Cwikius-Spring/spring-security
1
0
Fork 0
mirror of synced 2026-08-31 14:35:18 +00:00
Code Issues Packages Projects Releases Wiki Activity
21,166 Commits 77 Branches 385 Tags
dependabot/github_actions/7.1.x/spring-io/spring-security-release-tools/dot-github/workflows/deploy-artifacts.yml-1.0.17
Commit Graph

21166 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
dependabot[bot] 105d1d9426 Bump spring-io/spring-security-release-tools/.github/workflows/deploy-artifacts.yml 
Bumps [spring-io/spring-security-release-tools/.github/workflows/deploy-artifacts.yml](https://github.com/spring-io/spring-security-release-tools) from 1.0.15 to 1.0.17.
- [Release notes](https://github.com/spring-io/spring-security-release-tools/releases)
- [Changelog](https://github.com/spring-io/spring-security-release-tools/blob/main/RELEASE.adoc)
- [Commits](https://github.com/spring-io/spring-security-release-tools/compare/b92832ecbc7cbe969201e6beafbde0ee400cf095...3f6cc7ffc137ca160061749d5f34dc30d5f36986)

---
updated-dependencies:
- dependency-name: spring-io/spring-security-release-tools/.github/workflows/deploy-artifacts.yml
  dependency-version: 1.0.17
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-08-28 00:36:39 +00:00
Josh Cummings edaae1d17d Merge branch '7.0.x' into 7.1.x 2026-08-26 10:17:34 -06:00
dependabot[bot] e8084090ff Bump org.hibernate.orm:hibernate-core from 7.4.5.Final to 7.4.6.Final 
Bumps [org.hibernate.orm:hibernate-core](https://github.com/hibernate/hibernate-orm) from 7.4.5.Final to 7.4.6.Final.
- [Release notes](https://github.com/hibernate/hibernate-orm/releases)
- [Changelog](https://github.com/hibernate/hibernate-orm/blob/7.4.6/changelog.txt)
- [Commits](https://github.com/hibernate/hibernate-orm/compare/7.4.5...7.4.6)

---
updated-dependencies:
- dependency-name: org.hibernate.orm:hibernate-core
  dependency-version: 7.4.6.Final
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-08-26 03:24:42 +00:00
dependabot[bot] 4773b40f02 Bump gradle-wrapper from 9.7.0 to 9.7.1 
Bumps [gradle-wrapper](https://github.com/gradle/gradle) from 9.7.0 to 9.7.1.
- [Release notes](https://github.com/gradle/gradle/releases)
- [Commits](https://github.com/gradle/gradle/compare/v9.7.0...v9.7.1)

---
updated-dependencies:
- dependency-name: gradle-wrapper
  dependency-version: 9.7.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-08-24 03:28:40 +00:00
dependabot[bot] 9a4a965b0d Bump io.spring.gradle:spring-security-release-plugin 
Bumps [io.spring.gradle:spring-security-release-plugin](https://github.com/spring-io/spring-security-release-tools) from 1.0.15 to 1.0.16.
- [Release notes](https://github.com/spring-io/spring-security-release-tools/releases)
- [Changelog](https://github.com/spring-io/spring-security-release-tools/blob/main/RELEASE.adoc)
- [Commits](https://github.com/spring-io/spring-security-release-tools/compare/v1.0.15...v1.0.16)

---
updated-dependencies:
- dependency-name: io.spring.gradle:spring-security-release-plugin
  dependency-version: 1.0.16
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-08-24 03:27:38 +00:00
Josh Cummings 0bae8a73d1 Next Development Version 
Signed-off-by: Josh Cummings <3627351+jzheaux@users.noreply.github.com>
 2026-08-21 09:14:37 -06:00
Josh Cummings 461ccd817d Next Development Version 
Signed-off-by: Josh Cummings <3627351+jzheaux@users.noreply.github.com>
 2026-08-21 09:14:09 -06:00
Josh Cummings 8dc341af8c Merge branch '7.0.x' into 7.1.x 
Closes gh-19572
 2026-08-20 16:58:02 -06:00
Josh Cummings 381c556f78 Add Release Announcement Workflows 
Closes gh-19571

