Spring Boot 3 & Spring Framework 6

The biggest Spring upgrade in a decade. Java 17 minimum, Jakarta EE namespace, native images, observability baked in, virtual threads.

%%{init: {'theme': 'base', 'themeVariables': {'fontSize': '13px', 'fontFamily': 'Inter, -apple-system, sans-serif'}, 'flowchart': {'nodeSpacing': 30, 'rankSpacing': 50, 'padding': 12, 'curve': 'basis'}, 'sequence': {'actorMargin': 60, 'messageMargin': 40}, 'class': {'padding': 12}}}%%
flowchart LR
    SB3["Spring Boot 3"]
    SB3 --> J17["Java 17+\nBaseline"]
    SB3 --> JK["Jakarta EE\njavax → jakarta"]
    SB3 --> N["Native Images\nGraalVM AOT"]
    SB3 --> O["Observability\nMicrometer"]
    SB3 --> VT["Virtual Threads\nJava 21+"]
    SB3 --> HE["HTTP Interfaces\nDeclarative clients"]
    SB3 --> PD["Problem Details\nRFC 7807"]
    SB3 --> SEC["Security 6\nLambda DSL"]

    style SB3 fill:#FEF3C7,stroke:#FCD34D,stroke-width:2px,color:#1E40AF
    style J17 fill:#ECFDF5,stroke:#6EE7B7,color:#1E40AF
    style JK fill:#EFF6FF,stroke:#DBEAFE,color:#1E40AF
    style N fill:#EFF6FF,stroke:#93C5FD,color:#1E40AF
    style O fill:#FFFBEB,stroke:#FCD34D,color:#1E40AF
    style VT fill:#FEF2F2,stroke:#FCA5A5,color:#1E40AF
    style HE fill:#EFF6FF,stroke:#93C5FD,color:#1E40AF
    style PD fill:#EFF6FF,stroke:#6EE7B7,color:#1E40AF
    style SEC fill:#FEF2F2,stroke:#92400E,color:#1E40AF

Java 17 Baseline

Spring Boot 3 requires Java 17 minimum. No negotiation. This unlocks language features that Spring itself now uses internally.

Records as DTOs

// Immutable, concise, works with Jackson out of the box
public record CreateOrderRequest(
    @NotBlank String customerId,
    @NotEmpty List<LineItem> items,
    @Positive BigDecimal total
) {}

// Spring MVC binds directly to records
@PostMapping("/orders")
public ResponseEntity<Order> create(@Valid @RequestBody CreateOrderRequest req) {
    return ResponseEntity.ok(orderService.create(req));
}

Records also work with Spring Data projections:

public interface OrderRepository extends JpaRepository<Order, Long> {
    // Spring Data creates the record for you
    List<OrderSummary> findByCustomerId(String customerId);
}

public record OrderSummary(Long id, BigDecimal total, LocalDateTime createdAt) {}

Sealed Classes for Domain Modeling

public sealed interface PaymentResult permits PaymentSuccess, PaymentFailed, PaymentPending {
}

public record PaymentSuccess(String transactionId, Instant settledAt) implements PaymentResult {}
public record PaymentFailed(String errorCode, String reason) implements PaymentResult {}
public record PaymentPending(String redirectUrl) implements PaymentResult {}

// Pattern matching in service layer (Java 21)
public String describeResult(PaymentResult result) {
    return switch (result) {
        case PaymentSuccess s -> "Settled: " + s.transactionId();
        case PaymentFailed f -> "Failed: " + f.reason();
        case PaymentPending p -> "Redirect to: " + p.redirectUrl();
    };
}

Pattern Matching instanceof

// Old way — cast after check
if (event instanceof OrderCreatedEvent) {
    OrderCreatedEvent oce = (OrderCreatedEvent) event;
    process(oce.orderId());
}

// Java 17+ — binding variable in one shot
if (event instanceof OrderCreatedEvent oce) {
    process(oce.orderId());
}

Text Blocks in Spring

@Query("""
    SELECT o FROM Order o
    JOIN FETCH o.items i
    WHERE o.status = :status
      AND o.createdAt > :since
    ORDER BY o.createdAt DESC
    """)
List<Order> findRecentByStatus(@Param("status") OrderStatus status,
                               @Param("since") LocalDateTime since);

Jakarta EE Migration (javax to jakarta)

The single biggest breaking change. Oracle transferred Java EE to Eclipse Foundation. Eclipse cannot use the javax trademark. Every javax.* EE package became jakarta.*.

