mir-backend-jvm-spring
SolidMake It Right (Spring Boot module). Spring Boot 4.x / Framework 7 + Spring Data JPA/Hibernate + Spring Security 7 + MVC/WebFlux footguns. Covers: @Transactional self-invocation (a same-bean call bypasses the proxy, so no transaction), checked exceptions not rolling back by default, JPA/Hibernate N+1 and LazyInitializationException plus the open-in-view default, @Async on Boot's auto-configured applicationTaskExecutor (unbounded queue, swallowed exceptions, spring.threads.virtual.enabled), the Jackson 3 and Boot 3.x-to-4 migration cliff, @Valid + DTOs against overposting, and Spring Security object-level authorization plus the current authorization-bypass advisories (NimbusJwtDecoder issuer validation, method security on parameterized types, Actuator health-group paths, versioned static-resource path traversal). Chains: mir-backend (gates) -> mir-backend-jvm (JVM runtime) -> this, which adds only Spring library mechanics. TRIGGER only when the JVM backend stack is Spring Boot — building, reviewing, or debuggin
Install
Quality Score: 81/100
Skill Content
Details
- Author
- anantbhandarkar
- Repository
- anantbhandarkar/make-it-right
- Created
- 3 months ago
- Last Updated
- 1 weeks ago
- Language
- Python
- License
- Apache-2.0
Integrates with
Similar Skills
Semantically similar based on skill content — not just same category
mir-backend-jvm
Make It Right (JVM runtime tier). Java 25/21 LTS and Kotlin runtime reliability footguns shared across every JVM backend framework — distinct from the generic backend gates and from any one framework's mechanics. Covers: thread-pool sizing and pool-exhaustion deadlock, blocking I/O on platform threads, virtual threads after JEP 491 (synchronized no longer pins on Java 24+, jdk.VirtualThreadPinned JFR event) and virtual threads not bounding concurrency, GC choice (G1, ZGC, Generational Shenandoah) and container-aware heap sizing (-XX:MaxRAMPercentage), cold start (Leyden AOT cache, AppCDS, GraalVM native image, CRaC), JMM visibility and data races, ThreadLocal leaks in pooled threads, and JVM-level security (untrusted deserialization and ObjectInputFilter, XXE defaults, SSRF to the cloud metadata IP, Security Manager disabled since JDK 24, Maven/Gradle dependency verification). Chains: mir-backend -> this -> framework module. TRIGGER when the backend runtime is Java or Kotlin on the JVM. SKIP for Python, Node,
mir-backend-jvm-micronaut
Make It Right (Micronaut module). Micronaut 5.x / 4.x + Micronaut Data + Micronaut Security + Netty footguns. Covers: compile-time DI and AOT (bean definitions are generated at build, but resolution is still runtime, so NoSuchBeanException/NonUniqueBeanException surfaces after startup because singletons are lazy), bean scope pitfalls (@Singleton default), blocking the Netty event loop (@ExecuteOn(TaskExecutors.BLOCKING), virtual-thread backed where supported, or reactive types), Micronaut Data repository transaction scoping and self-invocation, compile-time AOP interceptor limits on final/private/new-ed instances, and Micronaut security (CORS wide open when enabled with no configurations, allowCredentials defaulting to true on 4.x and false on 5.x, @Secured object-level authorization, and the HTTP-client credential-leakage and unbounded-redirect advisories). Chains: mir-backend -> mir-backend-jvm -> this, which adds only Micronaut library mechanics. TRIGGER only when the JVM backend stack is Micronaut — build
mir-backend-jvm-quarkus
Make It Right (Quarkus module). Quarkus 3.x (LTS 3.33) + Hibernate ORM/Panache + Quarkus REST (formerly RESTEasy Reactive) + Mutiny footguns. Covers: build-time DI (reflection must be registered with @RegisterForReflection or it fails only at native runtime), the Quarkus REST execution model (the return type picks the thread — Uni/Multi/CompletionStage run on the Vert.x event loop, everything else on a worker thread), blocking inside Mutiny pipelines, @RunOnVirtualThread, build-time vs runtime config keys and secrets baked into a native binary, native-image gotchas, and Quarkus security (deny-unannotated-endpoints defaulting to false, CORS config, the quarkus-rest-csrf extension, Panache active-record mass assignment, and the path-normalization authorization-bypass advisories against quarkus.http.auth.permission policies). Chains: mir-backend -> mir-backend-jvm -> this, which adds only Quarkus library mechanics. TRIGGER only when the JVM backend stack is Quarkus — building, reviewing, or debugging a Quarkus R