- Shipped
- August 8, 2026 at 6:21 PM UTC
- Author
- Kamo
- Commit
- 6bb2dd6
kamo-shared-library 1.5.0 was republished today with spring-ws-core as a new transitive dependency, so Spring Boot now auto-registers a second servlet (MessageDispatcherServlet at /services/*). With two mappable servlets, Spring Security 6 will not guess whether a bare requestMatchers("/x/**") is MVC or Ant and throws while building the filter chain -- the application never starts. The running pod is from 25h ago and predates the republish, so it has no spring-ws and starts fine; the break arrives with the next build. BillingService already hit this in production (its deploys had been failing since 2026-07-03), and EmailService documents the same trap in ResourceServerConfig. Behaviour is unchanged: the chain still permits everything.