build(spring-boot): upgrade to Spring Boot 4.0.6 / Spring Security 7.0.5

Spring Boot 4 standardized on Jackson 3 (tools.jackson.*) — the same namespace
pk-auth-core uses (ADR 0009) — so the Jackson 2 bridge module is gone. The
core's PkAuthObjectMappers.pkAuthModule() is now registered directly as a
Spring bean, and Spring picks it up automatically.

- gradle/libs.versions.toml: spring-boot 4.0.6, spring-security 7.0.5; add
  spring-boot-webmvc-test for the AutoConfigureMockMvc artifact carved out of
  spring-boot-test-autoconfigure in Spring Boot 4.
- pk-auth-core: make PkAuthObjectMappers.pkAuthModule() public so adapter
  modules can register it on host-framework ObjectMappers.
- pk-auth-spring-boot-starter: delete PkAuthJacksonModule (Jackson 2 bridge);
  PkAuthWebAutoConfiguration registers the core's module directly. Tests
  migrated to tools.jackson.databind.ObjectMapper.
- examples/spring-boot-demo: AutoConfigureMockMvc import moved to
  org.springframework.boot.webmvc.test.autoconfigure.
- .github/dependabot.yml: drop the Spring Boot 4 / Spring Security 7 ignore
  rules now that the upgrade has landed.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: wolpert

.github/dependabot.yml

@@ -24,15 +24,6 @@ updates:
       # the implementation artifact id, so this is the right Dependabot dependency-name.
       - dependency-name: "com.diffplug.spotless:com.diffplug.spotless.gradle.plugin"
         versions: [">=8"]
-      # Spring Boot 4.x dropped Jackson 2 in favor of Jackson 3 (`tools.jackson.*`). Our Phase 8
-      # adapter's `PkAuthJacksonModule` bridges Jackson 2 ↔ pk-auth's Jackson 3 wire types;
-      # moving to Spring Boot 4 requires rewriting that bridge. Brief §6.10 also pins 3.5.x.
-      - dependency-name: "org.springframework.boot:*"
-        update-types: ["version-update:semver-major"]
-      # Spring Security 7 is tied to Spring Framework 7 / Spring Boot 4. Stay on the 6.x line
-      # until the Spring Boot 4 migration is planned.
-      - dependency-name: "org.springframework.security:*"
-        update-types: ["version-update:semver-major"]
       # Dropwizard 5 changes the bundle and configuration surface in ways the Phase 9 adapter
       # doesn't yet accommodate. Brief §6.11 also pins 4.x.
       - dependency-name: "io.dropwizard:*"

examples/spring-boot-demo/build.gradle.kts

@@ -34,6 +34,7 @@ dependencies {
 
     testImplementation(project(":pk-auth-testkit"))
     testImplementation(libs.spring.boot.starter.test)
+    testImplementation(libs.spring.boot.webmvc.test)
     testImplementation(libs.spring.security.test)
 }
 

examples/spring-boot-demo/src/test/java/com/codeheadsystems/pkauth/examples/spring/SpringBootDemoApplicationTest.java

@@ -9,8 +9,8 @@
 
 import org.junit.jupiter.api.Test;
 import org.springframework.beans.factory.annotation.Autowired;
-import org.springframework.boot.test.autoconfigure.web.servlet.AutoConfigureMockMvc;
 import org.springframework.boot.test.context.SpringBootTest;
+import org.springframework.boot.webmvc.test.autoconfigure.AutoConfigureMockMvc;
 import org.springframework.http.MediaType;
 import org.springframework.test.web.servlet.MockMvc;
 

gradle/libs.versions.toml

@@ -39,13 +39,13 @@ hikaricp = "7.0.2"
 aws-sdk = "2.44.6"
 testcontainers = "1.21.4"
 
