

**Remediation**:

<!-- Before --> <dependency> <groupId>org.springframework.boot</groupId> <artifactId>spring-boot-starter-web</artifactId> </dependency>

<!-- After --> <dependency> <groupId>org.springframework.boot</groupId> <artifactId>spring-boot-starter-webmvc</artifactId> </dependency>

#### [7] All Actuator Endpoints Exposed
- **Severity**: WARNING
- **Category**: Configuration
- **Location**: `src/main/resources/application.yml:12`

**Current**:

management: endpoints: web: exposure: include: "*"

**Recommended**:

management: endpoints: web: exposure: include: "health,info,metrics,prometheus"

---

### Migration Checklist

- [ ] Upgrade Spring Boot version to 4.0.1
- [ ] Migrate Jackson 2 to Jackson 3 namespace
- [ ] Replace @MockBean with @MockitoBean in tests
- [ ] Convert SecurityConfig to SecurityFilterChain bean
- [ ] Upgrade Java version to 17+
- [ ] Update to modular starters
- [ ] Restrict actuator endpoint exposure

---

Gradle Project Verification

Example: Kotlin DSL Build File

Input: build.gradle.kts analysis

Verification Output:

## Spring Boot 4.x Verification Report

**Generated**: 2025-12-22T11:00:00Z
**Project**: kotlin-service
**Build System**: Gradle (Kotlin DSL)

---

### Summary

| Severity | Count |
|----------|-------|
| CRITICAL | 0 |
| ERROR | 2 |
| WARNING | 1 |

**Status**: READY WITH ERRORS - Errors must be fixed

---

### Errors

#### [1] Incompatible Kotlin Version
- **Severity**: ERROR
- **Category**: Dependencies
- **Current**: kotlin("jvm") version "1.9.22"
- **Required**: 2.2.0+ for Spring Boot 4

**Remediation**:

plugins { kotlin("jvm") version "2.2.0" kotlin("plugin.spring") version "2.2.0" }

#### [2] @SpyBean Usage Detected
- **Severity**: ERROR
- **Category**: Testing
- **Location**: `src/test/kotlin/com/example/AuditServiceTest.kt:18`

**Before**:

@SpyBean private lateinit var auditService: AuditService

**After**:

@MockitoSpyBean private lateinit var auditService: AuditService

---

### Warnings

#### [3] 100% Trace Sampling Configured
- **Severity**: WARNING
- **Category**: Configuration
- **Location**: `src/main/resources/application.yml:25`

**Current**:

management: tracing: sampling: probability: 1.0

**Recommended for production**:

management: tracing: sampling: probability: 0.1 # 10% in production

---

Configuration Verification

Example: application.yml Analysis

Input:

spring:
  datasource:
    url: jdbc:postgresql://localhost:5432/mydb
    password: secret123
management:
  endpoints:
    web:
      exposure:
        include: "*"
  tracing:
    sampling:
      probability: 1.0
logging:
  level:
    root: DEBUG

Verification Output:

## Spring Boot 4.x Verification Report

**File**: src/main/resources/application.yml

---

### Warnings

#### [1] All Actuator Endpoints Exposed
- **Severity**: WARNING
- **Location**: Line 7
- **Issue**: `include: "*"` exposes all endpoints
- **Risk**: Security vulnerability in production

**Remediation**:

management: endpoints: web: exposure: include: "health,info,metrics,prometheus" access: default: none # Boot 4 opt-in approach

#### [2] 100% Trace Sampling
- **Severity**: WARNING
- **Location**: Line 11
- **Issue**: `probability: 1.0` samples all requests
- **Impact**: Performance overhead and storage costs

**Remediation**:

management: tracing: sampling: probability: 0.1 # 10% in production

#### [3] Hardcoded Database Password
- **Severity**: WARNING
- **Location**: Line 4
- **Issue**: Secrets should not be in configuration files

**Remediation**:

spring: datasource: password: ${DB_PASSWORD} # Use environment variable

#### [4] DEBUG Logging in Default Profile
- **Severity**: WARNING
- **Location**: Line 14
- **Issue**: DEBUG level inappropriate for production

**Remediation**:
Create profile-specific logging:

application-prod.yml

logging: level: root: INFO

---

Security Configuration Audit

Example: Legacy Security Configuration

Input: SecurityConfig.java with deprecated patterns

Verification Output:

## Spring Boot 4.x Verification Report

**File**: src/main/java/com/example/config/SecurityConfig.java

---

### Critical Issues

#### [1] Deprecated `and()` Chaining
- **Severity**: CRITICAL
- **Location**: Line 25
- **Issue**: `and()` method removed in Security 7

**Before**:

http .authorizeHttpRequests() .anyRequest().authenticated() .and() .oauth2ResourceServer() .jwt();

**After**:

http .authorizeHttpRequests(auth -> auth .anyRequest().authenticated() ) .oauth2ResourceServer(oauth2 -> oauth2 .jwt(Customizer.withDefaults()) );

---

### Errors

#### [2] Deprecated antMatchers()
- **Severity**: ERROR
- **Location**: Line 18
- **Issue**: `antMatchers()` replaced with `requestMatchers()`

**Before**:

.antMatchers("/public/").permitAll() .antMatchers("/api/admin/").hasRole("ADMIN")

