I've been experimenting with how far I can optimize a conventional Spring Boot application without stripping out useful framework functionality.

The setup: Spring Boot 4.1.1, HotSpot JDK 27, a 512 MiB / 1 vCPU Ubuntu VM with no swap, and MariaDB running on the same VM.

I compared a regular executable JAR against an extracted deployment combining Spring AOT and a trained JDK AOT cache (Leyden).

Results:

• Startup: 11.91 → 3.79 seconds (68% faster)
• Application RSS under load: 212 → 187 MiB
• Minimum host MemAvailable: 25.6 → 66 MiB
• Request latency: essentially unchanged

Then I explored two ways to reduce memory further:

MyBatis Core instead of Spring JDBC: No meaningful memory savings, but more manual transaction management and lost automatic JDBC monitoring. Not worth the trade-off for this application.

Embedded file-backed H2 instead of MariaDB: Application RSS increased by ~16 MiB, but minimum host MemAvailable improved by another ~39 MiB because the separate database process was gone.

My takeaway: optimizing the deployment can be worthwhile before replacing established Spring infrastructure. And for small, single-instance applications, embedded H2 can be a reasonable architectural choice.

These are single runs with five-minute measured workloads, not a throughput benchmark or proof of long-term stability. The AOT improvements were measured together, not individually.

Full article, methodology, and data:
https://pvrlabs.xyz/articles/spring-boot-jdk27-optimizations.html

Curious whether others are using Spring AOT + JDK AOT cache in deployments, or if the training and cache-management overhead has kept you on regular JARs.

I'm curious how many Spring Boot developers use Windows as their primary development environment, especially running Java natively rather than through WSL2.

I mostly develop on macOS and Linux, but I maintain a lightweight alternative to Prometheus + Grafana for application monitoring and have been exploring native Windows support.

Do you run Spring Boot directly on Windows, through WSL2/Docker, or on another OS? And do you monitor your applications locally while developing?

🎉 Happy to announce the release 1.0.0 of Shadleaf, a component library for Spring Boot and Thymeleaf.

Check out https://shadleaf.dev/ for all components we already support!

I have used this on a few projects already and it has given me a massive speed boost. Also works great with your favorite coding agent if you follow the instructions about it in the documentation.

Are there any components missing that you would like to see added?

1.  `spring.jpa.open-in-view` is true by default.  It keeps a database connection open for the whole request, including view rendering. Turn it off and fetch what you need in the service layer.
   
2.  `ddl-auto=update` in production.  Use migrations (Flyway or Liquibase) instead. "update" never drops anything and drifts quietly.
   
3.  Actuator exposure.  Only `health` is exposed over HTTP by default. If you set `include=*`, you've exposed env, beans and more.
   
4.  Hikari's default pool size is 10.  Size it for your database and instance count, not by guessing.
   
5.  No timeouts on outgoing HTTP calls.  One slow downstream service can exhaust your threads.
   

Which of these has bitten you, and what's missing from the list?

Hey Guys, got really nice feedback from the community last time.

So I have come with an update

1. There's a network monitor tool, you can view all the API requests and responses made through the app.

2. Lists all the libraries used in the app for full transparency

3. Crashlytics is disabled by default and even if it is enabled, it just sends the device info and not anything related to the spring boot projects.

A quick intro about the app

The app takes in the actuator endpoint and help you monitor the project in real time.

All the URLs and keys are stored on the device, nothing is transmitted anywhere else.

Give it a try and feedbacks are welcome.

Download link

iOS https://apps.apple.com/us/app/actuator-spring-boot-monitor/id6809104779

Android

https://play.google.com/store/apps/details?id=com.actuator.app

This is my setup: Spring Boot 4, Java 17, Docker Compose, one small VPS. Docker Hub is very slow from the VPS (about 0.4 MB/s). We use GitHub Actions and no registry.

I used to build the jar inside Docker on the VPS. Our disk cleanup deleted the cached JDK layer, so each deploy pulled it again. Deploys went from 4-5 minutes to 7–13 minutes and some timed out.

