spring-boot-v4

pom.xml

@@ -55,102 +55,90 @@
     <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
 
     <!-- Dependencies -->
-    <spring-boot.version>[3.4,3.5)</spring-boot.version>
-    <spring-security.version>[6.2,6.5)</spring-security.version>
-    <jackson.version>2.18.2</jackson.version>
-    <okhttp3.version>4.12.0</okhttp3.version>
-    <fabric8-mockwebserver.version>7.1.0</fabric8-mockwebserver.version>
+    <spring-boot.version>4.0.2</spring-boot.version>
+    <fabric8-mockwebserver.version>7.5.2</fabric8-mockwebserver.version>
 
     <!-- Plugins -->
     <jacoco-maven-plugin.version>0.8.12</jacoco-maven-plugin.version>
-    <maven-compiler-plugin.version>3.14.0</maven-compiler-plugin.version>
+    <maven-compiler-plugin.version>3.14.1</maven-compiler-plugin.version>
     <maven-enforcer-pluging.version>3.5.0</maven-enforcer-pluging.version>
-    <maven-jar-plugin.version>3.4.2</maven-jar-plugin.version>
-    <maven-gpg-plugin.version>3.2.7</maven-gpg-plugin.version>
-    <maven-javadoc-plugin.version>3.11.2</maven-javadoc-plugin.version>
+    <maven-jar-plugin.version>3.5.0</maven-jar-plugin.version>
+    <maven-gpg-plugin.version>3.2.8</maven-gpg-plugin.version>
+    <maven-javadoc-plugin.version>3.12.0</maven-javadoc-plugin.version>
     <maven-site-plugin.version>3.21.0</maven-site-plugin.version>
-    <maven-source-plugin.version>3.3.1</maven-source-plugin.version>
-    <maven-surefire-plugin.version>3.5.2</maven-surefire-plugin.version>
+    <maven-source-plugin.version>3.4.0</maven-source-plugin.version>
+    <maven-surefire-plugin.version>3.5.4</maven-surefire-plugin.version>
     <nexus-staging-maven-plugin.version>1.7.0</nexus-staging-maven-plugin.version>
     <sortpom-maven-plugin.version>4.0.0</sortpom-maven-plugin.version>
-    <versions-maven-plugin.version>2.18.0</versions-maven-plugin.version>
+    <versions-maven-plugin.version>2.21.0</versions-maven-plugin.version>
   </properties>
 
+  <dependencyManagement>
+    <dependencies>
+      <dependency>
+        <groupId>org.springframework.boot</groupId>
+        <artifactId>spring-boot-dependencies</artifactId>
+        <version>${spring-boot.version}</version>
+        <type>pom</type>
+        <scope>import</scope>
+      </dependency>
+    </dependencies>
+  </dependencyManagement>
+
   <dependencies>
+
+    <!-- Dependencies, avoiding spring-boot starter bundles as this is only a library -->
     <dependency>
       <groupId>org.springframework.boot</groupId>
-      <artifactId>spring-boot-starter</artifactId>
-      <version>${spring-boot.version}</version>
+      <artifactId>spring-boot-security-oauth2-client</artifactId>
     </dependency>
     <dependency>
-      <groupId>org.springframework.boot</groupId>
-      <artifactId>spring-boot-starter-oauth2-client</artifactId>
-      <version>${spring-boot.version}</version>
+      <groupId>org.springframework.security</groupId>
+      <artifactId>spring-security-config</artifactId>
     </dependency>
     <dependency>
       <groupId>org.springframework.boot</groupId>
-      <artifactId>spring-boot-starter-security</artifactId>
-      <version>${spring-boot.version}</version>
+      <artifactId>spring-boot-autoconfigure</artifactId>
     </dependency>
     <dependency>
       <groupId>org.springframework.boot</groupId>
-      <artifactId>spring-boot-starter-web</artifactId>
-      <version>${spring-boot.version}</version>
+      <artifactId>spring-boot-webclient</artifactId>
     </dependency>
     <dependency>
       <groupId>org.springframework.boot</groupId>
-      <artifactId>spring-boot-starter-webflux</artifactId>
-      <version>${spring-boot.version}</version>
+      <artifactId>spring-boot-jackson</artifactId>
     </dependency>
+
+    <!-- Test dependencies -->
     <dependency>
-      <groupId>org.springframework.boot</groupId>
-      <artifactId>spring-boot-starter-oauth2-resource-server</artifactId>
-      <version>${spring-boot.version}</version>
+      <groupId>io.fabric8</groupId>
+      <artifactId>mockwebserver</artifactId>
+      <version>${fabric8-mockwebserver.version}</version>
+      <scope>test</scope>
     </dependency>
     <dependency>
-      <groupId>com.fasterxml.jackson.core</groupId>
-      <artifactId>jackson-databind</artifactId>
-      <version>${jackson.version}</version>
+      <groupId>org.springframework.boot</groupId>
+      <artifactId>spring-boot-starter-oauth2-resource-server</artifactId>
       <scope>test</scope>
     </dependency>
     <dependency>
-      <groupId>com.squareup.okhttp3</groupId>
-      <artifactId>mockwebserver</artifactId>
-      <version>${okhttp3.version}</version>
+      <groupId>org.springframework.boot</groupId>
+      <artifactId>spring-boot-starter-test</artifactId>
       <scope>test</scope>
     </dependency>
     <dependency>
-      <groupId>io.fabric8</groupId>
-      <artifactId>mockwebserver</artifactId>
-      <version>${fabric8-mockwebserver.version}</version>
+      <groupId>org.springframework.boot</groupId>
+      <artifactId>spring-boot-starter-web</artifactId>
       <scope>test</scope>
-      <exclusions>
-        <exclusion>
-          <artifactId>tools</artifactId>
-          <groupId>com.sun</groupId>
-        </exclusion>
-      </exclusions>
     </dependency>
     <dependency>
       <groupId>org.springframework.boot</groupId>
-      <artifactId>spring-boot-starter-test</artifactId>
-      <version>${spring-boot.version}</version>
+      <artifactId>spring-boot-webmvc-test</artifactId>
       <scope>test</scope>
-      <exclusions>
-        <exclusion>
-          <artifactId>junit-vintage-engine</artifactId>
-          <groupId>org.junit.vintage</groupId>
-        </exclusion>
-        <exclusion>
-          <groupId>org.slf4j</groupId>
-          <artifactId>slf4j-api</artifactId>
-        </exclusion>
-      </exclusions>
     </dependency>
     <dependency>
       <groupId>org.springframework.security</groupId>
       <artifactId>spring-security-test</artifactId>
-      <version>${spring-security.version}</version>
       <scope>test</scope>
     </dependency>
   </dependencies>

