Skip to content

Upgrade Spring Boot from 3.5.x to 4.0.3#2408

Merged
commjoen merged 10 commits intomasterfrom
copilot/update-spring-boot-version
Mar 1, 2026
Merged

Upgrade Spring Boot from 3.5.x to 4.0.3#2408
commjoen merged 10 commits intomasterfrom
copilot/update-spring-boot-version

Conversation

Copy link
Contributor

Copilot AI commented Feb 27, 2026

  • Update spring-boot-starter-parent version from 3.5.11 to 4.0.3
  • Update spring-boot.version property from 3.5.11 to 4.0.3
  • Update spring.security.version from 6.5.8 to 7.0.3
  • Update spring.cloud-version from 2025.0.0 to 2025.1.1
  • Update com.azure.spring.version from 6.0.0 to 7.0.0
  • Replace spring-cloud-gcp-dependencies BOM with libraries-bom 26.76.0
  • Update io.netty.version from 4.1.123.Final to 4.2.10.Final
  • Update spring-vault.version from 3.2.0 to 4.0.1
  • Update springdoc.version from 2.8.15 to 3.0.1
  • Fix SecretsErrorController.java: move ErrorController import to new org.springframework.boot.webmvc.error package
  • Fix ChallengesCtfController.java: replace net.minidev.json with Jackson ObjectNode/ArrayNode
  • Add spring-boot-starter-webmvc-test test dependency for AutoConfigureMockMvc
  • Update AutoConfigureMockMvc import in all test files to new org.springframework.boot.webmvc.test.autoconfigure package
  • Pin Groovy to 4.0.25 to fix thymeleaf-layout-dialect NPE with Spring Boot 4.0's managed Groovy 5.0.4
  • Fix Spotless import ordering violations — spotless:apply to re-sort imports after package rename
Original prompt

This section details on the original issue you should resolve

<issue_title>Can you update the spring boot version to 4.0?</issue_title>
<issue_description>We need to upgrade our spring boot version to 4.0, for this you need to update all dependencies that are relevant for spring boot</issue_description>

Comments on the Issue (you are @copilot in this section)


🔒 GitHub Advanced Security automatically protects Copilot coding agent pull requests. You can protect all pull requests by enabling Advanced Security for your repositories. Learn more about Advanced Security.

Copilot AI and others added 2 commits February 27, 2026 08:40
…encies

Co-authored-by: commjoen <1457214+commjoen@users.noreply.github.com>
…Spring Boot 4.0

Co-authored-by: commjoen <1457214+commjoen@users.noreply.github.com>
Copilot AI changed the title [WIP] Update Spring Boot version to 4.0 and dependencies Upgrade Spring Boot from 3.5.x to 4.0.3 Feb 27, 2026
@github-actions
Copy link

🌐 GitHub Pages Preview Ready!

Your static preview is now available at:
🔗 Preview PR #2408

📄 What's included:

For full functionality testing: Use the Docker preview instead.

🔄 Auto-updates: This preview will be updated automatically when you push new commits to this PR.


Static preview with Thymeleaf generation by GitHub Actions

@github-actions
Copy link

🔨 Preview Build Complete!

Your changes have been built and pushed to GitHub Container Registry.

🐳 Docker Image: ghcr.io/owasp/wrongsecrets/wrongsecrets-pr:pr-2408-1744c3f

📦 Download & Test Locally:

  1. 📁 Download Docker Image Artifact (look for wrongsecrets-preview-pr-2408)
  2. Load and run the image:
# Download the artifact, extract it, then:
docker load < wrongsecrets-preview.tar
docker run -p 8080:8080 wrongsecrets-preview

🚀 Alternative - Pull from Registry:

docker pull ghcr.io/owasp/wrongsecrets/wrongsecrets-pr:pr-2408-1744c3f
docker run -p 8080:8080 ghcr.io/owasp/wrongsecrets/wrongsecrets-pr:pr-2408-1744c3f

Then visit: http://localhost:8080

📝 Changes in this PR:
- src/main/java/org/owasp/wrongsecrets/SecretsErrorController.java
- src/main/java/org/owasp/wrongsecrets/challenges/ChallengesCtfController.java

Visual diff screenshots will be available shortly...


Preview built by GitHub Actions

@github-actions
Copy link

📸 Visual Diff Ready!

Screenshots comparing your changes with the main branch are available:

📁 Download Visual Diff Artifacts

🖼️ Included screenshots:

  • pr-home.png vs main-home.png - Welcome page comparison
  • pr-about.png vs main-about.png - About page comparison
  • pr-challenge.png vs main-challenge.png - Challenge page comparison

🔍 How to review:

  1. Download the artifact zip file
  2. Extract and compare the pr-* and main-* images side by side
  3. Look for visual differences in layout, styling, and content

💡 Tip: Use an image comparison tool or open both images in separate browser tabs to spot differences easily.


Visual diff generated by GitHub Actions • PR #2408

@commjoen
Copy link
Collaborator

@copilot can you fix the failing actions in this pr please?

…ckage change

Co-authored-by: commjoen <1457214+commjoen@users.noreply.github.com>
Copy link
Contributor Author

Copilot AI commented Feb 27, 2026

@copilot can you fix the failing actions in this pr please?

The failing java_swagger_doc workflow was caused by a Spotless import-ordering violation — when AutoConfigureMockMvc was moved to the org.springframework.boot.webmvc.test.autoconfigure package, the imports in the affected test files ended up out of alphabetical order. Fixed in commit 0a9a3ec by running mvn spotless:apply to re-sort all affected imports.

@github-actions
Copy link

🌐 GitHub Pages Preview Ready!

Your static preview is now available at:
🔗 Preview PR #2408

📄 What's included:

For full functionality testing: Use the Docker preview instead.

🔄 Auto-updates: This preview will be updated automatically when you push new commits to this PR.


Static preview with Thymeleaf generation by GitHub Actions

@github-actions
Copy link

🔨 Preview Build Complete!

Your changes have been built and pushed to GitHub Container Registry.

🐳 Docker Image: ghcr.io/owasp/wrongsecrets/wrongsecrets-pr:pr-2408-bcc1e6e

📦 Download & Test Locally:

  1. 📁 Download Docker Image Artifact (look for wrongsecrets-preview-pr-2408)
  2. Load and run the image:
# Download the artifact, extract it, then:
docker load < wrongsecrets-preview.tar
docker run -p 8080:8080 wrongsecrets-preview

🚀 Alternative - Pull from Registry:

docker pull ghcr.io/owasp/wrongsecrets/wrongsecrets-pr:pr-2408-bcc1e6e
docker run -p 8080:8080 ghcr.io/owasp/wrongsecrets/wrongsecrets-pr:pr-2408-bcc1e6e

Then visit: http://localhost:8080

📝 Changes in this PR:
- src/main/java/org/owasp/wrongsecrets/SecretsErrorController.java
- src/main/java/org/owasp/wrongsecrets/challenges/ChallengesCtfController.java

Visual diff screenshots will be available shortly...


Preview built by GitHub Actions

@github-actions
Copy link

📸 Visual Diff Ready!

Screenshots comparing your changes with the main branch are available:

📁 Download Visual Diff Artifacts

🖼️ Included screenshots:

  • pr-home.png vs main-home.png - Welcome page comparison
  • pr-about.png vs main-about.png - About page comparison
  • pr-challenge.png vs main-challenge.png - Challenge page comparison

🔍 How to review:

  1. Download the artifact zip file
  2. Extract and compare the pr-* and main-* images side by side
  3. Look for visual differences in layout, styling, and content

💡 Tip: Use an image comparison tool or open both images in separate browser tabs to spot differences easily.


Visual diff generated by GitHub Actions • PR #2408

@github-actions
Copy link

🌐 GitHub Pages Preview Ready!

Your static preview is now available at:
🔗 Preview PR #2408

📄 What's included:

For full functionality testing: Use the Docker preview instead.

🔄 Auto-updates: This preview will be updated automatically when you push new commits to this PR.


Static preview with Thymeleaf generation by GitHub Actions

@github-actions
Copy link

🔨 Preview Build Complete!

Your changes have been built and pushed to GitHub Container Registry.

🐳 Docker Image: ghcr.io/owasp/wrongsecrets/wrongsecrets-pr:pr-2408-d16f9d2

📦 Download & Test Locally:

  1. 📁 Download Docker Image Artifact (look for wrongsecrets-preview-pr-2408)
  2. Load and run the image:
# Download the artifact, extract it, then:
docker load < wrongsecrets-preview.tar
docker run -p 8080:8080 wrongsecrets-preview

🚀 Alternative - Pull from Registry:

docker pull ghcr.io/owasp/wrongsecrets/wrongsecrets-pr:pr-2408-d16f9d2
docker run -p 8080:8080 ghcr.io/owasp/wrongsecrets/wrongsecrets-pr:pr-2408-d16f9d2

Then visit: http://localhost:8080

📝 Changes in this PR:
- src/main/java/org/owasp/wrongsecrets/SecretsErrorController.java
- src/main/java/org/owasp/wrongsecrets/challenges/ChallengesCtfController.java

Visual diff screenshots will be available shortly...


Preview built by GitHub Actions

@github-actions
Copy link

📸 Visual Diff Ready!

Screenshots comparing your changes with the main branch are available:

📁 Download Visual Diff Artifacts

🖼️ Included screenshots:

  • pr-home.png vs main-home.png - Welcome page comparison
  • pr-about.png vs main-about.png - About page comparison
  • pr-challenge.png vs main-challenge.png - Challenge page comparison

🔍 How to review:

  1. Download the artifact zip file
  2. Extract and compare the pr-* and main-* images side by side
  3. Look for visual differences in layout, styling, and content

💡 Tip: Use an image comparison tool or open both images in separate browser tabs to spot differences easily.


Visual diff generated by GitHub Actions • PR #2408

@github-actions
Copy link

🌐 GitHub Pages Preview Ready!

Your static preview is now available at:
🔗 Preview PR #2408

📄 What's included:

For full functionality testing: Use the Docker preview instead.

🔄 Auto-updates: This preview will be updated automatically when you push new commits to this PR.


Static preview with Thymeleaf generation by GitHub Actions

@github-actions
Copy link

🔨 Preview Build Complete!

Your changes have been built and pushed to GitHub Container Registry.

🐳 Docker Image: ghcr.io/owasp/wrongsecrets/wrongsecrets-pr:pr-2408-d212994

📦 Download & Test Locally:

  1. 📁 Download Docker Image Artifact (look for wrongsecrets-preview-pr-2408)
  2. Load and run the image:
# Download the artifact, extract it, then:
docker load < wrongsecrets-preview.tar
docker run -p 8080:8080 wrongsecrets-preview

🚀 Alternative - Pull from Registry:

docker pull ghcr.io/owasp/wrongsecrets/wrongsecrets-pr:pr-2408-d212994
docker run -p 8080:8080 ghcr.io/owasp/wrongsecrets/wrongsecrets-pr:pr-2408-d212994

Then visit: http://localhost:8080

📝 Changes in this PR:
- src/main/java/org/owasp/wrongsecrets/SecretsErrorController.java
- src/main/java/org/owasp/wrongsecrets/challenges/ChallengesCtfController.java

Visual diff screenshots will be available shortly...


Preview built by GitHub Actions

@github-actions
Copy link

📸 Visual Diff Ready!

Screenshots comparing your changes with the main branch are available:

📁 Download Visual Diff Artifacts

🖼️ Included screenshots:

  • pr-home.png vs main-home.png - Welcome page comparison
  • pr-about.png vs main-about.png - About page comparison
  • pr-challenge.png vs main-challenge.png - Challenge page comparison

🔍 How to review:

  1. Download the artifact zip file
  2. Extract and compare the pr-* and main-* images side by side
  3. Look for visual differences in layout, styling, and content

💡 Tip: Use an image comparison tool or open both images in separate browser tabs to spot differences easily.


Visual diff generated by GitHub Actions • PR #2408

@github-actions
Copy link

🌐 GitHub Pages Preview Ready!

Your static preview is now available at:
🔗 Preview PR #2408

📄 What's included:

For full functionality testing: Use the Docker preview instead.

🔄 Auto-updates: This preview will be updated automatically when you push new commits to this PR.


Static preview with Thymeleaf generation by GitHub Actions

@github-actions
Copy link

🔨 Preview Build Complete!

Your changes have been built and pushed to GitHub Container Registry.

🐳 Docker Image: ghcr.io/owasp/wrongsecrets/wrongsecrets-pr:pr-2408-216b9d1

📦 Download & Test Locally:

  1. 📁 Download Docker Image Artifact (look for wrongsecrets-preview-pr-2408)
  2. Load and run the image:
# Download the artifact, extract it, then:
docker load < wrongsecrets-preview.tar
docker run -p 8080:8080 wrongsecrets-preview

🚀 Alternative - Pull from Registry:

docker pull ghcr.io/owasp/wrongsecrets/wrongsecrets-pr:pr-2408-216b9d1
docker run -p 8080:8080 ghcr.io/owasp/wrongsecrets/wrongsecrets-pr:pr-2408-216b9d1

Then visit: http://localhost:8080

📝 Changes in this PR:
- src/main/java/org/owasp/wrongsecrets/SecretsErrorController.java
- src/main/java/org/owasp/wrongsecrets/challenges/ChallengesCtfController.java
- src/main/java/org/owasp/wrongsecrets/challenges/docker/Challenge59.java
- src/main/java/org/owasp/wrongsecrets/challenges/docker/SlackNotificationService.java
- src/main/java/org/owasp/wrongsecrets/challenges/kubernetes/MetaDataChallenge.java
- src/main/java/org/owasp/wrongsecrets/challenges/kubernetes/VaultSubKeyChallenge.java
- src/main/resources/explanations/challenge56_reason.adoc

Visual diff screenshots will be available shortly...


Preview built by GitHub Actions

@github-actions
Copy link

📸 Visual Diff Ready!

Screenshots comparing your changes with the main branch are available:

📁 Download Visual Diff Artifacts

🖼️ Included screenshots:

  • pr-home.png vs main-home.png - Welcome page comparison
  • pr-about.png vs main-about.png - About page comparison
  • pr-challenge.png vs main-challenge.png - Challenge page comparison

🔍 How to review:

  1. Download the artifact zip file
  2. Extract and compare the pr-* and main-* images side by side
  3. Look for visual differences in layout, styling, and content

💡 Tip: Use an image comparison tool or open both images in separate browser tabs to spot differences easily.


Visual diff generated by GitHub Actions • PR #2408

…ut, and having mockito as an agent, preventing future deprecation
@github-actions
Copy link

🌐 GitHub Pages Preview Ready!

Your static preview is now available at:
🔗 Preview PR #2408

📄 What's included:

For full functionality testing: Use the Docker preview instead.

🔄 Auto-updates: This preview will be updated automatically when you push new commits to this PR.


Static preview with Thymeleaf generation by GitHub Actions

@github-actions
Copy link

🔨 Preview Build Complete!

Your changes have been built and pushed to GitHub Container Registry.

🐳 Docker Image: ghcr.io/owasp/wrongsecrets/wrongsecrets-pr:pr-2408-06e3abe

📦 Download & Test Locally:

  1. 📁 Download Docker Image Artifact (look for wrongsecrets-preview-pr-2408)
  2. Load and run the image:
# Download the artifact, extract it, then:
docker load < wrongsecrets-preview.tar
docker run -p 8080:8080 wrongsecrets-preview

🚀 Alternative - Pull from Registry:

docker pull ghcr.io/owasp/wrongsecrets/wrongsecrets-pr:pr-2408-06e3abe
docker run -p 8080:8080 ghcr.io/owasp/wrongsecrets/wrongsecrets-pr:pr-2408-06e3abe

Then visit: http://localhost:8080

📝 Changes in this PR:
- src/main/java/org/owasp/wrongsecrets/SecretsErrorController.java
- src/main/java/org/owasp/wrongsecrets/challenges/ChallengesCtfController.java
- src/main/java/org/owasp/wrongsecrets/challenges/docker/Challenge49.java
- src/main/java/org/owasp/wrongsecrets/challenges/docker/Challenge52.java
- src/main/java/org/owasp/wrongsecrets/challenges/docker/Challenge59.java
- src/main/java/org/owasp/wrongsecrets/challenges/docker/SlackNotificationService.java
- src/main/java/org/owasp/wrongsecrets/challenges/kubernetes/MetaDataChallenge.java
- src/main/java/org/owasp/wrongsecrets/challenges/kubernetes/VaultSubKeyChallenge.java
- src/main/resources/explanations/challenge56_reason.adoc

Visual diff screenshots will be available shortly...


Preview built by GitHub Actions

@github-actions
Copy link

🌐 GitHub Pages Preview Ready!

Your static preview is now available at:
🔗 Preview PR #2408

📄 What's included:

For full functionality testing: Use the Docker preview instead.

🔄 Auto-updates: This preview will be updated automatically when you push new commits to this PR.


Static preview with Thymeleaf generation by GitHub Actions

@github-actions
Copy link

📸 Visual Diff Ready!

Screenshots comparing your changes with the main branch are available:

📁 Download Visual Diff Artifacts

🖼️ Included screenshots:

  • pr-home.png vs main-home.png - Welcome page comparison
  • pr-about.png vs main-about.png - About page comparison
  • pr-challenge.png vs main-challenge.png - Challenge page comparison

🔍 How to review:

  1. Download the artifact zip file
  2. Extract and compare the pr-* and main-* images side by side
  3. Look for visual differences in layout, styling, and content

💡 Tip: Use an image comparison tool or open both images in separate browser tabs to spot differences easily.


Visual diff generated by GitHub Actions • PR #2408

@github-actions
Copy link

🔨 Preview Build Complete!

Your changes have been built and pushed to GitHub Container Registry.

🐳 Docker Image: ghcr.io/owasp/wrongsecrets/wrongsecrets-pr:pr-2408-f1aef53

📦 Download & Test Locally:

  1. 📁 Download Docker Image Artifact (look for wrongsecrets-preview-pr-2408)
  2. Load and run the image:
# Download the artifact, extract it, then:
docker load < wrongsecrets-preview.tar
docker run -p 8080:8080 wrongsecrets-preview

🚀 Alternative - Pull from Registry:

docker pull ghcr.io/owasp/wrongsecrets/wrongsecrets-pr:pr-2408-f1aef53
docker run -p 8080:8080 ghcr.io/owasp/wrongsecrets/wrongsecrets-pr:pr-2408-f1aef53

Then visit: http://localhost:8080

📝 Changes in this PR:
- src/main/java/org/owasp/wrongsecrets/SecretsErrorController.java
- src/main/java/org/owasp/wrongsecrets/challenges/ChallengesCtfController.java
- src/main/java/org/owasp/wrongsecrets/challenges/docker/Challenge49.java
- src/main/java/org/owasp/wrongsecrets/challenges/docker/Challenge52.java
- src/main/java/org/owasp/wrongsecrets/challenges/docker/Challenge59.java
- src/main/java/org/owasp/wrongsecrets/challenges/docker/SlackNotificationService.java
- src/main/java/org/owasp/wrongsecrets/challenges/kubernetes/MetaDataChallenge.java
- src/main/java/org/owasp/wrongsecrets/challenges/kubernetes/VaultSubKeyChallenge.java
- src/main/resources/explanations/challenge56_reason.adoc

Visual diff screenshots will be available shortly...


Preview built by GitHub Actions

@github-actions
Copy link

📸 Visual Diff Ready!

Screenshots comparing your changes with the main branch are available:

📁 Download Visual Diff Artifacts

🖼️ Included screenshots:

  • pr-home.png vs main-home.png - Welcome page comparison
  • pr-about.png vs main-about.png - About page comparison
  • pr-challenge.png vs main-challenge.png - Challenge page comparison

🔍 How to review:

  1. Download the artifact zip file
  2. Extract and compare the pr-* and main-* images side by side
  3. Look for visual differences in layout, styling, and content

💡 Tip: Use an image comparison tool or open both images in separate browser tabs to spot differences easily.


Visual diff generated by GitHub Actions • PR #2408

@commjoen commjoen marked this pull request as ready for review March 1, 2026 06:42
@commjoen commjoen merged commit bfcf5b0 into master Mar 1, 2026
21 checks passed
@commjoen commjoen deleted the copilot/update-spring-boot-version branch March 1, 2026 06:42
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Update to spring boot 4.0

2 participants