ApiVersionConfigurer.addSupportedVersions is not enforced when controller methods(api) declare unsupported versions

[parvati-thapa]

While using ApiVersionConfigurer for path-based API versioning, I observed that versions declared via @GetMapping(version = "...") are still accepted even when they are not included in addSupportedVersions(...).
This creates an inconsistency where the configured supported versions are not strictly enforced, and controller-level mappings effectively override the configuration.

Configuration
@Override
public void configureApiVersioning(@NonNull ApiVersionConfigurer configurer) {
    configurer
            .usePathSegment(1)
            .setVersionRequired(true)
            .addSupportedVersions("1", "2");
}

Controller 
@RestController
@RequestMapping("/controller")
public class TestController {

 @GetMapping(value = "/users", version = "1")
    public String getResponseVersion1() {
        return "v1 response";
    }
 @GetMapping(value = "/users", version = "2")
    public String getResponseVersionTwo() {
        return "v2 response";
    }
    @GetMapping(value = "/users", version = "3")
    public String getResponseVersionThree() {
        return "v3 response";
    }
}

Expected Behavior
Request:
GET /controller/v3/users
Should fail with an error (e.g., 400 BAD_REQUEST) because:

• Version 3 is not listed in addSupportedVersions("1", "2")

Actual Behavior
The request:
GET /controller/v3/users
✔ Successfully resolves to the controller method annotated with @GetMapping(version = "3") and provide respective respons.

Analysis
It appears that:

• addSupportedVersions(...) does not act as a strict whitelist
• Controller-level version mappings (@GetMapping(version = "...")) take precedence
• Version validation is not enforced against the configured supported versions

Questions

1. Is this behaviour intentional?
2. Shouldn’t addSupportedVersions(...) act as a strict validation mechanism?
3. Is there a recommended way (within ApiVersionConfigurer) to enforce supported versions globally?
4. How can i restrict this behaviour and allow only supported versions configured in addSupportedVersions(..).
   Environment

• Spring Boot version: [4.0.4]
• Java version: [25]

Thank you!

[rstoyanchev]

By default supported versions are transparently detected from versions declared in request mappings for convenience. This is documented and expected, and it helps to avoid duplication. In your example there is no need for addSupportedVersions.

If you want to use only versions that are explicitly listed, you can set detectSupportedVersions to false.