Spring Security doesn't know that Spring MVC maps /foo, /foo.json and /foo/ all to the same handler. This change explicitly adds suffixes to the actuator endpoint matchers so they are properly protected.
