# Spring Boot 4 Web Services

`spring-boot/spring-boot-4` · Skill · v1.0.0

Spring Boot 4.1 REST services done right, and Boot 3.5 upgrades that keep the JSON contract, checked against Boot 4.1.2.

Teaches an agent the parts of Spring Boot 4 (4.1.2, Spring Framework 7.0.10, Jackson 3.1.7) that agents trained on Boot 2 and 3 get wrong when they build or upgrade Spring MVC services: the split starters and test starters, Jackson 3 packages and APIs (@JacksonComponent, ValueSerializer, JsonMapperBuilderCustomizer), the ObjectMapper bean that Boot 4 silently ignores, Jackson 3 default changes that alter the wire format without a compile error (enums read and written with toString, rejected missing primitives, sorted properties), built-in method validation versus a class-level @Validated, HandlerMethodValidationException and RFC 9457 problem details with per-field errors, the new test packages (@MockitoBean, RestTestClient, TestRestTemplate opt-in), RestTemplateBuilder and HTTP client property moves, HTTP service client groups, API versioning, core @Retryable and virtual threads. Every behaviour claim was measured on Boot 4.1.2.

## Verdict

- level: **submitted** — In the catalog, not yet checked for this digest.
- uplift: **untested** — No runs exist for this digest.
- digest: `sha256:1bc4fffbf783b178202a09819b31240ce06a888ca39201b3ecd71864560281d4`

## Uplift runs

None for this digest. Untested is not the same as useless: nobody has measured it yet.

## Security

No checks recorded for this digest.

## Compatibility

| agent | targeted | compiled | evaluated |
| --- | --- | --- | --- |
| Claude Code | yes | no record | no record |
| Codex | yes | no record | no record |
| Cursor | yes | no record | no record |
| GitHub Copilot | yes | no record | no record |
| Gemini CLI | yes | no record | no record |
| OpenCode | yes | no record | no record |

## Permissions

- network: none
- shell: mvn, gradlew, javap, unzip, grep, ls
- filesystem: write
- env: none

## Files

- `SKILL.md` 22014 B sha256:0d4ad9e4b1b3b31be8b101762d22500c99ebc6a50ff370495e4db68b50c29b25
- `references/http-and-resilience.md` 7062 B sha256:88ecc1a15cbd85a589e38c7489b7aa9d58f440a964a5e45a9309c0cc5f5c3be2
- `references/jackson-3.md` 9138 B sha256:a7ba4704de7c0252935423e1c2449142218286eb93da8a8002fdb1d1f41f25b5
- `references/sources.md` 9564 B sha256:5d1760ee35ceb6fc8f84dae6dffe944376b8339ad4dfb6e4aa2c284615cb3807
- `references/testing.md` 6376 B sha256:d3154f722ce38f9f98d87ee92783e581c1b1df158a7161e0d5fcd67b635027f4
- `references/upgrade-from-3.md` 6711 B sha256:57a0001f4fb6a206da716ae5080583d5d904c8ec1a27145c7f58db73ec0f2a18
- `references/validation-and-problem-details.md` 9288 B sha256:e71ba6b759be790155641097e887765dce05dff2a471749e8738d04387aee34f

## Limitations

- Written and measured against Spring Boot 4.1.2 (Framework 7.0.10, Jackson 3.1.7). 4.0.x behaves the same for everything here except where noted; check the release notes for 4.2 and later.
- Covers Spring MVC on the servlet stack. WebFlux, Spring Security 7, Spring Data and messaging are only touched where they meet the upgrade checklist.
- Jackson default changes are listed for the JSON features a REST API typically exercises; formats like XML, CBOR and Smile and polymorphic typing are not covered.
- The proof suite builds with Maven offline in a container. Gradle is mentioned for commands only.
- The suite measures behaviour through MockMvc and real HTTP in tests; production concerns like observability and native images are out of scope.

## Install

```sh
npx sigil add spring-boot/spring-boot-4 --agent claude-code,codex,cursor
```

Source: https://github.com/dgesteves/sigil/tree/5cb851d5b2f2f14446ddf631ef5e91bf9d3263dd/catalog/skills/spring-boot/spring-boot-4