Spring Forward: Broadcom’s App Advisor Eases Spring Upgrades

Broadcom’s VMware is launching a new tool called “Application Advisor” to help automate the process of upgrading Spring applications to newer versions using an open source framework called OpenRewrite.

Michael Minella, director of OSS Spring R&D in the Tanzu Division at Broadcom, told The New Stack that, “We’re working on a tool that will be coming out actually next month [May] called Application Advisor. And what that does is it takes the knowledge of your Spring Boot applications, so you point it at your repository, and then using the OpenRewrite framework, it can run recipes against your application to do the upgrades for you.”

Minella explained that this is a deeper upgrade with a deeper knowledge of what’s happening than GitHub’s Dependabot because OpenRewrite can refactor your code. So if an API changes as part of an upgrade, it can actually refactor your code to take advantage of those changes.

Application Advisor will look at your build file in your repository and see what version of Spring Boot you’re using and it will make a version upgrade as needed.

“The hard part of what needs to be changed should be mostly automated,” Minella said.

Moreover. the Application Advisor “is a closed source, commercial tool we are developing,” he said.

New to Enterprises

Netflix, for example, gave a talk last year at SpringOne about their approach to staying up to date. “They have a team that is building these recipes and building some tooling around this kind of capability,” he said.

“But this type of capability is definitely new to most enterprises,” Minella said. “It’s something that when we talk to companies, a lot of them look at these upgrades — whether it be Spring or Java — they’re looking at it as a once-in-a-generation kind of upgrade. So they’ll say every three to five years, I’ll do the upgrade. But with the rate of change that’s happening with Java and everything that builds on top of it, that’s not a practical path forward for most enterprises.”

Keeping Pace with the Cadence

The pace of Java upgrades — at a six-month cadence — makes it risky to stay on older versions.

“When you consider Java is releasing every six months, Spring Boot releases every six months, Hibernate gives you three to six months’ worth of support, and the version upgrades that are required are getting more aggressive,” Minella said. “Spring went from Java 8 to Java 17; Jakarta EE went from 8 to 17 for their baseline or is in the process of doing that. So the idea that you can sit back on these versions and stay secure, stay safe and performant is something that we as an industry are going to have to evaluate.”

Spring simplifies Java development by providing pre-built modules and frameworks for common application needs like web APIs, security, data access, etc., Minella said.

However, Broadcom must proceed carefully in how it handles its role in supporting the Java developer ecosystem and open source in general, said Brad Shimmin, an analyst at Omdia. “As we’ve seen with Red Hat and Oracle over the last two years, any kind of licensing/support change can have far-reaching and sometimes unanticipated consequences,” he said.

Stuck on Java 8?

Many companies are stuck on older Java versions like Java 8, as upgrading used to be a slow process. However, since Java 9, new versions are released every 6 months, with long-term support (LTS) versions every 2-3 years.

“Based on surveys, a narrow majority (55%) of the Spring ecosystem is on at least Java 17,” Minella said. “However, many enterprises are still stuck on Java 8.”

Being on an old Java version holds back the entire application ecosystem built on top of it, making it harder to address security vulnerabilities and performance improvements.

In addition, security risks are higher when running older versions of libraries on top of an outdated Java version, as it becomes harder to quickly mitigate any announced CVEs.

Automate Upgrades Like CI/CD

“In our most recent survey, one of the things we saw was, most people from an upgrade perspective, still handle it from a legacy, ‘do these upgrades by hand’ approach,” Minella said.

He predicts a shift toward more automated platform updating similar to how DevOps and CI/CD improved the software development lifecycle.

“I think that’s going to be the next thing there is, over the next five years, you’re going to see tooling come into place, and processes come into place in enterprises that allow them to stay up-to-date more frequently and do continuous upgrades, just like we do continuous integration and continuous deployment today,” Minella said.

OpenRewrite and Moderne

Broadcom based its Application Advisor on OpenRewrite and has worked with Moderne, the creator of OpenRewrite.

“I don’t believe our team is familiar with Application Advisor, although it could be a new name for something we are aware of,” said Pat Johnson, Director of Product Marketing at Moderne. “However, we know that VMware/Broadcom is working on spring-rewrite commons to reuse elements of how the Spring team uses and runs OpenRewrite. OpenRewrite is integrated with the Spring Boot Migrator.”

OpenRewrite refactors code without enforcing a rigid coding style. It allows developers to simultaneously automate code changes across an entire repository, facilitating framework migrations and efficiently patching vulnerabilities. Developers can cover a lot more code more quickly, Johnson said.

The tool employs a recipe-based approach for code transformation. The recipe-based system enables simple transformations to be composed into complex recipes for broader refactoring tasks. This allows developers to automate changes without learning a new programming language.

The OpenRewrite ecosystem currently provides more than 2400 recipes for transforming code.

“Through these programs, the ecosystem is able to offer simple code fixes to more complex code migrations, such as the Spring Boot 3.2 migration recipe, which automates more than 1700 steps,” Johnson told The New Stack. “This is only possible through community-driven recipes — it takes many contributions. No single company can accomplish this.”

OpenRewrite is gaining traction in the industry. Amazon Q uses OpenRewrite, and Jetbrains’ IntelliJ IDEA has recently integrated OpenRewrite.

But there is a difference between OpenRewrite and Moderne. While OpenRewrite speeds code refactoring on individual repositories, Moderne runs OpenRewrite recipes at mass scale — across thousands of repositories — and provides a solution for enterprise-wide code collaboration that reduces the time and resources required for code refactoring, insights and management, Johnson said.

Developer Welcome

“Java developers love to take advantage of newfound language capabilities. However, when you’re talking about maintaining a large code base with perhaps thousands of JVMs in production, bringing in new functionality can be both expensive and risky,” Shimmin told The New Stack. “Therefore, anything Broadcom can do to simplify and streamline the way Java developers bring in new Spring functionality will be most welcome among the development community.”

Overall, enterprises should prioritize upgrading to more recent Java versions and adopting tools to simplify that process, in order to improve application security, performance and development productivity.

“A struggle for developers, who are heads down delivering code, is to keep their tooling and frameworks up to speed,” said Holger Mueller, an analyst at Constellation Research. “Downtime to upgrade those is always a nuisance, so it is good for Broadcom to offer easier, faster automation to move from one Spring version to the next. It is also a good data point that Broadcom will keep investing in Spring. No surprise if we will have some end-of-life and support discussions here, but better to have a migration/upgrade tool than not.”