Spring Security 7 actually no longer uses HandlerMappingIntrospector, but it still uses it as a CorsConfigurationSource for its CorsFilter.

What Spring Security really needs is a PreFlightRequestHandler, we are missing is a dedicated PreFlightRequestFilter to go with it, similar to the one in WebFlux.