mir-backend-jvm-springlisted

Make It Right (Spring Boot module). Spring Boot 4.x / Framework 7 + Spring Data JPA/Hibernate + Spring Security 7 + MVC/WebFlux footguns. Covers: @Transactional self-invocation (a same-bean call bypasses the proxy, so no transaction), checked exceptions not rolling back by default, JPA/Hibernate N+1 and LazyInitializationException plus the open-in-view default, @Async on Boot's auto-configured applicationTaskExecutor (unbounded queue, swallowed exceptions, spring.threads.virtual.enabled), the Jackson 3 and Boot 3.x-to-4 migration cliff, @Valid + DTOs against overposting, and Spring Security object-level authorization plus the current authorization-bypass advisories (NimbusJwtDecoder issuer validation, method security on parameterized types, Actuator health-group paths, versioned static-resource path traversal). Chains: mir-backend (gates) -> mir-backend-jvm (JVM runtime) -> this, which adds only Spring library mechanics. TRIGGER only when the JVM backend stack is Spring Boot — building, reviewing, or debuggin
anantbhandarkar/make-it-right · ★ 15 · API & Backend · score 81

Install: claude install-skill anantbhandarkar/make-it-right

# /mir-backend-jvm-spring · Make It Right (Spring Boot) Bottom tier of the chain: `mir-backend` (generic gates) → `mir-backend-jvm` (JVM runtime model) → **this** (Spring Boot / Spring Data library mechanics). Run the gates first; load the JVM runtime tier for threading, GC, and container-heap concerns; reach for *this* at Gate 5 (design mechanics), Gate 6 (implementation), and Gate 7 review. **Runtime-level concerns (virtual-thread pinning, pool sizing, GC tuning, `-XX:MaxRAMPercentage`, ThreadLocal hygiene) live in `mir-backend-jvm` — not here.** **Stack assumed:** Spring Boot 4.x · Spring Framework 7 · Spring Security 7 · Spring Data JPA (Hibernate 7.x, the version Boot 4 manages) · Spring MVC or WebFlux · PostgreSQL / MySQL. Notes call out WebFlux divergences explicitly. **Version and support status, verified 13 Aug 2026:** | Line | Status | Consequence | |---|---|---| | **Spring Boot 4.1** | Current. Released 30 Jun 2026; OSS support to 31 Jul 2027 | Target for new work | | **Spring Boot 4.0** | Released 30 Nov 2025; OSS support ends 31 Dec 2026 | Plan the 4.1 bump now | | **Spring Boot 3.5** | **OSS support ended 30 Jun 2026** (last OSS release 3.5.16). Commercial support to Jun 2032 | No free patches — new Spring CVEs are fixed in 4.x and, for paying customers, in 3.5.x. An unpatched 3.5 app is an unpatched app | | Spring Boot 3.4 and older | Out of OSS support | Upgrade path is 3.5 → clear every deprecation → 4.x. Do not jump from 3.2/3.3 straight to 4 | **What B