Spring Boot 4 is out now with improved support for Java 25 and better null handling. It's a worthy upgrade, and we may as well do it now.
This is also an opportunity to improve the JWT handling and session management, which is currently a bit flaky. The JWT logic can probably be replaced with a Spring-provided alternative and the filter chains should probably be split up for the different projects (frontend and API).