Skip to content
CipherCruCipherCru

Menu

Insights

How we think about technology decisions, and what we have learned delivering them.

Written by the people doing the work

Every piece here is written by an engineer who does this work, and sourced so you can check it. No trend commentary and no predictions.

Latest writing

Start here. The most recent thinking on decisions, delivery and modernization.

A table of Spring Boot support dates showing every 3.x branch past its open-source end date and 4.1 as the current release
Legacy modernization

Spring Boot 3.x Is EOL: Upgrade, Buy Runway, or Accept Risk

Your scanner has flagged an unsupported framework. Before you approve a migration budget, know that you have three options, not one, and that for some estates upgrading now is the wrong call.

11 min read

Read the article
Legacy modernization

What Spring Boot 4 Breaks: The Jackson 3 Blast Radius

Every Spring Boot 4 migration guide is written against a clean project. Yours is not clean. The API change is a weekend, and the propagation through a dependency tree you did not build is the quarter.

10 min read

AI engineering

Where AI Agents Help a Java Migration, and Where They Lie

Whether AI can rewrite legacy Java is settled: it can. The question your board needs answered is who certifies that the business logic still does what it did, and that answer has not changed.

11 min read

Practical resources

Checklists and frameworks we use on engagements, written up so you can use them without us.

Framework

The Spring Boot 3.x decision tree

Upgrade, buy runway or accept the risk, and the one count that predicts which of the three fits your estate.

Checklist

The Jackson 2 dependency audit

Two commands, three buckets, and the single number that belongs in your Spring Boot 4 migration plan.

Guide

Staging Spring Boot 4 across two releases

Take the supported framework now and sequence the Jackson move separately, once your upstreams ship.

Reference

The Jackson defaults that change your JSON

Six flipped defaults and one exception change that alter your payloads without altering your code.

Checklist

Four controls before an agent touches legacy code

What to lock, what to automate and what to review by hand before the first AI agent run.

Framework

Where AI fits in a legacy migration

The three-layer split between deterministic tooling, agents and the validation that stays human.

Get new writing by email

Occasional notes on technology decisions, delivery and modernization. No more than once a month.

Unsubscribe in one click.

Want this thinking applied to your problem?

Tell us the constraint you are working under. We will tell you how we would approach it.

Start a project

Strictly necessary cookies are always on. Every other category is off until you turn it on, and you can come back and change this at any time.

Strictly necessaryEssential for the site to function: page navigation, security, session management, and remembering the cookie choices you make here.
Always on
FunctionalRemembers choices you make, such as language, region or display preferences, so the site opens the way you left it.
Performance and analyticsPerformance and analytics cookies show us how the Website is used: which pages are visited, how long is spent on them, where visitors came from, and what errors occur. They are set by Google Analytics and by HubSpot, whose cookies also link the pages you viewed to any enquiry you later send us.
Marketing and targetingTracks browsing activity to measure advertising and show relevant ads. We set none of these today, and will not without your opt-in.