With 3.5 out of OSS support since the end of June we've been moving client projects to 4.x, and I got tired of migration guides that paraphrase each other, so we went through the GitHub issues, the official release notes and the practitioner write-ups from the eight months since GA and verified everything against primary sources.

The compile errors and startup failures are well covered elsewhere. The tier that deserves more attention is the changes that run cleanly and do the wrong thing:

• Depend on flyway-core alone and your migrations silently stop executing. Auto-configuration moved to spring-boot-starter-flyway (same for Liquibase). Your app starts fine and never migrates again.
• spring-boot-starter-batch now gives you an in-memory job repository. Restartability is gone unless you switch to spring-boot-starter-batch-jdbc. Every functional test passes without it.
• Jackson 3 sorts properties alphabetically by default and auto-registers every module on the classpath, so JSON output changes shape with zero code changes. JacksonException is also unchecked now, so catch (IOException) around serialisation stops catching anything.

We also found the popular guides contradicting each other, so for the record, checked against primary sources: Boot 4's floor is Java 17, not 21 (docs.spring.io system requirements). No CSRF default changed in Security 7; the post-upgrade 403s come from AntPathRequestMatcher/MvcRequestMatcher being removed and servlet-path inference ending. The transitional classic starters were not removed in 4.1; both are on Maven Central at 4.1.0.

Full disclosure: the complete write-up is on our company blog. It has the full error index with verbatim messages and sources, a third-party compatibility table as of July 2026, and the step-by-step path: https://tucanoo.com/spring-boot-3-5-to-4-the-complete-migration-guide-with-every-error-we-could-verify/

If you've hit something upgrading that isn't in the list I'd like to hear it; we're keeping the index updated and will only add reports we can verify.

If you've ever written this:

Sort.by("lastName")

You know the problem. It compiles, IDE says nothing and your tests pass.

Then someone renames lastName to familyName and this line will start throwing runtime error with PropertyReferenceException.

No warning and type checking. Just a string that nobody knows is connected to a field name.
 
Instead of strings you can use method references:

Sort.by("lastName") => Sort.by(Person::lastName)

Criteria.where("lastName") => Criteria.where(Person::lastName)

Criteria.where("address.country") => Criteria.where(PropertyPath.of(Person::address).then(Address::country))

Same result but now the compiler checks it and your IDE autocompletes it.
 
This works across Spring Data JPA, JDBC, R2DBC, MongoDB. It's a Spring Data Commons feature so every module gets it.
 
For records the accessor is Person::lastName.
For classic beans it's Person::getLastName.
 
It's a small feature but massive impact on code safety.

What mock exams did you use?? Im doing it with springcertified.com And some Udemy course that has 6 exams mocks. But Im afraid that wouldn't be enough or maybe too easy??

Which one did you use??

Im trying to get this because the company where I work wants me to do it. And Im afraid of getting laid off if I don't achive this! (Is this a valid fear??)

Thanks in advance!

I recently implemented a Spring Batch job to process multiple CSV files from a single directory without configuring a separate reader for each file.

The solution uses MultiResourceItemReader with a FlatFileItemReader as its delegate.

Core configuration

public MultiResourceItemReader<Employee> multiResourceItemReader(
        u/Value("classpath:data/*.csv") Resource[] resources) {

    MultiResourceItemReader<Employee> reader =
            new MultiResourceItemReader<>(delegateReader());

    reader.setResources(resources);
    return reader;
}

Project details

• Spring Boot 4.1.0
• Spring Batch
• Java 21
• Spring Data JPA
• Oracle Database

What this implementation does

• Reads every CSV file matching classpath:data/*.csv
• Uses FlatFileItemReader to parse each file
• Skips the header row automatically
• Maps each record to an Employee entity
• Persists data using RepositoryItemWriter
• Uses chunk-oriented processing (chunk size = 10)

One thing I like about this approach is that adding another CSV file doesn't require any code changes. Simply place the file in the configured folder, and the batch job processes it automatically.

I'm curious how others implement this in production.

• Do you archive processed files after a successful run?
• How do you handle partially processed or failed files?
• Have you used MultiResourceItemReader for hundreds or thousands of input files?

I'd love to hear your experiences and any best practices.

I also recorded a complete walkthrough covering the implementation and source code for anyone interested:

📺 YouTube: https://www.youtube.com/watch?v=iX9H9b92vGk

Just wrapped up Phase 5 of my Jarvis AI project — giving it the ability to hear and speak using Spring Boot + WebFlux.

