RESTHeart v9 Just Dropped and Spring Boot Developers Are Nervous

It’s funny how the AI has generated Spring Boot developers :)

Let’s be honest. You’re tired of it. Tired of spending three days just to set up a Spring Boot project that exposes a basic REST API over MongoDB. Tired of drowning in annotations, configuration files, and repository classes that do nothing but repeat what you already told the framework five times before. Tired of waiting for Quarkus to start up while pretending those three seconds are “blazingly fast.” Tired of Micronaut’s fifty-page documentation on how to inject a simple service.

The mainstream frameworks would have you believe that complexity equals sophistication, that more code means more control, and that spending weeks on architecture decisions is just “enterprise-grade development.” They’re wrong.

RESTHeart v9 is here, and it’s everything those bloated frameworks aren’t: instant, elegant, and unapologetically simple.

The Problem with “Modern” Frameworks

Spring, Quarkus, Micronaut — they all promise the same thing: modern Java development made easy. Then you actually use them. Suddenly you’re writing DTOs, entities, repositories, services, controllers, and configuration classes just to perform a simple CRUD operation. You’re managing dependency injection hierarchies, debugging cryptic annotation conflicts, and wondering why your “microservice” needs 512MB of RAM just to say “Hello World.”

These frameworks don’t make you productive. They make you busy. There’s a difference.

And don’t even get us started on performance. Your Quarkus app takes three seconds to start? Cute. Your Spring Boot application uses “only” 256MB of RAM? Adorable. Meanwhile, you’re writing hundreds of lines of code to do what RESTHeart does with a single JSON document.

RESTHeart v9: Zero Code, Zero Compromise

RESTHeart takes a radically different approach. Instead of forcing you to write code for every single endpoint, we built a backend that’s production-ready out of the box. Your MongoDB database becomes a complete REST API with GraphQL support, authentication, authorization, aggregation pipelines, and real-time data — all without writing a single line of Java.

With v9, we’ve doubled down on this philosophy while adding the features that actually matter.

**Java 25 LTS** powers the entire stack, giving you the latest JVM optimizations and virtual thread improvements that make your competitors’ “reactive” frameworks look quaint. We’re running on the cutting edge while they’re still backporting patches to Java 11.

**GraalVM Native Image support** means your RESTHeart backend starts in under 100 milliseconds and consumes just 64MB of RAM. Not “startup time optimized for cloud.” Not “memory footprint reduced through careful tuning.” Actual, real-world numbers that make Kubernetes operators cry tears of joy.

Our new **OAuth 2.0-compatible authentication endpoints** deliver an 85% performance improvement over the previous implementation. That’s not a typo. While Spring Security users are still reading documentation about filter chains, you’re already authenticated and making your actual business requests.

🚀 RESTHeart native starting in 115ms on my laptop:

❯ ./restheart
19:10:37.533 [main] INFO  ⚬ Starting RESTHeart instance default
19:10:37.533 [main] INFO  ⚬ Version 9.0.0
19:10:37.535 [main] INFO  ⚬ Logging to console with level INFO
19:10:37.599 [main] INFO  ┌── JWT CONFIGURATION
19:10:37.600 [main] INFO  │   No JWT key configured. Generated secure random key for this session.
19:10:37.600 [main] WARN  │   │  └─ IMPORTANT: In clustered deployments, all nodes must use the same JWT key!
19:10:37.600 [main] WARN  │   │  └─ Configure 'key' in jwtConfigProvider to ensure consistent token verification across nodes.
19:10:37.600 [main] INFO  │   Algorithm: HS256, Issuer: restheart.org, Audience: null
19:10:37.600 [main] INFO  └── JWT CONFIGURATION COMPLETED
19:10:37.600 [main] INFO  ⚬ Connecting to MongoDB...
19:10:37.611 [main] INFO  ⚬ MongoDB version 6.0.5
19:10:37.612 [main] INFO  ⚬ MongoDB is a replica set.
19:10:37.627 [main] INFO  ┌── MONGODB RESOURCE BINDING
19:10:37.627 [main] INFO  └── MONGODB RESOURCE BINDING COMPLETED in 0ms
19:10:37.628 [main] INFO  ┌── INTERCEPTORS
19:10:37.628 [main] INFO  │   Found 28 interceptors
19:10:37.628 [main] INFO  │   ├─ dbPropsInjector (DbPropsInjector) - Priority: -2147483648, Intercept Point: REQUEST_BEFORE_AUTH
19:10:37.628 [main] INFO  │   ├─ fileMediaTypeDetector (FileMediaTypeDetector) - Priority: -2147483648, Intercept Point: REQUEST_AFTER_AUTH
19:10:37.628 [main] INFO  │   ├─ userPwdStrengthEnforcer (UserPwdStrengthEnforcer) - Priority: -2147483648, Intercept Point: REQUEST_AFTER_AUTH
19:10:37.628 [main] INFO  │   ├─ collectionPropsInjector (CollectionPropsInjector) - Priority: -2147483647, Intercept Point: REQUEST_BEFORE_AUTH
19:10:37.628 [main] INFO  │   ├─ graphAppDefinitionEscaper (GraphAppDefinitionEscaper) - Priority: 10, Intercept Point: REQUEST_AFTER_AUTH
19:10:37.628 [main] INFO  │   ├─ graphAppDefinitionGetUnescaper (GraphAppDefinitionGetUnescaper) - Priority: 10, Intercept Point: RESPONSE
19:10:37.628 [main] INFO  │   ├─ graphAppDefinitionPatchChecker (GraphAppDefinitionPatchChecker) - Priority: 10, Intercept Point: RESPONSE
19:10:37.628 [main] INFO  │   ├─ graphAppDefinitionPutPostChecker (GraphAppDefinitionPutPostChecker) - Priority: 10, Intercept Point: REQUEST_AFTER_AUTH
19:10:37.628 [main] INFO  │   ├─ dateHeader (DateHeader) - Priority: 10, Intercept Point: REQUEST_AFTER_AUTH
19:10:37.628 [main] INFO  │   ├─ xPoweredBy (XPoweredBy) - Priority: 10, Intercept Point: REQUEST_AFTER_AUTH
19:10:37.628 [main] INFO  │   ├─ obsoleteChangeStreamRemover (ObsoleteChangeStreamRemover) - Priority: 10, Intercept Point: RESPONSE
19:10:37.628 [main] INFO  │   ├─ addRequestProperties (AddRequestProperties) - Priority: 10, Intercept Point: REQUEST_AFTER_AUTH
19:10:37.628 [main] INFO  │   ├─ checkContentSize (ContentSizeChecker) - Priority: 10, Intercept Point: REQUEST_BEFORE_AUTH
19:10:37.628 [main] INFO  │   ├─ jsonSchemaAfterWrite (JsonSchemaAfterWriteChecker) - Priority: 10, Intercept Point: RESPONSE
19:10:37.628 [main] INFO  │   ├─ namespacesResponseFlattener (NamespacesResponseFlattener) - Priority: 10, Intercept Point: RESPONSE
19:10:37.628 [main] INFO  │   ├─ mongoPermissionProjectResponse (ProjectResponse) - Priority: 10, Intercept Point: RESPONSE
19:10:37.628 [main] INFO  │   ├─ mongoPermissionFilters (RequestFilters) - Priority: 10, Intercept Point: REQUEST_AFTER_AUTH
19:10:37.628 [main] INFO  │   ├─ authCookieHandler (AuthCookieHandler) - Priority: 10, Intercept Point: REQUEST_BEFORE_AUTH
19:10:37.628 [main] INFO  │   ├─ authCookieSetter (AuthCookieSetter) - Priority: 10, Intercept Point: RESPONSE
19:10:37.628 [main] INFO  │   ├─ denyFilterOnUserPwd (DenyFilterOnUserPwd) - Priority: 10, Intercept Point: RESPONSE
19:10:37.628 [main] INFO  │   ├─ userPwdHasher (UserPwdHasher) - Priority: 10, Intercept Point: REQUEST_AFTER_AUTH
19:10:37.628 [main] INFO  │   ├─ userPwdRemover (UserPwdRemover) - Priority: 10, Intercept Point: RESPONSE
19:10:37.628 [main] INFO  │   ├─ formDataToBasicAuthInterceptor (FormDataToBasicAuthInterceptor) - Priority: 10, Intercept Point: REQUEST_BEFORE_EXCHANGE_INIT
19:10:37.629 [main] INFO  │   ├─ mongoPermissionMergeRequest (MergeRequest) - Priority: 11, Intercept Point: REQUEST_AFTER_AUTH
19:10:37.629 [main] INFO  │   ├─ rootRoleGuard (RootRoleGuard) - Priority: 11, Intercept Point: REQUEST_AFTER_AUTH
19:10:37.629 [main] INFO  │   ├─ halRepresentation (HALRepresentation) - Priority: 2147483647, Intercept Point: RESPONSE
19:10:37.629 [main] INFO  │   ├─ jsonSchemaBeforeWrite (JsonSchemaBeforeWriteChecker) - Priority: 2147483647, Intercept Point: REQUEST_AFTER_AUTH
19:10:37.629 [main] INFO  │   ├─ failedAuthMetricsCollector (FailedAuthMetricsCollector) - Priority: 2147483647, Intercept Point: REQUEST_AFTER_FAILED_AUTH
19:10:37.629 [main] INFO  └── INTERCEPTORS LOGGED
19:10:37.629 [main] INFO  ┌── BEFORE_STARTUP INITIALIZERS
19:10:37.629 [main] INFO  └── BEFORE_STARTUP COMPLETED in 0ms
19:10:37.629 [main] WARN  ⚬ HTTP listener bound to localhost:8080. Remote systems will be unable to connect to this server.
19:10:37.629 [main] INFO  ┌── SECURITY HANDLERS INITIALIZATION
19:10:37.629 [main] INFO  └── SECURITY HANDLERS INITIALIZED in 0ms
19:10:37.629 [main] INFO  ┌── SERVICE BINDING
19:10:37.629 [main] INFO  │   ├─ URI / bound to service mongo, secured: true, uri match PREFIX
19:10:37.629 [main] INFO  │   ├─ URI /graphql bound to service graphql, secured: true, uri match PREFIX
19:10:37.630 [main] INFO  │   ├─ URI /metrics bound to service metrics, secured: true, uri match PREFIX
19:10:37.630 [main] INFO  │   ├─ URI /ic bound to service cacheInvalidator, secured: false, uri match PREFIX
19:10:37.630 [main] INFO  │   ├─ URI /csv bound to service csvLoader, secured: true, uri match PREFIX
19:10:37.630 [main] INFO  │   ├─ URI /health/db bound to service database-probe, secured: false, uri match PREFIX
19:10:37.630 [main] INFO  │   ├─ URI /logout bound to service authCookieRemover, secured: false, uri match PREFIX
19:10:37.630 [main] INFO  │   ├─ URI /token bound to service authTokenService, secured: true, uri match PREFIX
19:10:37.630 [main] INFO  │   ├─ URI /roles bound to service roles, secured: true, uri match PREFIX
19:10:37.631 [main] INFO  │   ├─ URI /ping bound to service ping, secured: false, uri match PREFIX
19:10:37.631 [main] INFO  └── SERVICE BINDING COMPLETED in 2ms
19:10:37.631 [main] INFO  ┌── PROXY BINDING
19:10:37.631 [main] INFO  └── PROXY BINDING COMPLETED
19:10:37.631 [main] INFO  ┌── STATIC RESOURCE BINDING
19:10:37.631 [main] INFO  └── STATIC RESOURCE BINDING COMPLETED
19:10:37.631 [main] INFO  ⚬ Available processors: 8, IO threads (auto detected): 8, worker scheduler parallelism (auto detected): 12, worker scheduler max pool size: 256
19:10:37.638 [main] INFO  ⚬ Pid file /var/folders/yx/mgksqtzn41j41xdnv74snjpc0000gp/T/restheart-0.pid
19:10:37.638 [main] INFO  ┌── AFTER_STARTUP INITIALIZERS
19:10:37.647 [main] INFO  └── AFTER_STARTUP COMPLETED in 9ms
19:10:37.648 [main] INFO  ⚬ RESTHeart started