**After**:

.requestMatchers("/public/").permitAll() .requestMatchers("/api/admin/").hasRole("ADMIN")

#### [3] Deprecated authorizeRequests()
- **Severity**: ERROR
- **Location**: Line 16
- **Issue**: `authorizeRequests()` replaced with `authorizeHttpRequests()`

**Before**:

http.authorizeRequests()

**After**:

http.authorizeHttpRequests(auth -> auth // rules )

#### [4] @EnableGlobalMethodSecurity Deprecated
- **Severity**: ERROR
- **Location**: Line 8
- **Issue**: Use `@EnableMethodSecurity` instead

**Before**:

@EnableGlobalMethodSecurity(prePostEnabled = true)

**After**:

@EnableMethodSecurity(prePostEnabled = true)

---

Migration Readiness Assessment

Example: Full Project Assessment

Verification Output:

## Spring Boot 4.x Migration Readiness Assessment

**Project**: enterprise-app
**Current Version**: Spring Boot 3.2.5
**Target Version**: Spring Boot 4.0.1

---

### Overall Score: 45/100

**Status**: BLOCKED - Critical issues prevent migration

---

### Migration Blockers (Must Fix Before Upgrade)

| # | Issue | Files Affected | Effort |
|---|-------|----------------|--------|
| 1 | Upgrade Spring Boot to 4.0.x | pom.xml | 1h |
| 2 | Migrate Jackson 2 to Jackson 3 | 12 files | 4h |
| 3 | Convert Security config to Lambda DSL | 3 files | 4h |
| 4 | Replace @MockBean with @MockitoBean | 45 tests | 2h |
| 5 | Upgrade Java from 11 to 17 | pom.xml, CI | 2h |

---

### Required Changes (Will Cause Failures)

| # | Issue | Files Affected | Effort |
|---|-------|----------------|--------|
| 6 | Replace antMatchers with requestMatchers | 3 files | 1h |
| 7 | Replace authorizeRequests() | 3 files | 1h |
| 8 | Add @AutoConfigureMockMvc to tests | 15 tests | 1h |
| 9 | Update Kotlin to 2.2.0 | build.gradle.kts | 30m |

---

### Recommended Changes (Should Fix)

| # | Issue | Files Affected | Effort |
|---|-------|----------------|--------|
| 10 | Use modular starters | pom.xml | 30m |
| 11 | Enable virtual threads | application.yml | 15m |
| 12 | Configure JSpecify null-safety | 0 | Optional |
| 13 | Restrict actuator endpoints | application.yml | 30m |
| 14 | Add graceful shutdown | application.yml | 15m |

---

### Migration Checklist

**Dependencies**:
- [ ] Upgrade spring-boot-starter-parent to 4.0.1
- [ ] Update Java version to 17
- [ ] Update Kotlin to 2.2.0 (if applicable)
- [ ] Replace Jackson 2 imports with Jackson 3

**Security**:
- [ ] Convert SecurityConfig to use SecurityFilterChain bean
- [ ] Replace and() chaining with Lambda DSL
- [ ] Replace antMatchers() with requestMatchers()
- [ ] Replace authorizeRequests() with authorizeHttpRequests()
- [ ] Replace @EnableGlobalMethodSecurity with @EnableMethodSecurity

**Testing**:
- [ ] Replace @MockBean with @MockitoBean
- [ ] Replace @SpyBean with @MockitoSpyBean
- [ ] Add @AutoConfigureMockMvc to integration tests

**Configuration**:
- [ ] Update to modular starters (webmvc, etc.)
- [ ] Enable virtual threads (optional)
- [ ] Configure graceful shutdown
- [ ] Restrict actuator endpoint exposure

---

### Estimated Total Effort

| Area | Hours |
|------|-------|
| Dependencies | 3 |
| Security Config | 6 |
| Testing | 4 |
| Configuration | 2 |
| **Total** | **15 hours** |

---

### Next Steps

1. Create a feature branch for migration
2. Address CRITICAL issues first (blockers)
3. Run full test suite after each change
4. Use Spring Boot migration guide for edge cases
5. Deploy to staging for validation

Spring Boot 4.0 Migration Guide

Comprehensive guide for migrating Spring Boot applications from 3.x to 4.0.

Source: Official Spring Boot 4.0 Migration Guide

Table of Contents

• Pre-Upgrade Preparation
• System Requirements
• Removed Features
• Module Reorganization
• Breaking Changes
• Deprecations
• New Features and Patterns
• Migration Checklist

---

Pre-Upgrade Preparation

Before starting the migration:

1. Upgrade to latest Spring Boot 3.x - Ensure you're on the latest 3.x release 2. Review deprecation warnings - Address all deprecation warnings in 3.x 3. Update build tools - Gradle 8.14+ or Maven 3.9+ 4. Run full test suite - Establish baseline before changes 5. Create migration branch - Isolate changes for review

---

System Requirements

Spring Boot 4.0 has updated baseline requirements:

Verify Java Version

<!-- pom.xml -->
<properties>
    <java.version>17</java.version>
</properties>

// build.gradle.kts
java {
    toolchain {
        languageVersion.set(JavaLanguageVersion.of(17))
    }
}

---

Removed Features

The following features are removed in Spring Boot 4.0:

Undertow Support

Undertow is dropped due to Servlet 6.1 incompatibility.

