Cwikius-Spring/spring-security
1
0
Fork 0
mirror of synced 2026-09-12 20:25:06 +00:00
Code Issues Packages Projects Releases Wiki Activity
21,312 Commits 50 Branches 385 Tags
b9a47df3c22e846dcfbe22aa5c80465f09170f7f
Commit Graph

21312 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
Rob Winch b9a47df3c2 Merge pull request #19696 from rwinch/request-cache-modern-ignores 
Modernize the default RequestCache background-request ignore list

Closes gh-19691
 2026-09-09 14:32:34 -05:00
Robert Winch 0ca2c39244 Ignore Chrome DevTools well-known probe in default RequestCache 
Chrome DevTools itself (not the loaded page, and not the user)
requests /.well-known/appspecific/com.chrome.devtools.json when
DevTools is open against a page, as part of the Automatic Workspace
Folders feature, to map a local project folder for live source
editing. This request is tooling-driven, not user navigation, so it
should never be able to become the URL a user is redirected to after
authenticating.

Closes gh-19694
 2026-09-09 14:12:56 -05:00
Robert Winch bf30738840 Ignore browserconfig.xml requests in default RequestCache 
Legacy Internet Explorer 11 and pre-Chromium Edge automatically fetch
browserconfig.xml at the domain root to configure Windows pinned-site
tiles. It's still commonly generated by favicon-generator tooling even
though it's legacy, and is a background request unrelated to what the
user actually navigated to, so it shouldn't be able to become the URL
a user is redirected to after authenticating.

Closes gh-19693
 2026-09-09 14:08:39 -05:00
Robert Winch d6363f2d3e Ignore web app manifest requests in default RequestCache 
Chrome, Edge, and other Chromium-based browsers asynchronously fetch
a page's web app manifest (manifest.json or manifest.webmanifest)
shortly after page load to evaluate PWA installability. This is a
fire-and-forget background request that should never become the URL
a user is redirected to after authenticating.

Closes gh-19695
 2026-09-09 14:00:19 -05:00
Robert Winch 242a779034 Ignore Apple touch icon requests in default RequestCache 
Safari and other WebKit-based browsers automatically probe for
apple-touch-icon.png, apple-touch-icon-precomposed.png, and sized
variants (e.g. apple-touch-icon-152x152.png) at the domain root as
soon as a page loads, even without a matching <link> tag. This is a
background fetch unrelated to what the user actually navigated to, so
it should never become the URL a user is redirected to after
authenticating, just like the existing favicon.* exclusion.

This also refactors the single-pattern favicon matcher into a small
list of ignored background-request patterns so more patterns can be
added going forward.

Closes gh-19692
 2026-09-09 13:54:54 -05:00
dependabot[bot] a7410ddc37 Bump org.hibernate.orm:hibernate-core from 7.4.5.Final to 7.4.7.Final 
Bumps [org.hibernate.orm:hibernate-core](https://github.com/hibernate/hibernate-orm) from 7.4.5.Final to 7.4.7.Final.
- [Release notes](https://github.com/hibernate/hibernate-orm/releases)
- [Changelog](https://github.com/hibernate/hibernate-orm/blob/7.4.7/changelog.txt)
- [Commits](https://github.com/hibernate/hibernate-orm/compare/7.4.5...7.4.7)

---
updated-dependencies:
- dependency-name: org.hibernate.orm:hibernate-core
  dependency-version: 7.4.7.Final
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-09-09 03:16:02 +00:00
Josh Cummings a2d8a3206a Update to htmlunit 5 
This commit updates to htmlunit 5, given that
org.seleniumhq.selenium:htmlunit3-driver 4.48.0 requires it.
Since htmlunit is a test dependency, we can take the
major upgrade in a minor release.

