Updating Vaadin 14.0.10 app to 14.5.4 results into MIME type error for resources loaded from /VAADIN/

I have a Vaadin 14.0.10 app with Spring Boot and a Spring Security configuration. I'm trying to update it to 14.5.4, but after the update, I get a blank page when I try to load the app. There are no errors on the server logs, but on the browser console, it shows two errors:

Refused to execute script from 'http://localhost:8080/login' because its MIME type ('text/html') is not executable, and strict MIME type checking is enabled.

and

login:1 Failed to load module script: The server responded with a non-JavaScript MIME type of "text/html". Strict MIME type checking is enforced for module scripts per HTML spec.

Looking at the Network tab, it seems that both webcomponents-loader.js and vaadin-bundle-*.cache.js get status 302 "script/redirect". Both files are served from under /VAADIN/build.

At first I thought this could be a Spring Security configuration problem, but in my WebSecurityConfigurerAdapter implementation, I have:

    @Override
    public void configure(WebSecurity web) throws Exception {

        web.ignoring().antMatchers(
                // Vaadin Flow static resources
                "/VAADIN/**",

                // the standard favicon URI
                "/favicon.ico",

                // the robots exclusion standard
                "/robots.txt",
                // and so on

...and the /VAADIN/** matcher should take care of giving access to the problematic files.

I've tried running mvn clean and I've deleted and repopulated node_modules to no avail.