From 9db0285e52ab25a82353e8149ecf79fa3c4ff816 Mon Sep 17 00:00:00 2001 From: Alexander Zakharov Date: Mon, 20 Jul 2026 09:23:07 +0200 Subject: [PATCH 1/2] feat: ETU-73914 upgrade to Spring Boot 4.1 --- build.gradle | 2 +- .../ReactiveResourceServerAutoConfiguration.java | 16 ++++++++++++++++ 2 files changed, 17 insertions(+), 1 deletion(-) diff --git a/build.gradle b/build.gradle index 216734d..20cc8e5 100644 --- a/build.gradle +++ b/build.gradle @@ -13,7 +13,7 @@ plugins { id 'com.github.ben-manes.versions' version '0.53.0' apply false id "com.github.spotbugs" version "6.4.5" apply false id 'com.diffplug.spotless' version "8.0.0" apply false - id 'org.springframework.boot' version "4.0.6" apply false + id 'org.springframework.boot' version "4.1.0" apply false } subprojects { diff --git a/oidc-rs-spring-boot-webflux/src/main/java/org/entur/auth/spring/webflux/ReactiveResourceServerAutoConfiguration.java b/oidc-rs-spring-boot-webflux/src/main/java/org/entur/auth/spring/webflux/ReactiveResourceServerAutoConfiguration.java index f623e57..42c56f7 100644 --- a/oidc-rs-spring-boot-webflux/src/main/java/org/entur/auth/spring/webflux/ReactiveResourceServerAutoConfiguration.java +++ b/oidc-rs-spring-boot-webflux/src/main/java/org/entur/auth/spring/webflux/ReactiveResourceServerAutoConfiguration.java @@ -11,6 +11,7 @@ import org.springframework.security.config.annotation.method.configuration.EnableReactiveMethodSecurity; import org.springframework.security.config.web.server.SecurityWebFiltersOrder; import org.springframework.security.config.web.server.ServerHttpSecurity; +import org.springframework.security.web.SecurityFilterChain; import org.springframework.security.web.server.SecurityWebFilterChain; /** @@ -58,4 +59,19 @@ public SecurityWebFilterChain filterChain() throws ReactiveResourceServerConfigu throw new ReactiveResourceServerConfigurationException(e); } } + + /** + * Workaround for + * spring-boot#50778: in a pure WebFlux application, {@code @ConditionalOnDefaultWebSecurity} + * always evaluates to true because it checks for a servlet {@link SecurityFilterChain} bean, + * which never exists in a reactive context. This causes Spring Boot to create its own {@code + * reactiveJwtSecurityFilterChain} alongside ours, leading to a duplicate {@code anyExchange()} + * registration. Registering this sentinel bean makes the condition false, preventing Spring + * Boot's chain from being created. + */ + @Bean + @ConditionalOnMissingBean(SecurityFilterChain.class) + public SecurityFilterChain sentinelServletSecurityFilterChain() { + return null; + } } From 9dcec50ab27dda4d6496d101e8f041fae68e2e9b Mon Sep 17 00:00:00 2001 From: Alexander Zakharov Date: Mon, 20 Jul 2026 09:27:14 +0200 Subject: [PATCH 2/2] chore: ETU-73914 upgrade dependencies --- build.gradle | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/build.gradle b/build.gradle index 20cc8e5..23a9c81 100644 --- a/build.gradle +++ b/build.gradle @@ -18,16 +18,16 @@ plugins { subprojects { ext { - javaJwtVersion = '4.5.0' + javaJwtVersion = '4.6.0' jjwtVersion = '0.13.0' - apacheCommonsVersion = '2.21.0' - slf4jVersion = '2.0.17' + apacheCommonsVersion = '2.22.0' + slf4jVersion = '2.0.18' junitPlatformVersion = '1.12.2' - junitJupiterVersion = '6.0.1' + junitJupiterVersion = '6.1.2' wiremockVersion = '3.13.2' - lombokVersion = '1.18.42' + lombokVersion = '1.18.46' } }