Robert Winch
0039bc0cf0
Handle null value in OnCommittedResponseWrapper header methods
...
Closes gh-18970
2026-03-26 14:50:44 -05:00
Josh Cummings
057e5181ea
Adjust Formatting
...
Issue gh-18805
Signed-off-by: Josh Cummings <3627351+jzheaux@users.noreply.github.com>
2026-03-25 15:19:29 -06:00
Tran Ngoc Nhan
178ca56aaf
Fallback defaultTargetUrl if refererHeader is empty
...
Closes gh-18805
Signed-off-by: Tran Ngoc Nhan <ngocnhan.tran1996@gmail.com>
2026-03-25 15:19:29 -06:00
dependabot[bot]
61ccf14953
Bump org.hibernate.orm:hibernate-core from 6.6.44.Final to 6.6.45.Final
...
Bumps [org.hibernate.orm:hibernate-core](https://github.com/hibernate/hibernate-orm ) from 6.6.44.Final to 6.6.45.Final.
- [Release notes](https://github.com/hibernate/hibernate-orm/releases )
- [Changelog](https://github.com/hibernate/hibernate-orm/blob/6.6.45/changelog.txt )
- [Commits](https://github.com/hibernate/hibernate-orm/compare/6.6.44...6.6.45 )
---
updated-dependencies:
- dependency-name: org.hibernate.orm:hibernate-core
dependency-version: 6.6.45.Final
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com>
2026-03-25 15:11:27 -06:00
Joe Grandja
6e683f2286
Fix ID Token auth_time validation
...
Closes gh-18839
2026-03-25 11:33:55 -04:00
Josh Cummings
b6e24db68c
Return Mono.empty on Empty POST
...
Closes gh-18973
Signed-off-by: Josh Cummings <3627351+jzheaux@users.noreply.github.com>
2026-03-23 18:12:21 -06:00
Daniel Garnier-Moiroux
aeb5fc1fb0
Fix HttpSessionRequestCache#getMatchingRequest query string parsing
...
- URL parsing changed in framework 6.2, and fails when path contains a % sign.
- The HttpSessionRequestCache only needs to inspect the query string, not the full URL.
Fixes gh-16656
Signed-off-by: Daniel Garnier-Moiroux <git@garnier.wf>
2026-03-23 17:52:17 -06:00
Tran Ngoc Nhan
62f33d3fcf
Add equals and hashCode to HttpMethodRequestMatcher
...
Closes gh-18911
Signed-off-by: Tran Ngoc Nhan <ngocnhan.tran1996@gmail.com>
2026-03-20 21:22:20 -06:00
Rob Winch
9fed1ac8c3
New line per sentence
...
Signed-off-by: Rob Winch <362503+rwinch@users.noreply.github.com>
2026-03-20 15:28:21 -06:00
Josh Cummings
9dbe3bdcc0
Polish Session Management Persistence Docs
...
Signed-off-by: Josh Cummings <3627351+jzheaux@users.noreply.github.com>
2026-03-20 15:28:21 -06:00
sankranti
d547ae0181
Fix defaults description in Session Management doc
...
Corrected that starting from Spring Security 6
security context is not automatically saved by default.
Signed-off-by: sankranti <sankranty@gmail.com>
2026-03-20 15:28:21 -06:00
dependabot[bot]
b8b1278e1f
Bump @springio/antora-extensions from 1.14.7 to 1.14.9 in /docs
...
Bumps [@springio/antora-extensions](https://github.com/spring-io/antora-extensions ) from 1.14.7 to 1.14.9.
- [Changelog](https://github.com/spring-io/antora-extensions/blob/main/CHANGELOG.adoc )
- [Commits](https://github.com/spring-io/antora-extensions/compare/v1.14.7...v1.14.9 )
---
updated-dependencies:
- dependency-name: "@springio/antora-extensions"
dependency-version: 1.14.9
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com>
2026-03-20 15:22:06 -06:00
dependabot[bot]
381047e386
Bump spring-io/spring-security-release-tools from 1.0.14 to 1.0.15
...
