SampleMethodSecurityApplicationTests fails in CI and after some digging it appears to be due to WebMvcConfigurationSupport.getMessageConverters() order changing.
In Spring Boot 3.5 the order is:
org.springframework.http.converter.ByteArrayHttpMessageConverter
org.springframework.http.converter.StringHttpMessageConverter
org.springframework.http.converter.ResourceHttpMessageConverter
org.springframework.http.converter.ResourceRegionHttpMessageConverter
org.springframework.http.converter.support.AllEncompassingFormHttpMessageConverter
org.springframework.http.converter.xml.MappingJackson2XmlHttpMessageConverter
org.springframework.http.converter.json.MappingJackson2HttpMessageConverter
org.springframework.http.converter.cbor.MappingJackson2CborHttpMessageConverter
In the current 4.0.x SNAPSHOT it is:
org.springframework.http.converter.ByteArrayHttpMessageConverter
org.springframework.http.converter.StringHttpMessageConverter
org.springframework.http.converter.ResourceHttpMessageConverter
org.springframework.http.converter.ResourceRegionHttpMessageConverter
org.springframework.http.converter.json.MappingJackson2HttpMessageConverter
org.springframework.http.converter.cbor.MappingJackson2CborHttpMessageConverter
org.springframework.http.converter.yaml.MappingJackson2YamlHttpMessageConverter
org.springframework.http.converter.xml.MappingJackson2XmlHttpMessageConverter
org.springframework.http.converter.support.AllEncompassingFormHttpMessageConverter
The critical thing here is that AllEncompassingFormHttpMessageConverter is behind MappingJackson2HttpMessageConverter. This causes SampleMethodSecurityApplicationTests.testDenied to fail because rather than HttpEntity sends a body that is converted to JSON rather than a form.
Comment From: philwebb
See spring-projects/spring-framework#33894
Comment From: philwebb
I've put in a temporary workaround until we decide which order we should adopt.