86e0f1341e
Bump com.fasterxml.jackson:jackson-bom from 2.18.6 to 2.18.7
...
Bumps [com.fasterxml.jackson:jackson-bom](https://github.com/FasterXML/jackson-bom ) from 2.18.6 to 2.18.7.
- [Commits](https://github.com/FasterXML/jackson-bom/compare/jackson-bom-2.18.6...jackson-bom-2.18.7 )
---
updated-dependencies:
- dependency-name: com.fasterxml.jackson:jackson-bom
dependency-version: 2.18.7
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
2026-05-21 12:38:00 -06:00
cea6618265
Bump org.hibernate.orm:hibernate-core from 6.6.49.Final to 6.6.50.Final
...
Bumps [org.hibernate.orm:hibernate-core](https://github.com/hibernate/hibernate-orm ) from 6.6.49.Final to 6.6.50.Final.
- [Release notes](https://github.com/hibernate/hibernate-orm/releases )
- [Changelog](https://github.com/hibernate/hibernate-orm/blob/6.6.50/changelog.txt )
- [Commits](https://github.com/hibernate/hibernate-orm/compare/6.6.49...6.6.50 )
---
updated-dependencies:
- dependency-name: org.hibernate.orm:hibernate-core
dependency-version: 6.6.50.Final
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
2026-05-21 12:36:57 -06:00
5bf8f641f1
Bump spring-io/spring-gradle-build-action from 2.0.5 to 2.0.6
...
Bumps [spring-io/spring-gradle-build-action](https://github.com/spring-io/spring-gradle-build-action ) from 2.0.5 to 2.0.6.
- [Release notes](https://github.com/spring-io/spring-gradle-build-action/releases )
- [Commits](https://github.com/spring-io/spring-gradle-build-action/compare/efc55f07f4dfa22f2afd97f9ea1be4212eeed737...c8668747d7c264864c8c7f7026d0d277d14a78dc )
---
updated-dependencies:
- dependency-name: spring-io/spring-gradle-build-action
dependency-version: 2.0.6
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
2026-05-21 12:36:52 -06:00
8b9f556d8f
Bump gradle-wrapper from 8.14.4 to 8.14.5
...
Bumps [gradle-wrapper](https://github.com/gradle/gradle ) from 8.14.4 to 8.14.5.
- [Release notes](https://github.com/gradle/gradle/releases )
- [Commits](https://github.com/gradle/gradle/compare/v8.14.4...v8.14.5 )
---
updated-dependencies:
- dependency-name: gradle-wrapper
dependency-version: 8.14.5
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
2026-05-21 12:36:46 -06:00
d9b8a8ec54
Bump spring-io/spring-release-actions from 0.0.4 to 0.0.5
...
Bumps [spring-io/spring-release-actions](https://github.com/spring-io/spring-release-actions ) from 0.0.4 to 0.0.5.
- [Release notes](https://github.com/spring-io/spring-release-actions/releases )
- [Commits](https://github.com/spring-io/spring-release-actions/compare/2420148725bebe44bd59a575a9b1961ca4459b0b...a1f321783a0769dd2aea4fad6c2ae2f95a52b885 )
---
updated-dependencies:
- dependency-name: spring-io/spring-release-actions
dependency-version: 0.0.5
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
2026-05-21 12:36:42 -06:00
4e04c266be
Bump antora from 3.2.0-alpha.11 to 3.2.0-alpha.12 in /docs
...
---
updated-dependencies:
- dependency-name: antora
dependency-version: 3.2.0-alpha.12
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
2026-05-21 12:36:37 -06:00
9b14465243
Align Assertions in Builder with Deprecated Constructor
...
The deprecated (introspectionUri, clientId, clientSecret) constructors
that the builders replaced explicitly asserted non-null clientId and
clientSecret. Bring the builder's build() in line with that contract by
asserting at the API boundary rather than relying on downstream classes
to enforce it.
