Architect: migrating Spring Boot from Thymeleaf to JTE catches errors at build time

The piece frames the choice as a design change rather than a syntax swap. Thymeleaf has long been the de facto only option for Spring Boot apps with screens, and it binds controllers to templates by name, leaving the controller-to-template boundary to be protected separately. JTE shifts templates under Java's type checking and compiler, which the architect says makes the scope of a change mechanically visible. To hold that boundary, the recommended pattern is one ViewModel record per screen passed as a single Model attribute, plus rendering tests over the main screens.

A notable caveat is that JTE itself has had security issues: an XSS caused by a JavaScript template string inside script (CVE-2025-23026) was reported and fixed in 3.1.16, and the architect says dependency updates are needed for any engine. On speed, the architect advises measuring in your own environment first, since Thymeleaf also caches templates in production and the dominant bottleneck in business apps is normally the database and external integrations.

The migration guidance is staged: shared layouts, then parts, then leaf screens, comparing normalized HTML before and after for regressions, with all-template precompilation required in CI. JTE's type safety does not extend to display specs, authorization, or security correctness, and the architect says the size of the AI-related benefit depends on the existing tests and CI setup.