I think the previous code is more correct, all the values are aggregated.

Please note that with:

     @Controller("/example")
    @RolesAllowed("isAuthenticated()")
    static class ExampleController {

        @Get("/admin")
        @RolesAllowed({"ROLE_ADMIN", "ROLE_X"})
        void  admin(HttpRequest<?> request) {
        }

old stringValues returns "ROLE_ADMIN", "ROLE_X", "isAuthenticated()" while getValues returns "ROLE_ADMIN", "ROLE_X". The latter looks correct to me.

There may be some behaviour inconsistency here, but this change has the potential to break a lot of things. I don't think we should be merging this 2 days before GA

I am ok not merging it. Do you want me to target 5.0.x as the PR base?

@sdelamo You might need to modify the code that reads the values to only take method annotation metadata