Home Search Pricing Get inErrata About

Sign in Sign up

Graph/spring-boot-config-drift

AntiPattern

Spring Boot Config Drift

spring-boot-config-drift

Spring Boot upgrades and packaging defaults cause dependency and servlet configuration drift—missing or renamed starters, disabled default servlets, and mismatched Maven versions lead to broken dependency management and incorrect web/servlet behavior at runtime.

Node Details

Public graph metadata

Updated7/28/2026

Connections

30 linked nodes

MATCHESSolution

Instead of `io.sentry:sentry-spring` one has to use `io.sentry:sentry-spring-boot-starter` — in the dependencies. Tension: remove the following from the code. Outcome: I've just tested in my actual project, and logged errors are still sent to Sentry correctly.

MATCHESSolution

I found a solution: — spring-boot-maven-plugin. Tension: all the options above are ignored by `maven-surefire-plugin`. Outcome: org.apache.maven.plugins maven-surefire-plugin 60.

MATCHESSolution

looking if they reactivate the default servlet with the property "server.servlet.register-default-servlet=true" — in spring boot. Tension: there are no web.xml files in the resulting jar.

MATCHESSolution

Identify the exact transitive dependency introducing each vulnerable artifact (e.g., inspect the Maven dependency tree), upgrade or exclude/override those specific transitive versions, and re-run the scan. Use tools like Vulert playground (or similar dependency vulnerability checkers) to confirm which dependencies in the POM cause the findings and what they pull in.

MATCHESSolution

Spring Boot 4 introduced some major changes where, by default, it uses Jackson 3 instead of Jackson 2. Outcome: making it a more suitable candidate over the no-arg counterpart.

MATCHESSolution

`spring-boot-starter-aop` has been renamed to `spring-boot-starter-aspectj` — Replace that in your pom.xml. Outcome: it will run fine.

MATCHESSolution

Remove `spring-boot-starter-json` and keep `spring-boot-jackson2`, then configure Spring Boot to prefer Jackson 2 via `spring.http.converters.preferred-json-mapper: jackson2` and (if needed) supply an `ObjectMapper` bean built from `Jackson2ObjectMapperBuilder` with the custom module registered.

MATCHESSolution

Use a stable 3.x version or a proper `4.0.x-SNAPSHOT` — `start.spring.io` shows Spring Boot 4.x SNAPSHOTs. Tension: using `4.0.0` (without `-SNAPSHOT`) in the parent POM breaks dependency management. Outcome: with the Spring snapshot repository configured.

MATCHESSolution

Spring Boot 4. Tension: Spring Boot 4 modularizes the codebase so various things are moved to different modules/dependencies.

MATCHESSolution

But you can try this workaround solution to see if this works: — spring-cloud-gcp-starter-secretmanager 7.3.2. Tension: enforce Spring Cloud GCP 7.x to use Spring Cloud Context 5.0.0. Outcome: which uses Spring Boot 4.0.0 starters.

MATCHESSolution

Replace spring-boot-starter-webmvc with spring-boot-starter-web to include an embedded server and make the H2 console accessible.

MATCHESSolution

Or do I need to set java.library.path at runtime? — How should I include these .so files in a modern Spring Boot application so that the JAR can still use them? Tension: Should they be put in src/main/resources? Outcome: set `LD_LIBRARY_PATH` environment variable to the path containing your .so files before executing the application.

MATCHESSolution

If you see 2 versions of JPA — Spring Boot 3.3.x pulling in Spring Data JPA 3.3.x but another library in your project bringing an older Spring Data JPA. Tension: then remove the older version. Outcome: remove the older version.

MATCHESSolution

overwrite the default logback pattern by your own patternLayout — Since Spring Boot is using logback for logging. Outcome: masking your password properties.

MATCHESSolution

ctx.setParentLoaderPriority(false);. Tension: now my webapp classpath has priority over Jetty, and I can use logback. Outcome: and now my webapp classpath has priority over Jetty, and I can use logback.

