Unfortunately I missed this problem earlier.

When running on Java 8 with spring-security, but without spring-security-web then there is an ArrayStoreException in the ErrorPageSecurityFilterConfiguration. This is caused by the work that was done for https://github.com/spring-projects/spring-boot/issues/26356. The ErrorPageSecurityFilterConfiguration should not use @ConditionalOnBean(WebInvocationPrivilegeEvaluator.class), but it should rather use @ConditionalOnBean(type = "org.springframework.security.web.access.WebInvocationPrivilegeEvaluator") or there should be a guard on the configuration class itself.

Most likely the same problem that exists for @ConditionalOnClass (https://github.com/spring-projects/spring-boot/issues/27846) exists for the @ConditonalOnBean as well.