-# Spring Boot adapter (Phase 8). Brief §6.10 mandates Spring Boot 3.5.x / Spring Security 6.5.x.
-# Spring Boot 4.0 dropped Jackson 2 in favor of Jackson 3 (`tools.jackson.*`), which breaks our
-# Phase 8 Jackson 2 bridge (`PkAuthJacksonModule`). Stay on 3.5.x until we revisit the
-# Jackson-bridge strategy in a future phase. Dependabot ignore in .github/dependabot.yml keeps
-# this from getting bumped back automatically.
-spring-boot = "3.5.5"
-spring-security = "6.5.3"
+# Spring Boot adapter (Phase 8). Spring Boot 4 / Spring Security 7. Spring Boot 4 standardized
+# on Jackson 3 (`tools.jackson.*`), the same namespace pk-auth-core uses (ADR 0009) — so the
+# previous Jackson 2 bridge module is gone, replaced by direct registration of the core's
+# `PkAuthObjectMappers.pkAuthModule()` as a Spring bean. Brief §6.10 originally specified
+# 3.5.x / 6.5.x; the upgrade landed as a deliberate framework refresh.
+spring-boot = "4.0.6"
+spring-security = "7.0.5"
 # H2 in the demo so reviewers can run the spring-boot-demo without an external Postgres.
 # Confined to the demo's runtime; the starter does not pull it in.
 h2 = "2.4.240"
@@ -143,6 +143,9 @@ spring-boot-starter = { module = "org.springframework.boot:spring-boot-starter",
 spring-boot-starter-web = { module = "org.springframework.boot:spring-boot-starter-web", version.ref = "spring-boot" }
 spring-boot-starter-security = { module = "org.springframework.boot:spring-boot-starter-security", version.ref = "spring-boot" }
 spring-boot-starter-test = { module = "org.springframework.boot:spring-boot-starter-test", version.ref = "spring-boot" }
+# Spring Boot 4 carved AutoConfigureMockMvc / the MockMvc test slice out of
+# spring-boot-test-autoconfigure into a dedicated spring-boot-webmvc-test artifact.
+spring-boot-webmvc-test = { module = "org.springframework.boot:spring-boot-webmvc-test", version.ref = "spring-boot" }
 spring-boot-configuration-processor = { module = "org.springframework.boot:spring-boot-configuration-processor", version.ref = "spring-boot" }
 spring-security-test = { module = "org.springframework.security:spring-security-test", version.ref = "spring-security" }
 h2 = { module = "com.h2database:h2", version.ref = "h2" }

pk-auth-core/src/main/java/com/codeheadsystems/pkauth/json/PkAuthObjectMappers.java

@@ -53,8 +53,13 @@ public static JsonMapper.Builder builder() {
             value -> value.withValueInclusion(JsonInclude.Include.NON_NULL));
   }
 
-  /** Module registering byte[] / UserHandle / ChallengeId (de)serializers. */
-  static SimpleModule pkAuthModule() {
+  /**
+   * Returns a fresh {@link SimpleModule} registering the byte[] / {@link UserHandle} / {@link
+   * ChallengeId} (de)serializers used by pk-auth's wire contract. Adapter modules that drive a
+   * host-framework {@link ObjectMapper} (Spring Boot 4 / Micronaut on Jackson 3, etc.) register
+   * this module so their mapper produces the same wire shape the core's mapper does.
+   */
+  public static SimpleModule pkAuthModule() {
     SimpleModule module = new SimpleModule("pk-auth");
     module.addSerializer(byte[].class, new Base64UrlBytesSerializer());
     module.addDeserializer(byte[].class, new Base64UrlBytesDeserializer());

pk-auth-spring-boot-starter/build.gradle.kts

@@ -65,6 +65,7 @@ dependencies {
     testImplementation(project(":pk-auth-persistence-jdbi"))
     testImplementation(project(":pk-auth-persistence-dynamodb"))
     testImplementation(libs.spring.boot.starter.test)
+    testImplementation(libs.spring.boot.webmvc.test)
     testImplementation(libs.spring.security.test)
     testImplementation(libs.h2)
     testRuntimeOnly(libs.logback.classic)

pk-auth-spring-boot-starter/src/main/java/com/codeheadsystems/pkauth/spring/autoconfigure/PkAuthWebAutoConfiguration.java

