Spring Boot 4.x Project Verification

Analyzes Spring Boot projects for dependency compatibility, configuration correctness, and migration readiness.

Verification Workflow

1. Detect Build System → Find pom.xml or build.gradle, extract Spring Boot version
2. Analyze Dependencies → Check versions, find deprecated libraries, validate compatibility
3. Validate Configuration → Check application.yml/properties, security config, actuator settings
4. Generate Report → Structured markdown with severity levels and remediation code
5. Lookup Docs → Use Exa MCP to fetch latest Spring Boot 4.x documentation when needed

Dependency Quick Reference

Check	Severity	Action
Spring Boot version < 4.0	CRITICAL	Upgrade to 4.0.x
Jackson 2.x (com.fasterxml)	CRITICAL	Migrate to Jackson 3 (tools.jackson)
javax.* imports	CRITICAL	Migrate to jakarta.* namespace
@MockBean in tests	ERROR	Replace with @MockitoBean
Undertow server	ERROR	Switch to Tomcat or Jetty
Java version < 17	ERROR	Minimum Java 17 required
Gradle version < 8.14	ERROR	Upgrade Gradle (required for Kotlin 2.2/Boot 4)
spring-boot-starter-web	WARNING	Use spring-boot-starter-webmvc
Missing Virtual Threads	INFO	Enable with spring.threads.virtual.enabled=true

Configuration Quick Reference

Check	Severity	Action
Security and() chaining	CRITICAL	Convert to Lambda DSL closures
antMatchers() usage	ERROR	Replace with requestMatchers()
authorizeRequests()	ERROR	Replace with authorizeHttpRequests()
All actuator endpoints exposed	WARNING	Limit to health, info, metrics
100% trace sampling	WARNING	Use 10% in production

Jakarta Namespace Migration

Critical for Spring Boot 3+: All javax.* packages must migrate to jakarta.*:

Old Package	New Package
javax.persistence.*	jakarta.persistence.*
javax.servlet.*	jakarta.servlet.*
javax.validation.*	jakarta.validation.*
javax.inject.*	jakarta.inject.*
javax.annotation.*	jakarta.annotation.*

Use Grep to find: import\s+javax\.

Spring Boot 4 New Features

Feature	Configuration	Benefit
Virtual Threads	spring.threads.virtual.enabled=true	High concurrency without WebFlux
JSpecify Null-Safety	Add @NullMarked to package-info	Framework-wide null contracts
AOT Compilation	Enabled by default	Faster startup times

JSpecify Annotations

Spring Framework 7 uses JSpecify for null-safety:

@NullMarked  // Package or class level - all parameters/returns non-null by default
package com.example.myapp;

import org.jspecify.annotations.Nullable;

public class UserService {
    // @Nullable for parameters/returns that can be null
    public @Nullable User findById(Long id) { ... }
}

Tools to Use

1. Glob → Find **/pom.xml, **/build.gradle*, **/application.{yml,properties}
2. Grep → Search for deprecated patterns (@MockBean, com.fasterxml, .and(), import javax.)
3. Read → Inspect build files and configuration
4. Exa MCP → Fetch latest Spring Boot 4.x docs: mcp__exa__web_search_exa

Output Format

Generate verification reports with this structure:

## Spring Boot 4.x Verification Report

### Summary
- **Project**: {name}
- **Boot Version**: {detected version}
- **Issues Found**: {n} Critical, {n} Errors, {n} Warnings

### Critical Issues / Errors / Warnings
[Issue details with code remediation]

Detailed References

• Workflow: See WORKFLOW.md for step-by-step verification process
• Migration Guide: See MIGRATION_GUIDE.md for step-by-step migration from Boot 3.x to 4.0 (also referenced from WORKFLOW.md)
• Examples: See EXAMPLES.md for sample verification outputs
• Troubleshooting: See TROUBLESHOOTING.md for detection issues
• Dependencies: See references/DEPENDENCIES.md for complete version matrix
• Configuration: See references/CONFIGURATION.md for validation rules

Critical Reminders

1. Check Spring Boot version first — Many issues are version-specific
2. Jakarta namespace migration — javax.* to jakarta.* (required for Boot 3+)
3. Jackson 3 namespace change — com.fasterxml.jackson to tools.jackson
4. Security 7 Lambda DSL — and() method removed, closures required
5. Testing annotations changed — @MockBean to @MockitoBean
6. Virtual Threads — Enable with spring.threads.virtual.enabled=true for Java 21+
7. Gradle 8.14+ — Required for Kotlin 2.2 and Spring Boot 4 support
8. Use official docs — https://docs.spring.io/spring-boot/documentation.html

Related Skills

• spring-boot-security — Deep security configuration verification
• spring-boot-testing — Testing patterns and coverage analysis
• spring-boot-observability — Actuator, metrics, and tracing setup
• spring-boot-modulith — Module structure verification
• domain-driven-design — DDD architecture patterns