Cwikius-Spring/spring-security
1
0
Fork 0
mirror of synced 2026-08-30 22:15:07 +00:00
Code Issues Packages Projects Releases Wiki Activity
21,134 Commits 76 Branches 385 Tags
dependabot/gradle/main/org.seleniumhq.selenium-selenium-java-4.47.0
Commit Graph

21134 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
dependabot[bot] 8cab91b485 Bump org.seleniumhq.selenium:selenium-java from 4.43.0 to 4.47.0 
Bumps [org.seleniumhq.selenium:selenium-java](https://github.com/SeleniumHQ/selenium) from 4.43.0 to 4.47.0.
- [Release notes](https://github.com/SeleniumHQ/selenium/releases)
- [Commits](https://github.com/SeleniumHQ/selenium/compare/selenium-4.43.0...selenium-4.47.0)

---
updated-dependencies:
- dependency-name: org.seleniumhq.selenium:selenium-java
  dependency-version: 4.47.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-08-14 03:06:18 +00:00
Josh Cummings 82241b6cb8 Merge branch '7.1.x' 
Closes gh-19549
 2026-08-13 15:59:03 -06:00
Josh Cummings 7cecfbb4db Merge branch '7.0.x' into 7.1.x 
Closes gh-19548
 2026-08-13 15:58:42 -06:00
dae won 5b923c78ea Validate Parameter in setPostAuthenticationChecks 
The null check in setPostAuthenticationChecks of
AbstractUserDetailsReactiveAuthenticationManager asserted the current
field value, which is initialized to a default and can never be null,
instead of the method parameter. As a result, null was silently
accepted and the next authenticate call failed with a raw
NullPointerException instead of failing fast with a clear message.

Closes gh-19276

Signed-off-by: dae won <eodnjs01477@gmail.com>
 2026-08-13 15:58:01 -06:00
Josh Cummings 6eb16dc35e Merge branch '7.1.x' 
Closes gh-19546
 2026-08-13 15:20:47 -06:00
Josh Cummings bd4f9a1644 Merge branch '7.0.x' into 7.1.x 
Closes gh-19545
 2026-08-13 15:20:20 -06:00
Tran Ngoc Nhan 65a1099ccb Correct validation logic in CasAuthenticationToken 
Closes gh-19368

Signed-off-by: Tran Ngoc Nhan <ngocnhan.tran1996@gmail.com>
 2026-08-13 15:19:26 -06:00
Josh Cummings 1ad93f45f8 Add Test Coverage for Implicit CORS Bean Detection 
Verify that <cors> detects a PreFlightRequestHandler bean and uses a
PreFlightRequestFilter when no explicit ref or
configuration-source-ref is given and no mvcHandlerMappingIntrospector
bean is present.

See gh-19542

Signed-off-by: Josh Cummings <3627351+jzheaux@users.noreply.github.com>
 2026-08-13 13:25:09 -06:00
Josh Cummings 8c9a8e3f6c Suppress Removal Warnings on RestOperations Usage 
Spring Framework 7.1 deprecates RestTemplate and related types for
removal. Suppress the resulting warnings at existing internal usage
sites until they are migrated to RestClient per gh-19027.

Closes gh-19544

Signed-off-by: Josh Cummings <3627351+jzheaux@users.noreply.github.com>
 2026-08-13 11:59:50 -06:00
Josh Cummings a8f54db7e4 Disable CORS Tests Relying on HandlerMappingIntrospector 
Spring Framework 7.1 removes HandlerMappingIntrospector-derived
implicit CORS handling for plain requests; these tests assert the
old behavior.

Closes gh-19543

Signed-off-by: Josh Cummings <3627351+jzheaux@users.noreply.github.com>
 2026-08-13 11:54:26 -06:00
Josh Cummings 24bfdc1dee Support Implicit CORS Bean Detection in <cors> Namespace 
Add CorsFilterFactoryBean so the <cors> XML element can detect a
CorsConfigurationSource or PreFlightRequestHandler bean implicitly,
matching CorsConfigurer's existing Java config behavior.