@@ -2,13 +2,13 @@
 package com.codeheadsystems.pkauth.spring.autoconfigure;
 
 import com.codeheadsystems.pkauth.ceremony.PasskeyAuthenticationService;
+import com.codeheadsystems.pkauth.json.PkAuthObjectMappers;
 import com.codeheadsystems.pkauth.jwt.PkAuthJwtIssuer;
 import com.codeheadsystems.pkauth.jwt.PkAuthJwtValidator;
 import com.codeheadsystems.pkauth.spi.CredentialRepository;
 import com.codeheadsystems.pkauth.spring.security.PkAuthAuthenticationProvider;
 import com.codeheadsystems.pkauth.spring.security.PkAuthJwtAuthenticationFilter;
 import com.codeheadsystems.pkauth.spring.web.PkAuthCeremonyController;
-import com.codeheadsystems.pkauth.spring.web.PkAuthJacksonModule;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 import org.springframework.boot.autoconfigure.AutoConfiguration;
@@ -24,6 +24,7 @@
 import org.springframework.security.web.SecurityFilterChain;
 import org.springframework.security.web.authentication.HttpStatusEntryPoint;
 import org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter;
+import tools.jackson.databind.module.SimpleModule;
 
 /**
  * Wires the HTTP-facing portion of the starter: the ceremony controller, the JWT validation filter,
@@ -50,14 +51,16 @@ public class PkAuthWebAutoConfiguration {
   private static final Logger LOG = LoggerFactory.getLogger(PkAuthWebAutoConfiguration.class);
 
   /**
-   * Register the pk-auth Jackson 2 module on every Spring Jackson {@code ObjectMapper} so the
-   * starter's controllers produce the same base64url-no-padding wire format the testkit and
-   * Jackson-3 core mapper use. Spring's autoconfigured {@code ObjectMapper} picks up every {@link
-   * com.fasterxml.jackson.databind.Module} bean automatically.
+   * Register the pk-auth Jackson 3 module on Spring's autoconfigured {@code ObjectMapper}. Spring
+   * Boot 4 standardized on Jackson 3 ({@code tools.jackson.*}), the same namespace pk-auth-core's
+   * ObjectMapper uses (ADR 0009); the core's {@link PkAuthObjectMappers#pkAuthModule()} supplies
+   * the byte[] / UserHandle / ChallengeId (de)serializers, so Spring's mapper produces the same
+   * base64url-no-padding wire format the testkit and core mapper use. Spring picks up every {@code
+   * tools.jackson.databind.module.JacksonModule} bean automatically.
    */
   @Bean
-  public PkAuthJacksonModule pkAuthJacksonModule() {
-    return new PkAuthJacksonModule();
+  public SimpleModule pkAuthJacksonModule() {
+    return PkAuthObjectMappers.pkAuthModule();
   }
 
   @Bean

pk-auth-spring-boot-starter/src/main/java/com/codeheadsystems/pkauth/spring/web/PkAuthJacksonModule.java

@@ -20,7 +20,6 @@
 import com.codeheadsystems.pkauth.config.RelyingPartyConfig;
 import com.codeheadsystems.pkauth.spi.UserLookup;
 import com.codeheadsystems.pkauth.testkit.FakeAuthenticator;
-import com.fasterxml.jackson.databind.ObjectMapper;
 import com.webauthn4j.converter.util.ObjectConverter;
 import org.junit.jupiter.api.BeforeEach;
 import org.junit.jupiter.api.Test;
@@ -32,6 +31,7 @@
 import org.springframework.test.web.servlet.MvcResult;
 import org.springframework.test.web.servlet.setup.MockMvcBuilders;
 import org.springframework.web.context.WebApplicationContext;
+import tools.jackson.databind.ObjectMapper;
 
 /** Exercises a couple of admin endpoints behind the JWT filter using a real JWT. */
 @SpringBootTest(classes = PkAuthTestApplication.class)

pk-auth-spring-boot-starter/src/test/java/com/codeheadsystems/pkauth/spring/PkAuthAdminIntegrationTest.java

@@ -20,7 +20,6 @@
 import com.codeheadsystems.pkauth.jwt.PkAuthJwtValidator;
 import com.codeheadsystems.pkauth.spi.UserLookup;
 import com.codeheadsystems.pkauth.testkit.FakeAuthenticator;
-import com.fasterxml.jackson.databind.ObjectMapper;
 import com.webauthn4j.converter.util.ObjectConverter;
 import org.junit.jupiter.api.BeforeEach;
 import org.junit.jupiter.api.Test;
@@ -31,6 +30,7 @@
 import org.springframework.test.web.servlet.MvcResult;
 import org.springframework.test.web.servlet.setup.MockMvcBuilders;
 import org.springframework.web.context.WebApplicationContext;
+import tools.jackson.databind.ObjectMapper;
 
 /**
  * End-to-end ceremony test: register a passkey via {@code /auth/passkeys/registration/*}, assert