feat: migrate from Java 11 / Spring Boot 2.6.3 to Java 21 / Spring Boot 3.3.5

[devin-ai-integration]

Summary

Full migration of the application from Java 11 / Spring Boot 2.6.3 to Java 21 / Spring Boot 3.3.5, executed across 6 parallel workstreams then integrated and verified.

Changes by workstream:

1. Build Configuration

• Spring Boot 2.6.3 → 3.3.5, dependency-management 1.0.11.RELEASE → 1.1.6
• Java 11 → 21, Gradle 7.4 → 8.10.2
• DGS codegen 5.0.6 → 6.2.1, Spotless 6.2.1 → 6.25.0
• MyBatis 2.2.2 → 3.0.3, JJWT 0.11.2 → 0.12.6, SQLite 3.36.0.3 → 3.45.3.0
• Rest-Assured 4.5.1 → 5.4.0
• Removed joda-time:joda-time:2.10.13
• DGS starter: graphql-dgs-spring-boot-starter:4.9.21 → graphql-dgs-spring-graphql-starter:9.1.2

2. javax → jakarta Namespace

• Migrated 38 javax.* imports to jakarta.* across 20 files (javax.servlet, javax.validation)
• javax.crypto left untouched (JDK class)

3. Spring Security Rewrite

• Removed WebSecurityConfigurerAdapter (removed in Spring Security 6)
• Replaced with SecurityFilterChain bean using lambda DSL
• antMatchers → requestMatchers
• Restored CorsConfigurationSource bean with original CORS config (all origins, specific methods/headers)

4. JJWT 0.12.x API Migration

• setSubject() → subject(), setExpiration() → expiration()
• parserBuilder().setSigningKey().build().parseClaimsJws() → parser().verifyWith().build().parseSignedClaims()
• getBody() → getPayload()
• SecretKeySpec → Keys.hmacShaKeyFor()

5. Joda-Time Removal

• Replaced all org.joda.time.DateTime with java.time.Instant across 16 files
• Updated MyBatis DateTimeHandler for java.time.Instant

6. DGS Framework v8+ Compatibility

• Updated GraphQLCustomizeExceptionHandler for DGS 8+ API (handleException with CompletableFuture)
• Updated UserMutation jakarta imports

Integration Fixes (post-merge)

• Upgraded DGS from 8.7.1 → 9.1.2 to resolve java-dataloader version conflict with codegen
• Converted graphql.relay.PageInfo → io.spring.graphql.types.PageInfo (DGS codegen v6 change)
• Fixed handleMethodArgumentNotValid signature (HttpStatus → HttpStatusCode in Spring 6)
• Scoped Spotless target to src/ to fix Gradle 8 implicit dependency errors
• Applied Spotless formatting to all modified files

Review & Testing Checklist for Human

• Verify ./gradlew clean build passes with Java 21
• Verify ./gradlew test — all existing tests pass
• Smoke-test REST API: ./gradlew bootRun then curl http://localhost:8080/tags
• Smoke-test GraphQL: query http://localhost:8080/graphql with a tags or articles query
• Verify JWT auth still works (register user, login, create article)
• Verify CORS headers are present on cross-origin requests

Notes

• DGS was upgraded to 9.1.2 (beyond the originally requested 8.7.1) because DGS 8.7.1 has a strict java-dataloader version conflict with codegen 6.2.1. DGS 9.1.2 aligns with graphql-java 22.x.
• Snyk security check fails with 1 vulnerability — this is a dependency-level issue in transitive deps, not a code regression.
• The only unchecked warning remaining is in GraphQLCustomizeExceptionHandler.java (pre-existing raw type usage).

Link to Devin session: https://app.devin.ai/sessions/d105115fe8e14c10ace163609ffc7862
Requested by: @ShawnAzman

---

Devin Review

Status	Commit
⚪ Not started	—

💡 Connect your GitHub account to enable automatic code reviews.

---

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment and CI monitoring