Java Development Company: Custom Java Software, Spring Boot Builds and JDK Upgrades

Updated October 2026 · Written and maintained by the Progression Agency strategy team

A Java development company designs, builds, upgrades and supports software that runs on the Java platform: web applications and APIs built with Spring Boot or Jakarta EE, back-office systems, integrations between business systems and the services behind mobile apps. This page is for owners, CTOs and IT leads who run Java software or are about to commission it, and it covers what the work includes, which Java and Spring versions are supported in October 2026, Oracle licensing, security patching, cost, timelines and how to choose a partner. Progression Agency is based in New York City and works with clients across the United States and worldwide.

What does a Java development company do?

It builds and looks after software written for the Java Virtual Machine. Most engagements fall into six kinds of work, and a good partner will tell you which one you are buying before it quotes.

Building a new application

New Java work in 2026 usually means a Spring Boot service or a Jakarta EE application on a long-term support JDK, a relational database, a browser front end and automated tests that run on every change. The interesting decisions are rarely the language. They are the data model, which systems the application must talk to, how it will be deployed and who will maintain it in year three.

Taking over a system someone else wrote

Many buyers already own a Java system and need a team to understand it, stabilize it and keep it running. The first weeks should go on reading: the build files, the dependency tree, the deployment scripts and the parts of the code that change most often. Nothing should be rewritten until the team can build, test and deploy the existing system reliably.

Keeping a production system current

Java runtimes and libraries receive security fixes on a published calendar, and frameworks retire old release lines on dates you can look up. Keeping a system current means planning upgrades before free support ends rather than after, and applying each security update within days rather than months.

Java software development services and what each one delivers

Seven services cover nearly every request. The table sets out what each produces, the Java tools usually involved and where to read more, because a buyer who names the right service gets a sharper proposal.

Custom Java software development for one company’s process

Custom software earns its cost when it runs a process that sets the business apart, such as how it prices, schedules or serves customers. Java suits that work when the system will live for many years, carry a lot of business rules and connect to several other systems, because long support windows and strong typing make that kind of code cheaper to change later. Our custom versus off-the-shelf guide covers the build-or-buy decision itself.

What a Java web application development company builds

Mostly the unglamorous systems that run a business: customer portals, order and inventory screens, approval workflows and reporting. Spring Boot’s web documentation describes self-contained HTTP servers using embedded Tomcat, Jetty or Netty, with most web applications built on Spring MVC and reactive ones on WebFlux. Pages can be rendered on the server with Thymeleaf, a server-side Java template engine, or served as an API to a separate front end built by our front-end team.

APIs and integrations between the systems you already run

A large share of Java work is plumbing between systems that were never designed to agree: an ERP that owns inventory, a CRM that owns customers, a payment provider and a warehouse partner. The work is defining which system owns each fact, building interfaces that retry safely and recording what moved. Our back-end development and ERP development pages go further into both sides.

What problems send buyers to a Java development company?

Usually one of four: a JDK or framework line that is past, or close to, the end of its free support, a license question after an Oracle notice, a security finding, or a system whose original developers have left. Each calls for a different first step.

The sections below take those problems in turn.

Which Java version should your production systems run?

A long-term support release. For new work in October 2026 that means Java 25; Java 21 is a sound choice for systems already on it; Java 17 still gets builds from several vendors, but its upgrade should be on the calendar; Java 8 and 11 need an exit plan.

Feature releases every six months, long-term support every two years

The OpenJDK JDK project ships a feature release every six months on a strict, time-based schedule. Oracle’s Java SE Support Roadmap names Java 8, 11, 17, 21 and 25 as long-term support releases and says Oracle intends a new one every two years, which puts the next at Java 29 in September 2027. Non-LTS releases are superseded as soon as the next feature release ships, so they suit teams that upgrade twice a year and few others.