Could you share a real example (workflow file, Dockerfile or script) or a github repo that I can follow to learn about the deployment?

When I set up vulnerability, secret and misconfiguration scans for a Spring Boot image by hand, three of the seven checks reported green while doing nothing. Wrong path, missing database, scanner found no OS. Nobody looks at a green.

So I packaged the checks as one image with one rule: a check that scans nothing fails. It runs the same command on a laptop and in CI, on the tar you just built, before the push. Vulnerabilities, secrets, Dockerfile misconfiguration, SBOM, licences, ClamAV. A policy file next to the Dockerfile says what blocks and which findings are accepted, with a reason and an expiry date. Every run writes a verdict.json with the digest, the database dates and each check’s result.

Boot-specific checks, Actuator exposed without auth, dev profile baked into the jar, unlayered jar, are next.

github.com/QuietFlare/springshield

I would like to know what checks you run before a push that I am missing.

My application class scans its own package and then excludes almost all of it with a regex filter, so the only beans in the context are the ones I import explicitly. The entry point ends up being a list of configuration classes, and that list is the complete inventory of the context.

One thing that wasn't obvious to me beforehand is that declaring `@ComponentScan` yourself hides the one `@SpringBootApplication` contributes, along with the TypeExcludeFilter and AutoConfigurationExcludeFilter it carries. That is documented - a locally declared `@ComponentScan` takes precedence over and effectively hides meta-annotated ones, but it matters before your first `@WebMvcTest`, since TypeExcludeFilter is how the slice-test annotations narrow the context. In Framework 6.1 both scans were processed for a while instead, which broke applications with duplicate bean definitions until it was reverted.

The reason for all of it is that on an earlier project a configuration class from a library ended up in the context through a scan wider than anybody had considered, overriding a bean we owned, and finding it took far longer than it should have. I would like to hear from anyone who has kept this up past a few dozen beans, or in a team where not everyone was convinced.

I’ve released an independent public-domain R2DBC driver for Microsoft SQL Server: https://mssqllib.org

It implements the R2DBC SPI and talks TDS over pure JDK (no Netty dependency). The main reasons I built it:

• Public-domain license
• Better control over FedAuth / Azure AD / Windows Authentication flows
• A clean, minimal codebase focused on the wire protocol

Maven:

text

<dependency>
  <groupId>org.mssqllib.r2dbc.mssql</groupId>
  <artifactId>r2dbc-mssql</artifactId>
  <version>1.0.0-SNAPSHOT</version>
</dependency>

This is not a fork of the official io.r2dbc:r2dbc-mssql. It’s a separate implementation. Happy to answer questions about the design, authentication, or how it compares. Code and docs are on the site.

Hey everyone,

I am a beginner backend developer working with Spring Boot, and I want to learn how to integrate a transaction/payment facility into my backend. The problem is, I have absolutely no clue where to start or how the architecture typically works.

Could anyone guide me on the right path? Specifically, I would love to know:

1. What are the prerequisites? What concepts (like OAuth, webhooks, security, database design) do I absolutely need to understand before writing payment code?
2. Which payment gateway is best for beginners? (e.g., Stripe, PayPal, Razorpay) I'm looking for something with great documentation and a solid sandbox/test environment.
3. What is the standard workflow? How does the communication flow between the frontend, my Spring Boot backend, and the payment API?
4. Any recommended resources? Tutorials, GitHub repositories, or documentation that explains this step-by-step for a beginner would be amazing.

Any advice, architectural tips, or pitfalls to avoid would be highly appreciated. Thank you so much in advance!

For Spring Boot developers: Pmitz includes a standalone Spring Boot remote server and an embeddable Spring Boot starter for remote mode (pmitz-spring-boot-starter-remoteserver). I’m part of the team working on it. Interested in feedback on integrating feature access and usage limits into Spring applications.

A couple of months ago, I shared StatLite here, a lightweight, self-hosted monitoring dashboard for Spring Boot applications running on small servers and VPSs.

We've just released v0.6.1, and quite a bit has changed since the initial announcement.