Closes gh-19201
Signed-off-by: Josh Cummings <3627351+jzheaux@users.noreply.github.com >
2026-05-21 10:36:10 -06:00
b075f0df02
Decode percent-encoded values
...
Closes gh-19136
Signed-off-by: Josh Cummings <3627351+jzheaux@users.noreply.github.com >
2026-04-29 08:57:16 -06:00
6343002b32
Next development version
2026-04-20 18:55:26 +00:00
0a9d4dc8fc
Release 6.5.10
2026-04-20 17:54:21 +00:00
3d4e20597a
Merge remote-tracking branch 'oss/6.5.x' into 6.5.x
2026-04-20 11:49:17 -06:00
81bd52ae48
Bump org.hibernate.orm:hibernate-core from 6.6.48.Final to 6.6.49.Final
...
Bumps [org.hibernate.orm:hibernate-core](https://github.com/hibernate/hibernate-orm ) from 6.6.48.Final to 6.6.49.Final.
- [Release notes](https://github.com/hibernate/hibernate-orm/releases )
- [Changelog](https://github.com/hibernate/hibernate-orm/blob/6.6.49/changelog.txt )
- [Commits](https://github.com/hibernate/hibernate-orm/compare/6.6.48...6.6.49 )
---
updated-dependencies:
- dependency-name: org.hibernate.orm:hibernate-core
dependency-version: 6.6.49.Final
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
2026-04-20 11:27:51 -06:00
25b6af2738
Bump org.springframework:spring-framework-bom from 6.2.17 to 6.2.18
...
Bumps [org.springframework:spring-framework-bom](https://github.com/spring-projects/spring-framework ) from 6.2.17 to 6.2.18.
- [Release notes](https://github.com/spring-projects/spring-framework/releases )
- [Commits](https://github.com/spring-projects/spring-framework/compare/v6.2.17...v6.2.18 )
---
updated-dependencies:
- dependency-name: org.springframework:spring-framework-bom
dependency-version: 6.2.18
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
2026-04-20 11:27:29 -06:00
95987bffc1
Bump org.apache.maven:maven-resolver-provider from 3.9.14 to 3.9.15
...
Bumps org.apache.maven:maven-resolver-provider from 3.9.14 to 3.9.15.
---
updated-dependencies:
- dependency-name: org.apache.maven:maven-resolver-provider
dependency-version: 3.9.15
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
2026-04-20 11:27:07 -06:00
6e5f8f2a1d
Merge remote-tracking branch 'origin/6.5.x' into 6.5.x
2026-04-20 09:51:26 -06:00
4187af38b2
Verify token deletion in JdbcOneTimeTokenService
2026-04-18 12:30:30 -04:00
5b638a54a4
Use SHA Hashes
...
This commit updates workflows that were using tags to instead
use SHA hashes to reference actions and workflows
Signed-off-by: Josh Cummings <3627351+jzheaux@users.noreply.github.com >
2026-04-17 14:15:50 -06:00
51eef2b980
Bump io.projectreactor:reactor-bom from 2024.0.16 to 2024.0.17
...
Bumps [io.projectreactor:reactor-bom](https://github.com/reactor/reactor ) from 2024.0.16 to 2024.0.17.
- [Release notes](https://github.com/reactor/reactor/releases )
- [Commits](https://github.com/reactor/reactor/compare/2024.0.16...2024.0.17 )
---
updated-dependencies:
- dependency-name: io.projectreactor:reactor-bom
dependency-version: 2024.0.17
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
2026-04-17 11:57:33 -06:00
302cfb116e
Bump @springio/antora-extensions from 1.14.10 to 1.14.11 in /docs
...
Bumps [@springio/antora-extensions](https://github.com/spring-io/antora-extensions ) from 1.14.10 to 1.14.11.
- [Changelog](https://github.com/spring-io/antora-extensions/blob/main/CHANGELOG.adoc )
- [Commits](https://github.com/spring-io/antora-extensions/compare/v1.14.10...v1.14.11 )
---
updated-dependencies:
- dependency-name: "@springio/antora-extensions"
dependency-version: 1.14.11
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
2026-04-17 11:08:19 -06:00
695ea1717f
Bump org.hibernate.orm:hibernate-core from 6.6.47.Final to 6.6.48.Final
...