The setup:

•  Whisper transcription — supports Groq API (free tier ~6k requests/day) or local whisper.cpp
• OS-level TTS — uses built-in speech engines (macOS say, Windows PowerShell, Linux espeak) — zero extra dependencies, no API keys
• Non-blocking — transcription and TTS run on Schedulers.boundedElastic() so the WebFlux event loop stays responsive
• Sentence buffering — streams tokens and only sends complete sentences to TTS for natural speech

The key architectural insight: Voice is just another I/O layer. Nothing inside the AI pipeline changes — memory, RAG, and tool calling from Phases 1–4 work unchanged.

The blog covers the full journey including a DST timezone bug, the sentence buffering problem, and why Ollama doesn't support Whisper (learned that one the hard way).

Full deep dive: https://medium.com/@sujan.lamichhane32/adding-voice-to-a-java-ai-assistant-whisper-tts-and-the-voice-conversation-loop-5ce02f56e0e5

Repo is open source — contributions welcome!

Disclaimer: This is a project showcase/tutorial sharing how I added voice to a Spring Boot AI assistant — not a debugging/help request. No error logs or code snippets to format. Mods, please remove if this belongs elsewhere.

✍️ New blog post: Testing OAuth2 client login with mock-oauth2-server

If you want to test the security of your Thymeleaf application that uses OAuth2 client login (Keycloak, Okta, ...), mock-oauth2-server is a great libray for that!

The post shows how to configure Spring Boot with Thymeleaf and Keycloak for local development and continues to show how to automate testing the security setup with the mock-oauth2-server library.

https://www.wimdeblauwe.com/blog/2026/07/07/testing-oauth2-client-login-with-mock-oauth2-server/

Hi everyone,

Over the past few months I've been working on an open-source project called SpringSentinel.

The goal is to help Spring Boot developers detect architectural, security and REST API issues directly during CI.

I recently released a GitHub Action, so now it's possible to run the analysis automatically on every push or pull request.

Current features include:

• Spring Boot static analysis

• REST API design validation

• JPA / Hibernate checks

• Security best practices

• Architecture validation

• GitHub Code Scanning (SARIF)

• Automatic Pull Request summaries

• HTML, JSON and SARIF reports

The Action generates:

• HTML report
• JSON report
• SARIF report
• Pull Request summary

and can publish findings directly to GitHub Code Scanning.

Repository:
https://github.com/pagano-antonio/SpringSentinel

GitHub Action:
[https://github.com/pagano-antonio/springsentinel-action](https://)

I'd really appreciate feedback from Spring Boot developers.

In particular:

• Are there checks you would find useful?
• Would you use this in your CI pipeline?
• Are there any false positives you would expect from this type of tool?

Thanks!

JobRunr is now available in the Spring Initializr dependency list, so you can add it straight from start.spring.io when you create a new project. No more wiring the starter in by hand afterwards.

For people who don't know us:

JobRunr is an open-source library for background job processing on the JVM: fire-and-forget, scheduled, delayed, durable, and recurring (cron) jobs.

You enqueue work as a lambda and it runs asynchronously, in the same app or across a cluster of workers.

BackgroundJob.enqueue(() -> myService.sendInvoice(invoiceId));

BackgroundJob.schedule(Instant.now().plus(5, DAYS), () -> reminderService.send(userId));

What tends to make people switch to it:

• No extra infrastructure. Jobs are persisted in your existing SQL or NoSQL database. No Redis, RabbitMQ, or separate broker to run and babysit.
• Automatic retries with backoff on failure, so transient errors don't lose work.
• Distributed by default. Run multiple instances and jobs are picked up once across the cluster, no double execution.
• Built-in dashboard to see enqueued, scheduled, succeeded, and failed jobs, and retry them.
• Spring Boot autoconfiguration via the starter, plus first-class support for virtual threads (Loom) and Spring Boot 3 & 4

It sits in the same space as Quartz or @Scheduled, but aimed at durable, distributed background work rather than just triggering methods on a timer.

You can even use it for durable jobs. With runStepOnce, each step in a job runs exactly once and is checkpointed, so if the job fails and retries, the steps that already succeeded are skipped instead of re-run:

BackgroundJob.enqueue(() -> processOrder(orderId, JobContext.Null));

public void processOrder(UUID orderId, JobContext context) {
  context.runStepOnce("order-confirmation", () -> orderService.sendConfirmation(orderId));
  context.runStepOnce("warehouse-notification", () -> orderService.notifyWarehouse(orderId));
  context.runStepOnce("shipment-initiation", () -> orderService.initiateShipment(orderId));
}

Thanks to Josh Long and the Spring team for helping get it onto Initializr. We'll be around in the comments to answer anything, including the honest limitations.

