Chore: upgrade to spring boot 4

server/build.gradle

@@ -15,16 +15,15 @@ plugins {
 
 def jooqSrcDir = 'src/main/jooq-gen'
 
-ext['junit-jupiter.version'] = libs.versions.junit.get()
+//ext['junit-jupiter.version'] = libs.versions.junit.get()
 
 // override spring boot managed versions
 // see https://docs.spring.io/spring-boot/gradle-plugin/managing-dependencies.html
 // example:
 // ext['netty.version'] = '4.1.132.Final'
 
-ext['postgresql.version'] = '42.7.11'
-ext['netty.version'] = '4.1.135.Final'
 ext['opentelemetry.version'] = '1.63.0'
+ext['flyway.version'] = libs.versions.flyway
 
 java {
     sourceCompatibility = libs.versions.java.get()
@@ -49,33 +48,18 @@ configurations {
     devImplementation.extendsFrom implementation
     devRuntimeOnly.extendsFrom runtimeOnly
 
-    // exclude commons-logging to avoid runtime warnings like these
-    // Standard Commons Logging discovery in action with spring-jcl:
-    //    please remove commons-logging.jar from classpath in order to avoid potential conflicts
-    configureEach {
-        exclude group: "commons-logging", module: "commons-logging"
-    }
-
-    // Gatling 3.15 requires Netty 4.2.x but Spring Boot's dependency management forces 4.1.x.
-    // Override all io.netty modules (except tcnative which has its own versioning) on the
-    // gatling configuration to keep its classpath internally consistent.
-    matching { it.name.startsWith('gatling') }.configureEach {
-        resolutionStrategy.eachDependency { details ->
-            if (details.requested.group == 'io.netty' && !details.requested.name.startsWith('netty-tcnative')) {
-                details.useVersion '4.2.13.Final'
-            }
-        }
-    }
+    testImplementation.exclude group: 'com.vaadin.external.google', module: 'android-json'
 }
 
 dependencies {
-    implementation "org.springframework.boot:spring-boot-starter-web"
+    implementation "org.springframework.boot:spring-boot-starter-webmvc"
     implementation "org.springframework.boot:spring-boot-starter-jetty"
     modules {
         module("org.springframework.boot:spring-boot-starter-tomcat") {
             replacedBy("org.springframework.boot:spring-boot-starter-jetty")
         }
     }
+    implementation "org.springframework.boot:spring-boot-starter-restclient"
     implementation "org.springframework.boot:spring-boot-starter-validation"
     implementation "org.springframework.boot:spring-boot-starter-jooq"
     implementation "org.springframework.boot:spring-boot-starter-data-jpa"
@@ -84,13 +68,16 @@ dependencies {
     implementation "org.springframework.boot:spring-boot-starter-security"
     implementation "org.springframework.boot:spring-boot-starter-actuator"
     implementation "org.springframework.boot:spring-boot-starter-cache"
-    implementation "org.springframework.boot:spring-boot-starter-aop"
     implementation "org.springframework.boot:spring-boot-starter-mail"
-    implementation "org.springframework.boot:spring-boot-starter-thymeleaf"
+    implementation "org.springframework.boot:spring-boot-starter-zipkin"
+    implementation "org.springframework.boot:spring-boot-security-oauth2-client"
+
     implementation "org.springframework.security:spring-security-oauth2-client"
     implementation "org.springframework.security:spring-security-oauth2-jose"
+
     implementation "org.springframework.session:spring-session-jdbc"
-    implementation "org.springframework.retry:spring-retry"
+
+    implementation "org.springframework.boot:spring-boot-thymeleaf"
 
     implementation "org.apache.httpcomponents.client5:httpclient5"
     implementation "com.github.ben-manes.caffeine:caffeine"
@@ -110,6 +97,7 @@ dependencies {
 
     implementation libs.jobrunr.spring
 
+    implementation "org.springframework.boot:spring-boot-flyway"
     implementation libs.flyway.core
     implementation libs.flyway.database.postgresql
 
@@ -120,12 +108,8 @@ dependencies {
 
     implementation libs.springdoc
 
-    implementation libs.jackson.core
-    implementation libs.jackson.annotations
-    implementation libs.jackson.databind
-    implementation libs.jackson.jaxb.annotations
-    implementation libs.jackson.dataformat.xml
     implementation libs.jackson.dataformat.yaml
+    implementation libs.jackson.dataformat.xml
     implementation libs.jackson.dataformat.toml
 
     implementation libs.woodstox.core
@@ -142,19 +126,22 @@ dependencies {
     runtimeOnly "org.postgresql:postgresql"
     jooqCodegen "org.postgresql:postgresql"
 
