7cc20776c1
Avoid spring-core in password encoder validation
...
`spring-core` is an `optional` dependency of `spring-security-crypto`,
so it is not published in the POM and is not guaranteed to be on the
classpath when the module is used standalone.
7.1.0 refactored `AbstractValidatingPasswordEncoder` to use
`org.springframework.util.StringUtils#hasLength`, which causes
`NoClassDefFoundError` on `BCryptPasswordEncoder#matches` (and other
encoders extending it) for standalone users.
Restore the inline null/empty checks the encoder used prior to that
refactor so that the runtime hot path no longer reaches into
`spring-core`.
Closes gh-19317
Signed-off-by: seonwoo_jung <laborlawseon@kap.kr >
2026-09-10 16:01:40 -06:00
25c71e28a8
Skip Null List Elements When Mapping CAS Attributes To Authorities
...
The io.spring.nullability plugin 0.0.16 upgrade tightens NullAway
analysis and flags list elements from the unannotated, raw
List<?> attribute value as possibly null. A null element has no
value to contribute to an authority, consistent with how a null
attribute value as a whole is already skipped.
See gh-19670
Signed-off-by: Josh Cummings <3627351+jzheaux@users.noreply.github.com >
2026-09-08 12:50:53 -06:00
864c082a38
Mark addGrantedAuthorityCollection Value Parameter Nullable
...
The io.spring.nullability plugin 0.0.16 upgrade tightens NullAway
analysis and flags the raw Collection<?> element passed into
addGrantedAuthorityCollection(Collection, Object) as possibly null,
even though the method already null-checks it internally.
See gh-19670
Signed-off-by: Josh Cummings <3627351+jzheaux@users.noreply.github.com >
2026-09-08 12:50:53 -06:00
ddcdd461e6
Bump io.spring.nullability:io.spring.nullability.gradle.plugin
...
Bumps [io.spring.nullability:io.spring.nullability.gradle.plugin](https://github.com/spring-gradle-plugins/nullability-plugin ) from 0.0.15 to 0.0.16.
- [Release notes](https://github.com/spring-gradle-plugins/nullability-plugin/releases )
- [Commits](https://github.com/spring-gradle-plugins/nullability-plugin/compare/v0.0.15...v0.0.16 )
---
updated-dependencies:
- dependency-name: io.spring.nullability:io.spring.nullability.gradle.plugin
dependency-version: 0.0.16
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
2026-09-08 12:50:53 -06:00
5149494e08
Bump com.webauthn4j:webauthn4j-core
...
Bumps [com.webauthn4j:webauthn4j-core](https://github.com/webauthn4j/webauthn4j ) from 0.31.9.RELEASE to 0.31.10.RELEASE.
- [Release notes](https://github.com/webauthn4j/webauthn4j/releases )
- [Commits](https://github.com/webauthn4j/webauthn4j/compare/0.31.9.RELEASE...0.31.10.RELEASE )
---
updated-dependencies:
- dependency-name: com.webauthn4j:webauthn4j-core
dependency-version: 0.31.10.RELEASE
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
2026-09-08 12:12:06 -06:00
3abed4886f
Merge branch '7.0.x' into 7.1.x
...
# Conflicts:
# gradle/libs.versions.toml
2026-09-08 12:04:42 -06:00
4e5eb822a0
Fix typos in Javadocs
...
- Add missing parentheses
- Add missing quote
- Remove duplicate word
Signed-off-by: Tran Ngoc Nhan <ngocnhan.tran1996@gmail.com >
2026-09-08 12:02:43 -06:00
c4a46d100e
Update Reactor's Context reference link
...
Signed-off-by: Tran Ngoc Nhan <ngocnhan.tran1996@gmail.com >
2026-09-08 12:02:37 -06:00
6b007529bb
Bump org.slf4j:slf4j-api from 2.0.18 to 2.0.19
...
Bumps org.slf4j:slf4j-api from 2.0.18 to 2.0.19.
---
updated-dependencies:
- dependency-name: org.slf4j:slf4j-api
dependency-version: 2.0.19
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
2026-09-08 12:02:08 -06:00
176fb7df13
Merge branch '7.0.x' into 7.1.x
2026-09-08 11:37:12 -06:00
98628d1abd
Update check-snapshots to spring-security-release-tools 1.0.17
...
See gh-19625
Signed-off-by: Josh Cummings <3627351+jzheaux@users.noreply.github.com >
2026-09-08 11:36:43 -06:00
6f8a8b6663
Merge branch '7.0.x' into 7.1.x
2026-09-08 11:32:56 -06:00
4ba0d38ca5
Exclude webauthn4j-core from dependabot on 7.0.x
...
