Cwikius-Spring/spring-security
1
0
Fork 0
mirror of synced 2026-08-31 22:46:02 +00:00
Code Issues Packages Projects Releases Wiki Activity
21,226 Commits 76 Branches 385 Tags
main
Commit Graph

21226 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
Josh Cummings 43f5ae5b21 Remove Auto-merge for .x Branches 
Closes gh-19632

Signed-off-by: Josh Cummings <3627351+jzheaux@users.noreply.github.com>
 2026-08-31 10:43:16 -06:00
Josh Cummings b2a6bbf314 Merge branch '7.1.x' 2026-08-31 10:42:04 -06:00
Josh Cummings a161421409 Turn Off Auto-merge for Maintenance Branch 
This commit removes the auto-merge workflow on 7.1.x since it
is a maintenance branch.

Closes gh-19631

Signed-off-by: Josh Cummings <3627351+jzheaux@users.noreply.github.com>
 2026-08-31 10:41:54 -06:00
Joe Grandja 36aa2ad744 Merge branch '7.1.x' 2026-08-31 12:02:21 -04:00
Josh Cummings ed4e0e2ea8 Merge branch '7.1.x' 2026-08-31 09:55:00 -06:00
Joe Grandja 978eb4396a Polish gh-19585 2026-08-31 11:09:18 -04:00
Evgeniy Cheban 770c860d9d Ensure WebSession ID is not changed after token refresh (Reactive) 
Closes gh-19424

Signed-off-by: Evgeniy Cheban <mister.cheban@gmail.com>
 2026-08-31 10:11:13 -04:00
dependabot[bot] 11890f2f49 Bump io.spring.gradle:spring-security-release-plugin 
Bumps [io.spring.gradle:spring-security-release-plugin](https://github.com/spring-io/spring-security-release-tools) from 1.0.16 to 1.0.17.
- [Release notes](https://github.com/spring-io/spring-security-release-tools/releases)
- [Changelog](https://github.com/spring-io/spring-security-release-tools/blob/main/RELEASE.adoc)
- [Commits](https://github.com/spring-io/spring-security-release-tools/compare/v1.0.16...v1.0.17)

---
updated-dependencies:
- dependency-name: io.spring.gradle:spring-security-release-plugin
  dependency-version: 1.0.17
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-08-28 03:17:31 +00:00
dependabot[bot] 5809451de7 Bump spring-io/spring-release-actions/compute-next-version 
Bumps [spring-io/spring-release-actions/compute-next-version](https://github.com/spring-io/spring-release-actions) from 0.0.5 to 0.0.6.
- [Release notes](https://github.com/spring-io/spring-release-actions/releases)
- [Commits](https://github.com/spring-io/spring-release-actions/compare/a1f321783a0769dd2aea4fad6c2ae2f95a52b885...1b8671612c3eb3d9b9763e2d7b66f1a80d00ee95)

---
updated-dependencies:
- dependency-name: spring-io/spring-release-actions/compute-next-version
  dependency-version: 0.0.6
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-08-28 00:50:20 +00:00
dependabot[bot] 31d379a7bf Bump spring-io/spring-security-release-tools/.github/workflows/release-announcements-stage.yml 
Bumps [spring-io/spring-security-release-tools/.github/workflows/release-announcements-stage.yml](https://github.com/spring-io/spring-security-release-tools) from 1.0.16 to 1.0.17.
- [Release notes](https://github.com/spring-io/spring-security-release-tools/releases)
- [Changelog](https://github.com/spring-io/spring-security-release-tools/blob/main/RELEASE.adoc)
- [Commits](https://github.com/spring-io/spring-security-release-tools/compare/d6c65d3013c0888e2c9cbae9f4beda610994776c...3f6cc7ffc137ca160061749d5f34dc30d5f36986)