What Java 21 and 25 changed for business applications

Three changes matter more than the rest. Virtual threads, final in Java 21 under JEP 444, make it practical to write simple blocking code that handles a very large number of concurrent requests. Records, sealed classes, record patterns and pattern matching for switch, all final by Java 21, let business rules be written as data and checked by the compiler. And Java 25 made scoped values final and turned compact object headers into a supported option, which shrinks the header on every object and with it the heap.

Should you adopt Java 27 now?

Only if the team will move again in six months. Java 27 reached general availability on September 15, 2026, with G1 as the default garbage collector in all environments and compact object headers on by default, but Oracle lists its Premier Support as ending in March 2027. Check your framework first: the Spring Boot 4.1.1 system requirements list compatibility up to and including Java 26.

Still running Java 8 or 11 in 2026

Plenty of companies do, and it is a cost decision rather than an emergency, provided the runtime is getting updates. Oracle lists Extended Support for Java 8 to December 2030 and Java 11 to January 2032 for paying customers, and Adoptium lists Temurin builds for Java 8 to at least December 2030 and Java 11 to at least October 2027. The bigger problem is usually the libraries: current Spring Boot needs Java 17, so an application on Java 8 is also stuck on framework versions that no longer receive free fixes.

Oracle JDK, OpenJDK and the license question

Running Java in production can cost nothing, but which build you run decides that. Oracle JDK 25 is currently free for all users under Oracle’s No-Fee Terms and Conditions; Oracle JDK 21 updates are planned to move to the more restrictive OTN license from the October 2026 update; and OpenJDK builds from Adoptium, Amazon and Microsoft are free with long-term updates.

What changes for Oracle JDK 21 in October 2026

Oracle’s Java SE Licensing FAQ says Oracle JDK 21 updates were planned under the No-Fee Terms until September 2026, a year after Java 25 shipped, and that later updates are planned under the OTN license used for Java 8, 11 and 17. Oracle’s Critical Patch Update page lists October 20, 2026 as the next update date. A company that keeps applying Oracle JDK 21 updates in production after that date needs a subscription, a move to Oracle JDK 25 or a switch to another vendor’s build of Java 21. This is a reading of Oracle’s published terms, not legal advice; your counsel decides how they apply.

Free OpenJDK builds with long-term updates

Several vendors build OpenJDK and keep long-term support releases patched at no charge. Adoptium’s Temurin support page commits to at least four years for each LTS release and lists commercial companies that sell support with service levels. Amazon Corretto describes a no-cost, production-ready distribution with quarterly updates, and the Microsoft Build of OpenJDK is a no-cost distribution that passes the Java compatibility test kit. Oracle’s own OpenJDK builds on jdk.java.net are free too, but each release is updated only for a short time.

Taking an inventory of every JDK you run

License exposure usually hides in places nobody checks. Before deciding anything, list every runtime and who installed it:

• Application servers and virtual machines, with the vendor and exact version of each JDK.
• Container base images, which often pin a JDK nobody chose on purpose.
• Build servers and CI runners, which may use a different JDK from production.
• Desktop tools and installed applications that bundle their own runtime.
• Vendor products that ship a JDK and may carry their own Java license terms.
• Runtime images built with jlink, which Oracle’s FAQ says the No-Fee Terms cover.

What to expect from a Java Spring Boot development company

A plan that starts from the Spring Boot line you are on and the date its free support ends. Spring Boot 4.1 is current, 4.0 gets open-source fixes until December 2026, and 3.5 and 2.7 now receive fixes only through paid commercial support.

The dates come from the support table on the Spring Boot project page, which is worth bookmarking: a new line arrives roughly every six months and each one gets about a year of open-source fixes. A Spring Boot application that is not upgraded at least once a year falls off free support.

Spring MVC or WebFlux?

Spring MVC for most business applications. It is the blocking, servlet-based model most Java developers know, and with virtual threads it handles high concurrency without the reactive style. WebFlux still makes sense for streaming and for services that are almost entirely calls to other services, but it asks more of every developer who touches the code afterward.