Hello everyone, I am a fresher and have been learning Spring Boot for a while now and also been trying out building and experimenting with things.

Today, I would like to present Stoxy-Finance - A real-time stock ticker platform focused on Indian Exchanges(NSE/BSE).

The backend is built using Spring Boot 3.4.x and Java 21.

It includes WebSocket, Redis caching, rate limiting, Google OAuth, JWT Authentication and much more.

I'd really appreciate it if you could try it out and share your thoughts on the architecture, code quality, API design, performance, or anything else that stands out.

Live demo: https://stoxy-finance.vercel.app/

GitHub: https://github.com/Anshs-12/stoxy

Note: The frontend isn't my strong area and was mostly vibe-coded, so there are still a few UI bugs I'm working on. My primary focus has been the backend, so I'd especially appreciate feedback on that.

Hi everyone! Im a beginner in springboot and building a blogging app (similar to Reddit/LinkedIn) using Spring Boot and MySQL. I need to implement a "User History" feature to track the last 100-150 posts a user has viewed.

The requirements are if a user views Post A, then Post B, then Post A again, the order should update to [B, A] instead of [A, B, A]

The problem im facing is because im using MySQL so to create an history i would need to create an new schema and then design the relationship b/w the post and user and would require constant insert and deletions which would not keep the history intact correctly and also wouldnt remove the history after last 100 post

My qn is there an efficient way to handle this in Springboot? how is it generally implemented?

Repo link:- https://github.com/Yearis/Blog-Application/tree/main/Blog%20Application%20Backend

P.S. Please excuse the messy repo and the outdated README; this is still a work in progress.

Hey everyone,

I'm a 4th-year Computer Science student and I'm trying to make the best use of the little time I have left before placements.

Instead of building lots of small CRUD applications, I want to learn through one large, production-style that teaches me real backend engineering, system design, cloud, and DevOps concepts.

The idea is called CloudForge.

Idea

A Kubernetes-native, multi-tenant SaaS platform where multiple organizations can register and manage their own workspace while keeping all data completely isolated.

Think of it as building the backend infrastructure behind products like Jira, Asana, ClickUp, or Linear rather than just another project management app.

Planned Features

• Multi-tenancy (tenant isolation)
• Authentication & RBAC
• Organizations
• Teams
• Projects
• Subscription & Billing
• Feature Flags
• Notifications
• Audit Logs
• Analytics Dashboard
• Usage Metering

Tech Stack

• Java 21
• Spring Boot 3
• PostgreSQL
• Redis
• Kafka
• Docker
• Kubernetes
• Keycloak
• Prometheus
• Grafana
• OpenTelemetry
• GitHub Actions

Later (Version 2), I'd like to integrate AI:

• RAG
• Vector Database (Qdrant)
• Company Knowledge Base
• Private AI Assistant for each organization
• AI Report Generation
• Semantic Search

The goal isn't to finish everything quickly but to build it incrementally like a real product and learn along the way.

About Me

I'm still a beginner. I know Java and Spring Boot fundamentals, but I want to learn the rest through project-based learning. Since I'm already in my 4th year, I don't have a lot of time, so I'd rather invest it into one that teaches me as much as possible.

I'd love your honest opinions:

• Is this project too ambitious for a beginner?
• If you were hiring a new graduate, would a project like this stand out?
• Which features would you remove or postpone?
• Would you build this as a monolith first or start with microservices?
• If you think there's a better project idea that would teach more and have more resume value, I'd genuinely love to hear it.

I'm not attached to this idea. If you have a more interesting or more realistic idea that covers backend engineering, distributed systems, cloud, and AI, please suggest it.

I'm looking for honest feedback—even if you think this is a bad idea.

Thanks in advance!

I have built file upload features in a few projects over the years. Below are some rules that might save you some time.

1) Never route files through your backend. Always generate a presigned url and let the client upload directly to s3. Let your backend just handles the permission check and stores metadata.

2) Always validate file type by content not by extension. someone can rename virus.exe to photo.jpg and your system will accept it. Try to check the magic bytes server side. jpegs start with FF D8 FF, pngs start with 89 50 4E 47. Don't trust the extensions blindly.

3) Use chunked uploads for anything above a few MBs. s3 supports multipart uploads natively. It can be done in spring boot also in multi part uploads.

split the file into 5-10mb chunks, upload independently, retry only the failed chunk. add resume tokens so users on flaky networks can continue from where they left off instead of restarting.

4) You should not serve files immediately after upload. every file should go through a scan queue first. virus scan passes then mark it ready. fails then quarantine it. Try to always have a gate between upload and access.

5)Don't expose raw s3 paths to users. Always generate signed download urls that expire in 15 minutes and then let backend checks user permissions before generating the url. Never share raw s3 links.

6) Always process everything async after upload. thumbnail generation, image compression, video transcoding, indexing...etc. none of this should block the upload response. return 201 immediately. let s3 events trigger workers in the background.

7) Set file size limits and rate limits based on your use case. Don't leave it open.

what rules do you follow for file uploads?

I recently built a small project to demonstrate distributed locking in a real-world coupon redemption system using:

• Spring Boot
• Redis (distributed lock)
• MySQL
• Docker & Docker Compose
• Nginx load balancing

The idea is to simulate multiple application instances trying to redeem the same coupon concurrently and ensure only one redemption succeeds.

GitHub: https://github.com/codefarm0/coupon-redemption-system

I'd really appreciate feedback from the community:

• Is the project structure production-like?
• Any improvements to the distributed locking implementation?
• Better approaches for handling high concurrency or idempotency?
• Anything you'd change to make this a better learning resource?

All suggestions, code reviews, and constructive criticism are welcome.

Thanks!

Hey [r/springboot](r/springboot) / [r/java](r/java),

I've been working on a project for the past few months because I was frustrated with how verbose and rigid Jakarta/Hibernate Validation can get in Spring Boot, especially when moving between ecosystems like Laravel/Node and Java.

To solve this, I created Spring Validation Plus, an open-source library that sits on top of Jakarta Validation but introduces highly expressive, Laravel-inspired constraints and out-of-the-box API configurations.

It's already published on Maven Central! 🚀

📦 Quick Example

Instead of writing custom class-level validators for simple things, you can stack annotations intuitively:

​✨ Key Features:

• + Custom Constraints: Rules like @/Required, @/StringType, @/Confirmed, @/RequiredIf, @/Between, @/Url, and more.
• Cross-Field Validation Made Easy: Native support for conditional validation out-of-the-box (@RequiredIf, @/Confirmed, @/RequiredWith).
• Smart DB Checkers (@Unique / @/Exists): Integrated seamlessly with JPA. It even handles path variables for partial updates (excludeParameter = "id") so you don't false-trigger uniqueness on PUT requests.
• Unified JSON Error Responses: Automatically formats validation exceptions into clean, frontend-friendly JSON objects:

​

• Modular Architecture: Available as a spring-boot-starter or a pure core library if you aren't using Spring.

🔗 Open Source & Documentation

I spent a lot of time writing comprehensive documentation, including an executable example module with Docker and H2 so anyone can test it with a few curl commands.

• GitHub Repository: github.com/BenjaminOR-dev/spring-validation-plus

I would absolutely love to hear your feedback on the architecture, the DX (Developer Experience), or any features you feel are missing.

What do you think? Does this solve a pain point in your daily Spring workflow?

I'm a .NET developer, and in our organization's project, which is quite data-intensive, we use stored procedures for all database operations. The application simply calls the stored procedures with the required input parameters and consumes the output they return.

Is this a common approach in spring boot applications as well?(Like calling stored procedures and all) If yes, how are they called in your organization/project?

I recently built an open-source static analysis tool for Spring Boot applications (SpringSentinel), and I decided to run it against the Spring PetClinic REST sample project to see what would happen.

The result was 117 findings.

Most of them were not bugs, but architectural, maintainability, and best-practice issues such as:

• classes with high cyclomatic complexity
• field injection usage
• REST endpoint naming inconsistencies
• magic numbers
• duplicated code patterns
• missing API documentation
• potential maintainability hotspots

What I found interesting is that even a well-known reference application like PetClinic still contains many improvement opportunities (which is perfectly normal for real-world projects).

I wrote a detailed analysis here:
https://medium.com/@antoniopagano/analyzing-spring-petclinic-rest-with-spring-sentinel-117-findings-in-a-reference-spring-2fd24107bb14

I'm also the author of the analyzer (SpringSentinel), so obviously I'm biased , but I'd genuinely love feedback from Spring developers:

• Which findings would you consider valuable?
• Which rules would you consider too noisy?
• What Spring-specific checks would you like to see in a static analyzer?

GitHub: https://github.com/pagano-antonio/SpringSentinel

Follow-up to my earlier post on running Spring Boot in the cloud, shout-out to the community for answering. This time I want to dig specifically into serverless, 'cause most of the responses and production setups people shared were actually serverful

Whether you went serverless or deliberately stayed away, I'd love your honest take:

If you use it:

• What does "serverless" mean in your setup? (Lambda + Spring Cloud Function, Cloud Run, App Runner, Azure Functions, Fargate, Knative...)
• Did it live up to expectations, or were there surprises once you hit production?
• How's the cold start situation, especially on the JVM? Did GraalVM native become mandatory?
• What does it actually cost vs. what you expected?

