build: upgrade all dependencies to latest (Spring Boot 2.5 to 4.1)

[houko]

Upgrades every dependency in the project to its latest release. This is not a version-number bump — Spring Boot 2.5.12 to 4.1.1 crosses two major versions, so it carries the full javax to jakarta migration, the Jackson 2 to 3 switch, and the removal of several libraries that have no Spring Boot 4 successor.

Dependency versions

Dependency	Before	After
Spring Boot	2.5.12	4.1.1
JDK baseline	11	21
springfox-swagger	2.2.2	springdoc-openapi 3.1.1
mysql-connector	mysql:mysql-connector-java 8.0.28	com.mysql:mysql-connector-j 26.7.0
dom4j	dom4j:dom4j 1.6.1	org.dom4j:dom4j 2.2.0
fastjson	com.alibaba:fastjson [1.2.31,)	com.alibaba.fastjson2:fastjson2 2.0.65
Apache POI	3.17	5.5.1
mybatis-spring-boot	1.1.1	4.1.0
jsoup	1.9.2 (effective)	1.23.2
commons-io	2.7	2.22.0
commons-lang3	3.5	3.20.0
lombok	1.18.14	1.18.48
slf4j	1.7.21	2.0.19
zxing	3.2.1 / 3.3.3	3.5.4
maven-compiler-plugin	3.5.1	3.16.0
maven-surefire-plugin	2.19.1	3.6.0
maven-source-plugin	3.2.0	3.4.0
actions/checkout	v3	v7
github/codeql-action	v2	v4

Jackson, Hibernate, JUnit, Tomcat, Thymeleaf and the rest are now managed by the spring-boot-dependencies BOM rather than being pinned by hand.

Pre-existing bugs fixed along the way

• jsoup.version was declared twice in the parent POM. The second declaration (1.9.2) silently overrode the first (1.14.2), so Bump jsoup from 1.10.1 to 1.14.2 #32's jsoup upgrade never actually took effect — the build has been resolving a 2016 release this whole time.
• Open-ended version ranges. fastjson used [1.2.31,) and commons-fileupload used [1.3.3,), which makes builds non-reproducible and silently pulls whatever is newest at build time. Both are gone now.
• spring.redis.pool.* had been dead config since Spring Boot 2.0. The correct key is spring.data.redis.lettuce.pool.*; the old keys were being ignored entirely.
• The in-memory security user could not log in. .password("test") with no PasswordEncoder throws IllegalArgumentException: There is no PasswordEncoder mapped for the id "null" on any Spring Security 5+ login attempt. Now {noop}test, which preserves the plaintext-demo intent and actually works.

Migration details

javax to jakarta — 49 imports across persistence, servlet, mail and websocket. javax.sql, javax.net and javax.swing are JDK packages and were correctly left alone.

Spring Boot 4 module split — @EntityScan, DataSourceAutoConfiguration and HibernateJpaAutoConfiguration all moved out of org.springframework.boot.autoconfigure.* into their own modules.

Jackson 2 to 3 — Spring Boot 4 defaults to Jackson 3 under the tools.jackson package. JsonSerializer became ValueSerializer, SerializerProvider became SerializationContext, and serialize no longer declares a checked exception. Jackson 2.21.5 is still on the classpath because swagger-core needs it; both are BOM-managed and coexist by design.

Spring Security — WebSecurityConfigurerAdapter was removed in Spring Security 6. Replaced with a SecurityFilterChain bean plus a UserDetailsService bean.

springfox to springdoc — springfox has been unmaintained since 2020 and does not support jakarta. The four Docket + ApiInfo configurations became GroupedOpenApi + OpenAPI beans, preserving the original basePackage grouping. 32 annotation usages moved to OpenAPI 3: @Api to @Tag, @ApiOperation to @Operation, @ApiImplicitParam to @Parameter, @ApiModelProperty to @Schema, @ApiIgnore to @Hidden.

Apache POI 5 — the HSSFCell.CELL_TYPE_* int constants became the CellType enum, and HSSFDateUtil was folded into DateUtil.

Dropped

knife4j (formerly swagger-bootstrap-ui). Its latest release, 4.5.0, still targets Spring Boot 3.0.4 and springdoc 2.x, so it cannot run under Spring Boot 4. The /doc.html UI it provided is gone; springdoc's own Swagger UI at /swagger-ui.html remains and is verified working below.

commons-fileupload. Not referenced by any source file, and it is built on javax.servlet with no drop-in jakarta replacement under the same coordinates.

junit4. Superseded by JUnit 5 via spring-boot-starter-test. The project's single test was migrated.

Verification

mvn clean install — all 17 modules pass:

[INFO] BUILD SUCCESS

Runtime smoke test on the order module (the one module needing no external services), confirming the springdoc rewiring actually works rather than merely compiling:

Starting OrderMain using Java 21.0.2
Starting Servlet engine: [Apache Tomcat/11.0.24]
Started OrderMain in 1.438 seconds
:: Spring Boot ::                (v4.1.1)

GET /v3/api-docs/order returns a well-formed OpenAPI 3.1.0 document with the migrated annotations intact — tag, summary, description, the path parameter with its description and required flag, and both declared error responses. @Hidden correctly keeps the / redirect out of the spec. GET /swagger-ui.html returns 302 to /swagger-ui/index.html, which returns 200.

Note

Tests remain globally disabled by <skipTests>true</skipTests> in the parent POM, unchanged from before. The single existing test (RabbitMqTests) has no @SpringBootTest, so its @Autowired field is null and it would NPE if ever enabled — pre-existing, left alone as out of scope here.

Security alerts closed

All 7 open Dependabot alerts on the default branch are resolved by this upgrade:

Severity	Package	CVE	Resolution
critical	io.springfox:springfox-swagger-ui	CVE-2019-17495	springfox removed entirely
high	commons-io:commons-io	CVE-2024-47554	2.7 to 2.22.0
high	mysql:mysql-connector-java	CVE-2023-22102	replaced by com.mysql:mysql-connector-j 26.7.0
high	org.jsoup:jsoup	CVE-2021-37714	1.9.2 to 1.23.2
medium	org.apache.commons:commons-lang3	CVE-2025-48924	3.5 to 3.20.0
medium	org.apache.poi:poi	CVE-2019-12415	3.17 to 5.5.1
medium	org.jsoup:jsoup	CVE-2022-36033	1.9.2 to 1.23.2

The two jsoup entries are worth calling out: #32 bumped jsoup to 1.14.2 and was merged, but the duplicate jsoup.version property meant the build kept resolving 1.9.2, so CVE-2021-37714 was never actually fixed. Removing the duplicate is what closes it.