---
updated-dependencies:
- dependency-name: spring-io/spring-security-release-tools/.github/workflows/release-announcements-stage.yml
  dependency-version: 1.0.17
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-08-28 00:47:19 +00:00
dependabot[bot] 825370f8e3 Bump spring-io/spring-security-release-tools/.github/workflows/deploy-schema.yml 
Bumps [spring-io/spring-security-release-tools/.github/workflows/deploy-schema.yml](https://github.com/spring-io/spring-security-release-tools) from 1.0.15 to 1.0.17.
- [Release notes](https://github.com/spring-io/spring-security-release-tools/releases)
- [Changelog](https://github.com/spring-io/spring-security-release-tools/blob/main/RELEASE.adoc)
- [Commits](https://github.com/spring-io/spring-security-release-tools/compare/v1.0.15...3f6cc7ffc137ca160061749d5f34dc30d5f36986)

---
updated-dependencies:
- dependency-name: spring-io/spring-security-release-tools/.github/workflows/deploy-schema.yml
  dependency-version: 1.0.17
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-08-28 00:47:16 +00:00
Josh Cummings 61feae94a0 Merge branch '7.1.x' 2026-08-26 10:17:45 -06:00
Josh Cummings edaae1d17d Merge branch '7.0.x' into 7.1.x 2026-08-26 10:17:34 -06:00
dependabot[bot] e8084090ff Bump org.hibernate.orm:hibernate-core from 7.4.5.Final to 7.4.6.Final 
Bumps [org.hibernate.orm:hibernate-core](https://github.com/hibernate/hibernate-orm) from 7.4.5.Final to 7.4.6.Final.
- [Release notes](https://github.com/hibernate/hibernate-orm/releases)
- [Changelog](https://github.com/hibernate/hibernate-orm/blob/7.4.6/changelog.txt)
- [Commits](https://github.com/hibernate/hibernate-orm/compare/7.4.5...7.4.6)

---
updated-dependencies:
- dependency-name: org.hibernate.orm:hibernate-core
  dependency-version: 7.4.6.Final
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-08-26 03:24:42 +00:00
dependabot[bot] 4773b40f02 Bump gradle-wrapper from 9.7.0 to 9.7.1 
Bumps [gradle-wrapper](https://github.com/gradle/gradle) from 9.7.0 to 9.7.1.
- [Release notes](https://github.com/gradle/gradle/releases)
- [Commits](https://github.com/gradle/gradle/compare/v9.7.0...v9.7.1)

---
updated-dependencies:
- dependency-name: gradle-wrapper
  dependency-version: 9.7.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-08-24 03:28:40 +00:00
dependabot[bot] 9a4a965b0d Bump io.spring.gradle:spring-security-release-plugin 
Bumps [io.spring.gradle:spring-security-release-plugin](https://github.com/spring-io/spring-security-release-tools) from 1.0.15 to 1.0.16.
- [Release notes](https://github.com/spring-io/spring-security-release-tools/releases)
- [Changelog](https://github.com/spring-io/spring-security-release-tools/blob/main/RELEASE.adoc)
- [Commits](https://github.com/spring-io/spring-security-release-tools/compare/v1.0.15...v1.0.16)

---
updated-dependencies:
- dependency-name: io.spring.gradle:spring-security-release-plugin
  dependency-version: 1.0.16
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-08-24 03:27:38 +00:00
Josh Cummings 0bae8a73d1 Next Development Version 
Signed-off-by: Josh Cummings <3627351+jzheaux@users.noreply.github.com>
 2026-08-21 09:14:37 -06:00
Josh Cummings 461ccd817d Next Development Version 
Signed-off-by: Josh Cummings <3627351+jzheaux@users.noreply.github.com>
 2026-08-21 09:14:09 -06:00
Josh Cummings d449950b36 Merge branch '7.1.x' 
Closes gh-19573
 2026-08-20 16:58:15 -06:00
Josh Cummings 8dc341af8c Merge branch '7.0.x' into 7.1.x 
Closes gh-19572
 2026-08-20 16:58:02 -06:00
Josh Cummings 381c556f78 Add Release Announcement Workflows 
Closes gh-19571