src/main/java/io/dwpbank/movewp3/microservice/security/autoconfiguration/client/WebClientOauth2AutoConfiguration.java

@@ -4,10 +4,10 @@
 import org.springframework.boot.autoconfigure.AutoConfiguration;
 import org.springframework.boot.autoconfigure.AutoConfigureAfter;
 import org.springframework.boot.autoconfigure.condition.ConditionalOnBean;
-import org.springframework.boot.autoconfigure.jackson.JacksonAutoConfiguration;
-import org.springframework.boot.autoconfigure.security.oauth2.client.servlet.OAuth2ClientAutoConfiguration;
-import org.springframework.boot.autoconfigure.web.reactive.function.client.WebClientAutoConfiguration;
 import org.springframework.boot.context.properties.EnableConfigurationProperties;
+import org.springframework.boot.jackson.autoconfigure.JacksonAutoConfiguration;
+import org.springframework.boot.security.oauth2.client.autoconfigure.OAuth2ClientAutoConfiguration;
+import org.springframework.boot.webclient.autoconfigure.WebClientAutoConfiguration;
 import org.springframework.context.annotation.Bean;
 import org.springframework.context.annotation.Scope;
 import org.springframework.security.oauth2.client.AuthorizedClientServiceOAuth2AuthorizedClientManager;

src/main/java/io/dwpbank/movewp3/microservice/security/autoconfiguration/server/WebSecurityAutoConfiguration.java

@@ -4,10 +4,8 @@
 import java.util.Optional;
 import org.springframework.beans.factory.annotation.Qualifier;
 import org.springframework.boot.autoconfigure.AutoConfiguration;
-import org.springframework.boot.autoconfigure.AutoConfigureBefore;
 import org.springframework.boot.autoconfigure.condition.ConditionalOnProperty;
 import org.springframework.boot.autoconfigure.condition.ConditionalOnWebApplication;
-import org.springframework.boot.autoconfigure.security.oauth2.client.servlet.OAuth2ClientAutoConfiguration;
 import org.springframework.boot.context.properties.EnableConfigurationProperties;
 import org.springframework.context.annotation.Bean;
 import org.springframework.security.config.Customizer;
@@ -17,21 +15,16 @@
 import org.springframework.security.config.http.SessionCreationPolicy;
 import org.springframework.security.web.AuthenticationEntryPoint;
 import org.springframework.security.web.SecurityFilterChain;
-import org.springframework.security.web.servlet.util.matcher.MvcRequestMatcher;
-import org.springframework.web.servlet.handler.HandlerMappingIntrospector;
+import org.springframework.security.web.servlet.util.matcher.PathPatternRequestMatcher;
+import org.springframework.security.web.util.matcher.RequestMatcher;
 