Signed-off-by: Josh Cummings <3627351+jzheaux@users.noreply.github.com>
 2026-08-20 16:57:48 -06:00
Josh Cummings 6b2f892e66 Merge branch '7.0.x' into 7.1.x 
Closes gh-19567
# Conflicts:
#	config/src/main/java/org/springframework/security/config/annotation/web/configurers/oauth2/server/resource/DPoPAuthenticationConfigurer.java
#	config/src/main/java/org/springframework/security/config/annotation/web/configurers/oauth2/server/resource/OAuth2ResourceServerConfigurer.java
#	config/src/test/java/org/springframework/security/config/annotation/web/configurers/oauth2/server/resource/DPoPAuthenticationTests.java
#	gradle/libs.versions.toml
#	oauth2/oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/server/authorization/InMemoryOAuth2AuthorizationService.java
#	oauth2/oauth2-jose/src/main/java/org/springframework/security/oauth2/jwt/DPoPProofJwtDecoderFactory.java
#	oauth2/oauth2-jose/src/main/java/org/springframework/security/oauth2/jwt/DPoPProofReplayValidator.java
#	oauth2/oauth2-resource-server/src/main/java/org/springframework/security/oauth2/server/resource/authentication/DPoPAuthenticationProvider.java
 2026-08-20 12:23:20 -06:00
Josh Cummings 3b276e6c0d Update to Spring Data 2025.1.7 
Closes gh-19485

Signed-off-by: Josh Cummings <3627351+jzheaux@users.noreply.github.com>
 2026-08-20 11:24:08 -06:00
Josh Cummings f2115fbef8 Update to Spring LDAP 4.0.5 
Closes gh-19486

Signed-off-by: Josh Cummings <3627351+jzheaux@users.noreply.github.com>
 2026-08-20 11:24:01 -06:00
Josh Cummings 298335a57e Update to Micrometer 1.16.7 
Closes gh-19484

Signed-off-by: Josh Cummings <3627351+jzheaux@users.noreply.github.com>
 2026-08-20 11:23:55 -06:00
Josh Cummings c6566ee772 Update to Reactor 2025.0.7 
Closes gh-19483

Signed-off-by: Josh Cummings <3627351+jzheaux@users.noreply.github.com>
 2026-08-20 11:23:50 -06:00
Josh Cummings 7442214225 Update to Spring Framework 7.0.9 
Closes gh-19482

Signed-off-by: Josh Cummings <3627351+jzheaux@users.noreply.github.com>
 2026-08-20 11:23:44 -06:00
Josh Cummings 0123ae0981 Deprecate AesBytesEncryptor 
This commit separates AesBytesEncryptor into two separate
implememtations, allowing for a migration away from default
arrangements that used a null IV

Signed-off-by: Josh Cummings <3627351+jzheaux@users.noreply.github.com>
 2026-08-20 11:23:36 -06:00
Josh Cummings 11a648d106 Improve Equivalence Tests 
This commit adds equals and hashCode implementations as well
as a readResolve implementation to ensure that deserialization
mechanisms can correctly assess the equality of a constnat
and a corresponding deserialized instance. For defense-in-depth
reasons, this commit also favors .equals over == for these
constants.

Signed-off-by: Josh Cummings <3627351+jzheaux@users.noreply.github.com>
 2026-08-20 11:23:29 -06:00
Joe Grandja 536e09756c Bind UnboundIdContainer to loopback address 2026-08-20 11:23:22 -06:00
Joe Grandja ac15cdbea3 Apply html encoding in DefaultConsentPage 2026-08-20 11:23:14 -06:00
Joe Grandja ad812aefc4 Provide ability to configure DPoP proof replay 2026-08-20 11:23:08 -06:00
Josh Cummings d8769fb183 Use Constant-Time Comparison 
This commit updates password encoders to use a
constant-time comparison method to defend against
timing attacks

Signed-off-by: Josh Cummings <3627351+jzheaux@users.noreply.github.com>
 2026-08-20 11:23:02 -06:00
Josh Cummings ae997a4f46 Use Utf8#isEqual 
Signed-off-by: Josh Cummings <3627351+jzheaux@users.noreply.github.com>
 2026-08-20 11:22:55 -06:00
Josh Cummings bbc6273abf Use Constant-Time Equals 
This commit updates the filter to use constant-time
equals for sensitive material