Closes gh-19687

Signed-off-by: Josh Cummings <3627351+jzheaux@users.noreply.github.com>
 2026-09-08 20:07:29 +00:00
dependabot[bot] 262b2f9366 Bump org.seleniumhq.selenium:selenium-java from 4.43.0 to 4.48.0 
Bumps [org.seleniumhq.selenium:selenium-java](https://github.com/SeleniumHQ/selenium) from 4.43.0 to 4.48.0.
- [Release notes](https://github.com/SeleniumHQ/selenium/releases)
- [Commits](https://github.com/SeleniumHQ/selenium/compare/selenium-4.43.0...selenium-4.48.0)

---
updated-dependencies:
- dependency-name: org.seleniumhq.selenium:selenium-java
  dependency-version: 4.48.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-09-08 20:07:29 +00:00
Josh Cummings 47d6012d5d Merge branch '7.1.x' 
# Conflicts:
#	gradle/libs.versions.toml
 2026-09-08 13:29:19 -06:00
Josh Cummings 25c71e28a8 Skip Null List Elements When Mapping CAS Attributes To Authorities 
The io.spring.nullability plugin 0.0.16 upgrade tightens NullAway
analysis and flags list elements from the unannotated, raw
List<?> attribute value as possibly null. A null element has no
value to contribute to an authority, consistent with how a null
attribute value as a whole is already skipped.

See gh-19670

Signed-off-by: Josh Cummings <3627351+jzheaux@users.noreply.github.com>
 2026-09-08 12:50:53 -06:00
Josh Cummings 864c082a38 Mark addGrantedAuthorityCollection Value Parameter Nullable 
The io.spring.nullability plugin 0.0.16 upgrade tightens NullAway
analysis and flags the raw Collection<?> element passed into
addGrantedAuthorityCollection(Collection, Object) as possibly null,
even though the method already null-checks it internally.

See gh-19670

Signed-off-by: Josh Cummings <3627351+jzheaux@users.noreply.github.com>
 2026-09-08 12:50:53 -06:00
dependabot[bot] ddcdd461e6 Bump io.spring.nullability:io.spring.nullability.gradle.plugin 
Bumps [io.spring.nullability:io.spring.nullability.gradle.plugin](https://github.com/spring-gradle-plugins/nullability-plugin) from 0.0.15 to 0.0.16.
- [Release notes](https://github.com/spring-gradle-plugins/nullability-plugin/releases)
- [Commits](https://github.com/spring-gradle-plugins/nullability-plugin/compare/v0.0.15...v0.0.16)

---
updated-dependencies:
- dependency-name: io.spring.nullability:io.spring.nullability.gradle.plugin
  dependency-version: 0.0.16
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-09-08 12:50:53 -06:00
dependabot[bot] 37647eaecb Bump gradle-wrapper from 9.7.0 to 9.7.1 
Bumps [gradle-wrapper](https://github.com/gradle/gradle) from 9.7.0 to 9.7.1.
- [Release notes](https://github.com/gradle/gradle/releases)
- [Commits](https://github.com/gradle/gradle/compare/v9.7.0...v9.7.1)

---
updated-dependencies:
- dependency-name: gradle-wrapper
  dependency-version: 9.7.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-09-08 18:30:55 +00:00
dependabot[bot] c194e5a0a0 Bump antora from 3.2.0-rc.3 to 3.2.0 in /docs 
Bumps [antora](https://gitlab.com/antora/antora/tree/HEAD/packages/antora) from 3.2.0-rc.3 to 3.2.0.
- [Changelog](https://gitlab.com/antora/antora/blob/main/CHANGELOG.adoc)
- [Commits](https://gitlab.com/antora/antora/compare/v3.2.0-rc.3...v3.2.0)

---
updated-dependencies:
- dependency-name: antora
  dependency-version: 3.2.0
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-09-08 18:29:29 +00:00
Josh Cummings c320883466 Merge branch '7.1.x' 2026-09-08 12:13:48 -06:00
dependabot[bot] 5149494e08 Bump com.webauthn4j:webauthn4j-core 
Bumps [com.webauthn4j:webauthn4j-core](https://github.com/webauthn4j/webauthn4j) from 0.31.9.RELEASE to 0.31.10.RELEASE.
- [Release notes](https://github.com/webauthn4j/webauthn4j/releases)
- [Commits](https://github.com/webauthn4j/webauthn4j/compare/0.31.9.RELEASE...0.31.10.RELEASE)

---
updated-dependencies:
- dependency-name: com.webauthn4j:webauthn4j-core
  dependency-version: 0.31.10.RELEASE
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-09-08 12:12:06 -06:00
Josh Cummings 7efae499d5 Merge branch '7.1.x' 
# Conflicts:
#	gradle/libs.versions.toml
 2026-09-08 12:05:41 -06:00
Josh Cummings 3abed4886f Merge branch '7.0.x' into 7.1.x 
# Conflicts:
#	gradle/libs.versions.toml
 2026-09-08 12:04:42 -06:00
Tran Ngoc Nhan 4e5eb822a0 Fix typos in Javadocs 
- Add missing parentheses
- Add missing quote
- Remove duplicate word

Signed-off-by: Tran Ngoc Nhan <ngocnhan.tran1996@gmail.com>
 2026-09-08 12:02:43 -06:00
Tran Ngoc Nhan c4a46d100e Update Reactor's Context reference link 
Signed-off-by: Tran Ngoc Nhan <ngocnhan.tran1996@gmail.com>
 2026-09-08 12:02:37 -06:00
dependabot[bot] 6b007529bb Bump org.slf4j:slf4j-api from 2.0.18 to 2.0.19 
Bumps org.slf4j:slf4j-api from 2.0.18 to 2.0.19.

---
updated-dependencies:
- dependency-name: org.slf4j:slf4j-api
  dependency-version: 2.0.19
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-09-08 12:02:08 -06:00
Josh Cummings f71aa9d92c Merge branch '7.1.x' 2026-09-08 11:37:23 -06:00
Josh Cummings 176fb7df13 Merge branch '7.0.x' into 7.1.x 2026-09-08 11:37:12 -06:00
Josh Cummings 98628d1abd Update check-snapshots to spring-security-release-tools 1.0.17 
See gh-19625

Signed-off-by: Josh Cummings <3627351+jzheaux@users.noreply.github.com>
 2026-09-08 11:36:43 -06:00
Josh Cummings f2d16447eb Merge branch '7.1.x' 2026-09-08 11:33:07 -06:00
Josh Cummings 6f8a8b6663 Merge branch '7.0.x' into 7.1.x 2026-09-08 11:32:56 -06:00
Josh Cummings 4ba0d38ca5 Exclude webauthn4j-core from dependabot on 7.0.x 
Newer webauthn4j-core releases require a Jackson minor bump, which
we do not want to pull into a maintenance branch.

See gh-19669
 2026-09-08 11:32:10 -06:00
Josh Cummings e5ec154cf0 Merge branch '7.1.x' 
Closes gh-19680
 2026-09-08 11:21:44 -06:00
Josh Cummings 1cfb348445 Merge branch '7.0.x' into 7.1.x 
Closes gh-19679
 2026-09-08 11:21:34 -06:00
Josh Cummings 8c5f925a43 Merge branch '7.1.x' 2026-09-08 11:20:38 -06:00
Josh Cummings 3f14445bd4 Merge branch '7.0.x' into 7.1.x 2026-09-08 11:20:26 -06:00
Josh Cummings fc40a83d32 Update Dependabot 
This commit syncs dependabot with older branches since
it is at times warranted to update the dependabot configurations
as part of addressing a dependabot PR

Closes gh-19678

Signed-off-by: Josh Cummings <3627351+jzheaux@users.noreply.github.com>
 2026-09-08 11:14:41 -06:00
Josh Cummings 411dbb83a1 Merge branch '7.1.x' 2026-09-08 10:26:03 -06:00
Josh Cummings 29c6f855d7 Fix Formatting and Style 
Signed-off-by: Josh Cummings <3627351+jzheaux@users.noreply.github.com>
 2026-09-08 10:20:00 -06:00
Josh Cummings b894640bc7 Update Formatting and Style 
Signed-off-by: Josh Cummings <3627351+jzheaux@users.noreply.github.com>
 2026-09-08 10:19:57 -06:00
dependabot[bot] a37c0ac9ce Bump io-spring-javaformat from 0.0.47 to 0.0.48 
Bumps `io-spring-javaformat` from 0.0.47 to 0.0.48.

Updates `io.spring.javaformat:spring-javaformat-checkstyle` from 0.0.47 to 0.0.48
- [Release notes](https://github.com/spring-io/spring-javaformat/releases)
- [Commits](https://github.com/spring-io/spring-javaformat/compare/v0.0.47...v0.0.48)

Updates `io.spring.javaformat:spring-javaformat-gradle-plugin` from 0.0.47 to 0.0.48
- [Release notes](https://github.com/spring-io/spring-javaformat/releases)
- [Commits](https://github.com/spring-io/spring-javaformat/compare/v0.0.47...v0.0.48)

---
updated-dependencies:
- dependency-name: io.spring.javaformat:spring-javaformat-checkstyle
  dependency-version: 0.0.48
  dependency-type: direct:production
  update-type: version-update:semver-patch
- dependency-name: io.spring.javaformat:spring-javaformat-gradle-plugin
  dependency-version: 0.0.48
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-09-04 10:26:18 -06:00
Josh Cummings a551be65eb Update Formatting and Style 
Signed-off-by: Josh Cummings <3627351+jzheaux@users.noreply.github.com>
 2026-09-04 09:24:19 -07:00
dependabot[bot] 5449cca3e7 Bump io-spring-javaformat from 0.0.47 to 0.0.48 
Bumps `io-spring-javaformat` from 0.0.47 to 0.0.48.

Updates `io.spring.javaformat:spring-javaformat-checkstyle` from 0.0.47 to 0.0.48
- [Release notes](https://github.com/spring-io/spring-javaformat/releases)
- [Commits](https://github.com/spring-io/spring-javaformat/compare/v0.0.47...v0.0.48)

Updates `io.spring.javaformat:spring-javaformat-gradle-plugin` from 0.0.47 to 0.0.48
- [Release notes](https://github.com/spring-io/spring-javaformat/releases)
- [Commits](https://github.com/spring-io/spring-javaformat/compare/v0.0.47...v0.0.48)

---
updated-dependencies:
- dependency-name: io.spring.javaformat:spring-javaformat-checkstyle
  dependency-version: 0.0.48
  dependency-type: direct:production
  update-type: version-update:semver-patch
- dependency-name: io.spring.javaformat:spring-javaformat-gradle-plugin
  dependency-version: 0.0.48
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-09-04 09:24:19 -07:00
Josh Cummings c9b653b563 Fix Formatting and Style 
Signed-off-by: Josh Cummings <3627351+jzheaux@users.noreply.github.com>
 2026-09-04 09:10:59 -07:00
Yohei Kishimoto 7ddce27828 throw original exception to keep compatibility with common RestTemplate 
Signed-off-by: Yohei Kishimoto <morokosi@users.noreply.github.com>
 2026-09-04 09:10:59 -07:00
Josh Cummings 08517085b2 Merge branch '7.1.x' 2026-09-04 09:02:35 -06:00
Josh Cummings 01891c8032 Merge branch '7.0.x' into 7.1.x 2026-09-04 09:02:29 -06:00
dependabot[bot] 671cb75c72 Bump antora from 3.2.0-rc.3 to 3.2.0 in /docs 
Bumps [antora](https://gitlab.com/antora/antora/tree/HEAD/packages/antora) from 3.2.0-rc.3 to 3.2.0.
- [Changelog](https://gitlab.com/antora/antora/blob/main/CHANGELOG.adoc)
- [Commits](https://gitlab.com/antora/antora/compare/v3.2.0-rc.3...v3.2.0)

---
updated-dependencies:
- dependency-name: antora
  dependency-version: 3.2.0
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-09-04 08:02:13 -07:00
Josh Cummings 1dcb0b4927 Merge branch '7.1.x' 2026-09-04 09:01:11 -06:00
Josh Cummings 201adb3101 Merge branch '7.0.x' into 7.1.x 2026-09-04 08:59:03 -06:00
Josh Cummings 81ce86800e Update to spring-release-actions 0.0.6 
Signed-off-by: Josh Cummings <3627351+jzheaux@users.noreply.github.com>
 2026-09-04 08:58:54 -06:00
Josh Cummings 47373888ac Merge branch '7.1.x' 2026-09-04 08:54:23 -06:00
Josh Cummings 312e0a4529 Merge branch '7.0.x' into 7.1.x 2026-09-04 08:52:35 -06:00
Josh Cummings d5ac3a86bc Update Workflows to spring-security-release-tools 1.0.17 
Signed-off-by: Josh Cummings <3627351+jzheaux@users.noreply.github.com>
 2026-09-04 08:50:46 -06:00
Josh Cummings d2d9d14b8f Merge branch '7.1.x' 2026-09-04 08:32:02 -06:00