What Moved

What Did NOT Move

These stay as javax.* because they are part of Java SE, not Java EE:

• javax.crypto.* (JCE — part of JDK)
• javax.net.ssl.* (JSSE — part of JDK)
• javax.sql.DataSource (part of JDK)
• javax.swing.* (part of JDK)

Migration Tools

# IntelliJ: Refactor → Migrate Packages and Classes → Jakarta EE
# OpenRewrite (automated, handles edge cases)
./mvnw -U org.openrewrite.maven:rewrite-maven-plugin:run \
  -Drewrite.recipeArtifactCoordinates=org.openrewrite.recipe:rewrite-migrate-java:LATEST \
  -Drewrite.activeRecipes=org.openrewrite.java.migrate.jakarta.JavaxMigrationToJakarta

GraalVM Native Images

Spring Boot 3 supports ahead-of-time (AOT) compilation to produce standalone native executables via GraalVM.

%%{init: {'theme': 'base', 'themeVariables': {'fontSize': '13px', 'fontFamily': 'Inter, -apple-system, sans-serif'}, 'flowchart': {'nodeSpacing': 30, 'rankSpacing': 50, 'padding': 12, 'curve': 'basis'}, 'sequence': {'actorMargin': 60, 'messageMargin': 40}, 'class': {'padding': 12}}}%%
flowchart LR
    subgraph JVM Path
        direction LR
        J1[/"Source Code"/] --> J2{{"javac\nbytecode"}} --> J3{{"JVM\nJIT at runtime"}}
        J3 --> J4(["Warm: Fast\nCold: Slow"])
    end

    subgraph Native Path
        direction LR
        N1[/"Source Code"/] --> N2{{"AOT Processing\nSpring generates hints"}} --> N3{{"GraalVM native-image\nclosed-world analysis"}}
        N3 --> N4(["Static Binary\n~50ms startup"])
    end

    style J4 fill:#FFFBEB,stroke:#FCD34D,color:#1E40AF
    style N4 fill:#ECFDF5,stroke:#6EE7B7,color:#1E40AF

How Spring AOT Works

1. Build-time bean processing — Spring resolves the entire ApplicationContext at build time
2. Code generation — Generates Java source for bean definitions (no reflection at runtime)
3. Hint generation — Creates reflect-config.json, resource-config.json, etc. for GraalVM
4. Closed-world assumption — Everything reachable must be known at compile time

Comparison

Building

# Maven
./mvnw -Pnative native:compile

# Gradle
./gradlew nativeCompile

# Buildpacks (no local GraalVM needed)
./mvnw spring-boot:build-image -Pnative

Limitations and Gotchas

// Register reflection hints for classes GraalVM can't discover
@RegisterReflectionForBinding({Order.class, OrderLineItem.class})
@Configuration
public class NativeHints {}

// Or use RuntimeHintsRegistrar for complex cases
public class MyHints implements RuntimeHintsRegistrar {
    @Override
    public void registerHints(RuntimeHints hints, ClassLoader classLoader) {
        hints.reflection().registerType(MyEntity.class, MemberCategory.values());
        hints.resources().registerPattern("templates/*.html");
    }
}

Observability (Micrometer + Tracing)

Spring Boot 3 unifies metrics, tracing, and logging under the Micrometer Observation API. No more separate Spring Cloud Sleuth dependency.

