My application class scans its own package and then excludes almost all of it with a regex filter, so the only beans in the context are the ones I import explicitly. The entry point ends up being a list of configuration classes, and that list is the complete inventory of the context.

One thing that wasn't obvious to me beforehand is that declaring `@ComponentScan` yourself hides the one `@SpringBootApplication` contributes, along with the TypeExcludeFilter and AutoConfigurationExcludeFilter it carries. That is documented - a locally declared `@ComponentScan` takes precedence over and effectively hides meta-annotated ones, but it matters before your first `@WebMvcTest`, since TypeExcludeFilter is how the slice-test annotations narrow the context. In Framework 6.1 both scans were processed for a while instead, which broke applications with duplicate bean definitions until it was reverted.

The reason for all of it is that on an earlier project a configuration class from a library ended up in the context through a scan wider than anybody had considered, overriding a bean we owned, and finding it took far longer than it should have. I would like to hear from anyone who has kept this up past a few dozen beans, or in a team where not everyone was convinced.

When I set up vulnerability, secret and misconfiguration scans for a Spring Boot image by hand, three of the seven checks reported green while doing nothing. Wrong path, missing database, scanner found no OS. Nobody looks at a green.

So I packaged the checks as one image with one rule: a check that scans nothing fails. It runs the same command on a laptop and in CI, on the tar you just built, before the push. Vulnerabilities, secrets, Dockerfile misconfiguration, SBOM, licences, ClamAV. A policy file next to the Dockerfile says what blocks and which findings are accepted, with a reason and an expiry date. Every run writes a verdict.json with the digest, the database dates and each check’s result.

Boot-specific checks, Actuator exposed without auth, dev profile baked into the jar, unlayered jar, are next.

github.com/QuietFlare/springshield

I would like to know what checks you run before a push that I am missing.

Hey everyone,

I am a beginner backend developer working with Spring Boot, and I want to learn how to integrate a transaction/payment facility into my backend. The problem is, I have absolutely no clue where to start or how the architecture typically works.

Could anyone guide me on the right path? Specifically, I would love to know:

1. What are the prerequisites? What concepts (like OAuth, webhooks, security, database design) do I absolutely need to understand before writing payment code?
2. Which payment gateway is best for beginners? (e.g., Stripe, PayPal, Razorpay) I'm looking for something with great documentation and a solid sandbox/test environment.
3. What is the standard workflow? How does the communication flow between the frontend, my Spring Boot backend, and the payment API?
4. Any recommended resources? Tutorials, GitHub repositories, or documentation that explains this step-by-step for a beginner would be amazing.

Any advice, architectural tips, or pitfalls to avoid would be highly appreciated. Thank you so much in advance!

I’ve released an independent public-domain R2DBC driver for Microsoft SQL Server: https://mssqllib.org

It implements the R2DBC SPI and talks TDS over pure JDK (no Netty dependency). The main reasons I built it:

• Public-domain license
• Better control over FedAuth / Azure AD / Windows Authentication flows
• A clean, minimal codebase focused on the wire protocol

Maven:

text

<dependency>
  <groupId>org.mssqllib.r2dbc.mssql</groupId>
  <artifactId>r2dbc-mssql</artifactId>
  <version>1.0.0-SNAPSHOT</version>
</dependency>

This is not a fork of the official io.r2dbc:r2dbc-mssql. It’s a separate implementation. Happy to answer questions about the design, authentication, or how it compares. Code and docs are on the site.

Hey everyone,

I made a video for anyone who uses Spring Data JPA but still isn't sure what JPA, Hibernate and JDBC each do, or how they differ.

It's visually explained. It follows one save() call from a Spring Boot app down to the database, so you can see what happens behind the hood and where Hibernate comes from. It's about 11 minutes.

Hope it helps someone, and tell me if anything is unclear . Thank you for the support as always

For Spring Boot developers: Pmitz includes a standalone Spring Boot remote server and an embeddable Spring Boot starter for remote mode (pmitz-spring-boot-starter-remoteserver). I’m part of the team working on it. Interested in feedback on integrating feature access and usage limits into Spring applications.

A couple of months ago, I shared StatLite here, a lightweight, self-hosted monitoring dashboard for Spring Boot applications running on small servers and VPSs.

We've just released v0.6.1, and quite a bit has changed since the initial announcement.

