[mohaine]

I will admit that spring has gotten a lot better recently, but it is still a mess (IMHO of course) and this "benchmark" seems to agree.

The biggest issue I have with spring isn't performance but is the huge internal state that is the basis of Spring's DI.

After a few versions you end up with code that depends on bean named 'Abd" to preform a task, but in the next version is renamed to "Abc" which fixes the typo, but makes all the documentation off. And the 3 other classes that also needed that task still look for it under the name "Abd". And then the next major version replaces this entire module and the bean name is now "Xyz". To me this IS spring programming. Googling the DI names and trying them one by until you get the desired run time functionality.

I've had apps in production with unused beans defined (It only had 1 function that only throw an exception and was never called) but had to be defined or something would break. Multiple team members wasted some free time trying to locate the code that was requiring that bean but nobody could ever figure it out. At some point everybody gave up, it was easier to just let it be.

Most developers have little to no idea what is actually going on inside their spring apps (or even what half their dependencies are). When a struts like vulnerability comes along in the spring world it is going to be a massive PITA to fix. With how complex this all is I have little doubt that a vulnerability exist somewhere in there.

[jacques_chester]

The Struts vulnerability was less about Struts and more about the universal difficulty of dependency management.

Which Spring Boot ameliorates by providing starter POMs. Curated, levelled, updated collections of dependencies for common cases. No need to play whack-a-dep with Maven or Gradle. No need to track 50 different dependencies yourself.

The thing is: I don't care how Spring does the magic. I care that I don't have to care.

I came to Spring and Java-for-real development relatively late -- by fluke I was on what is almost certainly the first Boot production app ever deployed, back in early 2014.

Later I got a chance to see the primordial world of Spring 3. I understand the residual hate.