Home Search Pricing Get inErrata About

Sign in Sign up

Graph/spring-boot-upgrade-miswiring

AntiPattern

Spring Boot Upgrade Miswiring

spring-boot-upgrade-miswiring

Servlet registration, dependency coordinates, and default framework settings drift across Spring Boot versions, so builds or runtime routing break when Maven versions, servlet mappings, or security/request matchers no longer align with the new defaults.

Node Details

Public graph metadata

Updated7/9/2026

Connections

30 linked nodes

MATCHESSolution

Instead of `io.sentry:sentry-spring` one has to use `io.sentry:sentry-spring-boot-starter` — in the dependencies. Tension: remove the following from the code. Outcome: I've just tested in my actual project, and logged errors are still sent to Sentry correctly.

MATCHESSolution

I found a solution: — spring-boot-maven-plugin. Tension: all the options above are ignored by `maven-surefire-plugin`. Outcome: org.apache.maven.plugins maven-surefire-plugin 60.

MATCHESSolution

looking if they reactivate the default servlet with the property "server.servlet.register-default-servlet=true" — in spring boot. Tension: there are no web.xml files in the resulting jar.

MATCHESSolution

The issue was fixed in it — You can always override the dependency by specifying the version to be greater than 32.0.1. Outcome: Add the dependency in your pom.xml.

MATCHESSolution

Refactor the configuration to define a @Bean SecurityFilterChain (and relevant Authentication setup) instead of extending WebSecurityConfigurerAdapter, using the current HttpSecurity DSL such as authorizeHttpRequests with requestMatchers and anyRequest().authenticated(), plus formLogin/logout configuration.

MATCHESSolution

For each MvcRequestMatcher, call MvcRequestMatcher#setServletPath to indicate the servlet path. Tension: This method cannot decide whether these patterns are Spring MVC patterns or not. Outcome: For each MvcRequestMatcher, call MvcRequestMatcher#setServletPath to indicate the servlet path.

MATCHESSolution

Identify the exact transitive dependency introducing each vulnerable artifact (e.g., inspect the Maven dependency tree), upgrade or exclude/override those specific transitive versions, and re-run the scan. Use tools like Vulert playground (or similar dependency vulnerability checkers) to confirm which dependencies in the POM cause the findings and what they pull in.

MATCHESSolution

Verify and use the correct localhost port for the application so the request is processed by the intended Spring Security configuration.

MATCHESSolution

Spring Boot 4 introduced some major changes where, by default, it uses Jackson 3 instead of Jackson 2. Outcome: making it a more suitable candidate over the no-arg counterpart.

MATCHESSolution

`spring-boot-starter-aop` has been renamed to `spring-boot-starter-aspectj` — Replace that in your pom.xml. Outcome: it will run fine.

MATCHESSolution

Remove `spring-boot-starter-json` and keep `spring-boot-jackson2`, then configure Spring Boot to prefer Jackson 2 via `spring.http.converters.preferred-json-mapper: jackson2` and (if needed) supply an `ObjectMapper` bean built from `Jackson2ObjectMapperBuilder` with the custom module registered.

MATCHESSolution

Use a stable 3.x version or a proper `4.0.x-SNAPSHOT` — `start.spring.io` shows Spring Boot 4.x SNAPSHOTs. Tension: using `4.0.0` (without `-SNAPSHOT`) in the parent POM breaks dependency management. Outcome: with the Spring snapshot repository configured.

MATCHESSolution

Spring Boot 4. Tension: Spring Boot 4 modularizes the codebase so various things are moved to different modules/dependencies.

MATCHESSolution

But you can try this workaround solution to see if this works: — spring-cloud-gcp-starter-secretmanager 7.3.2. Tension: enforce Spring Cloud GCP 7.x to use Spring Cloud Context 5.0.0. Outcome: which uses Spring Boot 4.0.0 starters.

MATCHESSolution

Replace spring-boot-starter-webmvc with spring-boot-starter-web to include an embedded server and make the H2 console accessible.

MATCHESSolution

If you see 2 versions of JPA — Spring Boot 3.3.x pulling in Spring Data JPA 3.3.x but another library in your project bringing an older Spring Data JPA. Tension: then remove the older version. Outcome: remove the older version.

MATCHESSolution

overwrite the default logback pattern by your own patternLayout — Since Spring Boot is using logback for logging. Outcome: masking your password properties.

MATCHESSolution

ctx.setParentLoaderPriority(false);. Tension: now my webapp classpath has priority over Jetty, and I can use logback. Outcome: and now my webapp classpath has priority over Jetty, and I can use logback.

MATCHESSolution

I often choose to use 3rd libraries directly rather than introducing spring's wrapper for said library — in this instance Hibernate. Tension: The spring wrappers often add another layer of abstraction to understand. Outcome: The spring wrappers often add another layer of abstraction to understand.

MATCHESSolution

Add slf4j-bom 2.0.9 and log4j-slf4j2-impl 2.21.1 as a bridge for future SLF4J users

MATCHESSolution

Disabling the restart function didn't work for me — spring-boot-devtools which has a restart function. Tension: the restart class loader couldn't find the classes. Outcome: I simply removed devtools from Maven.

MATCHESSolution

Use a JAR-in-JAR packaging approach (e.g., Spring Boot’s `spring-boot-maven-plugin` with `repackage`) or another plugin that preserves/merges `META-INF/services/` so Log4j Core can be loaded correctly from the packaged dependencies.

MATCHESSolution

Instead just ditch this restructuring of the Spring Boot `bootJar` task — you now have a jar which is executable (it contains a `MANIFEST.MF` with all the proper entries). Tension: This task is basically replacing what Spring Boot already does and in a bad way as well. Outcome: let it do its thing instead of trying to be smarter.

MATCHESSolution

If you meant to use the Spring Boot support — you can remove the `io.opentelemetry` dependencies, use the actuator starter. Tension: this behavior difference is called out in the Spring Boot docs. Outcome: refer to the Spring Boot docs.

MATCHESSolution

Also you should not need the plugin at the end. Tension: wrong dependency artifactId lombok-maven-plugin.

MATCHESSolution

Align all Spring Boot/Spring Security/Authorization Server dependency versions (e.g., upgrade the Spring Boot plugin to the same version and remove hardcoded version overrides), and prefer using org.springframework.boot:spring-boot-starter-oauth2-authorization-server so transitive dependencies match.

MATCHESSolution

After remove this row it run perfectly — previously I did specify spring framework as 6.1.14. Tension: conflict between dependency that include in 3.4.x. Outcome: it run perfectly.

MATCHESSolution

When I remove @Component and only use @WebFilter, the program runs normally. Tension: Failed to register 'filter xssFilter' on the servlet context. Possibly already registered? Outcome: the program runs normally.

MATCHESSolution

Using the starter — `transaction-jdbc`, `transaction-jms` and `transaction-jta` are automatically imported with `jakarta` as classifier. Tension: Check if you are importing the "no-jakarta" modules. Outcome: try to use the starter, or specify the classifier in pom.xml.

MATCHESSolution

calls requesting the Provider afterwards do not work (the user returns null — after a Spring 5 -> 6 (Spring Boot 3.3.4) migration. Tension: I can sign in to my site, but calls requesting the Provider afterwards do not work. Outcome: I fixed this today, and found the following out that helped resolve this in my custom filter code.

[inerrata]Tags Knowledge Graph Docs About Team Pricing Contact Report a Bug Privacy Terms Cookie Settings Do Not Sell or Share My Info

© 2026 Inerrata