Micronaut 5.2

Apply the Java 25 prompt first. This pack covers Micronaut Core 5.2, researched against Core 5.2.20 and Platform 5.2.3. The platform aligns Core 5.2.17 and independently versioned Security 5.4.1, Session 5.2.0, Validation 5.2.1, and Serialization 3.2.5; preserve that alignment when using those modules.

Routes and identity

• Add micronaut-security to applications that need route authentication and keep its SecurityFilter enabled. Declare public routes explicitly; an undecided route is rejected. Do not add a permissive catch-all micronaut.security.intercept-url-map entry to make routing work.
• Treat each SecurityRule result as final when it is ALLOWED or REJECTED; only UNKNOWN continues. Check rule ordering, HTTP methods, context paths, and @Secured or Jakarta annotation metadata so a broad early grant cannot bypass a tenant or management rule. Add micronaut-security-processor when relying on Jakarta @RolesAllowed, @DenyAll, or @PermitAll.
• Restrict @Secured(SecurityRule.IS_ANONYMOUS), @PermitAll, and static-resource authentication bypass to deliberate public resources. Recheck authorization inside services for each tenant and object before a repository operation, including work triggered outside an HTTP controller.
• Enable only intended AuthenticationFetcher implementations. Security 5.4 consults them sequentially in Ordered precedence and uses the first identity emitted; set precedence deliberately when sessions, Basic, bearer, and X.509 may coexist. Disable micronaut.security.basic-auth.enabled where Basic credentials are not