Broadcom Expert Advantage Tanzu Services Partner of the Year, AMER, 2025
Awarded to AceMQ. Ace8 is the modernization practice of AceMQ, and AceMQ supports Spring after go-live.
AceMQDelivered by the AceMQ engineering team
Spring Boot 3 migration
Spring Boot 2 to 3 migration: a checklist, and a team to run it.
The mechanical edits are automated. The configuration and security changes are where engineers earn their review.
The short answer
Spring Boot 3 requires Java 17 or later, Spring Framework 6 and the Jakarta EE namespace, so every javax import changes to jakarta. Spring Security and Hibernate also change. Ace8 runs OpenRewrite recipes for the mechanical edits, tests the result and has engineers review the configuration and security changes.
Overview
What changes in Boot 3
| Area | Change | Who does the work |
|---|---|---|
| Java baseline | Java 17 or later | Upgrade first. See Java upgrade |
| Namespace | javax.* becomes jakarta.* | Recipe, then review |
| Spring Framework | Version 6 | Recipe and engineer |
| Spring Security | Version 6 configuration model | Engineer |
| Hibernate | Version 6 behavior and query changes | Engineer and tests |
| Properties and dependencies | Renamed and removed settings | Recipe, then review |
Prerequisite
The Java 17 prerequisite
If the application is still on Java 8 or 11, that upgrade comes first, or in the same project. Running both in one step makes failures hard to attribute. We usually do the Java change, get the tests green, and then start Spring.
Namespace
javax to jakarta
Jakarta EE moved its packages from javax to jakarta. In a Spring Boot 3 application every import of servlet, persistence, validation and related APIs changes. A recipe can rewrite imports, XML descriptors and annotations across the codebase.
The part that needs a person is the dependency graph. A library you use that still ships javax classes will break at runtime. Each one needs a new version, a replacement, or a shim. Application servers matter too: Tomcat 10 and later use the jakarta namespace.
The hard parts
Spring Security 6 and Hibernate 6
Spring Security 6 reworks how web security is configured, and older configuration styles are removed. Authorization rules written in the old style must be rewritten, and a mistake here is a security defect, not a build error. That is why security configuration gets a named engineer reviewer.
Hibernate 6 changes query handling and some mapping defaults. Applications can compile cleanly and return different data. Tests that compare query results before and after are the safety net.
Configuration
Property and dependency changes
- Some application properties are renamed or removed. The Spring Boot properties migrator flags them at startup.
- Starter and managed dependency versions change.
- Actuator, metrics and tracing configuration moved in recent releases.
- Libraries must be checked for Jakarta-compatible releases.
Evidence
Recipe run on our sample repo
We run the Spring Boot 3 and javax to jakarta recipes on an open-source Spring Boot 2 application. The write-up will show which files changed, which compile errors remained, and how long the manual fixes took. It is not published yet, so no numbers appear here. See OpenRewrite.
Safety net
Testing strategy
- 1
Baseline
Run the existing suite on Boot 2. Record what passes.
- 2
Characterization tests
Add tests around security rules and critical queries.
- 3
Migrate in slices
One module or service at a time, behind the tests.
- 4
Compare behavior
Same inputs, same outputs, on old and new.
- 5
Engineer sign-off
A named reviewer signs each security and persistence change.
Proof
Delivered by the AceMQ engineering team.
After go-live
Keep it running after cutover.
Java 17 or later, Spring Framework 6 and the Jakarta EE namespace. Every javax import changes to jakarta, and Spring Security and Hibernate need configuration and behavior changes.
Open-source support for Spring Boot 2.7 ended in November 2023. Teams that cannot move yet should plan the migration. Commercial support options exist; ask us.
It does the mechanical edits. Security configuration, Hibernate behavior and library compatibility need engineer review and tests.
Yes, to Java 17 or later. We usually do it first or as the opening phase.
AceMQ does, 24/7.
Know the cost before anything moves.
A fixed-price assessment gives you the inventory, the risk score and a phased plan. Scope and cost are fixed before the migration starts.
Book a Fixed-Price AssessmentGet in touch
Talk to a modernization engineer
Tell us what you run today. An engineer, not a sales script, replies within one business day.