Upgrade to Spring Boot 4.x

[Copilot]

• Breaking change? (if so, please describe the impact and migration path for existing application instances)

Yes. Spring Boot 4.0 requires Java 17+ and uses Jakarta EE instead of javax packages. No migration needed for application users—only internal code changes.

What changes did you make? (Give an overview)

Upgrade to Spring Boot 4.0.0 with required dependency and import migrations:

• Spring Boot: 3.5.8 → 4.0.0
• OpenAPI Generator: 7.13.0 → 7.17.0 (required for Spring Framework 7 HttpHeaders API changes—containsKey()/entrySet() removed)
• javax → jakarta migration (56 files):
  • javax.annotation.Nullable → jakarta.annotation.Nullable
  • javax.validation.Valid → jakarta.validation.Valid
  • javax.validation.ValidationException → jakarta.validation.ValidationException
• OAuth2 package restructuring (Spring Boot 4.x moved OAuth2 autoconfigure classes to separate modules):
  • OAuth2ResourceServerProperties → org.springframework.boot.security.oauth2.server.resource.autoconfigure
  • OAuth2ClientProperties → org.springframework.boot.security.oauth2.client.autoconfigure
  • OAuth2ClientPropertiesMapper → org.springframework.boot.security.oauth2.client.autoconfigure
• Web/WebFlux/LDAP package restructuring (Spring Boot 4.x moved these autoconfigure classes to separate modules):
  • AbstractErrorWebExceptionHandler → org.springframework.boot.webflux.autoconfigure.error
  • ErrorAttributes → org.springframework.boot.webflux.error
  • ServerProperties → org.springframework.boot.web.server.autoconfigure
  • WebFluxProperties → org.springframework.boot.webflux.autoconfigure
  • LdapAutoConfiguration → org.springframework.boot.ldap.autoconfigure
• New dependencies added:
  • spring-boot-security-oauth2-resource-server
  • spring-boot-security-oauth2-client
  • spring-boot-webflux
  • spring-boot-web-server
  • spring-boot-ldap

Note: javax.net.*, javax.management.*, javax.security.*, javax.rmi.* preserved (Java SE, not Jakarta EE).

Is there anything you'd like reviewers to focus on?

• Deprecation warnings for Jackson2JsonEncoder/Jackson2JsonDecoder in generated OpenAPI code are expected (deprecated in Spring Framework 7, removal planned for future version)

How Has This Been Tested? (put an "x" (case-sensitive!) next to an item)

• No need to
• Manually (please, describe, if necessary)
• Unit checks
• Integration checks
• Covered by existing automation

Contract module compiles successfully with Spring Boot 4.0.0. Full build requires CI (Confluent repo access).

Checklist (put an "x" (case-sensitive!) next to all the items, otherwise the build will fail)

• I have performed a self-review of my own code
• I have commented my code, particularly in hard-to-understand areas
• I have made corresponding changes to the documentation (e.g. ENVIRONMENT VARIABLES)
• My changes generate no new warnings (e.g. Sonar is happy)
• I have added tests that prove my fix is effective or that my feature works
• New and existing unit tests pass locally with my changes
• Any dependent changes have been merged

Check out Contributing and Code of Conduct

A picture of a cute animal (not mandatory but encouraged)

🐱

Original prompt

---

This section details on the original issue you should resolve

<issue_title>Upgrade to Spring Boot 4.x</issue_title>
<issue_description>### Issue submitter TODO list

• I've searched for an already existing issues here
• I'm running a supported version of the application which is listed here and the feature is not present there

Is your proposal related to a problem?

No, but it'll help to stay up to date

Describe the feature you're interested in

https://spring.io/blog/2025/11/20/spring-boot-4-0-0-available-now
Migration guide: https://github.com/spring-projects/spring-boot/wiki/Spring-Boot-4.0-Migration-Guide

Version you're running

f51df4c

</issue_description>

Comments on the Issue (you are @copilot in this section)

• Fixes Upgrade to Spring Boot 4.x #1538

---

💬 We'd love your input! Share your thoughts on Copilot coding agent in our 2 minute survey.

[Haarolean]

@copilot doesn't compile: /home/runner/work/kafka-ui/kafka-ui/api/src/main/java/io/kafbat/ui/config/auth/OAuthSecurityConfig.java:17: error: package org.springframework.boot.autoconfigure.security.oauth2.resource does not exist
import org.springframework.boot.autoconfigure.security.oauth2.resource.OAuth2ResourceServerProperties;
^

[Copilot]

@copilot doesn't compile: /home/runner/work/kafka-ui/kafka-ui/api/src/main/java/io/kafbat/ui/config/auth/OAuthSecurityConfig.java:17: error: package org.springframework.boot.autoconfigure.security.oau...

Fixed in 061ebca. In Spring Boot 4.x, OAuth2 autoconfigure classes moved to separate modules:

• OAuth2ResourceServerProperties → org.springframework.boot.security.oauth2.server.resource.autoconfigure
• OAuth2ClientProperties and OAuth2ClientPropertiesMapper → org.springframework.boot.security.oauth2.client.autoconfigure

Added the new dependencies spring-boot-security-oauth2-resource-server and spring-boot-security-oauth2-client to support the relocated classes.

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• https://api.github.com/repos/spring-projects/spring-boot/git/trees/v4.0.0
  • Triggering command: /usr/bin/curl curl -s REDACTED (http block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

[Haarolean]

@copilot Execution failed for task ':api:compileJava'.
Deprecated Gradle features were used in this build, making it incompatible with Gradle 10.