Virtual threads in Spring Boot applications

Spring Boot’s task execution reference explains that with Java 21 or later and the property spring.threads.virtual.enabled set to true, its auto-configured executor uses virtual threads. Java 24 removed nearly all cases of virtual threads being pinned when they block inside synchronized code, under JEP 491, which is one more reason to run Java 25 rather than 21 if you plan to rely on them.

Native images with GraalVM

A GraalVM native image compiles a Java application ahead of time into a standalone executable that starts in milliseconds and, according to GraalVM, uses a fraction of the resources a Java Virtual Machine requires. The trade is that reflection and other dynamic features must be declared to the build tool in advance. Spring Boot 4 requires GraalVM 25 or later for native images. It suits command-line tools and functions that start and stop often more than long-running services.

Upgrading Spring Boot 2.7 and 3.x applications

One line at a time, on a branch that keeps passing its tests. The official guides set the order: latest 2.7, then Java 17 and Spring Boot 3 with the jakarta rename, then the latest 3.5, then Spring Boot 4.

The javax to jakarta rename

Java EE moved from the Java Community Process to the Eclipse Foundation, where it became Jakarta EE. The Jakarta EE Platform 9 specification describes Jakarta EE 9 as functionally similar to Jakarta EE 8 but in the new jakarta namespace, and as removing a small set of old, optional or deprecated specifications. The Spring Boot 3.0 migration guide requires Java 17, moves to the Jakarta EE 10 versions of each specification and warns that older javax dependencies must not remain anywhere in the build, directly or transitively. Every import, every XML descriptor and every library that still uses javax has to move together.

What else changes in Spring Boot 4

The Spring Boot 4.0 migration guide lists a Jakarta EE 11 and Servlet 6.1 baseline, Spring Framework 7, Kotlin 2.2 or later for Kotlin code, and GraalVM 25 or later for native images. Undertow support is gone because it is not yet compatible with Servlet 6.1, the launch scripts for fully executable jars were removed, and anything deprecated in 3.x has been deleted.

Tools that do the mechanical edits

Much of an upgrade is repetitive renaming, and tools do it better than people. OpenRewrite is an open-source automated refactoring engine with recipes for common framework migrations, and Spring’s 3.0 guide lists it among the migration aids. Spring Boot also ships a properties migrator that reports renamed configuration keys at startup; it should be removed once the move is finished.

1. Freeze features on the branch being upgraded, or keep the upgrade branch short-lived.
2. Raise test coverage around the code that talks to databases, queues and external APIs.
3. Run the automated recipes, then review every change they made in small commits.
4. Fix what the compiler and the tests find, one module at a time.
5. Deploy to a staging environment that mirrors production, including the JDK vendor.
6. Release behind a rollback plan and watch error rates and response times for a week.

Jakarta EE, Quarkus and Micronaut: Java beyond Spring

Spring Boot is not the only choice. Jakarta EE application servers implement a set of published specifications, and Quarkus and Micronaut target container-first services with fast startup.

Jakarta EE 11 and what comes next

The Jakarta EE Platform 11 specification passed its release review ballot in June 2025. It requires Java SE 17 or higher, adds runtime-aware support for virtual threads and introduces Jakarta Data 1.0. Jakarta EE 12 is under development with a planned minimum of Java SE 21. Teams on an application server should follow their server vendor’s support dates as closely as they follow the JDK’s.

Quarkus and Micronaut for container-first services

Quarkus describes itself as a Java framework for fast, efficient, cloud-native applications that runs on the JVM or as a native executable and integrates with the Jakarta and MicroProfile standards. Micronaut is a JVM-based framework built on compile-time dependency injection with GraalVM native image support. Both are sound choices for small services; choose the one your team can maintain for years.

