Spring Boot 4.1 and Spring Security 7.1 make a resource server one property long. That property does not validate the audience, cannot see Keycloak's roles, and caches the JWK Set in a way that decides whether a leaked signing key stops working in five minutes or never. Read from the sources, then measured: a retired key accepted indefinitely, and 25 bad tokens producing 25 JWKS fetches at the issuer.
Spring Boot 3.x is now outside OSS support. Here's how to calculate the risk, choose the right 4.x landing zone, automate the mechanical work with OpenRewrite, and complete the migration without turning it into a six-month rewrite.
A three-part guide to JWT authentication on Spring Security 7.1 and Spring Boot 4.1, written to be useful whether you have never issued a token or already run one in production. Part 1 starts from zero: what a token is, what is inside it, the two paths through the application, and the smallest configuration that verifies one. Part 2 opens the filter chain — writing the OncePerRequestFilter by hand, where it goes, what really decides 401 versus 403, why a permitAll() login endpoint still returns 403 with CSRF on, and how to choose a signing algorithm. Part 3 is everything the defaults do not check.
A complete Spring AI 1.x to 2.0 migration guide, verified against Spring AI 2.0.0 on Spring Boot 4.1. Boot 4 is mandatory and Jackson moves to 3. internalToolExecutionEnabled and toolNames are removed outright, not renamed. Chat memory becomes stricter: 2.0 removes the remaining default-ID and builder-based configuration paths, while explicit per-request conversation IDs — introduced during the 1.x line — become the only safe migration target. Plus the changes that produce no compile error at all.
Spring Boot 4 promotes gRPC to a first-class starter. A beginner-to-advanced guide: all four call types, then the failures whose error messages point somewhere other than their cause — the 4 MB limit and which side enforces it, the absent default deadline, cancellation that never interrupts your thread, UNKNOWN statuses, and the in-process test transport that cannot enforce message size limits at all.
A beginner-to-advanced guide to exactly-once semantics with Spring Kafka on Spring Boot 4.1 — idempotent producers, transactions, and read-process-write. Verified against a live broker: the acks=1 setting that silently disables idempotence, the transaction markers that break offset arithmetic (but not consumer lag), the random transactional.id that defeats fencing entirely, the database boundary Kafka cannot cross, and what a transaction actually costs.
A beginner-to-advanced guide to Generational ZGC on JDK 25 — the first LTS where it is the only ZGC. Colored pointers, load and store barriers, and a measured comparison against G1: ZGC's p99.9 of 1.4 ms vs G1's 95.2 ms, 1.5 ms of total freeze time vs 1.14 s, plus the failure modes and throughput costs nobody charts — allocation stalls, disabled compressed oops, and the promotion crossover where ZGC wins throughput too.
The refined Specification API, AOT repository generation, and shared EntityManager wiring are the parts of the Spring Data JPA 3 to 4 migration that don't show up in a repository interface. Part 3 of the migration series covers DeleteSpecification/UpdateSpecification, JpaSort.unsafe, AOT knobs, and native-image implications.
Spring Data JPA 4 quietly moved derived queries off the Criteria API onto JPQL strings. Part 2 of the migration series covers the benchmark, getSingleResultOrNull, provider differences (with a real EclipseLink regression), the removed native-query parser, NULLS precedence, and which new JPQL functions are portable.
Part 1 of a 3-part Spring Data JPA 3 to 4 migration series. Covers the platform bump, the hibernate-jpamodelgen to hibernate-processor rename, repository interface compatibility, the JSpecify @NullMarked null-handling shift, and what genuinely doesn't change. Verified against Spring Boot 4.0.6 and Spring Data JPA 4.0.6.