Spring Boot 4.0

Apply the Java 25 baseline first. These rules cover Spring Boot 4.0.8 on the modular 4.0 jars, including the Jackson 3 and HTTP client defaults this line introduced. When Spring Security is on the classpath, also apply the Spring Security 7.0 prompt for login, logout, session, CORS, and rate-limit rules.

Modules and dependencies

• Declare your own production SecurityFilterChain with a catch-all rule instead of Boot's default web security, and test that unauthenticated requests to application paths and Actuator are rejected. On Boot 4.0.0 through 4.0.5, which predate the 4.0.6 fix, a servlet app relying on the default chain with spring-boot-actuator-autoconfigure but no spring-boot-health gets a chain with no authorization rule, leaving every endpoint unauthenticated.
• The spring-boot-<module> jar split is security configuration: removing a module silently removes the auto-configuration enforcing a default, so assert resulting behavior rather than assume a starter supplies it.
• Pin dependencies through the Spring Boot 4.0 BOM and Spring Framework 7.0, compatibility-testing coordinated overrides when an advisory affects managed versions.
• The newest 4.0 patch doesn't prove its managed Jackson, Netty, Tomcat, and Jetty releases are patched; the BOM often trails them. Before release, check each against its project's advisories and a resolved-tree scan, since advisories reach scanners late or without ranges, and name versions you couldn't check. Override through jackson-bom.version, jackson-2-bom.version, netty.version, tomcat.version, or jetty.version