Bumps [org.hibernate.orm:hibernate-core](https://github.com/hibernate/hibernate-orm ) from 6.6.47.Final to 6.6.48.Final.
- [Release notes](https://github.com/hibernate/hibernate-orm/releases )
- [Changelog](https://github.com/hibernate/hibernate-orm/blob/6.6.48/changelog.txt )
- [Commits](https://github.com/hibernate/hibernate-orm/compare/6.6.47...6.6.48 )
---
updated-dependencies:
- dependency-name: org.hibernate.orm:hibernate-core
dependency-version: 6.6.48.Final
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
2026-04-17 11:07:58 -06:00
1206c2b141
Bump actions/upload-artifact from 7.0.0 to 7.0.1
...
Bumps [actions/upload-artifact](https://github.com/actions/upload-artifact ) from 7.0.0 to 7.0.1.
- [Release notes](https://github.com/actions/upload-artifact/releases )
- [Commits](https://github.com/actions/upload-artifact/compare/bbbca2ddaa5d8feaa63e36b76fdaad77386f024f...043fb46d1a93c77aae656e7c1c64a875d1fc6a0a )
---
updated-dependencies:
- dependency-name: actions/upload-artifact
dependency-version: 7.0.1
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
2026-04-17 11:07:36 -06:00
3539f06146
Bump spring-io/spring-release-actions from 0.0.3 to 0.0.4
...
Bumps [spring-io/spring-release-actions](https://github.com/spring-io/spring-release-actions ) from 0.0.3 to 0.0.4.
- [Release notes](https://github.com/spring-io/spring-release-actions/releases )
- [Commits](https://github.com/spring-io/spring-release-actions/compare/0.0.3...0.0.4 )
---
updated-dependencies:
- dependency-name: spring-io/spring-release-actions
dependency-version: 0.0.4
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
2026-04-17 11:07:08 -06:00
a317a3d866
Add Support for Always Running Additional Authentication Checks
...
Signed-off-by: Josh Cummings <3627351+jzheaux@users.noreply.github.com >
2026-04-15 21:07:39 -06:00
68b820ed09
Check Issuer with Issuer Provided
...
Signed-off-by: Josh Cummings <3627351+jzheaux@users.noreply.github.com >
2026-04-15 18:23:22 -06:00
44d32815b1
Bump @springio/antora-extensions from 1.14.9 to 1.14.10 in /docs
...
Bumps [@springio/antora-extensions](https://github.com/spring-io/antora-extensions ) from 1.14.9 to 1.14.10.
- [Changelog](https://github.com/spring-io/antora-extensions/blob/main/CHANGELOG.adoc )
- [Commits](https://github.com/spring-io/antora-extensions/compare/v1.14.9...v1.14.10 )
---
updated-dependencies:
- dependency-name: "@springio/antora-extensions"
dependency-version: 1.14.10
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
2026-04-07 10:29:49 -06:00
87c3335e01
Bump org.hibernate.orm:hibernate-core from 6.6.45.Final to 6.6.47.Final
...
Bumps [org.hibernate.orm:hibernate-core](https://github.com/hibernate/hibernate-orm ) from 6.6.45.Final to 6.6.47.Final.
- [Release notes](https://github.com/hibernate/hibernate-orm/releases )
- [Changelog](https://github.com/hibernate/hibernate-orm/blob/6.6.47/changelog.txt )
- [Commits](https://github.com/hibernate/hibernate-orm/compare/6.6.45...6.6.47 )
---
updated-dependencies:
- dependency-name: org.hibernate.orm:hibernate-core
dependency-version: 6.6.47.Final
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
2026-04-07 10:07:57 -06:00
eefbb4da64
Fix DefaultOidcUser.equals()
...