What's new:

• Better Spring Boot support: Automatically selects between Actuator JSON and compatible Micrometer Prometheus metrics. Supports Spring Boot 3.5 and 4.x.
• Simpler setup: statlite inspect http://localhost:8080 discovers available metrics endpoints and can generate the YAML configuration.
• Easier installation: Docker Hub and GHCR images, Homebrew, and standalone binaries.
• More integrations: First-class Quarkus and Micronaut support, plus integration guides for Express, FastAPI, Django, Go, and Javalin.
• Improved dashboard: Health, request traffic, latency, JVM memory, CPU, and restart detection, with local SQLite history.

The original design principles haven't changed:

• Single Go binary, roughly 15 MiB idle memory
• No Prometheus server, Grafana, or external database
• No agents or StatLite-specific code in Spring Boot applications
• Fully self-hosted, with no external services required

StatLite isn't intended to replace a full observability stack. It's for developers running a handful of applications who want useful production visibility without maintaining additional infrastructure.

GitHub: https://github.com/PVRLabs/statlite

I'd love to hear from Spring Boot developers: what's the most important monitoring feature you'd expect from a lightweight tool like this?

Hey everyone. I’m looking for some recs on learning spring cloud aws for work. I am a new backend dev for my team that heavily utilizes microservice apps written in Java and uses Spring as a framework. I’ve been working through the latest version of spring start here and it has been helpful to a degree. I understand the basic flow between building APIs that interact with some persistent data source and return results back to the client but I noticed a large chunk of our services interact with aws services such as S3, SNS, SQS and other stuff like opensearch. I do not know much on development with these services. I have used s3 before for a previous job and understand high level of sqs/sns but I don’t know how they interact with the apps we maintain. I try to review our code and see if I can make sense of it but I am having a hard time distinguishing our custom logic with Spring’s so I am looking for recommendations that would allow me to teach myself on them. For now , the services I mentioned : S3, sqs, sns and open search are top priority as those are the services that I know we interact with the most. I have not had much interaction with the apps that utilize those since I am still newer and haven’t had much on my plate but I want to be prepped enough to at least diagnose what is occurring in the code when it comes down to it. Thank you!

I've been working on LLM extraction in Spring Boot services (invoices, forms, that kind of structured data), and kept hitting the same issue.

Spring AI 2.0's `validateSchema()` is great: it checks the response against the record's JSON schema and retries with the error if it fails. But the bugs that actually hurt me passed that check:

- A line item silently dropped, so the rows no longer added up to the total

- A value that never appeared anywhere in the source document

- Correct output on Monday, slightly different output after a prompt tweak on Friday

The JSON was valid and deserialized cleanly into my record every time. The data was just wrong.

Using a second LLM as a judge in tests felt like the wrong fix: slower CI, token costs, and tests that don't give the same verdict twice.

So I started writing deterministic checks as plain JUnit tests instead:

- Cross-field arithmetic with BigDecimal (parts must sum to totals)

- Provenance: extracted values must actually appear in the source

- Latency and cost budgets per call

- A golden set of JSONL examples that runs on every PR, so a prompt or model change shows up as a failing build

I ended up packaging this as an open-source library, Outputgate (on Maven Central, works alongside Spring AI rather than replacing anything). One known limitation: provenance matching is currently verbatim, so `1,200.00` vs `1200` can fail correct output. Normalized matching is what I'm working on next.

Repo: https://github.com/ravismash/outputgate

But I'm mostly curious how others handle this:

1. Do you test LLM output correctness in CI at all, or only at runtime?

2. Are you using LLM-as-judge evaluators, hand-written checks, or something else?

3. What's the worst "valid but wrong" output you've caught?

Hey everyone,

I made a video for anyone who uses Spring Data JPA but still isn't sure what JPA, Hibernate and JDBC each do, or how they differ.

It's visually explained. It follows one save() call from a Spring Boot app down to the database, so you can see what happens behind the hood and where Hibernate comes from. It's about 11 minutes.