Closes gh-19542

Signed-off-by: Josh Cummings <3627351+jzheaux@users.noreply.github.com>
 2026-08-13 11:53:36 -06:00
Josh Cummings 8876c30b00 Disable Lowercase HTTP Method Firewall Test 
Spring Framework's HttpMethod#valueOf now normalizes casing, so
StrictServerWebExchangeFirewall no longer detects a non-canonical-case
HTTP method as distinct from its canonical form.

Closes gh-19541

Signed-off-by: Josh Cummings <3627351+jzheaux@users.noreply.github.com>
 2026-08-13 11:51:30 -06:00
Josh Cummings 94d36e603b Merge branch '7.1.x' 
Closes gh-19540
 2026-08-13 11:37:03 -06:00
Josh Cummings ade851b2f1 Merge branch '7.0.x' into 7.1.x 
Closes gh-19539
 2026-08-13 11:36:49 -06:00
junhyeong9812 9fdd2dc675 Lowercase username in changePassword lookup 
InMemoryUserDetailsManager keys its user map on the lower-cased
username everywhere except changePassword, which looked the current
user up with the raw name. A user whose username contains uppercase
letters could therefore not change its password. Lower-case the
lookup key to match the rest of the class.

Closes gh-19336

Signed-off-by: junhyeong9812 <pickjog@gmail.com>
 2026-08-13 11:35:59 -06:00
dependabot[bot] 86fe79a848 Bump org.apache.httpcomponents.client5:httpclient5 from 5.6.3 to 5.6.4 
Bumps [org.apache.httpcomponents.client5:httpclient5](https://github.com/apache/httpcomponents-client) from 5.6.3 to 5.6.4.
- [Changelog](https://github.com/apache/httpcomponents-client/blob/rel/v5.6.4/RELEASE_NOTES.txt)
- [Commits](https://github.com/apache/httpcomponents-client/compare/rel/v5.6.3...rel/v5.6.4)

---
updated-dependencies:
- dependency-name: org.apache.httpcomponents.client5:httpclient5
  dependency-version: 5.6.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-08-13 03:19:25 +00:00
dependabot[bot] 329e9e6d71 Bump org.apache.httpcomponents.client5:httpclient5 from 5.6.3 to 5.6.4 
Bumps [org.apache.httpcomponents.client5:httpclient5](https://github.com/apache/httpcomponents-client) from 5.6.3 to 5.6.4.
- [Changelog](https://github.com/apache/httpcomponents-client/blob/rel/v5.6.4/RELEASE_NOTES.txt)
- [Commits](https://github.com/apache/httpcomponents-client/compare/rel/v5.6.3...rel/v5.6.4)

---
updated-dependencies:
- dependency-name: org.apache.httpcomponents.client5:httpclient5
  dependency-version: 5.6.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-08-13 03:18:39 +00:00
Josh Cummings 09a3280442 Merge branch '7.1.x' 2026-08-11 19:41:02 -06:00
Josh Cummings 852e81640b Merge branch '7.0.x' into 7.1.x 2026-08-11 19:40:43 -06:00
Josh Cummings 2aa3c1ab2e Remove NullAway 
Issue gh-17816

Signed-off-by: Josh Cummings <3627351+jzheaux@users.noreply.github.com>
 2026-08-11 19:40:18 -06:00
Kim Tae Eun 17c58ef088 Remove BeanResolver Null Checks 
StandardEvaluationContext.setBeanResolver now accepts a nullable
BeanResolver, so the workarounds added for the original limitation
are no longer needed. This removes the explicit null guards (and
equivalent Optional.ofNullable idiom) as well as the
@SuppressWarnings("NullAway") annotations introduced to silence
the false positives.

In addition to the seven sites that explicitly referenced
spring-projects/spring-framework#35371, two sites in
spring-security-core followed the same workaround pattern without
the comment marker (AbstractSecurityExpressionHandler and
DefaultMethodSecurityExpressionHandler) and have also been
simplified.