%%{init: {'theme': 'base', 'themeVariables': {'fontSize': '13px', 'fontFamily': 'Inter, -apple-system, sans-serif'}, 'flowchart': {'nodeSpacing': 30, 'rankSpacing': 50, 'padding': 12, 'curve': 'basis'}, 'sequence': {'actorMargin': 60, 'messageMargin': 40}, 'class': {'padding': 12}}}%%
flowchart LR
    App(("Spring Boot 3 App"))
    OBS{{"Observation API\n(single abstraction)"}}

    App --> OBS
    OBS --> M[["Metrics\nMicrometer Core"]]
    OBS --> T[["Traces\nMicrometer Tracing"]]
    OBS --> L[["Logs\nCorrelation IDs"]]

    M --> PROM(["Prometheus"])
    M --> DD(["Datadog"])
    T --> ZIPKIN(["Zipkin"])
    T --> OTLP(["OTLP Collector"])
    L --> LOKI(["Loki / ELK"])

    PROM --> GRAF(("Grafana"))
    ZIPKIN --> GRAF
    LOKI --> GRAF

    style App fill:#FEF3C7,stroke:#FCD34D,stroke-width:2px,color:#1E40AF
    style OBS fill:#ECFDF5,stroke:#6EE7B7,color:#1E40AF
    style GRAF fill:#EFF6FF,stroke:#93C5FD,stroke-width:2px,color:#1E40AF

Dependencies

<!-- Core observation + tracing with OpenTelemetry bridge -->
<dependency>
    <groupId>io.micrometer</groupId>
    <artifactId>micrometer-tracing-bridge-otel</artifactId>
</dependency>
<dependency>
    <groupId>io.opentelemetry</groupId>
    <artifactId>opentelemetry-exporter-otlp</artifactId>
</dependency>

Configuration

management:
  tracing:
    sampling:
      probability: 1.0  # 100% in dev, lower in prod
  endpoints:
    web:
      exposure:
        include: health,info,metrics,prometheus
  metrics:
    distribution:
      percentiles-histogram:
        http.server.requests: true
    tags:
      application: ${spring.application.name}

Custom Observations

@Service
@RequiredArgsConstructor
public class PaymentService {
    private final ObservationRegistry registry;

    public PaymentResult processPayment(PaymentRequest req) {
        return Observation.createNotStarted("payment.process", registry)
            .lowCardinalityKeyValue("payment.method", req.method().name())
            .highCardinalityKeyValue("payment.id", req.id())
            .observe(() -> doProcess(req));
        // Automatically records: timer metric + trace span + log correlation
    }
}

Structured Logging (Spring Boot 3.4+)

# application.yml
logging:
  structured:
    format:
      console: ecs  # Elastic Common Schema
      # or: logfmt, gelf

Output:

{"@timestamp":"2024-03-15T10:23:45Z","log.level":"INFO","message":"Order created",
 "trace.id":"abc123","span.id":"def456","service.name":"order-service"}

HTTP Interfaces (@HttpExchange)

Declarative HTTP clients, built into Spring. No Feign dependency. Works with RestClient (blocking) or WebClient (reactive).

@HttpExchange("/api/v1/users")
public interface UserServiceClient {

    @GetExchange
    List<UserDTO> findAll();

    @GetExchange("/{id}")
    UserDTO findById(@PathVariable Long id);

    @PostExchange
    UserDTO create(@RequestBody CreateUserRequest request);

    @PutExchange("/{id}")
    UserDTO update(@PathVariable Long id, @RequestBody UpdateUserRequest request);

    @DeleteExchange("/{id}")
    @ResponseStatus(HttpStatus.NO_CONTENT)
    void delete(@PathVariable Long id);

    // Supports headers, query params, reactive types
    @GetExchange("/search")
    List<UserDTO> search(@RequestParam String query,
                         @RequestHeader("X-Tenant-Id") String tenantId);
}

Wiring It Up

@Configuration
public class HttpClientConfig {

    @Bean
    UserServiceClient userServiceClient(RestClient.Builder builder) {
        RestClient client = builder
            .baseUrl("http://user-service:8080")
            .defaultHeader("X-Api-Key", "secret")
            .requestInterceptor(new LoggingInterceptor())
            .build();

        return HttpServiceProxyFactory
            .builderFor(RestClientAdapter.create(client))
            .build()
            .createClient(UserServiceClient.class);
    }
}

Problem Details (RFC 7807)

Spring Boot 3 natively produces RFC 7807 responses for errors. No extra setup for default behavior.