+    // to aid migration from 3.5 to 4.0
+    runtimeOnly "org.springframework.boot:spring-boot-properties-migrator"
+
     devRuntimeOnly "org.springframework.boot:spring-boot-devtools"
 
     testImplementation("org.springframework.boot:spring-boot-starter-test") {
         exclude group: 'org.junit.vintage', module: 'junit-vintage-engine'
     }
+    testImplementation "org.springframework.boot:spring-boot-starter-webmvc-test"
     testImplementation "org.springframework.security:spring-security-test"
-    testImplementation libs.junit.jupiter.api
+
+    testImplementation "org.springframework.boot:spring-boot-testcontainers"
     testImplementation libs.testcontainers.elasticsearch
     testImplementation libs.testcontainers.localstack
     testImplementation libs.testcontainers.junit.jupiter
-
-    testRuntimeOnly libs.junit.jupiter.engine
-    testRuntimeOnly libs.testcontainers.postgresql
+    testImplementation libs.testcontainers.postgresql
 
     gatling libs.gatling.core
     gatling libs.gatling.app
@@ -202,7 +189,7 @@ jooq {
 }
 
 rewrite {
-    activeRecipe("org.openrewrite.java.migrate.jakarta.JavaxAnnotationMigrationToJakartaAnnotation")
+    activeRecipe("org.openrewrite.java.jspecify.MigrateFromJakartaAnnotationApi")
     setExportDatatables(true)
 }
 

server/gradle/libs.versions.toml

@@ -8,35 +8,31 @@ commons-lang3   = "3.20.0"
 flyway          = "11.20.3"
 gatling         = "3.15.0"
 gcloud          = "2.62.1"
-hibernate       = "6.6.42.Final"
 ipaddress       = "5.5.1"
-jackson         = "2.18.8"
 java            = "25"
 jaxb-api        = "2.3.1"
 jaxb-impl       = "2.3.8"
 jedis           = "7.4.1"
-jobrunr         = "7.5.3"
+jobrunr         = "8.6.1"
 jooq            = "3.19.34"
 jsonpath        = "2.9.0"
-junit           = "5.14.2"
 loki4j          = "1.4.2"
 re2j            = "1.7"
-rewrite-java    = "3.26.0"
-spring-boot     = "3.5.14"
+rewrite-java    = "3.38.0"
+spring-boot     = "4.0.7"
 springdoc       = "2.8.13"
-testcontainers  = "1.21.4"
 tika            = "3.3.1"
 woodstox        = "6.4.0"
 
 [plugins]
 download                     = { id = "de.undercouch.download", version = "5.7.0" }
 gatling                      = { id = "io.gatling.gradle", version.ref = "gatling" }
-hibernate-orm                = { id = "org.hibernate.orm", version.ref = "hibernate" }
+hibernate-orm                = { id = "org.hibernate.orm" }
 jooq-codegen                 = { id = "org.jooq.jooq-codegen-gradle", version.ref = "jooq" }
 spring-boot                  = { id = "org.springframework.boot", version.ref = "spring-boot"}
 spring-dependency-management = { id = "io.spring.dependency-management", version = "1.1.7" }
 test-logger                  = { id = "com.adarshr.test-logger", version = "4.0.0" }
-rewrite                      = { id = "org.openrewrite.rewrite", version = "7.25.0" }
+rewrite                      = { id = "org.openrewrite.rewrite", version = "7.35.0" }
 