Closes gh-17816

Signed-off-by: Kim Tae Eun <snowykte0426@naver.com>
 2026-08-11 18:37:09 -07:00
Josh Cummings 88aedba0bf Update What's New 
Issue gh-17655

Signed-off-by: Josh Cummings <3627351+jzheaux@users.noreply.github.com>
 2026-08-11 16:30:43 -06:00
Josh Cummings f95a956345 Merge branch '7.1.x' 2026-08-11 16:20:05 -06:00
Josh Cummings fd233120a8 Merge branch '7.0.x' into 7.1.x 2026-08-11 16:19:41 -06:00
Josh Cummings 30cc0f21a9 Fix Documentation Sample Structure 
Signed-off-by: Josh Cummings <3627351+jzheaux@users.noreply.github.com>
 2026-08-11 15:18:49 -07:00
Josh Cummings c096e45242 Support Account Status Checks in OneTimeTokenReactiveAuthenticationManager 
Add the same opt-in UserDetailsChecker support to
OneTimeTokenReactiveAuthenticationManager, mirroring
OneTimeTokenAuthenticationProvider for the reactive stack.

Issue gh-17655

Signed-off-by: Josh Cummings <3627351+jzheaux@users.noreply.github.com>
 2026-08-11 15:18:49 -07:00
Josh Cummings b3e262187c Make OneTimeTokenAuthenticationProvider Account Status Checks Opt-In 
OneTimeTokenAuthenticationProvider no longer validates account status
by default. Applications can opt in via setUserDetailsChecker, for
example by providing AccountStatusUserDetailsChecker to reject locked,
disabled, or expired accounts.

Issue gh-17655

Signed-off-by: Josh Cummings <3627351+jzheaux@users.noreply.github.com>
 2026-08-11 15:18:49 -07:00
Andrey Litvitski 64fa98da1a Validate account status in OneTimeTokenAuthenticationProvider 
The main problem is that OneTimeTokenAuthenticationProvider does not
extend from AbstractUserDetailsAuthenticationProvider, which has a
preauthentication check for user details. However, we do not need to
extend from it because it does not fit the context of the class. In this
regard, I decided to add my own checker to this commit, which performs a
preauthentication check before authorizing the account, similar to how
it is done in AbstractUserDetailsAuthenticationProvider. I also added a
test to OneTimeTokenAuthenticationProviderTests that identifies this
problem.

Closes gh-17655

Signed-off-by: Andrey Litvitski <andrey1010102008@gmail.com>
 2026-08-11 15:18:49 -07:00
Arz Meow 63306ad8ee Update One-Time Token Docs for Renamed APIs 
Replace deprecated `UriComponentsBuilder` usage and renamed
`oneTimeTokenLogin` DSL method references in the docs with their
current equivalents.

Closes gh-18367

Signed-off-by: Arz Meow <arthur37231@gmail.com>
 2026-08-11 14:47:25 -07:00
Tran Ngoc Nhan 24aec1d002 Fix broken Javadoc links 
Closes gh-19194

Signed-off-by: Tran Ngoc Nhan <ngocnhan.tran1996@gmail.com>
 2026-08-11 14:31:49 -07:00
Tran Ngoc Nhan 863753580c Fix Broken DefaultLoginPageGeneratingFilter Javadoc Link 
Use the `javadoc:` macro so the reference resolves correctly.

