Spring Boot 3.x is now outside OSS support. Here's how to calculate the risk, choose the right 4.x landing zone, automate the mechanical work with OpenRewrite, and complete the migration without turning it into a six-month rewrite.
AI scanners are flooding the Spring ecosystem with patch PRs faster than any team can review. Build an automated remediation pipeline instead: Dependabot or Renovate tuned for Spring Boot parent POMs and BOMs, a Testcontainers regression gate that decides which bumps are safe, and canary deployments for minor framework upgrades.
A practical Spring Framework 6 to 7 migration guide covering the Jakarta EE 11 baseline, removed and deprecated APIs, AOT and GraalVM changes, BeanRegistrar and proxy lifecycle changes, JSpecify null safety, testing and security implications, an upgrade checklist, and an AI prompt to scan your project.
Of every breaking change in the Spring Boot 2 → 3 era, the removal of WebSecurityConfigurerAdapter generated the most confused stack traces I've debugged — because security configuration is the one place where "it compiles and runs" tells you almost nothing about whether it still protects anything. This guide migrates Spring Security 5 configurations to the 6.x component model (Spring Boot 3.x), covers what tightens further in Spring Security 7 (Spring Boot 4), and flags the places where a mechanical conversion quietly changes your authorization behaviour.
Spring Boot 4 finally forced the issue: RestTemplate, in maintenance mode since Spring 5, is out of the recommended path, and codebases full of getForObject() and exchange() calls need a plan. The good news is that RestClient (introduced in Spring 6.1 / Boot 3.2) was designed as the synchronous successor, so this migration is mostly mechanical — if you know the method-by-method mapping and the three places where behaviour quietly differs. This guide gives you both.
The first time I ported a Zuul gateway to Spring Cloud Gateway, the routes took an afternoon — and the filters took two weeks. That ratio surprises every team that attempts this migration, because the route configuration looks superficially similar while the filter model is a different universe: Zuul 1 is a blocking servlet filter chain, Spring Cloud Gateway runs on Netty with Project Reactor, and a single hidden blocking call in a ported filter can stall your entire gateway. This guide covers the route conversion, the filter-by-filter port, and the blocking-call traps, in that order.
In 2020 I published a dozen tutorials on this site covering Eureka, Hystrix, Zuul, Ribbon, and Feign — the Spring Cloud Netflix stack. They were accurate then. Today, most of that stack is dead: Netflix put Hystrix into maintenance mode back in 2018, Zuul 1 and Ribbon followed, and the Spring team removed them from the Spring Cloud release train entirely. If you are still running any of these libraries on Spring Boot 2.x, this guide maps every Netflix component to its modern replacement and shows you the actual migration steps — including the parts that break.
A hands-on comparison of serverless Java AI inference on AWS Lambda, Azure Functions, and Google Cloud Run — with real benchmark data, cost tables, a clear winner recommendation, and code you can run.
A practical Spring Boot 3 to 4 migration guide covering the real Java baseline, starter modularization, Jackson 3 as the default JSON library, Spring Security 7 defaults, virtual threads, testing breakage, and production pitfalls that most tutorials skip entirely.
Three identical Spring Boot 3.4 endpoints — DB-bound, external-API-bound, and CPU-bound — benchmarked under platform threads, virtual threads, and Spring WebFlux. Benchmark tables, explicit counterexamples, and a decision tree: if your service does X, pick Y, because Z.