 [libraries]
 awssdk-s3                    = { module = "software.amazon.awssdk:s3", version.ref = "aws" }
@@ -51,28 +47,22 @@ flyway-database-postgresql   = { module = "org.flywaydb:flyway-database-postgres
 gatling-app                  = { module = "io.gatling:gatling-app", version.ref = "gatling" }
 gatling-core                 = { module = "io.gatling:gatling-core", version.ref = "gatling" }
 google-cloud-storage         = { module = "com.google.cloud:google-cloud-storage", version.ref = "gcloud" }
-ipaddress                    = { module = "com.github.seancfoley:ipaddress", version.ref = "ipaddress"}
-jackson-annotations          = { module = "com.fasterxml.jackson.core:jackson-annotations", version.ref = "jackson" }
-jackson-core                 = { module = "com.fasterxml.jackson.core:jackson-core", version.ref = "jackson" }
-jackson-databind             = { module = "com.fasterxml.jackson.core:jackson-databind", version.ref = "jackson" }
-jackson-dataformat-toml      = { module = "com.fasterxml.jackson.dataformat:jackson-dataformat-toml", version.ref = "jackson" }
-jackson-dataformat-xml       = { module = "com.fasterxml.jackson.dataformat:jackson-dataformat-xml", version.ref = "jackson" }
-jackson-dataformat-yaml      = { module = "com.fasterxml.jackson.dataformat:jackson-dataformat-yaml", version.ref = "jackson" }
-jackson-jaxb-annotations     = { module = "com.fasterxml.jackson.module:jackson-module-jaxb-annotations", version.ref = "jackson" }
+ipaddress                    = { module = "com.github.seancfoley:ipaddress", version.ref = "ipaddress" }
+jackson-dataformat-yaml      = { module = "tools.jackson.dataformat:jackson-dataformat-yaml" }
+jackson-dataformat-xml       = { module = "tools.jackson.dataformat:jackson-dataformat-xml" }
+jackson-dataformat-toml      = { module = "tools.jackson.dataformat:jackson-dataformat-toml" }
 jaxb-api                     = { module = "javax.xml.bind:jaxb-api", version.ref = "jaxb-api" }
 jaxb-impl                    = { module = "com.sun.xml.bind:jaxb-impl", version.ref = "jaxb-impl" }
 jedis                        = { module = "redis.clients:jedis", version.ref = "jedis" }
-jobrunr-spring               = { module = "org.jobrunr:jobrunr-spring-boot-3-starter", version.ref = "jobrunr" }
+jobrunr-spring               = { module = "org.jobrunr:jobrunr-spring-boot-4-starter", version.ref = "jobrunr" }
 json-path                    = { module = "com.jayway.jsonpath:json-path", version.ref = "jsonpath" }
-junit-jupiter-api            = { module = "org.junit.jupiter:junit-jupiter-api", version.ref = "junit" }
-junit-jupiter-engine         = { module = "org.junit.jupiter:junit-jupiter-engine", version.ref = "junit" }
 loki-logback-appender        = { module = "com.github.loki4j:loki-logback-appender", version.ref = "loki4j" }
 re2j                         = { module = "com.google.re2j:re2j", version.ref = "re2j" }
 rewrite-java                 = { module = "org.openrewrite.recipe:rewrite-migrate-java", version.ref = "rewrite-java"}
 springdoc                    = { module = "org.springdoc:springdoc-openapi-starter-webmvc-ui", version.ref = "springdoc" }
-testcontainers-elasticsearch = { module = "org.testcontainers:elasticsearch", version.ref = "testcontainers" }
-testcontainers-junit-jupiter = { module = "org.testcontainers:junit-jupiter", version.ref = "testcontainers" }
-testcontainers-localstack    = { module = "org.testcontainers:localstack", version.ref = "testcontainers" }
-testcontainers-postgresql    = { module = "org.testcontainers:postgresql", version.ref = "testcontainers" }
+testcontainers-elasticsearch = { module = "org.testcontainers:testcontainers-elasticsearch" }
+testcontainers-junit-jupiter = { module = "org.testcontainers:testcontainers-junit-jupiter" }
+testcontainers-localstack    = { module = "org.testcontainers:testcontainers-localstack" }
+testcontainers-postgresql    = { module = "org.testcontainers:testcontainers-postgresql" }
 tika-core                    = { module = "org.apache.tika:tika-core", version.ref = "tika" }
 woodstox-core                = { module = "com.fasterxml.woodstox:woodstox-core", version.ref = "woodstox" }

server/settings.gradle

@@ -1 +1,38 @@
+import groovy.xml.XmlSlurper
+
+pluginManagement {
+    repositories {
+        gradlePluginPortal()
+        mavenCentral()
+    }
+    resolutionStrategy {
+        eachPlugin {
+            // Supply the Hibernate ORM plugin version from Spring Boot's BOM so it is
+            // always kept in sync with the managed hibernate-core dependency.
+            if (requested.id.id == 'org.hibernate.orm') {
+                useVersion(gradle.ext.hibernateOrmVersion)
+            }
+        }
+    }
+}
+
 rootProject.name = 'openvsx-server'
+
+buildscript {
+    repositories {
+        mavenCentral()
+    }
+}
+
+// Read the Spring Boot version from the version catalog file
+def tomlText = file("gradle/libs.versions.toml").text
+def springBootVersion = (tomlText =~ /(?m)^spring-boot\s*=\s*"([^"]+)"/).collect { it[1] }.first()
+
+// Resolve the Spring Boot BOM POM and extract the Hibernate ORM version it manages.
+// The BOM uses Maven property placeholders (e.g. ${hibernate.version}) in
+// <dependencyManagement>, so we read the resolved value from <properties> directly.
+def bomPomFile = buildscript.configurations.detachedConfiguration(
+    buildscript.dependencies.create("org.springframework.boot:spring-boot-dependencies:${springBootVersion}@pom")
+).singleFile
+def bomPom = new XmlSlurper().parse(bomPomFile)
+gradle.ext.hibernateOrmVersion = bomPom.properties['hibernate.version'].text()

server/src/dev/resources/application.yml

@@ -13,7 +13,7 @@ spring:
     name: openvsx-server
   autoconfigure:
     # don't send traces to Zipkin in development
-    exclude: org.springframework.boot.actuate.autoconfigure.tracing.zipkin.ZipkinAutoConfiguration
+    exclude: org.springframework.boot.zipkin.autoconfigure.ZipkinAutoConfiguration
   profiles:
     include: ovsx
 # connect to redis cluster configured in docker-compose.yml
@@ -39,9 +39,6 @@ spring:
     store-type: jdbc
     jdbc:
       initialize-schema: never
-  thymeleaf:
-    # explicitly disable thymeleaf view resolution
-    enabled: false
 
 #  mail:
 #    host: "localhost"