Kotlin on the server

Kotlin runs on the same JVM, calls Java libraries directly and is supported by Spring Boot. Mixing the two in one codebase works, but a company should choose deliberately, because every developer it hires later will need to read both.

Modernizing a legacy Java application without a rewrite

Upgrade in place first, then restructure only the parts that hold the business back. Rewrites are the most expensive and riskiest path and are rarely the first one to try.

Start with what the JDK’s own tools can tell you

The JDK ships analysis tools that cost nothing to run. jdeps is the class dependency analyzer, useful for finding code that leans on JDK internals, and jdeprscan scans jar files for uses of deprecated APIs. Run both against the current build before estimating an upgrade; their output turns a guess into a list.

Warnings newer JDKs print, and what they mean

Recent releases tighten the platform step by step. The memory-access methods in sun.misc.Unsafe were deprecated for removal in Java 23 and print a warning at run time from Java 24. Java 26 removed the Applet API and began warning when code uses deep reflection to change final fields. Java 18 made UTF-8 the default character set under JEP 400, which can change the output of older code that relied on the operating system’s default. Each warning is a line item in the upgrade plan, not noise to suppress.

Monolith, modules or services?

Most Java applications that feel slow to change need clearer internal boundaries, not a network between their parts. Our monolith versus microservices comparison covers the trade-offs, and cloud migration covers moving the result onto managed infrastructure.

When a rewrite is the honest answer

When the application depends on a framework or server that has no supported version, when nobody can build it from source, or when the business process it encodes has changed so much that most of the code is dead. Even then, run the old and new systems side by side and move users in stages.

Security and patching for Java systems

Patch on the published calendar and know what is inside every build. Oracle lists its next security update dates in advance, and flaws turn up in libraries as well as in the JDK itself, so both need a patch routine.

The Java security update calendar

Oracle releases Critical Patch Updates on the third Tuesday of January, April, July and October and publishes a pre-release announcement on the Thursday before. OpenJDK update releases follow the same quarterly rhythm, and Adoptium says Temurin binaries for the most popular platforms typically appear within a few days of those dates, with the full set taking up to three weeks. Since May 2026 Oracle has also released smaller Critical Security Patch Updates on the third Tuesday of the other eight months, and OpenJDK can produce a security release between quarters, which Adoptium builds typically on the third Tuesday of a month with no other release. A patch process that needs a month to roll out leaves production a month behind after every update.

What Log4Shell showed about dependencies

The NVD record for CVE-2021-44228 describes a flaw in Apache Log4j2 versions 2.0-beta9 through 2.15.0, apart from certain security releases, that, in vulnerable configurations, let an attacker who controlled log messages run code loaded from LDAP servers. It carries a CVSS 3.1 base score of 10.0, the maximum. The lesson for owners was that nobody could answer a simple question quickly: which of our systems include this library, directly or through something else?

Bills of materials and dependency scanning

A software bill of materials lists every component inside a build so that question has an answer in minutes. CycloneDX, an OWASP standard also published as ECMA-424, is a common format, and Maven and Gradle builds can produce one on every release. OWASP Dependency-Check is a software composition analysis tool that matches dependencies against publicly disclosed vulnerabilities. Run both in the pipeline, not once a year.

Application security practice

Framework defaults protect against many common mistakes, but only if they stay switched on. Automated tests on every change, code review before merge and guidance such as the OWASP Top 10 and the NIST Cybersecurity Framework are the baseline our software development work follows, and our website security page covers the public-facing side.

Java on Android and behind mobile apps

Java still runs on the server side of a great many mobile products, while new Android client code is mostly written in Kotlin. Know which half of the mobile product you are hiring for.

What Java app development companies build for mobile now

On the phone, less than they used to. Google’s Kotlin-first page says Android development became increasingly Kotlin-first after Google I/O 2019 and recommends starting new Android apps in Kotlin. Existing Android apps written in Java keep working, and Kotlin calls Java code directly, so a mixed codebase is common. Our Android app development page covers the client side in depth.