Enabling

// Enable globally via property
// spring.mvc.problemdetails.enabled=true

// Or extend ResponseEntityExceptionHandler (auto-enables it)
@RestControllerAdvice
public class GlobalExceptionHandler extends ResponseEntityExceptionHandler {

    @ExceptionHandler(OrderNotFoundException.class)
    public ProblemDetail handleOrderNotFound(OrderNotFoundException ex) {
        ProblemDetail pd = ProblemDetail.forStatusAndDetail(
            HttpStatus.NOT_FOUND, ex.getMessage());
        pd.setTitle("Order Not Found");
        pd.setType(URI.create("https://api.example.com/errors/order-not-found"));
        pd.setProperty("orderId", ex.getOrderId());
        pd.setProperty("timestamp", Instant.now());
        return pd;
    }

    @ExceptionHandler(InsufficientBalanceException.class)
    public ProblemDetail handleInsufficientBalance(InsufficientBalanceException ex) {
        ProblemDetail pd = ProblemDetail.forStatusAndDetail(
            HttpStatus.UNPROCESSABLE_ENTITY, "Not enough funds");
        pd.setTitle("Insufficient Balance");
        pd.setProperty("currentBalance", ex.getCurrentBalance());
        pd.setProperty("requiredAmount", ex.getRequiredAmount());
        return pd;
    }
}

Response

{
  "type": "https://api.example.com/errors/order-not-found",
  "title": "Order Not Found",
  "status": 404,
  "detail": "Order with ID ORD-9923 does not exist",
  "instance": "/api/orders/ORD-9923",
  "orderId": "ORD-9923",
  "timestamp": "2024-03-15T10:23:45Z"
}

Content-Type is application/problem+json automatically.

Spring Security 6 Changes

Major API overhaul. Old imperative style is removed, not just deprecated.

Lambda DSL (Required)

// REMOVED in Spring Security 6 — won't compile
http.authorizeRequests()
    .antMatchers("/admin/**").hasRole("ADMIN")
    .anyRequest().authenticated()
    .and()
    .formLogin();

// Required style now
@Bean
public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
    http
        .authorizeHttpRequests(auth -> auth
            .requestMatchers("/admin/**").hasRole("ADMIN")
            .requestMatchers("/api/public/**").permitAll()
            .anyRequest().authenticated()
        )
        .oauth2ResourceServer(oauth2 -> oauth2
            .jwt(jwt -> jwt.jwtAuthenticationConverter(jwtConverter()))
        )
        .sessionManagement(session -> session
            .sessionCreationPolicy(SessionCreationPolicy.STATELESS)
        )
        .csrf(csrf -> csrf.disable());

    return http.build();
}

Key Changes

Method Security

@EnableMethodSecurity // replaces @EnableGlobalMethodSecurity
@Configuration
public class MethodSecurityConfig {}

@Service
public class OrderService {

    @PreAuthorize("hasRole('ADMIN') or #order.customerId == authentication.name")
    public void cancelOrder(Order order) { /* ... */ }

    @PostAuthorize("returnObject.customerId == authentication.name")
    public Order getOrder(Long id) { /* ... */ }
}

Virtual Threads (Project Loom, Spring Boot 3.2+)

One config property to switch your entire servlet-based app from platform thread pools to virtual threads.

spring:
  threads:
    virtual:
      enabled: true

That is it. Tomcat/Jetty will create a virtual thread per request instead of pulling from a fixed thread pool.

%%{init: {'theme': 'base', 'themeVariables': {'fontSize': '13px', 'fontFamily': 'Inter, -apple-system, sans-serif'}, 'flowchart': {'nodeSpacing': 30, 'rankSpacing': 50, 'padding': 12, 'curve': 'basis'}, 'sequence': {'actorMargin': 60, 'messageMargin': 40}, 'class': {'padding': 12}}}%%
flowchart LR
    subgraph Old["Platform Threads"]
        direction LR
        TP{{"Thread Pool\n200 threads"}}
        TP --> REQ1[/"Request 1\nblocked on DB"/]
        TP --> REQ2[/"Request 2\nblocked on HTTP"/]
        TP --> REQ3(["Request 201\nREJECTED"])
    end

    subgraph New["Virtual Threads"]
        direction LR
        VT{{"Virtual Thread Executor\nunlimited"}}
        VT --> VR1[/"Request 1\nparked (free)"/]
        VT --> VR2[/"Request 2\nparked (free)"/]
        VT --> VR3(["Request 10000\nstill fine"])
    end

    style REQ3 fill:#FEE2E2,stroke:#FCA5A5,color:#1E40AF
    style VR3 fill:#ECFDF5,stroke:#6EE7B7,color:#1E40AF

