Skip to content

deps(phase6): upgrade Spring Boot 2.7.18 → 3.4.5#16

Merged
sundancekid73 merged 2 commits into
mainfrom
deps/phase6-spring-boot-3
Jun 10, 2026
Merged

deps(phase6): upgrade Spring Boot 2.7.18 → 3.4.5#16
sundancekid73 merged 2 commits into
mainfrom
deps/phase6-spring-boot-3

Conversation

@sundancekid73

Copy link
Copy Markdown
Collaborator

Summary

Final phase of the dependency update series. Upgrades to Spring Boot 3.4.5 with Java 17, Spring Security 6, and Eclipse Temurin Docker images.

Changes:

  • Spring Boot 2.7.18 → 3.4.5
  • io.spring.dependency-management 1.1.6 → 1.1.7
  • SpringDoc springdoc-openapi-ui:1.8.0springdoc-openapi-starter-webmvc-ui:2.8.8 (artifact ID changes for Boot 3)
  • ext['jackson.version'] and ext['log4j2.version'] overrides removed — Boot 3.4.5 BOM manages Jackson 2.18.3 (up from our 2.17.3 override) and safe log4j2 directly
  • SecurityConfig: authorizeRequests/antMatchersauthorizeHttpRequests/requestMatchers (Spring Security 6 removals)
  • Dockerfile: adoptopenjdk/openjdk11 (EOL) → eclipse-temurin:17-jdk/jre-alpine
  • ComicControllerTest: fixed trailing-slash test URL (/comics//comics) — Spring Framework 6 no longer matches trailing slashes by default

Full upgrade summary across all 6 phases

Component Before After
Spring Boot 2.4.5 (EOL) 3.4.5
Gradle 6.8 7.6.4
Java compile target 11 17
Jackson 2.9.10 (CVEs) 2.18.3 (BOM-managed)
Keycloak adapter 6.0.1 (deprecated 2022) removed → Spring OAuth2
SpringFox 2.9.2 (abandoned 2020) removed → SpringDoc 2.8.8
Spring Security 5.4.6 6.4.x (BOM-managed)
Log4j2 2.16.0 (CVE-2021-45105) BOM-managed
Docker base adoptopenjdk/openjdk11 (EOL) eclipse-temurin:17-jre-alpine

Test plan

  • All 56 tests pass, 0 failures
  • contextLoads() active (was disabled since Phase 1)

Generated with Claude Code

sundancekid73 and others added 2 commits June 10, 2026 12:17
…urity 6)

build.gradle:
- Spring Boot plugin 2.7.18 → 3.4.5
- io.spring.dependency-management 1.1.6 → 1.1.7
- SpringDoc springdoc-openapi-ui:1.8.0 → springdoc-openapi-starter-webmvc-ui:2.8.8
  (artifact ID change required for Spring Boot 3 compatibility)
- Remove ext[jackson.version] and ext[log4j2.version] overrides — Boot 3.4.5
  BOM now manages Jackson 2.18.3 and a safe log4j2 version directly

SecurityConfig.java:
- authorizeRequests() → authorizeHttpRequests() (removed in Spring Security 6)
- antMatchers() → requestMatchers() (removed in Spring Security 6)

Dockerfile:
- adoptopenjdk/openjdk11:alpine-slim → eclipse-temurin:17-jdk-alpine (build stage)
- adoptopenjdk/openjdk11:alpine-jre → eclipse-temurin:17-jre-alpine (runtime stage)
  adoptopenjdk images are EOL; Eclipse Temurin is the successor

ComicControllerTest:
- POST /comics/ → /comics: Spring Framework 6 no longer matches trailing
  slashes by default (spring.mvc.pathmatch trailing-slash-match removed)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Spring Boot 3.4.5 Gradle plugin requires Java 17 to run.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
@sundancekid73 sundancekid73 merged commit 2f4c306 into main Jun 10, 2026
8 checks passed
@sundancekid73 sundancekid73 deleted the deps/phase6-spring-boot-3 branch June 10, 2026 10:23
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant