Previiously, Spring HATEOAS pulled in the Spring WebMVC and apparently CorsRegistry, referenced from RepositoryRestConfiguration (unexpectedly) lives in that module. We now explicitly declare Spring WebMVC as dependency of Spring Data REST Core for the time being until [0] is resolved. Related tickets: [0] spring-projects/spring-framework#22458