Compilation failed; see the compiler output below.

/home/runner/work/kafka-ui/kafka-ui/api/src/main/java/io/kafbat/ui/mapper/DynamicConfigMapper.java:23: warning: Unmapped target properties: "fts, adminClient". Mapping from property "ApplicationConfigPropertiesKafkaDTO kafka" to "ClustersProperties kafka".
You can use '--warning-mode all' to show the individual deprecation warnings and determine if they come from your own scripts or plugins.
DynamicConfigOperations.PropertiesStructure fromDto(ApplicationConfigPropertiesDTO dto);

                                            ^

For more on this, please refer to https://docs.gradle.org/9.2.0/userguide/command_line_interface.html#sec:command_line_warnings in the Gradle documentation.
/home/runner/work/kafka-ui/kafka-ui/api/src/main/java/io/kafbat/ui/mapper/KafkaConnectMapper.java:47: warning: Unmapped target property: "topics".
15 actionable tasks: 15 executed
ConnectorDTO fromClient(Connector connector);
^
/home/runner/work/kafka-ui/kafka-ui/api/src/main/java/io/kafbat/ui/exception/GlobalErrorWebExceptionHandler.java:41: error: cannot find symbol
public GlobalErrorWebExceptionHandler(ErrorAttributes errorAttributes,
^
symbol: class ErrorAttributes
location: class GlobalErrorWebExceptionHandler
/home/runner/work/kafka-ui/kafka-ui/api/src/main/java/io/kafbat/ui/exception/GlobalErrorWebExceptionHandler.java:49: error: cannot find symbol
protected RouterFunction getRoutingFunction(ErrorAttributes errorAttributes) {
^
symbol: class ErrorAttributes
location: class GlobalErrorWebExceptionHandler
/home/runner/work/kafka-ui/kafka-ui/api/src/main/java/io/kafbat/ui/config/Config.java:8: error: cannot find symbol
import org.springframework.boot.autoconfigure.web.ServerProperties;
^
symbol: class ServerProperties
location: package org.springframework.boot.autoconfigure.web
/home/runner/work/kafka-ui/kafka-ui/api/src/main/java/io/kafbat/ui/config/Config.java:25: error: cannot find symbol
private final ServerProperties serverProperties;
^
symbol: class ServerProperties
location: class Config
/home/runner/work/kafka-ui/kafka-ui/api/src/main/java/io/kafbat/ui/config/Config.java:28: error: cannot find symbol
public HttpHandler httpHandler(ObjectProvider propsProvider) {
^
symbol: class WebFluxProperties
location: class Config
/home/runner/work/kafka-ui/kafka-ui/api/src/main/java/io/kafbat/ui/config/Config.java:20: error: cannot find symbol
@AllArgsConstructor
^
symbol: class ServerProperties
location: class Config
/home/runner/work/kafka-ui/kafka-ui/api/src/main/java/io/kafbat/ui/exception/GlobalErrorWebExceptionHandler.java:39: error: cannot find symbol
public class GlobalErrorWebExceptionHandler extends AbstractErrorWebExceptionHandler {
^
symbol: class AbstractErrorWebExceptionHandler
/home/runner/work/kafka-ui/kafka-ui/api/src/main/java/io/kafbat/ui/KafkaUiApplication.java:14: error: cannot find symbol
@SpringBootApplication(exclude = LdapAutoConfiguration.class)
^
symbol: class LdapAutoConfiguration
/home/runner/work/kafka-ui/kafka-ui/api/src/main/java/io/kafbat/ui/exception/GlobalErrorWebExceptionHandler.java:16: error: package org.springframework.boot.autoconfigure.web.reactive.error does not exist
import org.springframework.boot.autoconfigure.web.reactive.error.AbstractErrorWebExceptionHandler;
^
/home/runner/work/kafka-ui/kafka-ui/api/src/main/java/io/kafbat/ui/exception/GlobalErrorWebExceptionHandler.java:17: error: package org.springframework.boot.web.reactive.error does not exist
import org.springframework.boot.web.reactive.error.ErrorAttributes;
^
/home/runner/work/kafka-ui/kafka-ui/api/src/main/java/io/kafbat/ui/KafkaUiApplication.java:7: error: package org.springframework.boot.autoconfigure.ldap does not exist
import org.springframework.boot.autoconfigure.ldap.LdapAutoConfiguration;
^
/home/runner/work/kafka-ui/kafka-ui/api/src/main/java/io/kafbat/ui/config/Config.java:9: error: package org.springframework.boot.autoconfigure.web.reactive does not exist
import org.springframework.boot.autoconfigure.web.reactive.WebFluxProperties;
^
12 errors
2 warnings

[Copilot]

@copilot Execution failed for task ':api:compileJava'.
Deprecated Gradle features were used in this build, making it incompatible with Gradle 10.

Compilation failed; see the compiler output below....

Fixed in 70b1e97. Spring Boot 4.x restructured many autoconfigure classes into separate modules:

• AbstractErrorWebExceptionHandler → org.springframework.boot.webflux.autoconfigure.error
• ErrorAttributes → org.springframework.boot.webflux.error
• ServerProperties → org.springframework.boot.web.server.autoconfigure
• WebFluxProperties → org.springframework.boot.webflux.autoconfigure
• LdapAutoConfiguration → org.springframework.boot.ldap.autoconfigure

Added new dependencies: spring-boot-webflux, spring-boot-web-server, and spring-boot-ldap.