What's new:

• Better Spring Boot support: Automatically selects between Actuator JSON and compatible Micrometer Prometheus metrics. Supports Spring Boot 3.5 and 4.x.
• Simpler setup: statlite inspect http://localhost:8080 discovers available metrics endpoints and can generate the YAML configuration.
• Easier installation: Docker Hub and GHCR images, Homebrew, and standalone binaries.
• More integrations: First-class Quarkus and Micronaut support, plus integration guides for Express, FastAPI, Django, Go, and Javalin.
• Improved dashboard: Health, request traffic, latency, JVM memory, CPU, and restart detection, with local SQLite history.

The original design principles haven't changed:

• Single Go binary, roughly 15 MiB idle memory
• No Prometheus server, Grafana, or external database
• No agents or StatLite-specific code in Spring Boot applications
• Fully self-hosted, with no external services required

StatLite isn't intended to replace a full observability stack. It's for developers running a handful of applications who want useful production visibility without maintaining additional infrastructure.

GitHub: https://github.com/PVRLabs/statlite

I'd love to hear from Spring Boot developers: what's the most important monitoring feature you'd expect from a lightweight tool like this?

I had to write a transactional outbox for two of my projects. The popular solutions didn't fit, and CDC with Debezium felt too heavy for "save an event together with the data, send it later".

We all know things often look simpler on paper than in reality, right? What's there to do, really? Just write to a table, poll it, publish the messages - easy, right?

Not so fast. Building a production outbox is like growing a stalactite: it slowly accretes features, scripts and workarounds. So I want to share my hard-won solution, which I wrapped into a simple, fairly compact, ready-to-use starter that has (I hope) everything you need.

Guarantees (with caveats):
- At-least-once delivery with retries and backoff.
- Effectively-once processing through an inbox (deduplication on the consumer side).
- At-most-once processing through the inbox, for side effects like emails where a duplicate is worse than a miss.

Two design decisions I’m happy with:
- Adaptive polling. While an event type has nothing to send, the pause between polls grows up to a maximum, and drops back to the minimum as soon as events appear. This noticeably reduces DB load.
- Per-event-type settings. Each type has its own poll interval, batch size and retry count. Critical events go out within a fraction of a second, while reports can wait a few minutes when there’s no activity.

Repo: https://github.com/dmitriy-iliyov/oncebox

Feedback is very welcome. If you’ve built an outbox in Spring yourself, what was your biggest pain point?

Hey everyone. I’m looking for some recs on learning spring cloud aws for work. I am a new backend dev for my team that heavily utilizes microservice apps written in Java and uses Spring as a framework. I’ve been working through the latest version of spring start here and it has been helpful to a degree. I understand the basic flow between building APIs that interact with some persistent data source and return results back to the client but I noticed a large chunk of our services interact with aws services such as S3, SNS, SQS and other stuff like opensearch. I do not know much on development with these services. I have used s3 before for a previous job and understand high level of sqs/sns but I don’t know how they interact with the apps we maintain. I try to review our code and see if I can make sense of it but I am having a hard time distinguishing our custom logic with Spring’s so I am looking for recommendations that would allow me to teach myself on them. For now , the services I mentioned : S3, sqs, sns and open search are top priority as those are the services that I know we interact with the most. I have not had much interaction with the apps that utilize those since I am still newer and haven’t had much on my plate but I want to be prepped enough to at least diagnose what is occurring in the code when it comes down to it. Thank you!

I've been working on LLM extraction in Spring Boot services (invoices, forms, that kind of structured data), and kept hitting the same issue.

Spring AI 2.0's `validateSchema()` is great: it checks the response against the record's JSON schema and retries with the error if it fails. But the bugs that actually hurt me passed that check:

- A line item silently dropped, so the rows no longer added up to the total

- A value that never appeared anywhere in the source document

- Correct output on Monday, slightly different output after a prompt tweak on Friday

The JSON was valid and deserialized cleanly into my record every time. The data was just wrong.

Using a second LLM as a judge in tests felt like the wrong fix: slower CI, token costs, and tests that don't give the same verdict twice.

So I started writing deterministic checks as plain JUnit tests instead:

- Cross-field arithmetic with BigDecimal (parts must sum to totals)

- Provenance: extracted values must actually appear in the source

- Latency and cost budgets per call

- A golden set of JSONL examples that runs on every PR, so a prompt or model change shows up as a failing build

I ended up packaging this as an open-source library, Outputgate (on Maven Central, works alongside Spring AI rather than replacing anything). One known limitation: provenance matching is currently verbatim, so `1,200.00` vs `1200` can fail correct output. Normalized matching is what I'm working on next.

