ETU-73914: Upgrade to Spring Boot 4.1

build.gradle

@@ -13,21 +13,21 @@ plugins {
     id 'com.github.ben-manes.versions' version '0.53.0' apply false
     id "com.github.spotbugs" version "6.4.5" apply false
     id 'com.diffplug.spotless' version "8.0.0" apply false
-    id 'org.springframework.boot' version "4.0.6" apply false
+    id 'org.springframework.boot' version "4.1.0" apply false
 }
 
 subprojects {
     ext {
-        javaJwtVersion = '4.5.0'
+        javaJwtVersion = '4.6.0'
         jjwtVersion = '0.13.0'
-        apacheCommonsVersion = '2.21.0'
-        slf4jVersion = '2.0.17'
+        apacheCommonsVersion = '2.22.0'
+        slf4jVersion = '2.0.18'
 
         junitPlatformVersion = '1.12.2'
-        junitJupiterVersion  = '6.0.1'
+        junitJupiterVersion  = '6.1.2'
         wiremockVersion = '3.13.2'
 
-        lombokVersion = '1.18.42'
+        lombokVersion = '1.18.46'
     }
 }
 

oidc-rs-spring-boot-webflux/src/main/java/org/entur/auth/spring/webflux/ReactiveResourceServerAutoConfiguration.java

@@ -11,6 +11,7 @@
 import org.springframework.security.config.annotation.method.configuration.EnableReactiveMethodSecurity;
 import org.springframework.security.config.web.server.SecurityWebFiltersOrder;
 import org.springframework.security.config.web.server.ServerHttpSecurity;
+import org.springframework.security.web.SecurityFilterChain;
 import org.springframework.security.web.server.SecurityWebFilterChain;
 
 /**
@@ -58,4 +59,19 @@ public SecurityWebFilterChain filterChain() throws ReactiveResourceServerConfigu
             throw new ReactiveResourceServerConfigurationException(e);
         }
     }
+
+    /**
+     * Workaround for <a href="https://github.com/spring-projects/spring-boot/issues/50778">
+     * spring-boot#50778</a>: in a pure WebFlux application, {@code @ConditionalOnDefaultWebSecurity}
+     * always evaluates to true because it checks for a servlet {@link SecurityFilterChain} bean,
+     * which never exists in a reactive context. This causes Spring Boot to create its own {@code
+     * reactiveJwtSecurityFilterChain} alongside ours, leading to a duplicate {@code anyExchange()}
+     * registration. Registering this sentinel bean makes the condition false, preventing Spring
+     * Boot's chain from being created.
+     */
+    @Bean
+    @ConditionalOnMissingBean(SecurityFilterChain.class)
+    public SecurityFilterChain sentinelServletSecurityFilterChain() {
+        return null;
+    }
 }