Migration:

<!-- Remove -->
<dependency>
    <groupId>org.springframework.boot</groupId>
    <artifactId>spring-boot-starter-undertow</artifactId>
</dependency>

<!-- Use Tomcat (default) or Jetty -->
<dependency>
    <groupId>org.springframework.boot</groupId>
    <artifactId>spring-boot-starter-jetty</artifactId>
</dependency>

Pulsar Reactive Auto-Configuration

Reactive Pulsar auto-configuration removed.

Embedded Executable Launch Scripts

Embedded launch scripts for uber jars eliminated.

Spring Session Support

Direct support removed for:

• Spring Session Hazelcast
• Spring Session MongoDB

Use Spring Session's own auto-configuration instead.

Spock Integration

Spock removed due to Groovy 5 incompatibility.

Migration: Convert Spock tests to JUnit 5 or Kotest.

Optional Dependencies in Uber Jars

Optional dependencies no longer included automatically. Configure explicitly if needed.

---

Module Reorganization

Spring Boot 4.0 introduces modular architecture with consistent naming.

Starter Renaming

Gradual Migration: Classic starter POMs remain available for phased adoption.

<!-- Option 1: New modular starter -->
<dependency>
    <groupId>org.springframework.boot</groupId>
    <artifactId>spring-boot-starter-webmvc</artifactId>
</dependency>

<!-- Option 2: Classic starter (gradual migration) -->
<dependency>
    <groupId>org.springframework.boot</groupId>
    <artifactId>spring-boot-starter-web</artifactId>
</dependency>

Module Naming Pattern

All Spring Boot modules now follow: spring-boot-<technology>

• Dedicated test modules for each technology
• Dedicated starters for each technology
• Consistent packaging across modules

---

Breaking Changes

Jackson 3 Migration

Jackson upgraded to version 3 with new group IDs.

Before:

<dependency>
    <groupId>com.fasterxml.jackson.core</groupId>
    <artifactId>jackson-databind</artifactId>
</dependency>

import com.fasterxml.jackson.databind.ObjectMapper;
import com.fasterxml.jackson.core.JsonProcessingException;

After:

<dependency>
    <groupId>tools.jackson.core</groupId>
    <artifactId>jackson-databind</artifactId>
</dependency>

import tools.jackson.databind.json.JsonMapper;
import tools.jackson.core.JacksonException;

Note: Jackson 2 support provided as deprecated stop-gap measure for gradual migration.

Package Relocations

Several classes moved to new packages:

Migration: Update imports in affected files.

PropertyMapper Behavior Change

PropertyMapper no longer calls methods when source is null.

Before (may have worked):

mapper.from(config.getValue())  // Called even if null
    .to(builder::setValue);

After (throws on null):

mapper.from(config.getValue())
    .whenNonNull()  // Explicit null handling
    .to(builder::setValue);

Security Filter Chain Updates

Spring Security 7 removes and() method chaining.

Before:

http
    .authorizeHttpRequests()
        .anyRequest().authenticated()
    .and()
    .oauth2ResourceServer()
        .jwt();

After:

http
    .authorizeHttpRequests(auth -> auth
        .anyRequest().authenticated()
    )
    .oauth2ResourceServer(oauth2 -> oauth2
        .jwt(Customizer.withDefaults())
    );

HTTP Message Converters

HttpMessageConverters deprecated. Spring Framework provides improved defaults.

Use customizers for client/server message converter configuration:

• HttpMessageConvertersCustomizer for server
• RestClientCustomizer for RestClient
• WebClientCustomizer for WebClient

---

Deprecations

Testing Annotations

Migration:

// Before
@MockBean
private UserService userService;

@SpyBean
private AuditService auditService;

// After
@MockitoBean
private UserService userService;

@MockitoSpyBean
private AuditService auditService;

Test Configuration Annotations

New required annotations for test configuration:

• @AutoConfigureMockMvc - Required for MockMvc tests
• @AutoConfigureTestRestTemplate - Required for TestRestTemplate
• @AutoConfigureRestTestClient - Required for RestTestClient

MockitoExtension Over TestExecutionListener

Migration from MockitoTestExecutionListener to MockitoExtension.

---

New Features and Patterns

Liveness and Readiness Probes

Probes now enabled by default.

management:
  endpoint:
    health:
      probes:
        enabled: true  # Now default

JSpecify Nullability Annotations

Spring Boot 4 adopts JSpecify for null-safety annotations.

Virtual Threads Support

Enable virtual threads (Project Loom):

spring:
  threads:
    virtual:
      enabled: true

Improved Logback Defaults

UTF-8 charset handling improved by default.

