Spring Security 5 to 6 to 7 Migration: SecurityFilterChain, Lambda DSL, and the Silent Authorization Changes
Of every breaking change in the Spring Boot 2 → 3 era, the removal of WebSecurityConfigurerAdapter generated the most confused stack traces I've debugged — because security configuration is the one place where "it compiles and runs" tells you almost nothing about whether it still protects anything. This guide migrates Spring Security 5 configurations to the 6.x component model (Spring Boot 3.x), covers what tightens further in Spring Security 7 (Spring Boot 4), and flags the places where a mechanical conversion quietly changes your authorization behaviour.