 /**
  * An autoconfiguration that enables OIDC-based authentication for all HTTP endpoints (except for <code>/actuator/*</code> as soon as the
  * property <code>microservice.security.oauth2.resourceserver.jwt.jwk-set-uri</code> is set to the JWK Set URI of an OpenID Connect
  * provider.
- * <p>
- * In case both {@link OAuth2ClientAutoConfiguration} and this auto-configuration are applied onto an application, both would try and add a
- * {@link SecurityFilterChain}. To avoid such a conflict, the one defined in this class will take precedence over the one provided via
- * {@link OAuth2ClientAutoConfiguration}.
  */
 @AutoConfiguration
 @EnableWebSecurity
-@AutoConfigureBefore(OAuth2ClientAutoConfiguration.class)
 @ConditionalOnProperty("spring.security.oauth2.resourceserver.jwt.jwk-set-uri")
 @ConditionalOnWebApplication
 @EnableConfigurationProperties({MicroserviceSecurityConfigurationProperties.class})
@@ -42,16 +35,15 @@ public class WebSecurityAutoConfiguration {
   SecurityFilterChain oidcResourceServerSecurityFilterChainReduced(
       HttpSecurity http,
       MicroserviceSecurityConfigurationProperties microserviceSecurityConfigurationProperties,
-      HandlerMappingIntrospector introspector,
       @Qualifier("oauth2AuthenticationEntryPoint") Optional<AuthenticationEntryPoint> oauth2AuthenticationEntryPoint) throws Exception {
     return http.csrf(AbstractHttpConfigurer::disable)
         .logout(AbstractHttpConfigurer::disable)
         .anonymous(AbstractHttpConfigurer::disable)
         .authorizeHttpRequests(authorizationManagerRequestMatcherRegistry ->
             authorizationManagerRequestMatcherRegistry.requestMatchers(microserviceSecurityConfigurationProperties.getAllowlist()
                     .stream()
-                    .map(path -> new MvcRequestMatcher(introspector, path))
-                    .toArray(MvcRequestMatcher[]::new))
+                    .map(path -> PathPatternRequestMatcher.withDefaults().matcher(path))
+                    .toArray(RequestMatcher[]::new))
                 .permitAll()
                 .anyRequest()
                 .authenticated())
@@ -65,4 +57,3 @@ SecurityFilterChain oidcResourceServerSecurityFilterChainReduced(
         .build();
   }
 }
-

src/test/java/io/dwpbank/movewp3/microservice/security/autoconfiguration/client/WebClientOauth2AutoConfigurationTest.java

@@ -1,6 +1,7 @@
 package io.dwpbank.movewp3.microservice.security.autoconfiguration.client;
 
 import static org.assertj.core.api.Assertions.assertThat;
+import static org.junit.jupiter.api.Assertions.assertFalse;
 
 import io.fabric8.mockwebserver.DefaultMockServer;
 import io.fabric8.mockwebserver.utils.ResponseProviders;
@@ -68,7 +69,7 @@ void testRegularWebClientOmitsBearerToken() {
     var responseEntity = webClientBuilder
         .baseUrl("http://foo")
         .exchangeFunction(clientRequest -> {
-          assertThat(clientRequest.headers()).doesNotContainKeys("Authorization");
+          assertFalse(clientRequest.headers().containsHeader("Authorization"));
           return Mono.just(ClientResponse.create(HttpStatus.OK).build());
         })
         .build()

src/test/java/io/dwpbank/movewp3/microservice/security/autoconfiguration/server/WebSecurityConfigAllowlistTest.java

@@ -10,7 +10,7 @@
 import org.junit.jupiter.api.Test;
 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.boot.autoconfigure.ImportAutoConfiguration;
-import org.springframework.boot.test.autoconfigure.web.servlet.WebMvcTest;
+import org.springframework.boot.webmvc.test.autoconfigure.WebMvcTest;
 import org.springframework.test.context.TestPropertySource;
 import org.springframework.test.web.servlet.MockMvc;
 import org.springframework.test.web.servlet.setup.MockMvcBuilders;

src/test/java/io/dwpbank/movewp3/microservice/security/autoconfiguration/server/WebSecurityConfigMultipleSecurityFilterChainsOrderedTest.java

@@ -14,8 +14,8 @@
 import org.junit.jupiter.api.Test;
 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.boot.autoconfigure.ImportAutoConfiguration;
-import org.springframework.boot.test.autoconfigure.web.servlet.WebMvcTest;
 import org.springframework.boot.test.context.TestConfiguration;
+import org.springframework.boot.webmvc.test.autoconfigure.WebMvcTest;
 import org.springframework.context.annotation.Bean;
 import org.springframework.context.annotation.Import;
 import org.springframework.core.annotation.Order;

src/test/java/io/dwpbank/movewp3/microservice/security/autoconfiguration/server/WebSecurityConfigWithAuthEntryPointTest.java

@@ -13,7 +13,7 @@
 import org.junit.jupiter.api.Test;
 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.boot.autoconfigure.ImportAutoConfiguration;
-import org.springframework.boot.test.autoconfigure.web.servlet.WebMvcTest;
+import org.springframework.boot.webmvc.test.autoconfigure.WebMvcTest;
 import org.springframework.context.annotation.Import;
 import org.springframework.security.web.AuthenticationEntryPoint;
 import org.springframework.test.context.ContextConfiguration;