Modular Architecture Benefits

• Smaller runtime footprint
• Explicit dependencies
• Better native image support
• Clearer component boundaries

---

Migration Checklist

Phase 1: Prerequisites

• [ ] Upgrade to latest Spring Boot 3.x
• [ ] Resolve all deprecation warnings
• [ ] Update Java to 17+
• [ ] Update Kotlin to 2.2+ (if applicable)
• [ ] Update Gradle to 8.14+ or Maven to 3.9+
• [ ] Run full test suite and document baseline

Phase 2: Dependencies

• [ ] Update spring-boot-starter-parent to 4.0.x
• [ ] Remove Undertow dependency (if present)
• [ ] Migrate Jackson 2 to Jackson 3:
• [ ] Update Maven/Gradle group IDs
• [ ] Update Java imports
• [ ] Update starter names (or use classic starters)

Phase 3: Security Configuration

• [ ] Remove and() method chaining
• [ ] Replace antMatchers() with requestMatchers()
• [ ] Replace authorizeRequests() with authorizeHttpRequests()
• [ ] Replace @EnableGlobalMethodSecurity with @EnableMethodSecurity
• [ ] Convert to Lambda DSL patterns

Phase 4: Testing

• [ ] Replace @MockBean with @MockitoBean
• [ ] Replace @SpyBean with @MockitoSpyBean
• [ ] Add @AutoConfigureMockMvc where needed
• [ ] Add @AutoConfigureTestRestTemplate where needed
• [ ] Migrate Spock tests to JUnit 5 (if applicable)

Phase 5: Configuration

• [ ] Fix package relocations (BootstrapRegistry, EnvironmentPostProcessor)
• [ ] Add null guards for PropertyMapper usage
• [ ] Review actuator endpoint exposure
• [ ] Configure HTTP message converters via customizers

Phase 6: Validation

• [ ] Run full test suite
• [ ] Test in staging environment
• [ ] Verify actuator endpoints work
• [ ] Validate security configuration
• [ ] Check observability (metrics, traces, logs)

Phase 7: Optional Enhancements

• [ ] Enable virtual threads
• [ ] Switch to modular starters
• [ ] Configure graceful shutdown
• [ ] Add JSpecify nullability annotations

---

Recommended Migration Order

1. Low Risk: Update Java, Kotlin, build tools 2. Medium Risk: Replace test annotations (@MockBean → @MockitoBean) 3. Medium Risk: Fix package relocations 4. Medium Risk: Update Security configuration (Lambda DSL) 5. High Risk: Migrate Jackson 2 to Jackson 3 6. Verification: Full regression testing after each phase

---

Resources

• Official Migration Guide
• Spring Boot 4.0 Release Notes
• Spring Security 7 Reference
• Jackson 3 Migration Guide

Spring Boot 4.x Configuration Validation Rules

Complete configuration validation rules for Spring Boot 4.x projects.

Table of Contents

• Security Configuration Rules
• CRITICAL - Must Fix Immediately
• ERROR - Will Cause Failures
• Actuator Configuration Rules
• WARNING - Security Risk
• WARNING - Performance
• Boot 4 Specific - New Access Control Model
• Application Properties Rules
• Virtual Threads Configuration
• Graceful Shutdown (Required for Kubernetes)
• Health Probes for Kubernetes
• Jackson 3 Configuration
• Testing Configuration Rules
• Rule: @AutoConfigureMockMvc Required
• Rule: @MockitoBean Required (Not @MockBean)
• Profile Configuration Rules
• Rule: Check All Profile Files
• WARNING: Secrets in Default Profile
• WARNING: Debug Settings in Production
• Grep Patterns for Configuration Detection

Security Configuration Rules

CRITICAL - Must Fix Immediately

Rule: Lambda DSL Required (No and() Chaining)

Pattern to detect (Grep):

grep -r "\.and()" --include="*.java" --include="*.kt"

Deprecated:

http
    .authorizeRequests()
        .anyRequest().authenticated()
    .and()  // REMOVED IN SECURITY 7
    .oauth2ResourceServer()
        .jwt();

Required:

http
    .authorizeHttpRequests(auth -> auth
        .anyRequest().authenticated()
    )
    .oauth2ResourceServer(oauth2 -> oauth2
        .jwt(Customizer.withDefaults())
    );

Rule: authorizeHttpRequests Required

Pattern to detect:

grep -r "authorizeRequests()" --include="*.java" --include="*.kt"

Deprecated: .authorizeRequests() Required: .authorizeHttpRequests()

Rule: requestMatchers Required

Patterns to detect:

grep -r "antMatchers(" --include="*.java" --include="*.kt"
grep -r "mvcMatchers(" --include="*.java" --include="*.kt"
grep -r "regexMatchers(" --include="*.java" --include="*.kt"

Deprecated:

.antMatchers("/api/**").permitAll()
.mvcMatchers("/api/**").authenticated()
.regexMatchers("/api/.*").hasRole("USER")

Required:

.requestMatchers("/api/**").permitAll()
.requestMatchers(new AntPathRequestMatcher("/api/**")).authenticated()
.requestMatchers(new MvcRequestMatcher(introspector, "/api/{id}")).hasRole("USER")

ERROR - Will Cause Failures

Rule: WebSecurityConfigurerAdapter Removed

Pattern to detect:

grep -r "WebSecurityConfigurerAdapter" --include="*.java" --include="*.kt"

Deprecated:

public class SecurityConfig extends WebSecurityConfigurerAdapter {
    @Override
    protected void configure(HttpSecurity http) { }
}

Required:

@Configuration
@EnableWebSecurity
public class SecurityConfig {
    @Bean
    public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
        // configuration
        return http.build();
    }
}

Rule: Method Security Annotation Changed

Pattern to detect:

grep -r "@EnableGlobalMethodSecurity" --include="*.java" --include="*.kt"

Deprecated: @EnableGlobalMethodSecurity(prePostEnabled = true) Required: @EnableMethodSecurity(prePostEnabled = true)