Signed-off-by: Josh Cummings <3627351+jzheaux@users.noreply.github.com>
 2026-08-20 16:57:48 -06:00
Josh Cummings 19afc9121e Merge branch '7.1.x' 
Closes gh-19568
# Conflicts:
#	gradle/libs.versions.toml
 2026-08-20 12:29:12 -06:00
Josh Cummings 6b2f892e66 Merge branch '7.0.x' into 7.1.x 
Closes gh-19567
# Conflicts:
#	config/src/main/java/org/springframework/security/config/annotation/web/configurers/oauth2/server/resource/DPoPAuthenticationConfigurer.java
#	config/src/main/java/org/springframework/security/config/annotation/web/configurers/oauth2/server/resource/OAuth2ResourceServerConfigurer.java
#	config/src/test/java/org/springframework/security/config/annotation/web/configurers/oauth2/server/resource/DPoPAuthenticationTests.java
#	gradle/libs.versions.toml
#	oauth2/oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/server/authorization/InMemoryOAuth2AuthorizationService.java
#	oauth2/oauth2-jose/src/main/java/org/springframework/security/oauth2/jwt/DPoPProofJwtDecoderFactory.java
#	oauth2/oauth2-jose/src/main/java/org/springframework/security/oauth2/jwt/DPoPProofReplayValidator.java
#	oauth2/oauth2-resource-server/src/main/java/org/springframework/security/oauth2/server/resource/authentication/DPoPAuthenticationProvider.java
 2026-08-20 12:23:20 -06:00
Josh Cummings 3b276e6c0d Update to Spring Data 2025.1.7 
Closes gh-19485

Signed-off-by: Josh Cummings <3627351+jzheaux@users.noreply.github.com>
 2026-08-20 11:24:08 -06:00
Josh Cummings f2115fbef8 Update to Spring LDAP 4.0.5 
Closes gh-19486

Signed-off-by: Josh Cummings <3627351+jzheaux@users.noreply.github.com>
 2026-08-20 11:24:01 -06:00
Josh Cummings 298335a57e Update to Micrometer 1.16.7 
Closes gh-19484

Signed-off-by: Josh Cummings <3627351+jzheaux@users.noreply.github.com>
 2026-08-20 11:23:55 -06:00
Josh Cummings c6566ee772 Update to Reactor 2025.0.7 
Closes gh-19483

Signed-off-by: Josh Cummings <3627351+jzheaux@users.noreply.github.com>
 2026-08-20 11:23:50 -06:00
Josh Cummings 7442214225 Update to Spring Framework 7.0.9 
Closes gh-19482

Signed-off-by: Josh Cummings <3627351+jzheaux@users.noreply.github.com>
 2026-08-20 11:23:44 -06:00
Josh Cummings 0123ae0981 Deprecate AesBytesEncryptor 
This commit separates AesBytesEncryptor into two separate
implememtations, allowing for a migration away from default
arrangements that used a null IV

Signed-off-by: Josh Cummings <3627351+jzheaux@users.noreply.github.com>
 2026-08-20 11:23:36 -06:00
Josh Cummings 11a648d106 Improve Equivalence Tests 
This commit adds equals and hashCode implementations as well
as a readResolve implementation to ensure that deserialization
mechanisms can correctly assess the equality of a constnat
and a corresponding deserialized instance. For defense-in-depth
reasons, this commit also favors .equals over == for these
constants.

Signed-off-by: Josh Cummings <3627351+jzheaux@users.noreply.github.com>
 2026-08-20 11:23:29 -06:00
Joe Grandja 536e09756c Bind UnboundIdContainer to loopback address 2026-08-20 11:23:22 -06:00
Joe Grandja ac15cdbea3 Apply html encoding in DefaultConsentPage 2026-08-20 11:23:14 -06:00
Joe Grandja ad812aefc4 Provide ability to configure DPoP proof replay 2026-08-20 11:23:08 -06:00
Josh Cummings d8769fb183 Use Constant-Time Comparison 
This commit updates password encoders to use a
constant-time comparison method to defend against
timing attacks

Signed-off-by: Josh Cummings <3627351+jzheaux@users.noreply.github.com>
 2026-08-20 11:23:02 -06:00
Josh Cummings ae997a4f46 Use Utf8#isEqual 
Signed-off-by: Josh Cummings <3627351+jzheaux@users.noreply.github.com>
 2026-08-20 11:22:55 -06:00
Josh Cummings bbc6273abf Use Constant-Time Equals 
This commit updates the filter to use constant-time
equals for sensitive material