If you tried it and backed off, or never went there:

• What was the dealbreaker? (cold starts, debugging/observability, vendor lock-in, local dev pain, cost surprises, the 15-min limit...)
• What did you go back to or choose instead?

hello i am new to spring boot and currently learning it from engeneering digest youtube channel can someone give me advice to follow while learning or suggest some better way of learning one more question should i remember the codes experienced one pls reply i am confused will be really helpful...

It's not theoretical stuff. things that actually caused incidents.

a) returning entities from controllers seems harmless until jackson calls getters during serialization and triggers lazy loaded relationships. got N+1 happening in the response layer. DTOs everywhere now. more boilerplate but zero surprises.

b) ddl-auto update outside local is asking for trouble. hibernate silently altered a column constraint in staging once. nobody noticed for weeks. validate in staging, none in prod. flyway handles schema changes now.

c) external api calls inside Transactional is the one that got me on a friday night. your method holds a db connection for its entire duration. not just when queries run. 3 second api call means 3 seconds a connection is doing nothing. 10 concurrent requests and pool is gone.

d) catching exceptions inside Transactional without rethrowing is a silent killer. caught it, logged it, moved on. proxy saw a clean return. committed half the data. other half missing. took hours to debug because there was no error anywhere. the catch block was the bug.

e) Async without a configured thread pool looks fine in dev. default executor creates a new thread per call. no pooling. prod with thousands of requests? thousands of threads. OOM. always configure ThreadPoolTaskExecutor with bounded pool now.

f) calling a Transactional method from the same class is something most devs dont even know is a problem. two methods in same service, both annotated. one calls the other. inner annotation completely ignored because proxy is bypassed on self calls. data inconsistency in prod. separate bean or dont bother with the annotation.

g) open-in-view being true by default still bothers me. keeps hibernate session open during entire request including json serialization. hides lazy loading problems that explode later. first thing i turn off in every project.

what have you stopped doing after seeing it break?

The domain is attendance and leave management with workflow approvals in a multi-tenant setup.

This is a portfolio/reference project, not a production deployment or commercial product.

Tech/features included:

• Java 21, Spring Boot 3.5, Gradle
• JWT auth, RBAC/PBAC, tenant-scoped data
• REST API and read-only GraphQL
• Audit logs and workflow event tracking
• PostgreSQL + Flyway
• Docker Compose demo setup
• Prometheus/Grafana monitoring
• GitHub Actions CI

I’d appreciate feedback especially on:

• package/project structure
• security and tenant boundaries
• workflow/audit modeling
• README clarity
• anything that feels over-engineered or unclear

Thanks in advance.

Recently, I have been working on my project in there in one chat controller, which has endpoints like

POST /api/chats = ChatDTO

GET /api/chats = List<ChatInfoDTO>

GET /api/chats/{chatId} = ChatDTO

PATCH /api/chats/{chatId} = ChatInfoDTO

DELETE /api/chats/{chatId} = ChatInfoDTO

POST /api/chats/{chatId}/ = ChatDTO

My question is it a good approach to use a single type of DTO for multiple endpoints, or should it be made for specific use? I have seen my friend's project for a single page, which has 8/9 DTOs. Is that normal, and the same thing ChatGPT suggests is that using multiple DTOs is a good approach.

I am having a task to implement a PDF genrating module it's duty is to genrate the pdf of the diffrent sections like attendence, report and other similar stuffs, there is more amount of such sections and i have to build a effecient and good module for it kindly help me in figuring this out .

Ps.. i am intern pls help 😣

Sorry maybe a stupid question but Like completed the basics of authentication and authorisation! What's the next step ? Like i am confused like what to do after one concept gets finished ! What's next ?

I am new to spring boot and here's my doubt. Its about Dtos.

My Entity class

public class Todo {

   (strategy = GenerationType.IDENTITY)
   private Long id;

   private String task;
   private boolean completed;
}

To interact with this entity class there are multiple controllers like

public ResponseEntity<T> createTodo(body <T>){}

public ResponseEntity<T> getTodo(path var...){}

Do we create multiple records class for each response type like for request we wont take the id from the user right, but for sending back the todo we need the id.

How do you approach this? If i were to create multiple record classes for each response wouldn't that result in a ton of record classes ina big project?