Migrate from Java 11 + Spring Boot 2.6.3 to Java 17 + Spring Boot 3.2.0

[devin-ai-integration]

Summary

Major framework upgrade migrating from Java 11 / Spring Boot 2.6.3 to Java 17 / Spring Boot 3.2.0. This touches 27 files across build config, CI, security, and all Jakarta EE namespace imports.

Key changes:

• Build: Spring Boot 3.2.0, Gradle wrapper 7.4→8.5, dependency-management 1.1.4, DGS codegen 6.0.3, DGS starter 8.2.0, MyBatis 3.0.3, REST Assured 5.3.2
• Namespace: All javax.servlet.*, javax.validation.* → jakarta.servlet.*, jakarta.validation.* (20 files). javax.crypto left as-is (JDK, not Jakarta EE).
• Security: WebSecurityConfigurerAdapter removed → SecurityFilterChain @Bean with lambda DSL. antMatchers → requestMatchers, authorizeRequests → authorizeHttpRequests.
• Exception handling: CustomizeExceptionHandler.handleMethodArgumentNotValid signature updated (HttpStatus → HttpStatusCode).
• GraphQL/DGS: DataFetcherExceptionHandler.onException → handleException returning CompletableFuture. graphql.relay.DefaultPageInfo → DGS-generated io.spring.graphql.types.PageInfo builder pattern.
• CI & docs: GitHub Actions JDK 11→17, README updated.

Review & Testing Checklist for Human

• Security config equivalence: Verify the WebSecurityConfig lambda DSL produces identical security behavior to the old WebSecurityConfigurerAdapter chain — especially CORS handling (now passed via cors(cors -> cors.configurationSource(...)) instead of .cors().and()) and URL matching (requestMatchers vs antMatchers can differ in pattern semantics).
• Run the full test suite (./gradlew clean test). Compilation passes but tests were not run locally. MyBatis 2→3, DGS 4→8, and Spring Security 5→6 all have potential runtime/test-level breaking changes.
• Verify GraphQL PageInfo fields: The switch from graphql.relay.DefaultPageInfo to the DGS-generated PageInfo builder assumes the schema generates startCursor, endCursor, hasPreviousPage, hasNextPage. Confirm the generated types match.
• Boot the app (./gradlew bootRun) and hit a few endpoints (e.g., GET /tags, POST /users, GraphQL at /graphql) to verify Spring context loads and DGS wiring is correct.
• DGS 4→8 compatibility: This is a 4-major-version jump. Check for any additional DGS API changes beyond what was fixed in this PR (codegen output, datafetcher wiring, etc.).

Notes

• javax.crypto.SecretKey / SecretKeySpec imports in DefaultJwtService.java were intentionally not migrated — these are JDK classes, not Jakarta EE.
• Gradle wrapper upgraded to 8.5 to support Java 21 (the build VM runs Java 21, though the project targets Java 17).
• CI checks will run on Java 17 per the updated workflow.

Link to Devin run: https://app.devin.ai/sessions/e5a65850f33e460b8925a594dbcaac23
Requested by: @iancmoritz

---

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment and CI monitoring

[devin-ai-integration]

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no potential bugs to report.

View in Devin Review to see 5 additional findings.