Actuator Configuration Rules

WARNING - Security Risk

Rule: Avoid Exposing All Endpoints

Pattern to detect in application.yml:

management:
  endpoints:
    web:
      exposure:
        include: "*"  # WARNING: Security vulnerability

Recommended:

management:
  endpoints:
    web:
      exposure:
        include: "health,info,metrics,prometheus"
    access:
      default: none  # Opt-in approach (Boot 4)
  endpoint:
    health:
      show-details: when-authorized

Rule: Use Separate Management Port

Recommended for production:

management:
  server:
    port: 8081  # Separate from application port

WARNING - Performance

Rule: Avoid 100% Trace Sampling in Production

Pattern to detect:

management:
  tracing:
    sampling:
      probability: 1.0  # WARNING: Performance overhead

Recommended for production:

management:
  tracing:
    sampling:
      probability: 0.1  # 10% sampling

Boot 4 Specific - New Access Control Model

New in Boot 4:

management:
  endpoints:
    access:
      default: none  # Opt-in approach
  endpoint:
    health:
      access: unrestricted
    info:
      access: read-only
    metrics:
      access: read-only
    loggers:
      access: read-only

Application Properties Rules

Virtual Threads Configuration

Recommended for Boot 4 (I/O-bound workloads):

spring:
  threads:
    virtual:
      enabled: true  # Enable Project Loom virtual threads

Graceful Shutdown (Required for Kubernetes)

Required for production:

server:
  shutdown: graceful

spring:
  lifecycle:
    timeout-per-shutdown-phase: 30s

Health Probes for Kubernetes

Recommended:

management:
  endpoint:
    health:
      probes:
        enabled: true
        add-additional-paths: true  # Exposes /livez and /readyz
      group:
        liveness:
          include: "livenessState,ping"
        readiness:
          include: "readinessState,db,redis"

Jackson 3 Configuration

New in Boot 4 (immutable configuration via JsonMapper):

spring:
  jackson:
    default-property-inclusion: non-null
    date-format: "yyyy-MM-dd'T'HH:mm:ss.SSSZ"
    serialization:
      write-dates-as-timestamps: false

Testing Configuration Rules

Rule: @AutoConfigureMockMvc Required

Boot 4 change: MockMvc no longer auto-configured in @SpringBootTest

Pattern to detect (missing annotation):

@SpringBootTest
class MyTest {
    @Autowired MockMvc mockMvc;  // Will be null without @AutoConfigureMockMvc
}

Required:

@SpringBootTest
@AutoConfigureMockMvc  // Required in Boot 4!
class MyTest {
    @Autowired MockMvc mockMvc;
}

Rule: @MockitoBean Required (Not @MockBean)

Pattern to detect:

grep -r "@MockBean" --include="*.java" --include="*.kt"
grep -r "@SpyBean" --include="*.java" --include="*.kt"

Deprecated:

@MockBean
private UserService userService;

@SpyBean
private AuditService auditService;

Required:

@MockitoBean
private UserService userService;

@MockitoSpyBean
private AuditService auditService;

Profile Configuration Rules

Rule: Check All Profile Files

Verify these profile-specific files:

• application.yml (default)
• application-dev.yml
• application-test.yml
• application-staging.yml
• application-prod.yml / application-production.yml

WARNING: Secrets in Default Profile

Pattern to detect:

# application.yml - default profile
spring:
  datasource:
    password: prod-password  # WARNING: Hardcoded secret

Recommended:

# application-prod.yml
spring:
  datasource:
    password: ${DB_PASSWORD}  # Environment variable

WARNING: Debug Settings in Production

Pattern to detect (in prod profile):

logging:
  level:
    root: DEBUG  # WARNING in production
    org.hibernate.SQL: DEBUG
    org.springframework.security: DEBUG

Recommended for production:

logging:
  level:
    root: INFO
    org.hibernate.SQL: WARN
    org.springframework.security: WARN

Grep Patterns for Configuration Detection

# Security patterns (CRITICAL/ERROR)
grep -r "\.and()" --include="*.java" --include="*.kt"
grep -r "authorizeRequests()" --include="*.java" --include="*.kt"
grep -r "antMatchers(" --include="*.java" --include="*.kt"
grep -r "WebSecurityConfigurerAdapter" --include="*.java" --include="*.kt"
grep -r "@EnableGlobalMethodSecurity" --include="*.java" --include="*.kt"

# Testing patterns (ERROR)
grep -r "@MockBean" --include="*.java" --include="*.kt"
grep -r "@SpyBean" --include="*.java" --include="*.kt"

# Configuration patterns (WARNING)
grep -r 'include:.*"\*"' --include="*.yml" --include="*.yaml"
grep -r "probability: 1.0" --include="*.yml" --include="*.yaml"
grep -r "level:.*DEBUG" --include="*-prod*.yml" --include="*-production*.yml"

Spring Boot 4.x Dependency Verification Rules

Complete dependency compatibility matrix and verification rules for Spring Boot 4.x projects.