Closes gh-18622
2026-04-02 10:41:32 -04:00
a2793f31b4
Merge Add XML Based shouldWriteHeadersEagerly tests
...
Add XML Based shouldWriteHeadersEagerly tests
2026-04-01 12:53:29 -04:00
679a47a51d
Add XML Based shouldWriteHeadersEagerly tests
2026-04-01 11:37:39 -05:00
08fca57d12
Add Missing Serialization Support
...
Closed gh-19012
Signed-off-by: Josh Cummings <3627351+jzheaux@users.noreply.github.com >
2026-03-31 13:58:35 -06:00
acabacb971
Update Test to find SuppressWarnings
...
Signed-off-by: Josh Cummings <3627351+jzheaux@users.noreply.github.com >
2026-03-31 13:47:52 -06:00
1a130fca3c
Improve serialVersionUID check in tests
...
Signed-off-by: johnycho <shunnn215@gmail.com >
2026-03-31 13:47:50 -06:00
5a4ada04ac
Merge pull request #19004 from rwinch/CredentialRecordOwnerAuthorizationManager
...
Add CredentialRecordOwnerAuthorizationManager
2026-03-29 23:46:03 -04:00
a856baa6a8
Add CredentialRecordOwnerAuthorizationManager
...
Add CredentialRecordOwnerAuthorizationManager that verifies the
credential being deleted is owned by the currently authenticated user.
Also add an AuthorizationManager<Bytes> to WebAuthnRegistrationFilter
for the delete credential operation, defaulting to deny all, and wire it
up in WebAuthnConfigurer.
Per the WebAuthn specification [1], credential ids contain at least 16
bytes with at least 100 bits of entropy, making them practically
unguessable. The specification also advises that credential ids should
be kept private, as exposing them can leak personally identifying
information [2]. The CredentialRecordOwnerAuthorizationManager serves as
defense in depth: even if a credential id were somehow exposed, an
unauthorized user could not delete another user's credential.
[1] https://www.w3.org/TR/webauthn-3/#credential-id
[2] https://www.w3.org/TR/webauthn-3/#sctn-credential-id-privacy-leak
2026-03-29 21:54:27 -05:00
ac63cf4fa5
Polish CustomAuthorizationManager Docs
...
Issue gh-13967
Signed-off-by: Josh Cummings <3627351+jzheaux@users.noreply.github.com >
2026-03-27 16:45:25 -06:00
f6bb55effb
Fix documentation for Custom Authorization Manager
...
Closes gh-13967
Signed-off-by: as1605 <1605.aditya.singh@gmail.com >
2026-03-27 16:45:25 -06:00
85b756cb74
Update FilterChainProxy#getFilters(String) javadoc
...
Closes gh-18157
Signed-off-by: Tran Ngoc Nhan <ngocnhan.tran1996@gmail.com >
2026-03-27 16:09:50 -06:00
7441ce7f16
Bump spring-io/spring-security-release-tools/.github/workflows/perform-release.yml
...
Bumps [spring-io/spring-security-release-tools/.github/workflows/perform-release.yml](https://github.com/spring-io/spring-security-release-tools ) from 1.0.14 to 1.0.15.
- [Release notes](https://github.com/spring-io/spring-security-release-tools/releases )
- [Changelog](https://github.com/spring-io/spring-security-release-tools/blob/main/RELEASE.adoc )
- [Commits](https://github.com/spring-io/spring-security-release-tools/compare/729fed56d42122f88583aff1be35c0800b7d77e9...b92832ecbc7cbe969201e6beafbde0ee400cf095 )
---
updated-dependencies:
- dependency-name: spring-io/spring-security-release-tools/.github/workflows/perform-release.yml
dependency-version: 1.0.15
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
2026-03-27 13:25:46 -06:00
9dbcd8cf00
Bump spring-io/spring-security-release-tools/.github/workflows/update-scheduled-release-version.yml
...
Bumps [spring-io/spring-security-release-tools/.github/workflows/update-scheduled-release-version.yml](https://github.com/spring-io/spring-security-release-tools ) from 1.0.14 to 1.0.15.
