Migration guide

    public static abstract class AJwtSecurityConfigurer extends WebSecurityConfigurerAdapter {

    @Autowired
    protected ApplicationContext context;

    @Autowired
    @Qualifier(BASIC_AUTH_BEAN_NAME)
    protected AuthenticationEntryPoint authenticationEntryPoint;

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http
                .antMatcher(JwtRestServiceConfig.REST_API_URL_PREFIX + "/**")
                // As of Spring Security 4.0, CSRF protection is enabled by default.
                .csrf().disable()
                // Configure CORS
                .cors().and()
                .authorizeRequests()
                .antMatchers("/**").hasAnyAuthority(APP_ROLE__USER)
                .and()
                .httpBasic().authenticationEntryPoint(authenticationEntryPoint);
    }
}

@Bean
@Order(3)
protected SecurityFilterChain jwtSecurityFilterChain(HttpSecurity http, MvcRequestMatcher.Builder mvc) throws Exception {
        return http
        // CSRF and CORS
        .csrf(AbstractHttpConfigurer::disable)
        .cors(Customizer.withDefaults())

        .securityMatcher(mvc.pattern(url(JwtRestServiceConfig.REST_API_URL_PREFIX + "/**")))
        .authorizeHttpRequests(auth -> auth
        .requestMatchers(mvc.pattern(HttpMethod.OPTIONS, "**")).permitAll()
        .anyRequest().hasAnyAuthority(APP_ROLE__USER))
        .httpBasic(basic -> basic.authenticationEntryPoint(new HttpStatusEntryPoint(HttpStatus.UNAUTHORIZED)))
        .build();
        }

--add-opens java.base/java.util.concurrent=ALL-UNNAMED