Signed-off-by: Tran Ngoc Nhan <ngocnhan.tran1996@gmail.com>
 2026-08-11 14:31:43 -07:00
Tran Ngoc Nhan fa92ce3758 Remove Unnecessary AuthorizationDecision Cast 
Closes gh-19282
 2026-08-11 14:30:52 -07:00
Josh Cummings 26b20b2dd2 Merge branch '7.1.x' 2026-08-11 14:00:54 -06:00
Josh Cummings e7a4349774 Merge branch '7.0.x' into 7.1.x 2026-08-11 14:00:37 -06:00
dependabot[bot] 22f4a5d4da Bump com.nimbusds:oauth2-oidc-sdk from 11.38.1 to 11.38.2 
Bumps [com.nimbusds:oauth2-oidc-sdk](https://bitbucket.org/connect2id/oauth-2.0-sdk-with-openid-connect-extensions) from 11.38.1 to 11.38.2 and com.nimbusds:nimbus-jose-jwt from 10.9 to 10.9.1, which oauth2-oidc-sdk 11.38.2 requires.
- [Changelog](https://bitbucket.org/connect2id/oauth-2.0-sdk-with-openid-connect-extensions/src/master/CHANGELOG.txt)
- [Commits](https://bitbucket.org/connect2id/oauth-2.0-sdk-with-openid-connect-extensions/branches/compare/11.38.2..11.38.1)

---
updated-dependencies:
- dependency-name: com.nimbusds:oauth2-oidc-sdk
  dependency-version: 11.38.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
- dependency-name: com.nimbusds:nimbus-jose-jwt
  dependency-version: 10.9.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-08-11 19:33:41 +00:00
dependabot[bot] 561f1bba0f Bump com.unboundid:unboundid-ldapsdk from 7.0.4 to 7.0.5 
Bumps [com.unboundid:unboundid-ldapsdk](https://github.com/pingidentity/ldapsdk) from 7.0.4 to 7.0.5.
- [Release notes](https://github.com/pingidentity/ldapsdk/releases)
- [Changelog](https://github.com/pingidentity/ldapsdk/blob/master/docs/release-notes.html)
- [Commits](https://github.com/pingidentity/ldapsdk/compare/7.0.4...7.0.5)

---
updated-dependencies:
- dependency-name: com.unboundid:unboundid-ldapsdk
  dependency-version: 7.0.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-08-11 12:00:52 -07:00
dependabot[bot] e4d43fb89a Bump com.nimbusds:oauth2-oidc-sdk from 11.38.1 to 11.38.2 
Bumps [com.nimbusds:oauth2-oidc-sdk](https://bitbucket.org/connect2id/oauth-2.0-sdk-with-openid-connect-extensions) from 11.38.1 to 11.38.2 and com.nimbusds:nimbus-jose-jwt from 10.9 to 10.9.1, which oauth2-oidc-sdk 11.38.2 requires.
- [Changelog](https://bitbucket.org/connect2id/oauth-2.0-sdk-with-openid-connect-extensions/src/master/CHANGELOG.txt)
- [Commits](https://bitbucket.org/connect2id/oauth-2.0-sdk-with-openid-connect-extensions/branches/compare/11.38.2..11.38.1)

---
updated-dependencies:
- dependency-name: com.nimbusds:oauth2-oidc-sdk
  dependency-version: 11.38.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
- dependency-name: com.nimbusds:nimbus-jose-jwt
  dependency-version: 10.9.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-08-11 17:59:52 +00:00
dependabot[bot] 268fce2616 Bump antora from 3.2.0-alpha.12 to 3.2.0-rc.2 in /docs 
---
updated-dependencies:
- dependency-name: antora
  dependency-version: 3.2.0-rc.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-08-11 10:27:36 -07:00
dependabot[bot] c4c547b73b Bump org.apache.kerby:kerb-simplekdc from 2.1.1 to 2.1.2 
Bumps org.apache.kerby:kerb-simplekdc from 2.1.1 to 2.1.2.