Signed-off-by: Josh Cummings <3627351+jzheaux@users.noreply.github.com>
 2026-08-20 11:22:49 -06:00
Josh Cummings 475af0d3db Use Constant-Time Equals 
This commit updates the filter to use constant-time
equals for sensitive material

Signed-off-by: Josh Cummings <3627351+jzheaux@users.noreply.github.com>
 2026-08-20 11:22:43 -06:00
Josh Cummings f8a61e66d1 Add Utf8#isEqual 
This commit adds a constant-time equals method,
useful for comparing password hashes or other
sensitive material

Signed-off-by: Josh Cummings <3627351+jzheaux@users.noreply.github.com>
 2026-08-20 11:22:36 -06:00
Josh Cummings 8830e39073 Use MessageDigest#isEqual 
This commit favors constant-time comparison
to mitigate timing attacks

Signed-off-by: Josh Cummings <3627351+jzheaux@users.noreply.github.com>
 2026-08-20 11:22:31 -06:00
Josh Cummings 304cc21523 Add Tests for User and Device Code 
Signed-off-by: Josh Cummings <3627351+jzheaux@users.noreply.github.com>
 2026-08-20 11:22:25 -06:00
Josh Cummings 7048b08b9c Update to Spring Data 2026.0.1 
Closes gh-19490

Signed-off-by: Josh Cummings <3627351+jzheaux@users.noreply.github.com>
 2026-08-20 11:21:29 -06:00
Josh Cummings ff108a49a5 Update to Spring LDAP 4.1.1 
Closes gh-19491

Signed-off-by: Josh Cummings <3627351+jzheaux@users.noreply.github.com>
 2026-08-20 11:21:29 -06:00
Josh Cummings 9a70d73036 Update to Micrometer 1.17.1 
Closes gh-19489

Signed-off-by: Josh Cummings <3627351+jzheaux@users.noreply.github.com>
 2026-08-20 11:21:28 -06:00
Josh Cummings cf613ad2d3 Update to Reactor 2025.0.7 
Closes gh-19488

Signed-off-by: Josh Cummings <3627351+jzheaux@users.noreply.github.com>
 2026-08-20 11:21:28 -06:00
Josh Cummings fdec2d7617 Update to Spring Framework 7.0.9 
Closes gh-19487

Signed-off-by: Josh Cummings <3627351+jzheaux@users.noreply.github.com>
 2026-08-20 11:21:28 -06:00
Josh Cummings 748e3c9cf0 Use jspecify Nullable in DPoPProofReplayValidator 
org.springframework.lang.Nullable is banned by the
bannedNullabilityImports checkstyle rule on this line; the embargoed
commit that introduced this file predates that rule's adoption here.
Switch to org.jspecify.annotations.Nullable to match the rest of the
codebase (already used correctly elsewhere in this same file).

Signed-off-by: Josh Cummings <3627351+jzheaux@users.noreply.github.com>
 2026-08-20 11:21:21 -06:00
Josh Cummings 057581584a Align Null Behavior 
Previously, ExternalInetAddressMatcher treated a null InetAddress
as external by negating InternalInetAddressMatcher's result.

This commit makes ExternalInetAddressMatcher return false for a
null address, so that neither the internal nor the external
matcher classifies an unknown address as a match.

Signed-off-by: Josh Cummings <3627351+jzheaux@users.noreply.github.com>
 2026-08-20 11:21:20 -06:00
Josh Cummings 502ecf9241 Deprecate AesBytesEncryptor 
This commit separates AesBytesEncryptor into two separate
implememtations, allowing for a migration away from default
arrangements that used a null IV

Signed-off-by: Josh Cummings <3627351+jzheaux@users.noreply.github.com>
 2026-08-20 11:21:20 -06:00
Josh Cummings 7db67f923c Improve Equivalence Tests 
This commit adds equals and hashCode implementations as well
as a readResolve implementation to ensure that deserialization
mechanisms can correctly assess the equality of a constnat
and a corresponding deserialized instance. For defense-in-depth
reasons, this commit also favors .equals over == for these
constants.

Signed-off-by: Josh Cummings <3627351+jzheaux@users.noreply.github.com>
 2026-08-20 11:21:14 -06:00
Joe Grandja 35859220cb Bind UnboundIdContainer to loopback address 2026-08-20 11:21:14 -06:00