I'm doing some early migration tests of an application based on Spring Boot 3.5.0 to Spring Boot 4.0.0-M1. It uses Spring Security to implement an OAuth 2 resource server, using Spring Security 7.0.0-M1.

Starting with Spring Boot 4.0.0-M1 and Spring Security 7.0.0-M1, I get an error during startup regarding a missing bean of type ReactiveJwtDecoder:

Parameter 0 of method setSecurityWebFilterChains in org.springframework.security.config.annotation.web.reactive.WebFluxSecurityConfiguration required a bean of type 'org.springframework.security.oauth2.jwt.ReactiveJwtDecoder' that could not be found.

I have read through the release notes at https://github.com/spring-projects/spring-security/releases/tag/7.0.0-M1, but can't find any guidelines on changes I need to make to get it working.

Anything I'm missing?

I can put together a minimal reproducer application, if it can be of help.

Comment From: magnus-larsson

Adding a dependency to the new spring-boot-starter-security-oauth2-resource-server - starter solved the problem.