How It Works

• Virtual threads are mounted on carrier (platform) threads
• When a virtual thread hits a blocking call (Thread.sleep, Socket.read, Lock.lock), it unmounts — the carrier thread is freed
• Millions of virtual threads can exist simultaneously, consuming only ~1 KB of stack each

Gotchas

When NOT to Use Virtual Threads

• CPU-bound workloads (compression, encryption, ML inference) — platform threads are better
• If your code relies heavily on synchronized with I/O inside
• Libraries with thread-affinity assumptions (some connection pools, JDBC drivers with thread-local state)

Migration Guide: Spring Boot 2.x to 3.x

Step-by-Step

%%{init: {'theme': 'base', 'themeVariables': {'fontSize': '13px', 'fontFamily': 'Inter, -apple-system, sans-serif'}, 'flowchart': {'nodeSpacing': 30, 'rankSpacing': 50, 'padding': 12, 'curve': 'basis'}, 'sequence': {'actorMargin': 60, 'messageMargin': 40}, 'class': {'padding': 12}}}%%
flowchart LR
    A(["1. Upgrade to Spring Boot 2.7\n(bridge release)"]) --> B{{"2. Upgrade to Java 17"}}
    B --> C{{"3. Fix deprecations from 2.7"}}
    C --> D{{"4. javax → jakarta\n(OpenRewrite)"}}
    D --> E(["5. Upgrade to Spring Boot 3.0"])
    E --> F{{"6. Fix Security config\n(Lambda DSL)"}}
    F --> G{{"7. Update third-party libs"}}
    G --> H(["8. Test everything"])

    style A fill:#EFF6FF,stroke:#DBEAFE,color:#1E40AF
    style E fill:#FEF3C7,stroke:#FCD34D,color:#1E40AF
    style H fill:#ECFDF5,stroke:#6EE7B7,color:#1E40AF

Detailed Steps

Step 1: Upgrade to Spring Boot 2.7 first

• 2.7 introduced deprecation warnings for everything removed in 3.0
• spring.factories auto-configuration → META-INF/spring/org.springframework.boot.autoconfigure.AutoConfiguration.imports
• WebSecurityConfigurerAdapter → SecurityFilterChain bean

Step 2: Java 17 minimum

<properties>
    <java.version>17</java.version>
</properties>

Step 3: Fix 2.7 deprecations

Run your app and look for deprecation warnings. Fix them all BEFORE upgrading to 3.0.

Step 4: Namespace migration

# Use OpenRewrite
./mvnw -U org.openrewrite.maven:rewrite-maven-plugin:run \
  -Drewrite.recipeArtifactCoordinates=org.openrewrite.recipe:rewrite-migrate-java:LATEST \
  -Drewrite.activeRecipes=org.openrewrite.java.migrate.jakarta.JavaxMigrationToJakarta

Step 5: Bump Spring Boot version

<parent>
    <groupId>org.springframework.boot</groupId>
    <artifactId>spring-boot-starter-parent</artifactId>
    <version>3.3.5</version>
</parent>

Step 6: Fix Spring Security

• antMatchers → requestMatchers
• authorizeRequests → authorizeHttpRequests
• Remove .and() chains, use lambdas

Step 7: Third-party library compatibility

Step 8: Testing

# Run with debug to see auto-config report
java -jar app.jar --debug

# Check for reflection issues (native image prep)
./mvnw -Pnative spring-boot:process-aot

Common Pitfalls

Version-by-Version Features

Spring Boot 3.0 (Nov 2022)