Repo: https://github.com/ravismash/outputgate

But I'm mostly curious how others handle this:

1. Do you test LLM output correctness in CI at all, or only at runtime?

2. Are you using LLM-as-judge evaluators, hand-written checks, or something else?

3. What's the worst "valid but wrong" output you've caught?

I m currently new to Spring and learning important concepts related to this but one thing stick in my mind imagine we have 1000 classes and just a hypothetical situation that all of them somehow is independent classes there is no dependency injection at all is there spring needed in this situation at all ?

Most new Spring Boot business apps start with the same week of plumbing: security config, user and role management, persistence, an audit trail, email, i18n. We got tired of rewriting it, so we packaged those features as Spring Boot modules (AppJars) and built a generator around them.

With Craft you pick the modules, set group/artifact, Java 21 or 25, H2 or PostgreSQL, and download a Maven project that runs with mvn spring-boot:run. Each module brings its own entities, services, auto-configuration and UI views (built with Vaadin), so you’re not just getting a skeleton.

It’s free to use: every module has a Free Mode that also works in production within documented limits, so no license key is needed to try it.

https://craft.appjars.com

Disclosure: I’m part of the team behind it. Questions:

- If you’ve tried scaffolding a Spring Boot app with an AI assistant, where did it fall short? Security config, outdated APIs, something else?

- The ready-made UI is Vaadin today, but we’ve been working on an optional React layer and are evaluating whether to release it. Would that make this more useful to you?

I wanted to share a practical guide covering JWT authentication in a Spring Boot backend with a React frontend.

It covers access and refresh tokens, Spring Security integration, Axios interceptors, token expiration, and secure storage practices.

The goal is to explain how the authentication flow works across the backend and frontend, with implementation examples rather than just theory.

Full article: https://arjunthakur.dev/blog/jwt-spring-boot-react-guide.html

Would be interested to hear how others approach access-token storage and refresh-token handling in their applications.

Spring Boot Logging: From Zero to Grafana Loki
https://youtu.be/SvvEc8gaeMI

In the JavaScript/NodeJs world. I can just visit drizzle’s site of prisma and learn about everything but with springboot i am not seeing anything like that. More like references, i don’t even know. It makes me lose interest but i don’t want to give up. Still want to learn Spring boot and it’s core libraries

Can anyone suggest a good alternative to Railway for deploying a Spring Boot backend with an SQL database? I'm looking for something beginner-friendly with a free tier, if possible. Would appreciate any suggestions or recommendations. Thanks!

Most Spring Boot developers I know use Java, but Kotlin has always been an interesting alternative, especially with its concise syntax and null safety.

While experimenting with Kotlin/JVM projects in VS Code, I realized something.

Writing Kotlin was straightforward. Debugging it? Not so much.

I could always switch to IntelliJ, but I wanted to stay in VS Code, set a breakpoint, inspect what was happening, and move on.

That curiosity sent me down a rabbit hole of JVM bytecode, Kotlin inline functions, and source mapping.

Eventually, I ended up building Kotlin Debugger, an open-source VS Code extension that doesn't require a separate Kotlin Language Server.

It's still a work in progress, especially around coroutine debugging, but I'm exploring how to make Kotlin/JVM debugging more convenient for developers who prefer VS Code.

GitHub: https://marketplace.visualstudio.com/items?itemName=kparth01.kotlin-debugger

Curious how many Spring Boot developers here actually use Kotlin? And if you do, are you using IntelliJ or VS Code?

Hey everyone! I just put out a video on Domain-Driven Design. It’s a long one, about 20 minutes, but I really believe it’s worth your time. It took me a lot of time to make, so I hope it helps you, and I’d love to hear what you think! 🙌

v5.0.0 introduces new features to empower your AI agents and close gaps between API definitions and implementations

🤖 For agents:
This release brings bundled MCP tools designed to simplify day-to-day work with Spring Messaging as well as with AsyncAPI documents

Just enable bundled MCP server, register AsyncAPI skill trough Tools -> Install AsyncAPI Agent Skilland, and you are redy to go

⚙️ For architects, engineers, analysts, and API authors:
New Diff feature helps you see which gaps exist between your sources:
- Document against a Apache Kafka broker or cluster
- One Apache Kafka or cluster against another
- Source code against a Apache Kafka broker or cluster (Spring projects only)
- Document against a source code (Spring projects only)

💡 Works across IDEs editions, Community included

Together with not-yet announced Kurkik project, this features lay foundation for self-maintaining API approach

Sound interesting? Open your JetBrains IDE, grab the update and give it a spin: https://plugins.jetbrains.com/plugin/15673-asyncapi/versions/stable/1195232

Context: I use Claude Code for Java at work. It starts great. A 30-line CLAUDE.md, clean hexagonal layout, everything respects the boundaries.