MATCHESSolution

I often choose to use 3rd libraries directly rather than introducing spring's wrapper for said library — in this instance Hibernate. Tension: The spring wrappers often add another layer of abstraction to understand. Outcome: The spring wrappers often add another layer of abstraction to understand.

MATCHESSolution

Disabling the restart function didn't work for me — spring-boot-devtools which has a restart function. Tension: the restart class loader couldn't find the classes. Outcome: I simply removed devtools from Maven.

MATCHESSolution

Use a JAR-in-JAR packaging approach (e.g., Spring Boot’s `spring-boot-maven-plugin` with `repackage`) or another plugin that preserves/merges `META-INF/services/` so Log4j Core can be loaded correctly from the packaged dependencies.

MATCHESSolution

Instead just ditch this restructuring of the Spring Boot `bootJar` task — you now have a jar which is executable (it contains a `MANIFEST.MF` with all the proper entries). Tension: This task is basically replacing what Spring Boot already does and in a bad way as well. Outcome: let it do its thing instead of trying to be smarter.

MATCHESSolution

Remove your `cacheManager` bean and replace it with an `CacheManagerCustomizer` instead. — Make sure that you have both `spring-boot-starter-actuator` and approriate Google Caffeine and Micrometer dependencies. Tension: and that will be all you need to have metrics. Outcome: Spring Boot already configures those metrics.

MATCHESSolution

If you meant to use the Spring Boot support — you can remove the `io.opentelemetry` dependencies, use the actuator starter. Tension: this behavior difference is called out in the Spring Boot docs. Outcome: refer to the Spring Boot docs.

MATCHESSolution

Also you should not need the plugin at the end. Tension: wrong dependency artifactId lombok-maven-plugin.

MATCHESSolution

Align all Spring Boot/Spring Security/Authorization Server dependency versions (e.g., upgrade the Spring Boot plugin to the same version and remove hardcoded version overrides), and prefer using org.springframework.boot:spring-boot-starter-oauth2-authorization-server so transitive dependencies match.

MATCHESSolution

I primarily use view models in the web layer. — To decouple the database layer from the web layer in Spring Boot. Tension: This separation ensures that the web layer does not directly expose or depend on the structure of the underlying database entities. Outcome: three view models should suffice.

MATCHESSolution

After remove this row it run perfectly — previously I did specify spring framework as 6.1.14. Tension: conflict between dependency that include in 3.4.x. Outcome: it run perfectly.

MATCHESSolution

Update docker-compose to properly configure the Couchbase service and run startup scripts (e.g., setup-couchbase.sh) after the server starts to create the required bucket, scopes, collections, and indexes, ensuring the environment variables align with Spring Boot’s configuration.

MATCHESSolution

Configure Spring Security to ignore (bypass) the swagger-ui and api-docs endpoints by adding matching paths (e.g., /swagger-ui/** and /v3/api-docs/**, plus /swagger-ui.html) via a WebSecurityCustomizer (or equivalent permitAll configuration) so the documentation endpoints are accessible.

MATCHESSolution

Using the starter — `transaction-jdbc`, `transaction-jms` and `transaction-jta` are automatically imported with `jakarta` as classifier. Tension: Check if you are importing the "no-jakarta" modules. Outcome: try to use the starter, or specify the classifier in pom.xml.

MATCHESSolution

calls requesting the Provider afterwards do not work (the user returns null — after a Spring 5 -> 6 (Spring Boot 3.3.4) migration. Tension: I can sign in to my site, but calls requesting the Provider afterwards do not work. Outcome: I fixed this today, and found the following out that helped resolve this in my custom filter code.

MATCHESSolution

Only javax usage inside Jakarta EE is affected by modification restrictions. — Apache Commons IO uses javax.imageio. Tension: Our system uses Spring Boot 3 and therefore requires the Jakarta namespace. Outcome: Several javax package exist outside Jakarta EE and are therefore in no way affected.

[inerrata]Tags Knowledge Graph Docs About Team Pricing Contact Report a Bug Privacy Terms Cookie Settings Do Not Sell or Share My Info

© 2026 Inerrata

Spring Boot Config Drift - inErrata Knowledge Graph | Inerrata