Security That Actually Makes Sense

Here’s a fun question: how do you prevent users from executing arbitrary JavaScript in your database queries? If you’re using Spring Data MongoDB, you probably just realized you don’t. You’re hoping nobody figured that out yet.

RESTHeart v9 includes **comprehensive aggregation pipeline security** with stage and operator blacklisting, cross-database validation, and JavaScript execution controls — all enabled by default. Your API is secure before you even think about it, not after you read a Medium post about the vulnerability you accidentally shipped.

The new **request body predicates** let you write authorization rules that inspect the actual content of requests, not just the URL and HTTP method. Want to restrict users to transactions under $1,000? It’s one line of configuration. In Spring, it’s a custom validator, a service method, an aspect, and three Stack Overflow tabs.

Observability Without the Overhead

Mainstream frameworks give you observability as an afterthought. You bolt on Micrometer, configure Prometheus endpoints, write custom metrics, and hope everything plays nicely together. It usually doesn’t.

RESTHeart v9 includes **custom metrics support** built directly into the plugin system. Register counters, gauges, histograms, and summaries with a simple API, and they automatically appear at your /metrics endpoint. No dependencies. No conflicts. No surprises.

The **enhanced logging system** provides tree-style visual grouping and tracing IDs across your entire request pipeline. When something goes wrong, you’ll know exactly what happened and where. Compare that to grepping through 10,000 lines of Spring Boot startup logs trying to figure out which auto-configuration failed this time.

Stop Writing Code, Start Shipping Features

The fundamental difference between RESTHeart and the mainstream frameworks is philosophical. Spring, Quarkus, and Micronaut are designed for developers who want to write code. RESTHeart is designed for developers who want to ship products.

When you need to customize behavior, RESTHeart’s plugin system gives you the power of Java with none of the ceremony. A single annotated class. No interface implementations, no framework-specific abstractions, no mandatory inheritance hierarchies. Your plugin gets full access to the request pipeline, the security system, and the database — with proper virtual thread support and native image compatibility guaranteed.

Meanwhile, your colleagues using Spring are still debating whether to use @Service or @Component and wondering why their integration tests take four minutes to run.

The Choice Is Yours

You can keep using frameworks that were designed in 2004 and retrofitted for 2025. You can keep writing boilerplate, debugging cryptic errors, and pretending that complexity is sophistication. You can keep telling yourself that “enterprise-grade” means spending three months on architecture before writing your first endpoint.

Or you can use RESTHeart v9 and realize that the future of backend development isn’t about writing more code. It’s about writing less.

Your MongoDB database is already there. Your data model is already defined. Your access patterns are already clear. Why are you rewriting all of that in Java?

**Download RESTHeart v9** and discover what happens when a framework actually respects your time.

While everyone else is still configuring their dependency injection, you’ll already be in production.

RESTHeart is available under the AGPL v3 license with commercial licenses available. Visit restheart.org for documentation, examples, and community support.