Table of Contents

• Core Dependency Matrix
• Spring Boot 4.x Required Versions
• Jakarta EE 11 Requirements
• Deprecated Dependencies
• CRITICAL - Must Replace Immediately
• ERROR - Will Cause Failures
• WARNING - Should Update
• Required Dependencies
• Minimum Maven pom.xml
• Minimum Gradle (Kotlin DSL)
• Starter Migration Map
• Web Starters
• Security Starters
• Testing Starters
• Compatibility Starters (Migration Aid)
• Version Compatibility Rules
• Rule 1: Spring Boot and Spring Framework Must Match
• Rule 2: Hibernate Must Match JPA Version
• Rule 3: Testing Dependencies Must Be Aligned
• Grep Patterns for Detection

Core Dependency Matrix

Spring Boot 4.x Required Versions

Jakarta EE 11 Requirements

Deprecated Dependencies

CRITICAL - Must Replace Immediately

Jackson 3 Migration Example:

// Before (Jackson 2)
import com.fasterxml.jackson.databind.ObjectMapper;
ObjectMapper mapper = new ObjectMapper();

// After (Jackson 3)
import tools.jackson.databind.json.JsonMapper;
JsonMapper mapper = JsonMapper.builder().build();

ERROR - Will Cause Failures

Testing Migration Example:

// Before (Boot 3.x)
@MockBean
private UserService userService;

// After (Boot 4.x)
@MockitoBean
private UserService userService;

WARNING - Should Update

Required Dependencies

Minimum Maven pom.xml

<?xml version="1.0" encoding="UTF-8"?>
<project>
    <parent>
        <groupId>org.springframework.boot</groupId>
        <artifactId>spring-boot-starter-parent</artifactId>
        <version>4.0.1</version>
    </parent>

    <properties>
        <java.version>17</java.version>
    </properties>

    <dependencies>
        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-webmvc</artifactId>
        </dependency>
        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-test</artifactId>
            <scope>test</scope>
        </dependency>
    </dependencies>
</project>

Minimum Gradle (Kotlin DSL)

plugins {
    java
    id("org.springframework.boot") version "4.0.1"
    id("io.spring.dependency-management") version "1.1.7"
}

java {
    toolchain {
        languageVersion.set(JavaLanguageVersion.of(17))
    }
}

dependencies {
    implementation("org.springframework.boot:spring-boot-starter-webmvc")
    testImplementation("org.springframework.boot:spring-boot-starter-test")
}

Starter Migration Map

Web Starters

Security Starters

Testing Starters

Compatibility Starters (Migration Aid)

For gradual migration, use classic starters:

<!-- Temporary migration aid -->
<dependency>
    <groupId>org.springframework.boot</groupId>
    <artifactId>spring-boot-starter-classic</artifactId>
</dependency>
<dependency>
    <groupId>org.springframework.boot</groupId>
    <artifactId>spring-boot-starter-test-classic</artifactId>
    <scope>test</scope>
</dependency>

Version Compatibility Rules

Rule 1: Spring Boot and Spring Framework Must Match

Verification: Flag if Spring Framework version is explicitly overridden.

Rule 2: Hibernate Must Match JPA Version

Rule 3: Testing Dependencies Must Be Aligned

Grep Patterns for Detection

# Jackson 2 imports (CRITICAL)
grep -r "com\.fasterxml\.jackson" --include="*.java" --include="*.kt"

# @MockBean usage (ERROR)
grep -r "@MockBean" --include="*.java" --include="*.kt"

# @SpyBean usage (ERROR)
grep -r "@SpyBean" --include="*.java" --include="*.kt"

# Undertow dependency (ERROR)
grep -r "spring-boot-starter-undertow" pom.xml build.gradle*

# Old security annotations (ERROR)
grep -r "@EnableGlobalMethodSecurity" --include="*.java" --include="*.kt"

# WebSecurityConfigurerAdapter (ERROR)
grep -r "WebSecurityConfigurerAdapter" --include="*.java" --include="*.kt"

Spring Boot Verification Troubleshooting

Common issues encountered during project verification.

Table of Contents

• Build File Detection Issues
• Version Detection Issues
• False Positives
• Configuration Parsing Issues
• Multi-Module Projects

---

Build File Detection Issues

Issue: Build File Not Found

Symptom: Verification fails to detect project type

Causes:

• Non-standard project structure
• Build file in subdirectory
• Multi-module project with root pom missing

Solution: Specify the build file location explicitly:

Verify Spring Boot project at ./backend/pom.xml

Or use Glob to find all build files:

# Find all Maven projects
find . -name "pom.xml" -type f

# Find all Gradle projects
find . -name "build.gradle*" -type f

---

Issue: Gradle Wrapper vs Direct Gradle

Symptom: Different dependency versions reported than expected

Cause: Gradle wrapper uses a different Gradle version than system Gradle

Solution: Check Gradle version in gradle/wrapper/gradle-wrapper.properties:

distributionUrl=https\://services.gradle.org/distributions/gradle-8.14-bin.zip

For Boot 4 compatibility, ensure Gradle 8.14+.

