spring-boot-verify

Spring Boot 4.x Project Verification

Analyzes Spring Boot projects for dependency compatibility, configuration correctness, and migration readiness.

Verification Workflow

1. Detect Build System → Find pom.xml or build.gradle, extract Spring Boot version
2. Analyze Dependencies → Check versions, find deprecated libraries, validate compatibility
3. Validate Configuration → Check application.yml/properties, security config, actuator settings
4. Generate Report → Structured markdown with severity levels and remediation code
5. Lookup Docs → Use Exa MCP to fetch latest Spring Boot 4.x documentation when needed

Dependency Quick Reference

| Check | Severity | Action | |-------|----------|--------| | Spring Boot version < 4.0 | CRITICAL | Upgrade to 4.0.x | | Jackson 2.x (com.fasterxml) | CRITICAL | Migrate to Jackson 3 (tools.jackson) | | javax. imports | CRITICAL | Migrate to jakarta. namespace | | @MockBean in tests | ERROR | Replace with @MockitoBean | | Undertow server | ERROR | Switch to Tomcat or Jetty | | Java version < 17 | ERROR | Minimum Java 17 required | | Gradle version < 8.14 | ERROR | Upgrade Gradle (required for Kotlin 2.2/Boot 4) | | spring-boot-starter-web | WARNING | Use spring-boot-starter-webmvc | | Missing Virtual Threads | INFO | Enable with spring.threads.virtual.enabled=true |

Configuration Quick Reference

| Check | Severity | Action | |-------|----------|--------| | Security and() chaining | CRITICAL | Convert to Lambda DSL closures | | antMatchers() usage | ERROR | Replace with requestMatchers() | | authorizeRequests() | ERROR | Replace with authorizeHttpRequests() | | All actuator endpoints exposed | WARNING | Limit to health, info, metrics | | 100% trace sampling | WARNING | Use 10% in production |

Jakarta Namespace Migration

Critical for Spring Boot 3+: All javax. packages must migrate to jakarta.:

| Old Package | New Package | |-------------|-------------| | javax.persistence. | jakarta.persistence. | | javax.servlet. | jakarta.servlet. | | javax.validation. | jakarta.validation. | | javax.inject. | jakarta.inject. | | javax.annotation. | jakarta.annotation. |

Use Grep to find: import\s+javax\.

Spring Boot 4 New Features

| Feature | Configuration | Benefit | |---------|---------------|---------| | Virtual Threads | spring.threads.virtual.enabled=true | High concurrency without WebFlux | | JSpecify Null-Safety | Add @NullMarked to package-info | Framework-wide null contracts | | AOT Compilation | Enabled by default | Faster startup times |

JSpecify Annotations

Spring Framework 7 uses JSpecify for null-safety:

@NullMarked  // Package or class level - all parameters/returns non-null by default
package com.example.myapp;

import org.jspecify.annotations.Nullable;

public class UserService {
    // @Nullable for parameters/returns that can be null
    public @Nullable User findById(Long id) { ... }
}

Tools to Use

1. Glob → Find /pom.xml, /build.gradle*, **/application.{yml,properties}
2. Grep → Search for deprecated patterns (@MockBean, com.fasterxml, .and(), import javax.)
3. Read → Inspect build files and configuration
4. Exa MCP → Fetch latest Spring Boot 4.x docs: mcp__exa__web_search_exa

Output Format

Generate verification reports with this structure:

## Spring Boot 4.x Verification Report

### Summary
- **Project**: {name}
- **Boot Version**: {detected version}
- **Issues Found**: {n} Critical, {n} Errors, {n} Warnings

### Critical Issues / Errors / Warnings
[Issue details with code remediation]

Detailed References

• Workflow: See [WORKFLOW.md](WORKFLOW.md) for step-by-step verification process
• Migration Guide: See [MIGRATION_GUIDE.md](MIGRATION_GUIDE.md) for step-by-step migration from Boot 3.x to 4.0 (also referenced from WORKFLOW.md)
• Examples: See [EXAMPLES.md](EXAMPLES.md) for sample verification outputs
• Troubleshooting: See [TROUBLESHOOTING.md](TROUBLESHOOTING.md) for detection issues
• Dependencies: See [references/DEPENDENCIES.md](references/DEPENDENCIES.md) for complete version matrix
• Configuration: See [references/CONFIGURATION.md](references/CONFIGURATION.md) for validation rules

Critical Reminders

1. Check Spring Boot version first — Many issues are version-specific
2. Jakarta namespace migration — javax. to jakarta. (required for Boot 3+)
3. Jackson 3 namespace change — com.fasterxml.jackson to tools.jackson
4. Security 7 Lambda DSL — and() method removed, closures required
5. Testing annotations changed — @MockBean to @MockitoBean
6. Virtual Threads — Enable with spring.threads.virtual.enabled=true for Java 21+
7. Gradle 8.14+ — Required for Kotlin 2.2 and Spring Boot 4 support
8. Use official docs — https://docs.spring.io/spring-boot/documentation.html

Related Skills

• spring-boot-security — Deep security configuration verification
• spring-boot-testing — Testing patterns and coverage analysis
• spring-boot-observability — Actuator, metrics, and tracing setup
• spring-boot-modulith — Module structure verification
• domain-driven-design — DDD architecture patterns