Back ends for iOS and Android apps

The account system, the data, the notifications and the admin screens behind a mobile app are where Java earns its place. A Spring Boot back end can serve an iOS app, an Android app and a web dashboard from one data model. Our app development agency page explains how the mobile and server work are planned together, and cross-platform app development covers sharing client code between platforms.

How to compare Java development companies by location

Compare total cost, not the hourly rate: the hours you will spend managing, the overlap with your working day and the law your contract runs under. Our app development outsourcing guide puts typical market rates from $20 to $60 an hour offshore to $100 to $250 an hour for an onshore US agency.

Java development companies in the USA

A US team shares your working day, your language and your legal system, and that is what the higher rate buys. When we work with a client’s own team, our developers keep US working hours, sign confidentiality agreements before onboarding and assign all work to the client in writing. The New York app and software development page covers in-person workshops for clients near us.

Hiring a Java software development company in India

The appeal is the rate; the constraint is time. India keeps one time zone all year, five and a half hours ahead of UTC, so the gap to New York is nine and a half hours in US summer time and ten and a half in winter, and more to the West Coast. That suits work that can be specified a day ahead and reviewed the next morning. It suits urgent production support and fast-changing requirements less well. Put IP assignment, governing law and the hours of overlap in the contract, and keep repositories and cloud accounts in your company’s name.

Nearshore teams in between

Teams in Latin America sit closer to US hours at mid-range rates. Our app development outsourcing guide compares the three models in more detail, including what each costs you in management time.

How much does custom Java software development cost?

It depends on what is being built, not on the language. As published planning ranges, an integration runs $15,000 to $50,000, an internal tool $25,000 to $75,000, a client portal or business platform $75,000 to $250,000, and an enterprise system or modernization $250,000 and up.

What moves a Java estimate up or down

The number of systems the software must integrate with, the state of the existing code and its tests, the distance between the current JDK and framework versions and supported ones, compliance requirements such as audit trails, and how quickly the client’s team can answer questions. The ranges come from our software development and dedicated developer pages, and the same figures apply to clients across the United States and worldwide.

Project fee or monthly team?

A project fee suits work with a clear end, such as an integration or an upgrade from one named version to another. A monthly team suits a system that will keep changing. A sensible pattern is to scope the project, then keep one or two developers on monthly terms for patching and small changes. Our app development cost guide covers the wider market.

How long does a Java project take, and what should you measure?

From four weeks for a single integration to a year or more for an enterprise modernization, using the timelines in the table above. Whatever the length, you should see working software every two weeks and a fixed set of measures every month.

Delivery measures worth tracking

The DORA metrics guide defines five software delivery measures: change lead time, deployment frequency, failed deployment recovery time, change fail rate and deployment rework rate. They suit Java teams well because they measure the pipeline rather than the people, and they show quickly whether an upgrade has made releases harder.

Measures that belong to the business

Orders processed without manual re-keying, hours saved per week, errors avoided, customers served through a portal instead of by phone. Agree one or two before the work starts so the project is judged by what it was for.

How to choose a Java software development company

Choose the partner that can explain your runtime, framework and upgrade path in plain terms and puts ownership in writing. Polish in the pitch matters less than clarity about the versions you will run and who owns what.

Questions to ask a Java application development company

Short, specific questions separate experience from sales material quickly. Our general guide to software consulting covers the earlier step of deciding what to build.

• Which JDK distribution and version would you run, and why that one?
• What happens to our Oracle JDK licenses after the October 2026 update?
• How would you test our database access during a Spring Boot upgrade?
• How many days after a Java security update would production be patched?
• What would another team receive from you if we parted ways?
• Who owns the repositories, the cloud accounts and the code you write?
• How do you report progress, and how often will we see working software?

Red flags in a Java proposal

Most weak proposals show themselves in the first few pages.