---
updated-dependencies:
- dependency-name: org.apache.kerby:kerb-simplekdc
  dependency-version: 2.1.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-08-11 10:27:26 -07:00
dependabot[bot] d487048224 Bump ch.qos.logback:logback-classic from 1.5.34 to 1.5.38 
Bumps [ch.qos.logback:logback-classic](https://github.com/qos-ch/logback) from 1.5.34 to 1.5.38.
- [Release notes](https://github.com/qos-ch/logback/releases)
- [Commits](https://github.com/qos-ch/logback/compare/v_1.5.34...v_1.5.38)

---
updated-dependencies:
- dependency-name: ch.qos.logback:logback-classic
  dependency-version: 1.5.38
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-08-11 10:27:10 -07:00
dependabot[bot] 1d15210ae2 Bump actions/checkout from 6.0.3 to 7.0.1 
Bumps [actions/checkout](https://github.com/actions/checkout) from 6.0.3 to 7.0.1.
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](https://github.com/actions/checkout/compare/df4cb1c069e1874edd31b4311f1884172cec0e10...3d3c42e5aac5ba805825da76410c181273ba90b1)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-version: 7.0.1
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-08-11 10:26:57 -07:00
dependabot[bot] 5f377e5ec2 Bump @springio/antora-extensions from 1.14.12 to 1.14.13 in /docs 
Bumps [@springio/antora-extensions](https://github.com/spring-io/antora-extensions) from 1.14.12 to 1.14.13.
- [Changelog](https://github.com/spring-io/antora-extensions/blob/main/CHANGELOG.adoc)
- [Commits](https://github.com/spring-io/antora-extensions/compare/v1.14.12...v1.14.13)

---
updated-dependencies:
- dependency-name: "@springio/antora-extensions"
  dependency-version: 1.14.13
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-08-11 10:26:13 -07:00
dependabot[bot] e107329766 Bump actions/setup-java from 5.2.0 to 5.7.0 
Bumps [actions/setup-java](https://github.com/actions/setup-java) from 5.2.0 to 5.7.0.
- [Release notes](https://github.com/actions/setup-java/releases)
- [Commits](https://github.com/actions/setup-java/compare/be666c2fcd27ec809703dec50e508c2fdc7f6654...b6effb05e454b25005698d916606bdc6ffcbf961)

---
updated-dependencies:
- dependency-name: actions/setup-java
  dependency-version: 5.7.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-08-11 10:25:54 -07:00
Josh Cummings 04c08bb42a Merge branch '7.1.x' 2026-08-11 11:09:29 -06:00
Josh Cummings c96eca3ef4 Merge branch '7.0.x' into 7.1.x 2026-08-11 11:09:21 -06:00
Josh Cummings 905b4786e8 Remove Milestone Date Validation 
Closes gh-19526

Signed-off-by: Josh Cummings <3627351+jzheaux@users.noreply.github.com>
 2026-08-11 11:08:05 -06:00
dependabot[bot] 08d3108521 Bump org.junit:junit-bom from 6.1.2 to 6.1.3 
Bumps [org.junit:junit-bom](https://github.com/junit-team/junit-framework) from 6.1.2 to 6.1.3.
- [Release notes](https://github.com/junit-team/junit-framework/releases)
- [Commits](https://github.com/junit-team/junit-framework/compare/r6.1.2...r6.1.3)

---
updated-dependencies:
- dependency-name: org.junit:junit-bom
  dependency-version: 6.1.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-08-11 16:40:18 +00:00
Josh Cummings 73c93cebaf Remove 6.5.x from Dependabot 
Signed-off-by: Josh Cummings <3627351+jzheaux@users.noreply.github.com>
 2026-08-11 10:25:22 -06:00
Josh Cummings 3c6df7df1f Update to 7.2.0-SNAPSHOT 2026-08-11 10:25:22 -06:00
dependabot[bot] 70b161c772 Bump org.junit:junit-bom from 6.1.2 to 6.1.3 
Bumps [org.junit:junit-bom](https://github.com/junit-team/junit-framework) from 6.1.2 to 6.1.3.
- [Release notes](https://github.com/junit-team/junit-framework/releases)
- [Commits](https://github.com/junit-team/junit-framework/compare/r6.1.2...r6.1.3)

---
updated-dependencies:
- dependency-name: org.junit:junit-bom
  dependency-version: 6.1.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-08-11 03:24:26 +00:00