[Snyk] Upgrade org.springframework.boot:spring-boot-starter-security from 2.1.5.RELEASE to 2.7.18 by Rajcapabilityassessment · Pull Request #2 · Rajcapabilityassessment/java-sec-code

Rajcapabilityassessment · 2026-07-03T17:04:46Z

Snyk has created this PR to upgrade org.springframework.boot:spring-boot-starter-security from 2.1.5.RELEASE to 2.7.18.

ℹ️ Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.

The recommended version is 105 versions ahead of your current version.
The recommended version was released 3 years ago.

Breaking Change Risk

Notice: This assessment is enhanced by AI.

Important

Check the changes in this PR to ensure they won't cause issues with your project.
This PR was automatically created by Snyk using the credentials of a real user.

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open upgrade PRs.

For more information:

🧐 View latest project report

📜 Customise PR templates

🛠 Adjust upgrade PR settings

🔕 Ignore this dependency or unsubscribe from future upgrade PRs

…om 2.1.5.RELEASE to 2.7.18 Snyk has created this PR to upgrade org.springframework.boot:spring-boot-starter-security from 2.1.5.RELEASE to 2.7.18. See this package in maven: org.springframework.boot:spring-boot-starter-security See this project in Snyk: https://app.eu.snyk.io/org/hsbc-sast-pov-org/project/c12c5f85-7f45-444f-82d9-02c8dfe4dc73?utm_source=github&utm_medium=referral&page=upgrade-pr

Rajcapabilityassessment · 2026-07-03T17:04:47Z

This is a major upgrade from Spring Boot 2.1.5 to 2.7.18, which introduces significant breaking changes, most notably in Spring Security. A full refactoring of your security configuration is required.

Key Breaking Changes:

WebSecurityConfigurerAdapter is Deprecated: Spring Boot 2.7 uses Spring Security 5.7, which deprecates WebSecurityConfigurerAdapter. You must migrate from extending this class to a component-based approach by defining SecurityFilterChain beans.

Old Approach (Before):

@Configuration  
public class SecurityConfig extends WebSecurityConfigurerAdapter {  
    @Override  
    protected void configure(HttpSecurity http) throws Exception {  
        http.authorizeRequests().anyRequest().authenticated().and().formLogin();  
    }  
}

New Approach (After):

@Configuration  
public class SecurityConfig {  
    @Bean  
    public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {  
        http.authorizeHttpRequests(authz -&gt; authz.anyRequest().authenticated())  
            .formLogin(Customizer.withDefaults());  
        return http.build();  
    }  
}

Path Matching Strategy Change: As of Spring Boot 2.6, the default MVC path matching strategy changed from AntPathMatcher to PathPatternParser. This can break security rules. For example, a rule matching "/path" may no longer match "/path/". You must review your mvcMatchers rules to ensure they are still correct.
Circular Dependencies Blocked: Spring Boot 2.6 prohibits circular dependencies between beans by default. This can cause application startup failures that need to be resolved by refactoring your bean dependencies.
SAML Properties Renamed: In Spring Boot 2.7, SAML configuration properties under identityprovider have been moved to assertingparty.

Recommendation: This upgrade requires a mandatory and significant refactoring of your security configuration. Do not merge without allocating time to rewrite your WebSecurityConfigurerAdapter classes as SecurityFilterChain beans and verifying all security-related functionality, especially endpoint authorization rules.

Notice 🤖: This content was augmented using artificial intelligence. AI-generated content may contain errors and should be reviewed for accuracy before use.

Rajcapabilityassessment · 2026-07-03T17:05:46Z

Checkmarx One – Scan Summary & Details – 6d771b69-9e8e-4398-891d-f73c418d4244

New Issues (125)

Critical: 2 · High: 12 · Medium: 18 · Low: 93

Checkmarx found the following issues in this Pull Request

More results are available on the CxOne platform

Use @Checkmarx to interact with Checkmarx PR Assistant.
Examples:
@Checkmarx how are you able to help me?
@Checkmarx rescan this PR

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[Snyk] Upgrade org.springframework.boot:spring-boot-starter-security from 2.1.5.RELEASE to 2.7.18#2

[Snyk] Upgrade org.springframework.boot:spring-boot-starter-security from 2.1.5.RELEASE to 2.7.18#2
Rajcapabilityassessment wants to merge 1 commit into
masterfrom
snyk-upgrade-d6fa1cd5c53215960ab635d2051d5d33

Rajcapabilityassessment commented Jul 3, 2026

Uh oh!

Rajcapabilityassessment commented Jul 3, 2026

Uh oh!

Rajcapabilityassessment commented Jul 3, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

Rajcapabilityassessment commented Jul 3, 2026

Snyk has created this PR to upgrade org.springframework.boot:spring-boot-starter-security from 2.1.5.RELEASE to 2.7.18.

Breaking Change Risk

Uh oh!

Rajcapabilityassessment commented Jul 3, 2026

Uh oh!

Rajcapabilityassessment commented Jul 3, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants