Hacktoberfest 2026: the issues maintainers tagged for October, open and beginner-friendly. Browse Hacktoberfest issues

[FEATURE] Spring Security 7 migration inspections: request matchers, and() chains, requiresChannel, apply()

Open
  • Is something wrong?
#814 0 comments 0 reactions 0 assignees View on GitHub

Maintainers usually reply within 1 day

Nobody has claimed this yet.

Assessment

Difficulty
5/5
Estimated time
Over a week
Newbie friendliness
35/100
Issue type
Feature
Clarity
Mostly clear
Activity status
Active
Tech stack
java, kotlin, spring, spring-boot
Domain
devtools

Research direction

Start by reading the existing Boot 4 migration inspections, especially SpringBoot4MockBeanMigrationInspection, and the Spring4UastLocalInspectionTool pattern in modules/spring-security or spring-core. Check how inspections gate on replacement symbols and recognize unresolved legacy names. Done means migration inspections cover the four API changes, with quick-fixes that preserve HTTP methods and add the Kotlin DSL import; the .and() chain item may need separate scope.

Written by the indexing model from the issue text.

Description

inspection
Component

Inspection

Describe the problem

Spring Security 7 (shipped with Spring Boot 4) removed or deprecated several configuration APIs that most Boot 3 security configurations use. The upgrade turns into a wall of compile errors with no guided replacement, and some changes alter behaviour silently.

Verified against spring-security-web / spring-security-config 7.1.1:

  • AntPathRequestMatcher and MvcRequestMatcher are removed. Replacement: PathPatternRequestMatcher.withDefaults().matcher(...), with a servlet prefix set on the builder (withDefaults().basePath("/mvc")), not on the matcher.
  • SecurityConfigurerAdapter.and() is removed, so http.csrf().disable().and().formLogin() chains no longer compile. Replacement: the lambda DSL http.csrf { it.disable() }.formLogin(withDefaults()), or the Kotlin http { … } DSL. The Kotlin DSL needs the org.springframework.security.config.annotation.web.invoke import, which the IDE does not always offer.
  • HttpSecurity.requiresChannel(...) is deprecated. Replacement: redirectToHttps(...).
  • apply(SecurityConfigurerAdapter) is gone in favour of with(configurer, customizer); apply(SecurityConfigurer) remains.
Describe the solution

A family of Spring Security 7 migration inspections, following the existing Boot 4 migration pattern (Spring4UastLocalInspectionTool, gate on the replacement symbol, e.g. PathPatternRequestMatcher):

  1. Unresolved/legacy AntPathRequestMatcher / MvcRequestMatcher usage → quick-fix to PathPatternRequestMatcher.withDefaults().matcher(<pattern>), keeping the HTTP method argument.
  2. .and() chains on HttpSecurity configurers → quick-fix converting the chain to the lambda DSL (Java) or the Kotlin http { } DSL, adding the invoke import.
  3. requiresChannel → redirectToHttps.
  4. apply(adapter) → with(adapter, withDefaults()).

Recognise unresolved legacy symbols by written name/import, because after the upgrade the old classes no longer resolve (same approach as SpringBoot4MockBeanMigrationInspection).

Additional context
  • There is no area label for spring-security; the code would live in modules/spring-security or spring-core.
  • Item 2 is the largest and could ship separately.
  • Motivated by a public Boot 3.5 → 4.0 migration report; behaviour-level changes it lists (LoginUrlAuthenticationEntryPoint relative redirects, @WithMockUser needing spring-boot-starter-security-test) are out of scope here.

Created automatically by github-issue-manager skill.

Dominant language
Kotlin
Stars
163
Forks
16
Avg merge
5h 35m
Merged PRs (30d)
183

Getting set up

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from explyt/spring-plugin

All issues in explyt/spring-plugin

Similar issues

More Kotlin issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.