Newer webauthn4j-core releases require a Jackson minor bump, which
we do not want to pull into a maintenance branch.
See gh-19669
2026-09-08 11:32:10 -06:00
1cfb348445
Merge branch '7.0.x' into 7.1.x
...
Closes gh-19679
2026-09-08 11:21:34 -06:00
3f14445bd4
Merge branch '7.0.x' into 7.1.x
2026-09-08 11:20:26 -06:00
fc40a83d32
Update Dependabot
...
This commit syncs dependabot with older branches since
it is at times warranted to update the dependabot configurations
as part of addressing a dependabot PR
Closes gh-19678
Signed-off-by: Josh Cummings <3627351+jzheaux@users.noreply.github.com >
2026-09-08 11:14:41 -06:00
29c6f855d7
Fix Formatting and Style
...
Signed-off-by: Josh Cummings <3627351+jzheaux@users.noreply.github.com >
2026-09-08 10:20:00 -06:00
b894640bc7
Update Formatting and Style
...
Signed-off-by: Josh Cummings <3627351+jzheaux@users.noreply.github.com >
2026-09-08 10:19:57 -06:00
a37c0ac9ce
Bump io-spring-javaformat from 0.0.47 to 0.0.48
...
Bumps `io-spring-javaformat` from 0.0.47 to 0.0.48.
Updates `io.spring.javaformat:spring-javaformat-checkstyle` from 0.0.47 to 0.0.48
- [Release notes](https://github.com/spring-io/spring-javaformat/releases )
- [Commits](https://github.com/spring-io/spring-javaformat/compare/v0.0.47...v0.0.48 )
Updates `io.spring.javaformat:spring-javaformat-gradle-plugin` from 0.0.47 to 0.0.48
- [Release notes](https://github.com/spring-io/spring-javaformat/releases )
- [Commits](https://github.com/spring-io/spring-javaformat/compare/v0.0.47...v0.0.48 )
---
updated-dependencies:
- dependency-name: io.spring.javaformat:spring-javaformat-checkstyle
dependency-version: 0.0.48
dependency-type: direct:production
update-type: version-update:semver-patch
- dependency-name: io.spring.javaformat:spring-javaformat-gradle-plugin
dependency-version: 0.0.48
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
2026-09-04 10:26:18 -06:00
a551be65eb
Update Formatting and Style
...
Signed-off-by: Josh Cummings <3627351+jzheaux@users.noreply.github.com >
2026-09-04 09:24:19 -07:00
5449cca3e7
Bump io-spring-javaformat from 0.0.47 to 0.0.48
...
Bumps `io-spring-javaformat` from 0.0.47 to 0.0.48.
Updates `io.spring.javaformat:spring-javaformat-checkstyle` from 0.0.47 to 0.0.48
- [Release notes](https://github.com/spring-io/spring-javaformat/releases )
- [Commits](https://github.com/spring-io/spring-javaformat/compare/v0.0.47...v0.0.48 )
Updates `io.spring.javaformat:spring-javaformat-gradle-plugin` from 0.0.47 to 0.0.48
- [Release notes](https://github.com/spring-io/spring-javaformat/releases )
- [Commits](https://github.com/spring-io/spring-javaformat/compare/v0.0.47...v0.0.48 )
---
updated-dependencies:
- dependency-name: io.spring.javaformat:spring-javaformat-checkstyle
dependency-version: 0.0.48
dependency-type: direct:production
update-type: version-update:semver-patch
- dependency-name: io.spring.javaformat:spring-javaformat-gradle-plugin
dependency-version: 0.0.48
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
2026-09-04 09:24:19 -07:00
01891c8032
Merge branch '7.0.x' into 7.1.x
2026-09-04 09:02:29 -06:00
671cb75c72
Bump antora from 3.2.0-rc.3 to 3.2.0 in /docs
...
Bumps [antora](https://gitlab.com/antora/antora/tree/HEAD/packages/antora ) from 3.2.0-rc.3 to 3.2.0.
- [Changelog](https://gitlab.com/antora/antora/blob/main/CHANGELOG.adoc )
- [Commits](https://gitlab.com/antora/antora/compare/v3.2.0-rc.3...v3.2.0 )
---
updated-dependencies:
- dependency-name: antora
dependency-version: 3.2.0
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
2026-09-04 08:02:13 -07:00
201adb3101
Merge branch '7.0.x' into 7.1.x
2026-09-04 08:59:03 -06:00
81ce86800e
Update to spring-release-actions 0.0.6
...
Signed-off-by: Josh Cummings <3627351+jzheaux@users.noreply.github.com >
2026-09-04 08:58:54 -06:00
312e0a4529
Merge branch '7.0.x' into 7.1.x
2026-09-04 08:52:35 -06:00
d5ac3a86bc
Update Workflows to spring-security-release-tools 1.0.17
...
Signed-off-by: Josh Cummings <3627351+jzheaux@users.noreply.github.com >
2026-09-04 08:50:46 -06:00
9ad6b51aec
Bump spring-io/spring-security-release-tools/.github/workflows/release-announcements-publish.yml
...
Bumps [spring-io/spring-security-release-tools/.github/workflows/release-announcements-publish.yml](https://github.com/spring-io/spring-security-release-tools ) from 1.0.16 to 1.0.17.
- [Release notes](https://github.com/spring-io/spring-security-release-tools/releases )
- [Changelog](https://github.com/spring-io/spring-security-release-tools/blob/main/RELEASE.adoc )
- [Commits](https://github.com/spring-io/spring-security-release-tools/compare/d6c65d3013c0888e2c9cbae9f4beda610994776c...3f6cc7ffc137ca160061749d5f34dc30d5f36986 )
---
updated-dependencies:
- dependency-name: spring-io/spring-security-release-tools/.github/workflows/release-announcements-publish.yml
dependency-version: 1.0.17
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
2026-09-04 07:30:49 -07:00
a501e214f4
Bump spring-io/spring-security-release-tools/.github/actions/send-notification
...
Bumps [spring-io/spring-security-release-tools/.github/actions/send-notification](https://github.com/spring-io/spring-security-release-tools ) from 1.0.15 to 1.0.17.
- [Release notes](https://github.com/spring-io/spring-security-release-tools/releases )
- [Changelog](https://github.com/spring-io/spring-security-release-tools/blob/main/RELEASE.adoc )
- [Commits](https://github.com/spring-io/spring-security-release-tools/compare/b92832ecbc7cbe969201e6beafbde0ee400cf095...3f6cc7ffc137ca160061749d5f34dc30d5f36986 )
---
updated-dependencies:
- dependency-name: spring-io/spring-security-release-tools/.github/actions/send-notification
dependency-version: 1.0.17
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
2026-09-04 07:30:24 -07:00
e05cec1b7d
Bump spring-io/spring-release-actions/schedule-milestone
...
Bumps [spring-io/spring-release-actions/schedule-milestone](https://github.com/spring-io/spring-release-actions ) from 0.0.5 to 0.0.6.
- [Release notes](https://github.com/spring-io/spring-release-actions/releases )
- [Commits](https://github.com/spring-io/spring-release-actions/compare/a1f321783a0769dd2aea4fad6c2ae2f95a52b885...1b8671612c3eb3d9b9763e2d7b66f1a80d00ee95 )
---
updated-dependencies:
- dependency-name: spring-io/spring-release-actions/schedule-milestone
dependency-version: 0.0.6
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
2026-09-04 07:30:03 -07:00
b39e300395
Bump spring-io/spring-release-actions/compute-version
...
Bumps [spring-io/spring-release-actions/compute-version](https://github.com/spring-io/spring-release-actions ) from 0.0.5 to 0.0.6.
- [Release notes](https://github.com/spring-io/spring-release-actions/releases )
- [Commits](https://github.com/spring-io/spring-release-actions/compare/a1f321783a0769dd2aea4fad6c2ae2f95a52b885...1b8671612c3eb3d9b9763e2d7b66f1a80d00ee95 )
---
updated-dependencies:
- dependency-name: spring-io/spring-release-actions/compute-version
dependency-version: 0.0.6
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
2026-09-04 07:29:12 -07:00
7ea44bbb26
Bump antora from 3.2.0-rc.3 to 3.2.0 in /docs
...
Bumps [antora](https://gitlab.com/antora/antora/tree/HEAD/packages/antora ) from 3.2.0-rc.3 to 3.2.0.
- [Changelog](https://gitlab.com/antora/antora/blob/main/CHANGELOG.adoc )
- [Commits](https://gitlab.com/antora/antora/compare/v3.2.0-rc.3...v3.2.0 )
---
updated-dependencies:
- dependency-name: antora
dependency-version: 3.2.0
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
2026-09-04 07:28:40 -07:00
8130568ac6
Bump spring-io/spring-security-release-tools/.github/workflows/deploy-artifacts.yml
...
Bumps [spring-io/spring-security-release-tools/.github/workflows/deploy-artifacts.yml](https://github.com/spring-io/spring-security-release-tools ) from 1.0.15 to 1.0.17.
- [Release notes](https://github.com/spring-io/spring-security-release-tools/releases )
- [Changelog](https://github.com/spring-io/spring-security-release-tools/blob/main/RELEASE.adoc )
- [Commits](https://github.com/spring-io/spring-security-release-tools/compare/b92832ecbc7cbe969201e6beafbde0ee400cf095...3f6cc7ffc137ca160061749d5f34dc30d5f36986 )
---
updated-dependencies:
- dependency-name: spring-io/spring-security-release-tools/.github/workflows/deploy-artifacts.yml
dependency-version: 1.0.17
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
2026-09-04 07:25:08 -07:00
a4707d9e19
Bump org.hibernate.orm:hibernate-core from 7.4.6.Final to 7.4.7.Final
...
Bumps [org.hibernate.orm:hibernate-core](https://github.com/hibernate/hibernate-orm ) from 7.4.6.Final to 7.4.7.Final.
- [Release notes](https://github.com/hibernate/hibernate-orm/releases )
- [Changelog](https://github.com/hibernate/hibernate-orm/blob/7.4.7/changelog.txt )
- [Commits](https://github.com/hibernate/hibernate-orm/compare/7.4.6...7.4.7 )
---
updated-dependencies:
- dependency-name: org.hibernate.orm:hibernate-core
dependency-version: 7.4.7.Final
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
2026-09-04 07:23:29 -07:00
137d2e81b7
Bump io.spring.nullability:io.spring.nullability.gradle.plugin
...
Bumps [io.spring.nullability:io.spring.nullability.gradle.plugin](https://github.com/spring-gradle-plugins/nullability-plugin ) from 0.0.14 to 0.0.15.
- [Release notes](https://github.com/spring-gradle-plugins/nullability-plugin/releases )
- [Commits](https://github.com/spring-gradle-plugins/nullability-plugin/compare/v0.0.14...v0.0.15 )
---
updated-dependencies:
- dependency-name: io.spring.nullability:io.spring.nullability.gradle.plugin
dependency-version: 0.0.15
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
2026-09-04 00:30:20 +00:00
8525cbfd19
Fix Nullability
...
Signed-off-by: Josh Cummings <3627351+jzheaux@users.noreply.github.com >
2026-09-04 00:30:20 +00:00
02f5f5a459
Merge branch '7.0.x' into 7.1.x
2026-09-03 15:42:29 -06:00
3dff446d18
Bump spring-io/spring-release-actions/get-todays-release-version
...
Bumps [spring-io/spring-release-actions/get-todays-release-version](https://github.com/spring-io/spring-release-actions ) from 0.0.5 to 0.0.6.
- [Release notes](https://github.com/spring-io/spring-release-actions/releases )
- [Commits](https://github.com/spring-io/spring-release-actions/compare/a1f321783a0769dd2aea4fad6c2ae2f95a52b885...1b8671612c3eb3d9b9763e2d7b66f1a80d00ee95 )
---
updated-dependencies:
- dependency-name: spring-io/spring-release-actions/get-todays-release-version
dependency-version: 0.0.6
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
2026-09-03 14:39:30 -07:00
cc89707b03
Bump antora from 3.2.0-rc.2 to 3.2.0-rc.3 in /docs
...
Bumps [antora](https://gitlab.com/antora/antora ) from 3.2.0-rc.2 to 3.2.0-rc.3.
- [Changelog](https://gitlab.com/antora/antora/blob/main/CHANGELOG.adoc )
- [Commits](https://gitlab.com/antora/antora/compare/v3.2.0-rc.2...v3.2.0-rc.3 )
---
updated-dependencies:
- dependency-name: antora
dependency-version: 3.2.0-rc.3
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
2026-09-03 14:38:41 -07:00
812ad9c547
Bump spring-io/spring-security-release-tools/.github/workflows/build.yml
...
Bumps [spring-io/spring-security-release-tools/.github/workflows/build.yml](https://github.com/spring-io/spring-security-release-tools ) from 1.0.15 to 1.0.17.
- [Release notes](https://github.com/spring-io/spring-security-release-tools/releases )
- [Changelog](https://github.com/spring-io/spring-security-release-tools/blob/main/RELEASE.adoc )
- [Commits](https://github.com/spring-io/spring-security-release-tools/compare/b92832ecbc7cbe969201e6beafbde0ee400cf095...3f6cc7ffc137ca160061749d5f34dc30d5f36986 )
---
updated-dependencies:
- dependency-name: spring-io/spring-security-release-tools/.github/workflows/build.yml
dependency-version: 1.0.17
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
2026-09-03 14:38:08 -07:00
364c153e17
Bump spring-io/spring-release-actions/compute-next-version
...
Bumps [spring-io/spring-release-actions/compute-next-version](https://github.com/spring-io/spring-release-actions ) from 0.0.5 to 0.0.6.
- [Release notes](https://github.com/spring-io/spring-release-actions/releases )
- [Commits](https://github.com/spring-io/spring-release-actions/compare/a1f321783a0769dd2aea4fad6c2ae2f95a52b885...1b8671612c3eb3d9b9763e2d7b66f1a80d00ee95 )
---
updated-dependencies:
- dependency-name: spring-io/spring-release-actions/compute-next-version
dependency-version: 0.0.6
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
2026-09-03 14:37:16 -07:00
39383ab970
Bump spring-io/spring-security-release-tools/.github/workflows/test.yml
...
Bumps [spring-io/spring-security-release-tools/.github/workflows/test.yml](https://github.com/spring-io/spring-security-release-tools ) from ed473b4dafba053c63a453d2d88a89df3b3e18b3 to 9ca0acea761aa79d71c78cc462048c49ed5c4230.
- [Release notes](https://github.com/spring-io/spring-security-release-tools/releases )
- [Changelog](https://github.com/spring-io/spring-security-release-tools/blob/main/RELEASE.adoc )
- [Commits](https://github.com/spring-io/spring-security-release-tools/compare/ed473b4dafba053c63a453d2d88a89df3b3e18b3...9ca0acea761aa79d71c78cc462048c49ed5c4230 )
---
updated-dependencies:
- dependency-name: spring-io/spring-security-release-tools/.github/workflows/test.yml
dependency-version: 9ca0acea761aa79d71c78cc462048c49ed5c4230
dependency-type: direct:production
...
Signed-off-by: dependabot[bot] <support@github.com >
2026-09-03 14:35:20 -07:00
8ef5bcd003
Fix typos in Javadocs
...
- Remove duplicate words
- Remove unnecessary parentheses
- Fix grammar
Signed-off-by: Tran Ngoc Nhan <ngocnhan.tran1996@gmail.com >
2026-09-03 14:34:29 -07:00
4193b73d47
Bump actions/setup-java from 5.7.0 to 6.0.0
...
Bumps [actions/setup-java](https://github.com/actions/setup-java ) from 5.7.0 to 6.0.0.
- [Release notes](https://github.com/actions/setup-java/releases )
- [Commits](https://github.com/actions/setup-java/compare/b6effb05e454b25005698d916606bdc6ffcbf961...dd06d9cba3e5552c54d9f8ea23572deb30010f7c )
---
updated-dependencies:
- dependency-name: actions/setup-java
dependency-version: 6.0.0
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com >
2026-09-03 14:33:13 -07:00
4ce48297f6
Bump io.spring.gradle:spring-security-release-plugin
...
Bumps [io.spring.gradle:spring-security-release-plugin](https://github.com/spring-io/spring-security-release-tools ) from 1.0.15 to 1.0.17.
- [Release notes](https://github.com/spring-io/spring-security-release-tools/releases )
- [Changelog](https://github.com/spring-io/spring-security-release-tools/blob/main/RELEASE.adoc )
- [Commits](https://github.com/spring-io/spring-security-release-tools/compare/v1.0.15...v1.0.17 )
---
updated-dependencies:
- dependency-name: io.spring.gradle:spring-security-release-plugin
dependency-version: 1.0.17
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
2026-09-03 14:32:07 -07:00
9989735a49
Merge branch '7.0.x' into 7.1.x
...
Closes gh-19648
2026-09-03 15:22:26 -06:00
02cc2e9d14
Fix TokenType Comparison Logic
...
Compare OAuth2AccessToken.TokenType using equals() instead of == in
BearerTokenAuthentication, since TokenType instances are not
guaranteed to be singletons and reference comparison can incorrectly
reject an otherwise-equal bearer token.
Closes gh-19377
Signed-off-by: Josh Cummings <3627351+jzheaux@users.noreply.github.com >
2026-09-03 14:06:08 -07:00
118e51d45e
Merge branch '7.0.x' into 7.1.x
2026-09-03 15:01:11 -06:00
27a76a67ae
Include code example for reactive onetimetoken
...
Signed-off-by: Tran Ngoc Nhan <ngocnhan.tran1996@gmail.com >
2026-09-03 14:00:44 -07:00
ff6cef0cd2
Include code example for servlet onetimetoken
...
Signed-off-by: Tran Ngoc Nhan <ngocnhan.tran1996@gmail.com >
2026-09-03 14:00:44 -07:00
seonwoo_jung