• Java 17 baseline
• Jakarta EE 9+ (jakarta namespace)
• GraalVM native image support
• Micrometer Observation API
• Problem Details (RFC 7807)
• HTTP interface clients (@HttpExchange)
• META-INF/spring/org.springframework.boot.autoconfigure.AutoConfiguration.imports

Spring Boot 3.1 (May 2023)

• Docker Compose support — spring-boot-docker-compose auto-starts containers from compose.yml
• Testcontainers at dev time — @ServiceConnection for zero-config test containers
• SSL bundle abstraction — spring.ssl.bundle.* for unified TLS config
• Auto-config for spring.security.oauth2.authorizationserver

// Testcontainers with @ServiceConnection — no more manual URL config
@TestConfiguration(proxyBeanMethods = false)
public class TestContainersConfig {
    @Bean
    @ServiceConnection
    PostgreSQLContainer<?> postgres() {
        return new PostgreSQLContainer<>("postgres:16-alpine");
    }
}

Spring Boot 3.2 (Nov 2023)

• Virtual threads support — spring.threads.virtual.enabled=true
• RestClient — new synchronous HTTP client replacing RestTemplate
• JdbcClient — fluent API for JDBC
• Improved GraalVM support — fewer manual hints needed
• Initial support for CRaC (Coordinated Restore at Checkpoint)

// JdbcClient — cleaner than JdbcTemplate
@Repository
@RequiredArgsConstructor
public class OrderRepository {
    private final JdbcClient jdbc;

    public Optional<Order> findById(Long id) {
        return jdbc.sql("SELECT * FROM orders WHERE id = :id")
            .param("id", id)
            .query(Order.class)
            .optional();
    }

    public List<Order> findByStatus(OrderStatus status) {
        return jdbc.sql("SELECT * FROM orders WHERE status = :status")
            .param("status", status.name())
            .query(Order.class)
            .list();
    }
}

Spring Boot 3.3 (May 2024)

• CDS (Class Data Sharing) support for faster JVM startup
• Structured logging preparations
• Improved @HttpExchange error handling
• spring-boot-docker-compose improvements (profiles, readiness)
• Base64 resources support in configuration

Spring Boot 3.4 (Nov 2024)

• Structured logging — logging.structured.format.console=ecs|logfmt|gelf
• Fallback beans — @Fallback annotation for conditional bean registration
• @MockitoBean / @MockitoSpyBean — replaces @MockBean (moved to Spring Framework)
• Enhanced application properties binding
• RestClient improvements (request attributes, exchange strategies)

// @Fallback — bean only used if no other bean of same type exists
@Configuration
public class CacheConfig {
    @Bean
    @Fallback
    CacheManager defaultCacheManager() {
        return new ConcurrentMapCacheManager(); // used only if Redis/Caffeine not configured
    }
}

Spring Boot 3.5+ (2025)

• Continued CRaC improvements
• Deeper virtual threads integration
• More AOT / native image optimizations
• Project Leyden exploration (JVM-level AOT)

Real-World Configuration Example

# application.yml for a production Spring Boot 3.3+ service
spring:
  application:
    name: order-service
  threads:
    virtual:
      enabled: true
  datasource:
    url: jdbc:postgresql://${DB_HOST:localhost}:5432/orders
    hikari:
      maximum-pool-size: 20
      connection-timeout: 5000
  jpa:
    open-in-view: false  # always disable this
    properties:
      hibernate:
        jdbc.batch_size: 25
        order_inserts: true

management:
  tracing:
    sampling:
      probability: 0.1  # 10% in prod
  endpoints:
    web:
      exposure:
        include: health,info,metrics,prometheus
  endpoint:
    health:
      show-details: when-authorized
  metrics:
    tags:
      application: ${spring.application.name}
      env: ${ENVIRONMENT:local}

logging:
  structured:
    format:
      console: ecs
  level:
    org.springframework.web: INFO
    org.hibernate.SQL: DEBUG

server:
  shutdown: graceful
  tomcat:
    keep-alive-timeout: 60s

spring.lifecycle:
  timeout-per-shutdown-phase: 30s

Interview Questions