---

Issue: Both Maven and Gradle Present

Symptom: Conflicting dependency information

Cause: Project has both pom.xml and build.gradle

Solution: Ask which build system is primary:

• Check CI/CD pipeline for which is used
• Check .gitignore for which artifacts are ignored
• Look for wrapper scripts (mvnw vs gradlew)

---

Version Detection Issues

Issue: Spring Boot Version Not Detected

Symptom: Unable to determine Spring Boot version

Causes:

• Version defined in parent POM
• Version in Gradle version catalog
• Version in properties file

Maven - Check parent or properties:

<!-- In pom.xml -->
<parent>
    <artifactId>spring-boot-starter-parent</artifactId>
    <version>4.0.1</version>
</parent>

<!-- Or in properties -->
<properties>
    <spring-boot.version>4.0.1</spring-boot.version>
</properties>

Gradle - Check version catalog (gradle/libs.versions.toml):

[versions]
spring-boot = "4.0.1"

[plugins]
spring-boot = { id = "org.springframework.boot", version.ref = "spring-boot" }

Gradle - Check settings.gradle.kts:

pluginManagement {
    plugins {
        id("org.springframework.boot") version "4.0.1"
    }
}

---

Issue: Dependency Version Conflicts

Symptom: Multiple versions of same dependency detected

Cause: Transitive dependency conflicts

Solution - Maven: Use dependency management to enforce versions:

<dependencyManagement>
    <dependencies>
        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-dependencies</artifactId>
            <version>4.0.1</version>
            <type>pom</type>
            <scope>import</scope>
        </dependency>
    </dependencies>
</dependencyManagement>

Solution - Gradle:

dependencyManagement {
    imports {
        mavenBom("org.springframework.boot:spring-boot-dependencies:4.0.1")
    }
}

---

Issue: Spring Framework Version Override

Symptom: Spring Boot version is 4.x but Spring Framework shows 6.x

Cause: Explicit Spring Framework version override in dependencies

Detection:

# Maven
grep -r "spring-framework.version" pom.xml
grep -r "spring.version" pom.xml

# Gradle
grep -r "org.springframework:spring-" build.gradle*

Solution: Remove explicit Spring Framework versions; let Boot manage them.

---

False Positives

Issue: Jackson 2 Detected in Non-Production Code

Symptom: Jackson 2 warning for test utilities or legacy code

Cause: Test fixtures or deprecated modules still using Jackson 2

Solution: If Jackson 2 is intentionally used (e.g., testing both versions):

• Note this in verification scope
• Exclude specific directories from analysis:

# Exclude test utilities
grep -r "com\.fasterxml\.jackson" --include="*.java" \
  --exclude-dir="**/testutil" --exclude-dir="**/legacy"

---

Issue: Security and() Detected in Comments

Symptom: False positive for and() method in documentation comments

Cause: Pattern matching includes comments and strings

Solution: The verification should check for actual method calls:

# More precise pattern (excludes common false positives)
grep -r "\.and()" --include="*.java" | grep -v "//" | grep -v "\*"

For accurate detection, read the file and analyze the AST or context.

---

Issue: @MockBean in Commented Code

Symptom: @MockBean warning for commented-out test code

Cause: Pattern matching doesn't distinguish active vs commented code

Solution: Review flagged lines manually:

# Check if line is commented
grep -n "@MockBean" src/test/**/*.java | grep -v "^\s*//"

---

Configuration Parsing Issues

Issue: Multi-Profile Configuration

Symptom: Missing configuration issues in profile-specific files

Cause: Verification only checking application.yml, not application-{profile}.yml

Solution: Request verification of all profiles:

Verify configuration for all profiles: default, dev, staging, production

List all profile files:

ls -la src/main/resources/application*.yml
ls -la src/main/resources/application*.properties

---

Issue: YAML vs Properties Format Mismatch

Symptom: Configuration found in one format but not the other

Cause: Property keys differ between YAML and Properties formats

Reference: Spring Boot treats these as equivalent:

# YAML
spring:
  datasource:
    url: jdbc:postgresql://localhost/db

# Properties
spring.datasource.url=jdbc:postgresql://localhost/db

---

Issue: Externalized Configuration

Symptom: Configuration values not found in project files

Cause: Configuration loaded from:

• Environment variables
• Command line arguments
• External config server
• Kubernetes ConfigMaps/Secrets

Solution: Check for configuration sources:

# application.yml - using environment variable
spring:
  datasource:
    url: ${DATABASE_URL}
    password: ${DB_PASSWORD}

Note externalized values in verification report.

---

Multi-Module Projects

Issue: Parent POM Version Not Propagated

Symptom: Child modules show incorrect version

Cause: Child modules override parent version or use independent versioning

Solution: Check each module's pom.xml:

<!-- Parent POM -->
<parent>
    <groupId>org.springframework.boot</groupId>
    <artifactId>spring-boot-starter-parent</artifactId>
    <version>4.0.1</version>
</parent>

<!-- Child should inherit, not override -->
<parent>
    <groupId>com.example</groupId>
    <artifactId>parent</artifactId>
    <version>1.0.0</version>
</parent>
<!-- No spring-boot version here - inherited from parent -->

---

Issue: Mixed Spring Boot Versions Across Modules

Symptom: Different modules report different Spring Boot versions

Cause: Independent module versioning or stale dependencies

Solution: 1. Verify all modules use same parent 2. Check for explicit version overrides 3. Run dependency tree analysis:

# Maven
mvn dependency:tree | grep spring-boot

# Gradle
./gradlew dependencies | grep spring-boot

---

Issue: Shared Test Utilities with @MockBean

Symptom: Test utilities module using @MockBean that's shared across modules

Cause: Centralized test fixtures haven't been updated

Solution: Update shared test utilities first:

// shared-test-utils/src/main/java/com/example/test/MockConfig.java
// Before
@MockBean private SomeService service;

// After
@MockitoBean private SomeService service;

Then update all dependent modules.

