Adopt Spring Boot 4.1.0: migrate ${@environment.getProperty(...)} template pattern for Thymeleaf 3.1.5 restricted expressions #82

Deferred from #81 (dependency updates).

Problem

Spring Boot 4.0.4 → 4.1.0 bundles Thymeleaf 3.1.2 → 3.1.5. Under 3.1.5, expressions using Spring bean access — ${@environment.getProperty('...')} and ${@environment.acceptsProfiles(...)} — are evaluated in a restricted expression context while the thymeleaf-layout-dialect decorates the page, and throw:

org.thymeleaf.exceptions.TemplateProcessingException:
Instantiation of new objects and access to static classes or parameters is forbidden in this context

Confirmed it is the Thymeleaf bump, not the layout dialect: the failure reproduces with layout-dialect both 3.4.0 and 4.0.1 under Boot 4.1.0, and does not occur on Boot 4.0.4 (Thymeleaf 3.1.2). Two integration tests fail on the render (SecurityConfigurationTest, MfaChallengeFlowIntegrationTest), but the breakage is app-wide at render time.

Scope

The ${@environment...} idiom appears in ~20 places across ~10 templates:

• index.html, layout.html, fragments/header.html, fragments/footer.html
• user/register.html, user/login.html, user/registration-pending-verification.html, user/request-new-verification-email.html
• event/details.html

Note several usages are inside #{message(...)} arguments (e.g. register.html, request-new-verification-email.html), so a mechanical find/replace is not sufficient.

Likely fix

Stop using bean access in templates. Expose the framework config URIs (login/registration/forgot-password/update/loginAction page URIs, copyright year, active profiles) as model attributes via a @ControllerAdvice @ModelAttribute, then reference ${loginPageURI} etc. in templates. Verify with the full test suite plus Playwright E2E rendering.

Framework relevance

This @environment template idiom is used by the SpringUserFramework demo and is likely mirrored in downstream apps, so the migration guidance may belong in the framework docs / reference templates as well.

Blocks

• Spring Boot 4.1.0 adoption (and the BOM-managed bumps it carries: spring-security 7.0.4→7.1.0, hibernate-validator 9.0.1→9.1.3, thymeleaf-extras-springsecurity6, postgresql, lombok)