Signed-off-by: Josh Cummings <3627351+jzheaux@users.noreply.github.com>
 2026-08-20 11:22:49 -06:00
Josh Cummings 475af0d3db Use Constant-Time Equals 
This commit updates the filter to use constant-time
equals for sensitive material

Signed-off-by: Josh Cummings <3627351+jzheaux@users.noreply.github.com>
 2026-08-20 11:22:43 -06:00
Josh Cummings f8a61e66d1 Add Utf8#isEqual 
This commit adds a constant-time equals method,
useful for comparing password hashes or other
sensitive material

Signed-off-by: Josh Cummings <3627351+jzheaux@users.noreply.github.com>
 2026-08-20 11:22:36 -06:00
Josh Cummings 8830e39073 Use MessageDigest#isEqual 
This commit favors constant-time comparison
to mitigate timing attacks

Signed-off-by: Josh Cummings <3627351+jzheaux@users.noreply.github.com>
 2026-08-20 11:22:31 -06:00
Josh Cummings 304cc21523 Add Tests for User and Device Code 
Signed-off-by: Josh Cummings <3627351+jzheaux@users.noreply.github.com>
 2026-08-20 11:22:25 -06:00
Josh Cummings 7048b08b9c Update to Spring Data 2026.0.1 
Closes gh-19490

Signed-off-by: Josh Cummings <3627351+jzheaux@users.noreply.github.com>
 2026-08-20 11:21:29 -06:00
Josh Cummings ff108a49a5 Update to Spring LDAP 4.1.1 
Closes gh-19491

Signed-off-by: Josh Cummings <3627351+jzheaux@users.noreply.github.com>
 2026-08-20 11:21:29 -06:00
Josh Cummings 9a70d73036 Update to Micrometer 1.17.1 
Closes gh-19489

Signed-off-by: Josh Cummings <3627351+jzheaux@users.noreply.github.com>
 2026-08-20 11:21:28 -06:00
Josh Cummings cf613ad2d3 Update to Reactor 2025.0.7 
Closes gh-19488

Signed-off-by: Josh Cummings <3627351+jzheaux@users.noreply.github.com>
 2026-08-20 11:21:28 -06:00
Josh Cummings fdec2d7617 Update to Spring Framework 7.0.9 
Closes gh-19487

Signed-off-by: Josh Cummings <3627351+jzheaux@users.noreply.github.com>
 2026-08-20 11:21:28 -06:00
Josh Cummings 748e3c9cf0 Use jspecify Nullable in DPoPProofReplayValidator 
org.springframework.lang.Nullable is banned by the
bannedNullabilityImports checkstyle rule on this line; the embargoed
commit that introduced this file predates that rule's adoption here.
Switch to org.jspecify.annotations.Nullable to match the rest of the
codebase (already used correctly elsewhere in this same file).

Signed-off-by: Josh Cummings <3627351+jzheaux@users.noreply.github.com>
 2026-08-20 11:21:21 -06:00
Josh Cummings 057581584a Align Null Behavior 
Previously, ExternalInetAddressMatcher treated a null InetAddress
as external by negating InternalInetAddressMatcher's result.

This commit makes ExternalInetAddressMatcher return false for a
null address, so that neither the internal nor the external
matcher classifies an unknown address as a match.

Signed-off-by: Josh Cummings <3627351+jzheaux@users.noreply.github.com>
 2026-08-20 11:21:20 -06:00
Josh Cummings 502ecf9241 Deprecate AesBytesEncryptor 
This commit separates AesBytesEncryptor into two separate
implememtations, allowing for a migration away from default
arrangements that used a null IV

Signed-off-by: Josh Cummings <3627351+jzheaux@users.noreply.github.com>
 2026-08-20 11:21:20 -06:00
Josh Cummings 7db67f923c Improve Equivalence Tests 
This commit adds equals and hashCode implementations as well
as a readResolve implementation to ensure that deserialization
mechanisms can correctly assess the equality of a constnat
and a corresponding deserialized instance. For defense-in-depth
reasons, this commit also favors .equals over == for these
constants.