---

Verification Tool Issues

Issue: Grep Pattern Too Broad

Symptom: Too many false positives

Solution: Use more specific patterns:

# Too broad
grep "and()" *.java

# Better - method chain context
grep -E "\.and\(\)" --include="*.java"

# Best - with exclusions
grep -E "\.and\(\)" --include="*.java" \
  --exclude-dir="target" \
  --exclude-dir="build" \
  --exclude-dir=".git"

---

Issue: Large Codebase Performance

Symptom: Verification takes too long

Solution: 1. Focus on specific directories:

# Only check src/main and src/test
grep -r "pattern" src/main src/test

2. Use parallel execution:

find . -name "*.java" | xargs -P 4 grep "pattern"

3. Exclude generated code:

grep -r "pattern" --exclude-dir="target" --exclude-dir="build" --exclude-dir="generated"

---

Using Exa MCP for Latest Documentation

When verification encounters edge cases not covered in reference docs, use Exa MCP:

Use Exa MCP to search for: "Spring Boot 4 [specific issue]"

Examples:

• "Spring Boot 4 Jackson 3 migration guide"
• "Spring Security 7 Lambda DSL examples"
• "Spring Boot 4 Testcontainers @ServiceConnection"

Spring Boot 4.x Verification Workflow

Step-by-step guide for verifying Spring Boot projects for compatibility and migration readiness.

Step 1: Detect Build System and Version

Goal: Identify the build system and extract Spring Boot version.

Actions:

# Find build files
Glob: **/pom.xml, **/build.gradle, **/build.gradle.kts

Extract version from:

• pom.xml: <parent><version> or spring-boot.version property
• build.gradle: plugins { id 'org.springframework.boot' version 'X.X.X' }

Decision Point:

• Version < 3.0 → Major migration required
• Version 3.x → Incremental upgrade path
• Version 4.x → Validate current setup

Step 2: Analyze Dependencies

Goal: Identify deprecated or incompatible dependencies.

Critical Checks:

Grep Commands:

Grep: com\.fasterxml\.jackson  # Jackson 2.x
Grep: javax\.(servlet|persistence|validation)  # Java EE
Grep: springfox|io\.swagger  # Old Swagger

Step 3: Validate Configuration

Goal: Check application configuration for deprecated patterns.

Files to Analyze:

• application.yml / application.properties
• SecurityConfiguration.java or similar
• WebMvcConfigurer implementations

Critical Configuration Checks:

Grep Commands:

Grep: \.and\(\)  # Security chaining
Grep: antMatchers|authorizeRequests  # Deprecated security methods
Grep: @MockBean  # Deprecated test annotation

Step 4: Check Test Configuration

Goal: Identify deprecated test patterns.

Critical Test Checks:

Grep Command:

Grep: @MockBean|@SpyBean  glob: **/*Test.java

Step 5: Generate Verification Report

Goal: Produce actionable report with severity levels.

Report Structure:

## Spring Boot 4.x Verification Report

### Summary
- **Project**: {name from pom.xml/build.gradle}
- **Current Version**: {detected version}
- **Target Version**: 4.0.x
- **Issues Found**: {n} Critical, {n} Errors, {n} Warnings

### Critical Issues
[Must fix before upgrade]

### Errors
[Should fix for compatibility]

### Warnings
[Recommended improvements]

### Migration Checklist
- [ ] Update Spring Boot version
- [ ] Migrate Jackson dependencies
- [ ] Update Security configuration
- [ ] Replace deprecated test annotations
- [ ] Review actuator exposure

Step 6: Lookup Latest Documentation

Goal: Verify recommendations against official docs.

Use Exa MCP for latest information:

mcp__exa__web_search_exa: "Spring Boot 4.0 migration guide site:spring.io"
mcp__exa__web_search_exa: "Spring Security 7 lambda DSL site:spring.io"

Official Resources:

• https://docs.spring.io/spring-boot/documentation.html
• https://github.com/spring-projects/spring-boot/wiki/Spring-Boot-4.0-Release-Notes

Quick Reference

For comprehensive migration guidance, see MIGRATION_GUIDE.md (referenced from SKILL.md).

Severity Definitions

Common Migration Paths

See MIGRATION_GUIDE.md for complete migration checklist and phase-by-phase instructions.

Jackson 2 to Jackson 3:

<!-- Before -->
<dependency>
    <groupId>com.fasterxml.jackson.core</groupId>
    <artifactId>jackson-databind</artifactId>
</dependency>

<!-- After -->
<dependency>
    <groupId>tools.jackson.core</groupId>
    <artifactId>jackson-databind</artifactId>
</dependency>

Security Configuration:

// Before (Security 6)
http.authorizeRequests()
    .antMatchers("/public/**").permitAll()
    .and()
    .formLogin();

// After (Security 7)
http.authorizeHttpRequests(auth -> auth
        .requestMatchers("/public/**").permitAll()
    )
    .formLogin(Customizer.withDefaults());

Test Annotations:

// Before
@MockBean
private UserService userService;

// After
@MockitoBean
private UserService userService;