chore: adopt ds-spring-user-framework 5.3.0 on Spring Boot 4.1.0

[devondragon]

Adopts Spring Boot 4.1.0 and the released ds-spring-user-framework 5.3.0, and migrates the templates off the ${@environment...} idiom that Thymeleaf 3.1.5 rejects.

Closes #82

Why

Boot 4.0.4 -> 4.1.0 bundles Thymeleaf 3.1.2 -> 3.1.5. Under 3.1.5, expressions using Spring bean access — ${@environment.getProperty('user.security.*')} and ${@environment.acceptsProfiles(...)} — are evaluated in a restricted expression context while thymeleaf-layout-dialect decorates the page, and throw:

org.thymeleaf.exceptions.TemplateProcessingException:
Instantiation of new objects and access to static classes or parameters is forbidden in this context

That broke rendering app-wide, with SecurityConfigurationTest and MfaChallengeFlowIntegrationTest failing on the render.

What changed

• build.gradle: Spring Boot 4.0.4 -> 4.1.0, ds-spring-user-framework 5.1.1 -> 5.3.0. The Boot BOM carries the bumps noted in Adopt Spring Boot 4.1.0: migrate ${@environment.getProperty(...)} template pattern for Thymeleaf 3.1.5 restricted expressions #82 (spring-security, hibernate-validator, thymeleaf-extras-springsecurity6, postgresql, lombok).
• Templates: every ${@environment.getProperty('user.security.*')} now reads from ${userSecurity.*}, the secret-free view the framework exposes to templates as of 5.3.0 — loginPageUri, registrationUri, forgotPasswordUri, updateUserUri, loginActionUri, copyrightFirstYear. This covers the nine templates listed in the issue: index.html, layout.html, fragments/header.html, fragments/footer.html, user/register.html, user/login.html, user/registration-pending-verification.html, user/request-new-verification-email.html, event/details.html, including the usages nested inside #{message(...)} arguments in register.html and request-new-verification-email.html.
• New DemoTemplateModelAdvice (@ControllerAdvice + @ModelAttribute) exposing ${devOrLocalProfile} for the acceptsProfiles('dev','local') check, which is not a user.security value and so has no ${userSecurity} equivalent.
• CustomUserEmailService: super(...) updated for the 5.3.0 UserEmailService constructor.

No ${@environment...} usages remain in the templates.

The issue's "framework relevance" note is addressed upstream: 5.3.0 ships ${userSecurity} as the supported replacement, so downstream apps have a documented migration target rather than each rolling their own @ControllerAdvice.

Verification

• ./gradlew clean test --refresh-dependencies — 301 tests, 0 failures (refresh so the released 5.3.0 resolves from Maven Central, not a local snapshot).
• Playwright --project=chromium — 107 passed.
• Playwright --project=chromium-mfa — 1 passed.

[Copilot]

Pull request overview

This PR upgrades the demo app to Spring Boot 4.1.0 and ds-spring-user-framework 5.3.0, addressing Thymeleaf 3.1.5 restricted-expression failures by removing ${@environment...} bean access from decorated templates.

Changes:

• Bump Spring Boot Gradle plugin to 4.1.0 and ds-spring-user-framework dependency to 5.3.0.
• Migrate affected Thymeleaf templates from ${@environment.getProperty(...)} / ${@environment.acceptsProfiles(...)} to ${userSecurity.*} and a new ${devOrLocalProfile} model attribute.
• Update CustomUserEmailService constructor call chain to match the framework’s updated UserEmailService signature.

Reviewed changes

Copilot reviewed 11 out of 12 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
build.gradle	Upgrades Boot plugin and ds-spring-user-framework version.
src/main/java/com/digitalsanctuary/spring/demo/web/DemoTemplateModelAdvice.java	Adds a @ControllerAdvice model attribute for devOrLocalProfile to avoid restricted SpEL bean access.
src/main/java/com/digitalsanctuary/spring/demo/service/CustomUserEmailService.java	Updates super(...) call to pass new framework config dependency.
src/main/resources/templates/layout.html	Replaces @environment.acceptsProfiles(...) with ${devOrLocalProfile}.
src/main/resources/templates/index.html	Switches login/registration links to ${userSecurity.*} URIs.
src/main/resources/templates/fragments/header.html	Switches account/auth links to ${userSecurity.*} URIs.
src/main/resources/templates/fragments/footer.html	Switches copyright first-year source to ${userSecurity.copyrightFirstYear}.
src/main/resources/templates/user/login.html	Switches login action + auth links to ${userSecurity.*} URIs.
src/main/resources/templates/user/register.html	Switches message args + login link to ${userSecurity.*} URIs.
src/main/resources/templates/user/registration-pending-verification.html	Switches login link to ${userSecurity.loginPageUri}.
src/main/resources/templates/user/request-new-verification-email.html	Switches message args to ${userSecurity.*} URIs.
src/main/resources/templates/event/details.html	Switches login/registration links to ${userSecurity.*} URIs.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.