62f33d3fcf
Add equals and hashCode to HttpMethodRequestMatcher
...
Closes gh-18911
Signed-off-by: Tran Ngoc Nhan <ngocnhan.tran1996@gmail.com >
2026-03-20 21:22:20 -06:00
9fed1ac8c3
New line per sentence
...
Signed-off-by: Rob Winch <362503+rwinch@users.noreply.github.com >
2026-03-20 15:28:21 -06:00
9dbe3bdcc0
Polish Session Management Persistence Docs
...
Signed-off-by: Josh Cummings <3627351+jzheaux@users.noreply.github.com >
2026-03-20 15:28:21 -06:00
d547ae0181
Fix defaults description in Session Management doc
...
Corrected that starting from Spring Security 6
security context is not automatically saved by default.
Signed-off-by: sankranti <sankranty@gmail.com >
2026-03-20 15:28:21 -06:00
b8b1278e1f
Bump @springio/antora-extensions from 1.14.7 to 1.14.9 in /docs
...
Bumps [@springio/antora-extensions](https://github.com/spring-io/antora-extensions ) from 1.14.7 to 1.14.9.
- [Changelog](https://github.com/spring-io/antora-extensions/blob/main/CHANGELOG.adoc )
- [Commits](https://github.com/spring-io/antora-extensions/compare/v1.14.7...v1.14.9 )
---
updated-dependencies:
- dependency-name: "@springio/antora-extensions"
dependency-version: 1.14.9
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
2026-03-20 15:22:06 -06:00
381047e386
Bump spring-io/spring-security-release-tools from 1.0.14 to 1.0.15
...
Bumps [spring-io/spring-security-release-tools](https://github.com/spring-io/spring-security-release-tools ) from 1.0.14 to 1.0.15.
- [Release notes](https://github.com/spring-io/spring-security-release-tools/releases )
- [Changelog](https://github.com/spring-io/spring-security-release-tools/blob/main/RELEASE.adoc )
- [Commits](https://github.com/spring-io/spring-security-release-tools/compare/729fed56d42122f88583aff1be35c0800b7d77e9...b92832ecbc7cbe969201e6beafbde0ee400cf095 )
---
updated-dependencies:
- dependency-name: spring-io/spring-security-release-tools
dependency-version: 1.0.15
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
2026-03-20 15:21:53 -06:00
376b40a735
Bump io.spring.gradle:spring-security-release-plugin
...
Bumps [io.spring.gradle:spring-security-release-plugin](https://github.com/spring-io/spring-security-release-tools ) from 1.0.14 to 1.0.15.
- [Release notes](https://github.com/spring-io/spring-security-release-tools/releases )
- [Changelog](https://github.com/spring-io/spring-security-release-tools/blob/main/RELEASE.adoc )
- [Commits](https://github.com/spring-io/spring-security-release-tools/compare/v1.0.14...v1.0.15 )
---
updated-dependencies:
- dependency-name: io.spring.gradle:spring-security-release-plugin
dependency-version: 1.0.15
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
2026-03-20 14:58:20 -06:00
89fa1cbdd2
Bump spring-io/spring-security-release-tools/.github/workflows/build.yml
...
Bumps [spring-io/spring-security-release-tools/.github/workflows/build.yml](https://github.com/spring-io/spring-security-release-tools ) from 1.0.14 to 1.0.15.
- [Release notes](https://github.com/spring-io/spring-security-release-tools/releases )
- [Changelog](https://github.com/spring-io/spring-security-release-tools/blob/main/RELEASE.adoc )
- [Commits](https://github.com/spring-io/spring-security-release-tools/compare/729fed56d42122f88583aff1be35c0800b7d77e9...b92832ecbc7cbe969201e6beafbde0ee400cf095 )
---
updated-dependencies:
- dependency-name: spring-io/spring-security-release-tools/.github/workflows/build.yml
dependency-version: 1.0.15
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
2026-03-20 14:57:09 -06:00
0d75e6d10c
Bump @springio/asciidoctor-extensions in /docs
...
Bumps [@springio/asciidoctor-extensions](https://github.com/spring-io/asciidoctor-extensions ) from 1.0.0-alpha.17 to 1.0.0-alpha.18.
- [Changelog](https://github.com/spring-io/asciidoctor-extensions/blob/main/CHANGELOG.adoc )
- [Commits](https://github.com/spring-io/asciidoctor-extensions/compare/v1.0.0-alpha.17...v1.0.0-alpha.18 )
---
updated-dependencies:
- dependency-name: "@springio/asciidoctor-extensions"
dependency-version: 1.0.0-alpha.18
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
2026-03-20 14:56:46 -06:00
01758c4c59
Bump spring-io/spring-security-release-tools/.github/workflows/deploy-artifacts.yml
...
Bumps [spring-io/spring-security-release-tools/.github/workflows/deploy-artifacts.yml](https://github.com/spring-io/spring-security-release-tools ) from 1.0.14 to 1.0.15.
- [Release notes](https://github.com/spring-io/spring-security-release-tools/releases )
- [Changelog](https://github.com/spring-io/spring-security-release-tools/blob/main/RELEASE.adoc )
- [Commits](https://github.com/spring-io/spring-security-release-tools/compare/729fed56d42122f88583aff1be35c0800b7d77e9...b92832ecbc7cbe969201e6beafbde0ee400cf095 )
---
updated-dependencies:
- dependency-name: spring-io/spring-security-release-tools/.github/workflows/deploy-artifacts.yml
dependency-version: 1.0.15
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
2026-03-20 14:56:10 -06:00
f37833a59c
Bump spring-io/spring-security-release-tools/.github/workflows/test.yml
...
Bumps [spring-io/spring-security-release-tools/.github/workflows/test.yml](https://github.com/spring-io/spring-security-release-tools ) from 1.0.14 to 1.0.15.
- [Release notes](https://github.com/spring-io/spring-security-release-tools/releases )
- [Changelog](https://github.com/spring-io/spring-security-release-tools/blob/main/RELEASE.adoc )
- [Commits](https://github.com/spring-io/spring-security-release-tools/compare/729fed56d42122f88583aff1be35c0800b7d77e9...b92832ecbc7cbe969201e6beafbde0ee400cf095 )
---
updated-dependencies:
- dependency-name: spring-io/spring-security-release-tools/.github/workflows/test.yml
dependency-version: 1.0.15
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
2026-03-20 14:55:52 -06:00
52e6c4c4be
Bump spring-io/spring-security-release-tools/.github/workflows/deploy-schema.yml
...
Bumps [spring-io/spring-security-release-tools/.github/workflows/deploy-schema.yml](https://github.com/spring-io/spring-security-release-tools ) from 1.0.14 to 1.0.15.
- [Release notes](https://github.com/spring-io/spring-security-release-tools/releases )
- [Changelog](https://github.com/spring-io/spring-security-release-tools/blob/main/RELEASE.adoc )
- [Commits](https://github.com/spring-io/spring-security-release-tools/compare/729fed56d42122f88583aff1be35c0800b7d77e9...b92832ecbc7cbe969201e6beafbde0ee400cf095 )
---
updated-dependencies:
- dependency-name: spring-io/spring-security-release-tools/.github/workflows/deploy-schema.yml
dependency-version: 1.0.15
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
2026-03-20 14:55:38 -06:00
96ceb535f4
Next development version
2026-03-16 18:13:58 +00:00
0c54a55ae8
Release 6.5.9
2026-03-16 17:40:54 +00:00
01ff3b086a
Add Workflow for Deferring Issues
...
Signed-off-by: Josh Cummings <3627351+jzheaux@users.noreply.github.com >
2026-03-16 10:49:07 -06:00
33e6f4bd3f
Merge Fix Jackson Deserializer for AuthenticationExtensionsClientOutputs
2026-03-16 11:57:07 -04:00
cdd4b36d37
Update Antora UI Spring to v0.4.26
2026-03-16 08:26:19 -05:00
7672f76fde
Bump io.projectreactor:reactor-bom from 2024.0.15 to 2024.0.16
2026-03-16 08:26:12 -05:00
3db4999da4
Bump org.apache.maven:maven-resolver-provider from 3.9.13 to 3.9.14
2026-03-16 08:26:04 -05:00
a708d2f61b
Bump org.springframework:spring-framework-bom from 6.2.16 to 6.2.17
...
Bumps [org.springframework:spring-framework-bom](https://github.com/spring-projects/spring-framework ) from 6.2.16 to 6.2.17.
- [Release notes](https://github.com/spring-projects/spring-framework/releases )
- [Commits](https://github.com/spring-projects/spring-framework/compare/v6.2.16...v6.2.17 )
---
updated-dependencies:
- dependency-name: org.springframework:spring-framework-bom
dependency-version: 6.2.17
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
2026-03-16 03:07:46 +00:00
e726c05e76
Fix Jackson 2 deserializer for AuthenticationExtensionsClientOutputs
...
The deserializer is updated to properly ignore unknown extensions.
Closes gh-18643
Signed-off-by: Ziqin Wang <ziqin@wangziqin.net >
2026-03-15 15:04:14 +08:00
a7039fb3e6
Test Jackson 2 deserializer with unknown primitive WebAuthn ext
...
Signed-off-by: Ziqin Wang <ziqin@wangziqin.net >
2026-03-15 15:03:28 +08:00
88ea668f47
Test Jackson 2 deserializer with unknown obj/arr WebAuthn ext
...
Signed-off-by: Ziqin Wang <ziqin@wangziqin.net >
2026-03-15 15:03:17 +08:00
03a5de1955
Update Antora Spring UI to v0.4.26
2026-03-13 17:45:05 +00:00
06cbea383e
Bump org.apache.maven:maven-resolver-provider from 3.9.13 to 3.9.14
...
Bumps org.apache.maven:maven-resolver-provider from 3.9.13 to 3.9.14.
---
updated-dependencies:
- dependency-name: org.apache.maven:maven-resolver-provider
dependency-version: 3.9.14
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
2026-03-13 03:07:50 +00:00
e250236279
Read relayState from authenticationRequest
...
Closes gh-18243
Signed-off-by: Andrey Litvitski <andrey1010102008@gmail.com >
2026-03-12 10:30:11 -06:00
ef76ba040d
Require non-null authenticationRequest
...
Closes gh-18880
Signed-off-by: Josh Cummings <3627351+jzheaux@users.noreply.github.com >
2026-03-11 16:45:23 -06:00
d69af716c8
Bump io.projectreactor:reactor-bom from 2024.0.15 to 2024.0.16
...
Bumps [io.projectreactor:reactor-bom](https://github.com/reactor/reactor ) from 2024.0.15 to 2024.0.16.
- [Release notes](https://github.com/reactor/reactor/releases )
- [Commits](https://github.com/reactor/reactor/compare/2024.0.15...2024.0.16 )
---
updated-dependencies:
- dependency-name: io.projectreactor:reactor-bom
dependency-version: 2024.0.16
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
2026-03-11 03:06:57 +00:00
7e37aa2b75
Merge Fix CookieRequestCache parameters
2026-03-09 15:25:05 -04:00
07bfe371b4
Fix CookieRequestCache parameters
...
Previously the parameters were not restored.
This commit ensures the parameters are restored.
Closes gh-18204
Signed-off-by: Vishnutheep B <vishnutheep@gmail.com >
2026-03-09 14:10:30 -05:00
e12edf43f2
Bump @antora/collector-extension from 1.0.2 to 1.0.3 in /docs
2026-03-09 09:58:04 -05:00
a499e56b9b
Bump org.apache.maven:maven-resolver-provider from 3.9.12 to 3.9.13
...
Bumps org.apache.maven:maven-resolver-provider from 3.9.12 to 3.9.13.
---
updated-dependencies:
- dependency-name: org.apache.maven:maven-resolver-provider
dependency-version: 3.9.13
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
2026-03-09 03:09:41 +00:00
8c3f6ea0d4
Bump @antora/collector-extension from 1.0.2 to 1.0.3 in /docs
...
---
updated-dependencies:
- dependency-name: "@antora/collector-extension"
dependency-version: 1.0.3
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
2026-03-06 00:37:07 +00:00
e17d85e460
Add IDE Setup Documentation
...
Issue gh-17833
Signed-off-by: Josh Cummings <3627351+jzheaux@users.noreply.github.com >
2026-03-03 18:51:32 -07:00
f12036db05
Bump actions/upload-artifact from 6.0.0 to 7.0.0
...
Bumps [actions/upload-artifact](https://github.com/actions/upload-artifact ) from 6.0.0 to 7.0.0.
- [Release notes](https://github.com/actions/upload-artifact/releases )
- [Commits](https://github.com/actions/upload-artifact/compare/b7c566a772e6b6bfb58ed0dc250532a479d7789f...bbbca2ddaa5d8feaa63e36b76fdaad77386f024f )
---
updated-dependencies:
- dependency-name: actions/upload-artifact
dependency-version: 7.0.0
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com >
2026-03-03 18:16:39 -07:00
7b5c502a97
Bump org.hibernate.orm:hibernate-core from 6.6.43.Final to 6.6.44.Final
...
Bumps [org.hibernate.orm:hibernate-core](https://github.com/hibernate/hibernate-orm ) from 6.6.43.Final to 6.6.44.Final.
- [Release notes](https://github.com/hibernate/hibernate-orm/releases )
- [Changelog](https://github.com/hibernate/hibernate-orm/blob/6.6.44/changelog.txt )
- [Commits](https://github.com/hibernate/hibernate-orm/compare/6.6.43...6.6.44 )
---
updated-dependencies:
- dependency-name: org.hibernate.orm:hibernate-core
dependency-version: 6.6.44.Final
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
2026-03-03 17:47:07 -07:00
706b059ea8
Update logout.adoc
...
Directives should be Directive
Signed-off-by: HaiYan <haiyan_qi@hotmail.com >
2026-03-03 16:43:18 -07:00
ea3b112bea
Fix Flaky Crypto Tests
2026-03-03 15:58:17 -06:00
1261c229a3
Fix Flaky Crypto Tests
...
Previously the RsaSecretEncryptorTests were flaky because the assumed that a BadPaddigException would be thrown
when using things like different salt. However, given that the tests had random inputs (e.g. keys) there is the
possibility that, despite the fact that it can never be properly decrypted, the final bytes look like a valid
encrypted value.
This updates the tests to ensure that decrypt either throws an Exception or is not equal to the original
plaintext.
2026-03-03 14:52:28 -06:00
4501ae7d1c
Update Reactive Resource Server startup exceptations
...
Issue gh-16708
Signed-off-by: Josh Cummings <3627351+jzheaux@users.noreply.github.com >
2026-02-26 16:56:22 -07:00
48112d3d74
Polish Resource Server startup expectations
...
Issue gh-16708
Signed-off-by: Josh Cummings <3627351+jzheaux@users.noreply.github.com >
2026-02-26 16:56:22 -07:00
b8735abb63
Clarify Resource Server startup expectations
...
Clarify that Spring Boot defers OIDC discovery by default.
Closes gh-16708
Signed-off-by: [CLOUD4] 한현 <gusgus1467@naver.com >
2026-02-26 16:56:22 -07:00
68a02ff176
Update Link to CRSF Docs in FAQ
...
Signed-off-by: Guillaume Husta <guillaume.husta@gmail.com >
2026-02-26 14:47:21 -07:00
f37a706d62
Bump org-apache-maven-resolver from 1.9.26 to 1.9.27
...
Bumps `org-apache-maven-resolver` from 1.9.26 to 1.9.27.
Updates `org.apache.maven.resolver:maven-resolver-connector-basic` from 1.9.26 to 1.9.27
- [Release notes](https://github.com/apache/maven-resolver/releases )
- [Commits](https://github.com/apache/maven-resolver/compare/maven-resolver-1.9.26...maven-resolver-1.9.27 )
Updates `org.apache.maven.resolver:maven-resolver-impl` from 1.9.26 to 1.9.27
- [Release notes](https://github.com/apache/maven-resolver/releases )
- [Commits](https://github.com/apache/maven-resolver/compare/maven-resolver-1.9.26...maven-resolver-1.9.27 )
Updates `org.apache.maven.resolver:maven-resolver-transport-http` from 1.9.26 to 1.9.27
---
updated-dependencies:
- dependency-name: org.apache.maven.resolver:maven-resolver-connector-basic
dependency-version: 1.9.27
dependency-type: direct:production
update-type: version-update:semver-patch
- dependency-name: org.apache.maven.resolver:maven-resolver-impl
dependency-version: 1.9.27
dependency-type: direct:production
update-type: version-update:semver-patch
- dependency-name: org.apache.maven.resolver:maven-resolver-transport-http
dependency-version: 1.9.27
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
2026-02-26 14:38:30 -07:00
522c48b3b5
Merge Add Missing OnCommitedResponseWrapper Header Overrides
...
Add Missing OnCommitedResponseWrapper Header Overrides
2026-02-24 20:16:24 -06:00
1dae9aa459
Add Missing OnCommitedResponseWrapper Header Overrides
...
Spring Security's `OnCommitedResponseWrapper` does not override the `setHeader`, `setIntHeader`, `addIntHeader`
methods. This means that if the `Content-Length` response header is specified using any of those methods then
the response body length is not tracked and can be committed before the response headers are written.
Spring Security should override the missing methods and track `Content-Length` as is already done for `addHeader`.
This issue is the underlying problem for spring-projects/spring-framework#36381
Closes gh-18797
2026-02-24 19:46:29 -06:00
bec25edeb0
Merge pull request #18566 from Hann244/docs/gh-16530-jsp-method-attribute
...
Clarify need for method attribute in JSP authorize tag
2026-02-24 17:08:14 -07:00
4d43edfb20
Polish Documentation
...
- Combined explanation of method attribute with usage recommendations
- Used one sentence per line format
Issue gh-16530
Signed-off-by: Josh Cummings <3627351+jzheaux@users.noreply.github.com >
2026-02-24 14:24:11 -07:00
9f9699f8a5
Clarify need for method attribute in JSP authorize tag
...
Closes gh-16530
This aligns the JSP documentation with the changes made in gh-16529.
Added a NOTE to clarify that the method attribute is required when the underlying RequestMatcher is method-specific.
Signed-off-by: onhann <gusgus1467@naver.com >
2026-02-24 14:24:11 -07:00
d29c984881
Merge pull request #18544 from Khyojae/gh-18543
...
Fix GrantedAuthority.authority null in AuthoritiesAuthorizationManager
2026-02-23 11:16:42 -06:00
Tran Ngoc Nhan