The Request Body Nobody Checked

Leave @Valid off the same parameter, and the exact same constraint annotations stop doing anything at all — the invalid data sails straight through to the method body.

java

@PostMapping("/rides")
ResponseEntity<String> createRide(@RequestBody RideRequest request) {
    return ResponseEntity.ok("created without validation: " + request);
}

text

POST /rides, body {"pickup":"","passengers":0}
-> 200 created without validation: RideRequest[pickup=, passengers=0]

run in a container — the same bad body, no @Valid, no rejection

The constraints on RideRequest haven't changed. What's missing is the one annotation that tells Spring to check them — and a record with @NotBlank on a field looks validated by itself, which is exactly what makes leaving @Valid off easy to miss in review.

Spring Boot
Input Validation