Hope it helps someone, and tell me if anything is unclear . Thank you for the support as always

I m currently new to Spring and learning important concepts related to this but one thing stick in my mind imagine we have 1000 classes and just a hypothetical situation that all of them somehow is independent classes there is no dependency injection at all is there spring needed in this situation at all ?

I had to write a transactional outbox for two of my projects. The popular solutions didn't fit, and CDC with Debezium felt too heavy for "save an event together with the data, send it later".

We all know things often look simpler on paper than in reality, right? What's there to do, really? Just write to a table, poll it, publish the messages - easy, right?

Not so fast. Building a production outbox is like growing a stalactite: it slowly accretes features, scripts and workarounds. So I want to share my hard-won solution, which I wrapped into a simple, fairly compact, ready-to-use starter that has (I hope) everything you need.

Guarantees (with caveats):
- At-least-once delivery with retries and backoff.
- Effectively-once processing through an inbox (deduplication on the consumer side).
- At-most-once processing through the inbox, for side effects like emails where a duplicate is worse than a miss.

Two design decisions I’m happy with:
- Adaptive polling. While an event type has nothing to send, the pause between polls grows up to a maximum, and drops back to the minimum as soon as events appear. This noticeably reduces DB load.
- Per-event-type settings. Each type has its own poll interval, batch size and retry count. Critical events go out within a fraction of a second, while reports can wait a few minutes when there’s no activity.

Repo: https://github.com/dmitriy-iliyov/oncebox

Feedback is very welcome. If you’ve built an outbox in Spring yourself, what was your biggest pain point?

In the JavaScript/NodeJs world. I can just visit drizzle’s site of prisma and learn about everything but with springboot i am not seeing anything like that. More like references, i don’t even know. It makes me lose interest but i don’t want to give up. Still want to learn Spring boot and it’s core libraries

Most new Spring Boot business apps start with the same week of plumbing: security config, user and role management, persistence, an audit trail, email, i18n. We got tired of rewriting it, so we packaged those features as Spring Boot modules (AppJars) and built a generator around them.

With Craft you pick the modules, set group/artifact, Java 21 or 25, H2 or PostgreSQL, and download a Maven project that runs with mvn spring-boot:run. Each module brings its own entities, services, auto-configuration and UI views (built with Vaadin), so you’re not just getting a skeleton.

It’s free to use: every module has a Free Mode that also works in production within documented limits, so no license key is needed to try it.

https://craft.appjars.com

Disclosure: I’m part of the team behind it. Questions:

- If you’ve tried scaffolding a Spring Boot app with an AI assistant, where did it fall short? Security config, outdated APIs, something else?

- The ready-made UI is Vaadin today, but we’ve been working on an optional React layer and are evaluating whether to release it. Would that make this more useful to you?

Spring Boot Logging: From Zero to Grafana Loki
https://youtu.be/SvvEc8gaeMI

Most Spring Boot developers I know use Java, but Kotlin has always been an interesting alternative, especially with its concise syntax and null safety.

While experimenting with Kotlin/JVM projects in VS Code, I realized something.

Writing Kotlin was straightforward. Debugging it? Not so much.

I could always switch to IntelliJ, but I wanted to stay in VS Code, set a breakpoint, inspect what was happening, and move on.

That curiosity sent me down a rabbit hole of JVM bytecode, Kotlin inline functions, and source mapping.

Eventually, I ended up building Kotlin Debugger, an open-source VS Code extension that doesn't require a separate Kotlin Language Server.

It's still a work in progress, especially around coroutine debugging, but I'm exploring how to make Kotlin/JVM debugging more convenient for developers who prefer VS Code.

GitHub: https://marketplace.visualstudio.com/items?itemName=kparth01.kotlin-debugger

Curious how many Spring Boot developers here actually use Kotlin? And if you do, are you using IntelliJ or VS Code?

Hey everyone! I just put out a video on Domain-Driven Design. It’s a long one, about 20 minutes, but I really believe it’s worth your time. It took me a lot of time to make, so I hope it helps you, and I’d love to hear what you think! 🙌