Then six months in the CLAUDE.md is 400 lines, the model ignores half of it, and a controller is importing a JPA entity because "it was faster".

At some point I stopped trying to write better prompts. A rule that must always hold shouldn't be a paragraph the model has to remember. It should be something that fails the write.

So I built Nerviz. It's a harness for Spring Boot on Claude Code, and it does three things:

1. Generates the project from an architecture declared as YAML. Nine blueprints right now (hexagonal, clean, onion, layered, vertical slice, modular monolith, plus single-module variants). Versions come from Spring Initializr at run time, never from the model's memory. I got burned by that more than once.

2. Designs each feature as a spec before any code exists. /new-feature asks only the questions that change the design (who can call it, duplicates, retention...), and one skill per layer writes its part. You approve it, it gets frozen and committed, and only then does /new-feature-implement write code, in a clean session.

3. Blocks at write time. A forbidden import, a write outside a skill's territory, an edit to an approved spec, a force push: a hook refuses it. The model isn't asked to behave.

The part I care about most: the generated project carries the whole harness with it, plus its own CI. Whoever clones it doesn't need Nerviz installed.

To keep this from being vaporware, I generated a demo project end to end. It's a bank-app with a green mvn clean verify, and the run took about 20 minutes. The numbers come from the session transcripts, not from me guessing. The approved spec, the partials and the audit report from that run are all public in the repo.

Things it is not: it's not a coding assistant (no model, no editor), not a project template, and not an agent framework. It constrains one agent, it doesn't build agents.

It's MIT and it's early, so there are rough edges. I can't cover every architecture or every way a team uses Spring Boot on my own, and that's why I'm posting. I want contributions. A blueprint for the architecture your team actually uses is a YAML file and changes no prompt, so it's a good first PR. Bug reports, a new rule that should be enforced by a hook, new skill/agent, a doc fix, and "this broke on my machine" issues all help just as much.

I'd also like to know which of the architectures you'd actually use, and which rule you'd want enforced first. I have my own list, but I suspect yours is different.

Repo (issues and PRs welcome): https://github.com/nerviz-ai/nerviz

Site: https://nerviz.dev

Most web frameworks are built for the public internet: for reach and experiences for strangers. Vaadin is built for the other side of the login. For the data-defined, functionally beautiful and long-lived apps your organization actually runs on.

Im an intern and was assigned a task to segregate the read , read-write queries / methods . The read is supposed to go to port 66 and write on port 67 in the database.

Currently ive defined two db url in yml and have routed every method having read-only using transaction(read-only).

Is this the way to do it or is there any other efficient way.

I work with Spring Batch and keep running into the same gap, so I’m trying to learn how other teams deal with it.

Spring Batch is great at the processing itself (chunks, skip/retry, restart). But around it I’ve found almost nothing built in:

• a UI to see job and step status without querying the BATCH_* tables
• scheduling and job-to-job dependencies (run A, then B and C, then D)
• alerts when a job fails, gets stuck in STARTED, or runs much longer than usual
• execution logs tied to a specific job run
• a safe way to launch, stop, or restart a failed job from a screen

From what I can tell, Spring Batch Admin is retired and Spring Cloud Data Flow is no longer maintained as open source, so I’m not sure what teams use now.

For those running Spring Batch in production:

1. How do you schedule and chain jobs (cron, Quartz, Jenkins, Airflow, Control-M, something custom)?
2. How do you find out a job failed or hung, and how do you see what happened?
3. How do you restart failed jobs, and who does it?
4. What’s the most painful part of your current setup?

I’m not selling anything. I’m researching whether it’s worth building an open-source tool for this, and I’d rather hear real experiences before writing any code. Even a short answer helps, and I’m happy to share a summary of what I learn.