Signed-off-by: Josh Cummings <3627351+jzheaux@users.noreply.github.com>
 2026-08-20 11:21:14 -06:00
Joe Grandja 35859220cb Bind UnboundIdContainer to loopback address 2026-08-20 11:21:14 -06:00
Joe Grandja 3836091fe2 Apply html encoding in DefaultConsentPage 2026-08-20 11:21:14 -06:00
Joe Grandja 4c41928bc7 Provide ability to configure DPoP proof replay 2026-08-20 11:21:13 -06:00
Josh Cummings 61be628ad6 Use Constant-Time Comparison 
This commit updates password encoders to use a
constant-time comparison method to defend against
timing attacks

Signed-off-by: Josh Cummings <3627351+jzheaux@users.noreply.github.com>
 2026-08-20 11:21:06 -06:00
Josh Cummings e6208a4832 Use Utf8#isEqual 
Signed-off-by: Josh Cummings <3627351+jzheaux@users.noreply.github.com>
 2026-08-20 11:21:06 -06:00
Josh Cummings 01452e328f Use Constant-Time Equals 
This commit updates the filter to use constant-time
equals for sensitive material

Signed-off-by: Josh Cummings <3627351+jzheaux@users.noreply.github.com>
 2026-08-20 11:21:05 -06:00
Josh Cummings 836190546d Use Constant-Time Equals 
This commit updates the filter to use constant-time
equals for sensitive material

Signed-off-by: Josh Cummings <3627351+jzheaux@users.noreply.github.com>
 2026-08-20 11:21:05 -06:00
Josh Cummings 9f94fb92c5 Add Utf8#isEqual 
This commit adds a constant-time equals method,
useful for comparing password hashes or other
sensitive material

Signed-off-by: Josh Cummings <3627351+jzheaux@users.noreply.github.com>
 2026-08-20 11:20:58 -06:00
Josh Cummings 47804ee834 Use MessageDigest#isEqual 
This commit favors constant-time comparison
to mitigate timing attacks

Signed-off-by: Josh Cummings <3627351+jzheaux@users.noreply.github.com>
 2026-08-20 11:20:58 -06:00
Josh Cummings 865085e0b0 Add Tests for User and Device Code 
Signed-off-by: Josh Cummings <3627351+jzheaux@users.noreply.github.com>
 2026-08-20 11:20:58 -06:00
Josh Cummings 15a31d7dd7 Check isAnyLocalAddress 
This commit updates InternalInetAddressMatcher to check
InetAddress#isAnyLocalAddress in order to catch
additional IP addresses

Signed-off-by: Josh Cummings <3627351+jzheaux@users.noreply.github.com>
 2026-08-20 11:20:58 -06:00
dependabot[bot] 9d8026fcf3 Bump com.fasterxml.jackson:jackson-bom from 2.22.1 to 2.22.2 
Bumps [com.fasterxml.jackson:jackson-bom](https://github.com/FasterXML/jackson-bom) from 2.22.1 to 2.22.2.
- [Commits](https://github.com/FasterXML/jackson-bom/compare/jackson-bom-2.22.1...jackson-bom-2.22.2)

---
updated-dependencies:
- dependency-name: com.fasterxml.jackson:jackson-bom
  dependency-version: 2.22.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-08-20 03:19:14 +00:00
Josh Cummings 4e92ea215c Merge branch '7.0.x' into 7.1.x 2026-08-19 16:55:38 -06:00
Tadaya Tsuyukubo d111029078 Prevent sharing SecurityContext across threads 
`SecurityContextHolderThreadLocalAccessor` currently propagates the
same `SecurityContext` to other threads when Micrometer
Context Propagation is used. This leads to unintended sharing of
mutable state and can cause authentication to leak between threads.

This change updates the accessor to create a new
`SecurityContext` for the target thread while reusing only the
`Authentication` value. Each thread now receives its own
`SecurityContext` instance, preventing cross-thread interference and
aligning with recommended `SecurityContext` usage.

Signed-off-by: Tadaya Tsuyukubo <tadaya@ttddyy.net>
 2026-08-19 16:54:43 -06:00