Day 2: Intermediate Spring · Learn Spring Boot 4

API Versioning

Mon, 01 Jan 0001 00:00:00 +0000

Spring Boot 4 versions endpoints for you — no /v1/ copies of every controller, no manual header parsing. Enable it spring.mvc.apiversion.default=1.0 spring.mvc.apiversion.use.header=X-API-Version Other strategies: Property Client sends spring.mvc.apiversion.use.header=X-API-Version a header spring.mvc.apiversion.use.query-parameter=version ?version=1.1 spring.mvc.apiversion.use.path-segment=1 /api/1.1/books spring.mvc.apiversion.use.media-type-parameter=… Accept: application/json;version=1.1 Reactive apps use spring.webflux.apiversion.*. Version a mapping @RestController @RequestMapping("/api/books/{id}") public class BookController { @GetMapping // any version — lowest priority Book get(@PathVariable long id) { … } @GetMapping(version = "1.1") // exactly 1.1 BookV1_1 get1_1(@PathVariable long id) { … } @GetMapping(version = "1.2+") // 1.2 and everything above BookV1_2 get1_2(@PathVariable long id) { … } } curl -H "X-API-Version: 1.2" localhost:8080/api/books/1 Matching picks the highest version at or below the requested one. A request above every declared version fails with NotAcceptableApiVersionException → 400.

Null Safety with JSpecify

Mon, 01 Jan 0001 00:00:00 +0000

Spring Framework 7 and Spring Boot 4 annotate the whole portfolio with JSpecify. Your IDE and build can now tell you where a null can appear — before it appears at runtime. The four annotations Annotation Meaning @NullMarked in this scope everything is non-null unless marked otherwise @Nullable this type may be null @NonNull this type is not null (rarely needed inside @NullMarked) @NullUnmarked opt a scope back out org.jspecify jspecify Mark your packages src/main/java/com/example/demo/package-info.java:

Security

Mon, 01 Jan 0001 00:00:00 +0000

Add the starter org.springframework.boot spring-boot-starter-security Every endpoint is now protected, and a generated password is printed at startup. That default is a reminder to configure it, not a setup. A filter chain @Configuration @EnableWebSecurity public class SecurityConfig { @Bean SecurityFilterChain api(HttpSecurity http) throws Exception { return http .authorizeHttpRequests(auth -> auth .requestMatchers("/actuator/health", "/public/**").permitAll() .requestMatchers(HttpMethod.GET, "/api/books/**").hasRole("USER") .requestMatchers("/api/**").hasRole("ADMIN") .anyRequest().authenticated()) .csrf(csrf -> csrf.disable()) // stateless API with tokens only .httpBasic(Customizer.withDefaults()) .build(); } } Rules are matched top to bottom — put the specific ones first.

Actuator & Observability

Mon, 01 Jan 0001 00:00:00 +0000

Actuator org.springframework.boot spring-boot-starter-actuator Only /actuator/health is exposed over HTTP by default. Open more explicitly: management.endpoints.web.exposure.include=health,info,metrics,env,loggers management.endpoint.health.show-details=when-authorized Endpoint Shows /actuator/health up/down, plus per-component checks /actuator/info build and git info /actuator/metrics counters, gauges, timers /actuator/loggers log levels, changeable at runtime /actuator/env resolved configuration /actuator/prometheus metrics in Prometheus format curl localhost:8080/actuator/health curl localhost:8080/actuator/metrics/http.server.requests Warning env, heapdump and threaddump leak internals. Expose them only behind authentication, or move the whole actuator to its own port: management.server.port=9001.

Resilience

Mon, 01 Jan 0001 00:00:00 +0000

Retries and concurrency limits moved into the core framework in Spring 7 — no extra project, no Resilience4j needed for the common cases. Enable it @Configuration @EnableResilientMethods class ResilienceConfig {} @Retryable import org.springframework.resilience.annotation.Retryable; @Retryable public void sendNotification() { … } // 3 retries, 1 s apart @Retryable( includes = RemoteServiceException.class, maxRetries = 4, delay = 100, // ms jitter = 10, // random spread, avoids thundering herds multiplier = 2, // exponential backoff: 100, 200, 400, 800 maxDelay = 1000) public Book fetch(long id) { … } Attribute Default Meaning maxRetries 3 attempts after the first one delay 1000 milliseconds before retrying jitter 0 random addition to the delay multiplier 1 backoff factor maxDelay – cap for the growing delay includes / excludes all / none which exceptions to retry Reactive return types are retried too:

Async, Scheduling & Virtual Threads

Mon, 01 Jan 0001 00:00:00 +0000

Virtual threads One property, and every request plus every @Async task runs on a virtual thread: spring.threads.virtual.enabled=true Blocking code stops being expensive: a thread parked on I/O costs almost nothing, so an MVC app handles thousands of concurrent requests without going reactive. Two rules Do not pool virtual threads — create one per task. And avoid synchronized around blocking calls; use ReentrantLock instead.

Caching & Messaging

Mon, 01 Jan 0001 00:00:00 +0000

Caching @Configuration @EnableCaching class CacheConfig {} @Service public class BookService { @Cacheable("books") public Book byId(long id) { … } // called once per id @CachePut(value = "books", key = "#book.id") public Book update(Book book) { … } // always runs, refreshes the entry @CacheEvict(value = "books", key = "#id") public void delete(long id) { … } @CacheEvict(value = "books", allEntries = true) public void reload() { … } } Keys default to the method arguments; key = "#id" or a SpEL expression overrides that.

Packaging & Deployment

Mon, 01 Jan 0001 00:00:00 +0000

The executable jar ./mvnw clean package java -jar target/demo-0.0.1-SNAPSHOT.jar One file with your classes, the dependencies and a launcher. No application server. java -jar app.jar --server.port=9000 --spring.profiles.active=prod java -Dspring.profiles.active=prod -jar app.jar SPRING_PROFILES_ACTIVE=prod java -jar app.jar Container image, no Dockerfile ./mvnw spring-boot:build-image -Dspring-boot.build-image.imageName=demo:1.0 docker run -p 8080:8080 demo:1.0 Cloud Native Buildpacks pick a JDK, layer the image and set sane defaults.