- [Release notes](https://github.com/spring-io/spring-security-release-tools/releases )
- [Changelog](https://github.com/spring-io/spring-security-release-tools/blob/main/RELEASE.adoc )
- [Commits](https://github.com/spring-io/spring-security-release-tools/compare/729fed56d42122f88583aff1be35c0800b7d77e9...b92832ecbc7cbe969201e6beafbde0ee400cf095 )
---
updated-dependencies:
- dependency-name: spring-io/spring-security-release-tools/.github/workflows/update-scheduled-release-version.yml
dependency-version: 1.0.15
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
2026-03-27 13:25:35 -06:00
835d6c1fbd
Add Issuer Validation to withIssuerLocation Snippets
...
Closes gh-19000
Signed-off-by: Josh Cummings <3627351+jzheaux@users.noreply.github.com >
2026-03-27 13:22:24 -06:00
95b2cdf7f4
Clarify JavaDoc
...
Removed note about DelegatingJwtGrantedAuthoritiesConverter from
ExpressionJwtGrantedAuthoritiesConverter and further explained in
DelegatingJwtGrantedAuthoritiesConverter where it comes in handy.
Issue gh-18300
Signed-off-by: Josh Cummings <3627351+jzheaux@users.noreply.github.com >
2026-03-27 11:48:56 -06:00
3ecf84855e
Merge pull request #18989 from rwinch/gh-18970-null-oncommitted
...
Merge Handle null value in OnCommittedResponseWrapper header methods
2026-03-26 17:29:33 -04:00
0039bc0cf0
Handle null value in OnCommittedResponseWrapper header methods
...
Closes gh-18970
2026-03-26 14:50:44 -05:00
057e5181ea
Adjust Formatting
...
Issue gh-18805
Signed-off-by: Josh Cummings <3627351+jzheaux@users.noreply.github.com >
2026-03-25 15:19:29 -06:00
178ca56aaf
Fallback defaultTargetUrl if refererHeader is empty
...
Closes gh-18805
Signed-off-by: Tran Ngoc Nhan <ngocnhan.tran1996@gmail.com >
2026-03-25 15:19:29 -06:00
61ccf14953
Bump org.hibernate.orm:hibernate-core from 6.6.44.Final to 6.6.45.Final
...
Bumps [org.hibernate.orm:hibernate-core](https://github.com/hibernate/hibernate-orm ) from 6.6.44.Final to 6.6.45.Final.
- [Release notes](https://github.com/hibernate/hibernate-orm/releases )
- [Changelog](https://github.com/hibernate/hibernate-orm/blob/6.6.45/changelog.txt )
- [Commits](https://github.com/hibernate/hibernate-orm/compare/6.6.44...6.6.45 )
---
updated-dependencies:
- dependency-name: org.hibernate.orm:hibernate-core
dependency-version: 6.6.45.Final
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
2026-03-25 15:11:27 -06:00
6e683f2286
Fix ID Token auth_time validation
...
Closes gh-18839
2026-03-25 11:33:55 -04:00
b6e24db68c
Return Mono.empty on Empty POST
...
Closes gh-18973
Signed-off-by: Josh Cummings <3627351+jzheaux@users.noreply.github.com >
2026-03-23 18:12:21 -06:00
aeb5fc1fb0
Fix HttpSessionRequestCache#getMatchingRequest query string parsing
...
- URL parsing changed in framework 6.2, and fails when path contains a % sign.
- The HttpSessionRequestCache only needs to inspect the query string, not the full URL.
Fixes gh-16656
Signed-off-by: Daniel Garnier-Moiroux <git@garnier.wf >
2026-03-23 17:52:17 -06:00
62f33d3fcf
Add equals and hashCode to HttpMethodRequestMatcher
...
Closes gh-18911
Signed-off-by: Tran Ngoc Nhan <ngocnhan.tran1996@gmail.com >
2026-03-20 21:22:20 -06:00
dependabot[bot]