• A plan to rewrite before anyone has built and run the existing system.
• No mention of which JDK vendor or version the system will run.
• A fixed price for an upgrade whose dependency tree nobody has examined.
• Repositories or cloud accounts set up in the vendor’s name.
• No automated tests in the plan, or tests promised for the end.
• Reports that count hours or tickets but never releases or fixes.

Hire dedicated developers or commission a Java project?

Commission a project when the outcome can be written down; hire dedicated developers when you need capacity on a system that keeps changing. The two are often combined.

When a dedicated developer fits

When your own team owns the roadmap and needs more hands or a skill it lacks. Our dedicated developers work only on your product, in your repositories and tools, during your working hours, on monthly engagements with one month’s notice. Your team interviews them first, and a two-week paid trial guards against a poor fit.

When a fixed-scope project fits

When the work has an end: an integration, a portal, an upgrade from one named version to another. A written scope and estimate come before development, and the project is delivered in two-week sprints that each produce working software. Our MVP development page covers first releases of new products.

How Progression Agency runs software projects

The same way we run every software project: discovery that maps the real process, architecture decided early and written down, two-week sprints, testing on every change and a defined support plan after launch.

• Discovery interviews with the people who do the work, ending in a written scope with priorities.
• Mainstream, well-supported technologies, so you can hire for them later.
• Every architectural decision documented, so the system stays maintainable.
• Two-week sprints that each produce working software, with a short written update.
• Automated tests on every change and code review before anything merges.
• Hosting in your own cloud account; code, data and accounts owned by you from day one.
• IP assigned to you in the contract.
• A defined support plan with response times, and documentation and access so another team can continue.

One team across the stack

Java services rarely stand alone. The same team can build the web front end, the mobile app and the integrations, so they share one data model. Our web development services and software development life cycle pages describe how that work is organized.

Where we are

We are based in New York City and work with companies across the United States and worldwide. Dedicated developers work in your repositories and tools during US working hours, and New York clients who prefer in-person workshops can have them.

AI answers: how buyers ask assistants about Java vendors

Buyers ask assistants for a shortlist that fits a stack, a problem and a place. No one can promise a placement, but a vendor whose own pages state versions, methods and prices plainly gives a reader, or an assistant, specific facts to quote.

Typical questions put to ChatGPT, Claude and Perplexity

A shortlist: Java development companies in the US that handle Spring Boot upgrades. A problem: how to move off Oracle JDK 21 before the license change. A comparison: an onshore Java team or an offshore one for a ten-year-old system. A check: whether a named vendor has done a javax to jakarta migration. Gemini, Microsoft Copilot and Google’s AI Overviews field the same kinds of question.

Where the technical facts live

Technical facts such as support dates, license terms and framework requirements live in primary documentation: Oracle’s roadmap, the OpenJDK pages and Spring’s guides. A vendor page that restates those facts accurately and adds its own method and prices gives a reader, or an assistant, something specific to quote, which a page that only lists technology logos does not.

What a Java vendor should publish to be named

The six cards above, written as text rather than images: versions, upgrade method, licensing, patching, pricing and ownership. Our AEO for software companies and how to get cited by AI pages set out the method, and LLM visibility explains how to check what assistants say today.

Related services for Java projects

Pages a CTO or IT lead usually reads alongside this one.

• Software development company: custom software from discovery through support
• App development agency: iOS, Android and the back ends behind them
• Web development services: sites and web applications built to last
• Hire dedicated developers: engineers who join your team monthly
• Web app development company: portals, dashboards and SaaS products
• API development: interfaces between your systems and partners
• Backend development services: servers, data and integrations
• Python development company: data, automation and machine learning work
• .NET development services: for Microsoft environments
• Ruby on Rails development company: for Rails products
• Enterprise app development: large internal systems
• Cloud migration services: moving applications onto managed infrastructure
• DevOps services: pipelines, containers and infrastructure as code
• Tech stack guide: choosing languages and frameworks

Frequently asked questions