Migrate to Java 17 + Spring Boot 3

[devin-ai-integration]

Summary

Migrates the project from Java 11 / Spring Boot 2.6 to Java 17 / Spring Boot 3.2 per the requested 10-step plan.

Build / deps

• sourceCompatibility / targetCompatibility → 17
• Gradle wrapper 7.4 → 8.5
• Spring Boot 2.6.3 → 3.2.5, dependency-management 1.1.4
• MyBatis starter 2.2.2 → 3.0.3 (main + test), SQLite JDBC → 3.45.1.0, REST Assured → 5.4.0, jjwt → 0.12.5, Spotless → 6.25.0
• DGS: graphql-dgs-spring-boot-starter:4.9.21 → graphql-dgs-spring-graphql-starter:9.0.0, codegen plugin 6.2.1
• Removed joda-time
• Added explicit spotlessJava task deps (compileJava, generateJava, processResources, compileTestJava, processTestResources) to satisfy Gradle 8's stricter implicit-dependency validation

Code changes

• javax.servlet.* / javax.validation.* → jakarta.* across all web/validation files
• WebSecurityConfig refactored from WebSecurityConfigurerAdapter to the Spring Security 6 SecurityFilterChain bean (lambda DSL, requestMatchers, authorizeHttpRequests)
• CustomizeExceptionHandler.handleMethodArgumentNotValid signature updated to HttpStatusCode
• org.joda.time.DateTime → java.time.Instant everywhere (core entities, data DTOs, MyBatis DateTimeHandler, cursors, query services, Jackson serializer, tests)
• JacksonCustomizations now serializes Instant with a manual DateTimeFormatter producing yyyy-MM-dd'T'HH:mm:ss.SSS'Z'
• DGS datafetchers switched to generated io.spring.graphql.types.PageInfo (replacing graphql.relay.DefaultPageInfo); GraphQLCustomizeExceptionHandler now implements the DGS 9.0.0 handleException method returning CompletableFuture<DataFetcherExceptionHandlerResult>
• DefaultJwtService updated to the jjwt 0.12.x builder/parser API (subject, expiration, Jwts.SIG.HS512, verifyWith, parseSignedClaims, getPayload)
• Opportunistic Java 17 polish: pattern matching for instanceof, Map.of(...) replacing double-brace init, Stream.toList()

Test/config

• DefaultJwtServiceTest setUp key extended from 60 → 80 chars so the HS512 key meets jjwt 0.12.x's enforced 512-bit minimum
• Added spring.graphql.schema.inspection.enabled=false — required to start the context (see note below)

Full ./gradlew clean build passes locally (68 tests, all green).

Review & Testing Checklist for Human

• spring.graphql.schema.inspection.enabled=false — Spring GraphQL's SchemaMappingInspector infers node type names by stripping the Connection suffix, so ArticlesConnection/CommentsConnection map to Articles/Comments which don't exist (we have Article/Comment). I disabled the inspector to get the context to start. Confirm this workaround is acceptable, or consider renaming the GraphQL types to ArticleConnection/CommentConnection as a follow-up.
• JacksonCustomizations date format — the old Joda ISODateTimeFormat.dateTime().withZoneUTC() produces yyyy-MM-dd'T'HH:mm:ss.SSSZZ (e.g. ...SSS+00:00); I replaced it with a formatter that hardcodes a trailing Z. Functionally equivalent for UTC, but the literal bytes differ from the pre-migration output. Verify no downstream consumer pins the exact previous suffix.
• JWT test key change — extending the test secret to 80 chars was necessary because jjwt 0.12.x rejects <512-bit keys for HS512. The prod jwt.secret in application.properties is already long enough. Confirm this is acceptable.
• GraphQL + REST end-to-end — since schema inspection is now off, exercise key flows manually: list/create/update article, feed, comments (REST and /graphql), login, and cursor pagination (connections). Verify timestamps in responses look correct with the new Instant serializer.
• Flyway migrations on a fresh dev.db — delete dev.db and start the app to confirm Spring Boot 3 / Flyway 9 still applies the SQLite migrations cleanly.

Notes

• clean still deletes dev.db.
• No flyway-database-sqlite module was added — Flyway 9 bundled with Spring Boot 3.2 still handles SQLite via flyway-core and tests pass, but this is worth watching if you bump Flyway in the future.
• Sessions URL and requester info are appended automatically.

Link to Devin session: https://app.devin.ai/sessions/62e23f92e1624385ba70f64c526fb940
Requested by: @schaudhry123

---

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment and CI monitoring

[devin-ai-integration]

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no potential bugs to report.

View in Devin Review to see 6 additional findings.