Bumps [spring-io/spring-security-release-tools](https://github.com/spring-io/spring-security-release-tools ) from 1.0.14 to 1.0.15.
- [Release notes](https://github.com/spring-io/spring-security-release-tools/releases )
- [Changelog](https://github.com/spring-io/spring-security-release-tools/blob/main/RELEASE.adoc )
- [Commits](729fed56d4...b92832ecbc
2026-03-20 15:21:53 -06:00
dependabot[bot]
376b40a735
Bump io.spring.gradle:spring-security-release-plugin
...
Bumps [io.spring.gradle:spring-security-release-plugin](https://github.com/spring-io/spring-security-release-tools ) from 1.0.14 to 1.0.15.
- [Release notes](https://github.com/spring-io/spring-security-release-tools/releases )
- [Changelog](https://github.com/spring-io/spring-security-release-tools/blob/main/RELEASE.adoc )
- [Commits](https://github.com/spring-io/spring-security-release-tools/compare/v1.0.14...v1.0.15 )
---
updated-dependencies:
- dependency-name: io.spring.gradle:spring-security-release-plugin
dependency-version: 1.0.15
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com>
2026-03-20 14:58:20 -06:00
dependabot[bot]
89fa1cbdd2
Bump spring-io/spring-security-release-tools/.github/workflows/build.yml
...
Bumps [spring-io/spring-security-release-tools/.github/workflows/build.yml](https://github.com/spring-io/spring-security-release-tools ) from 1.0.14 to 1.0.15.
- [Release notes](https://github.com/spring-io/spring-security-release-tools/releases )
- [Changelog](https://github.com/spring-io/spring-security-release-tools/blob/main/RELEASE.adoc )
- [Commits](729fed56d4...b92832ecbc
2026-03-20 14:57:09 -06:00
dependabot[bot]
0d75e6d10c
Bump @springio/asciidoctor-extensions in /docs
...
Bumps [@springio/asciidoctor-extensions](https://github.com/spring-io/asciidoctor-extensions ) from 1.0.0-alpha.17 to 1.0.0-alpha.18.
- [Changelog](https://github.com/spring-io/asciidoctor-extensions/blob/main/CHANGELOG.adoc )
- [Commits](https://github.com/spring-io/asciidoctor-extensions/compare/v1.0.0-alpha.17...v1.0.0-alpha.18 )
---
updated-dependencies:
- dependency-name: "@springio/asciidoctor-extensions"
dependency-version: 1.0.0-alpha.18
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com>
2026-03-20 14:56:46 -06:00
dependabot[bot]
01758c4c59
Bump spring-io/spring-security-release-tools/.github/workflows/deploy-artifacts.yml
...
Bumps [spring-io/spring-security-release-tools/.github/workflows/deploy-artifacts.yml](https://github.com/spring-io/spring-security-release-tools ) from 1.0.14 to 1.0.15.
- [Release notes](https://github.com/spring-io/spring-security-release-tools/releases )
- [Changelog](https://github.com/spring-io/spring-security-release-tools/blob/main/RELEASE.adoc )
- [Commits](729fed56d4...b92832ecbc
2026-03-20 14:56:10 -06:00
dependabot[bot]
f37833a59c
Bump spring-io/spring-security-release-tools/.github/workflows/test.yml
...
Bumps [spring-io/spring-security-release-tools/.github/workflows/test.yml](https://github.com/spring-io/spring-security-release-tools ) from 1.0.14 to 1.0.15.
- [Release notes](https://github.com/spring-io/spring-security-release-tools/releases )
- [Changelog](https://github.com/spring-io/spring-security-release-tools/blob/main/RELEASE.adoc )
- [Commits](729fed56d4...b92832ecbc
2026-03-20 14:55:52 -06:00
dependabot[bot]
52e6c4c4be
Bump spring-io/spring-security-release-tools/.github/workflows/deploy-schema.yml
...
Bumps [spring-io/spring-security-release-tools/.github/workflows/deploy-schema.yml](https://github.com/spring-io/spring-security-release-tools ) from 1.0.14 to 1.0.15.
- [Release notes](https://github.com/spring-io/spring-security-release-tools/releases )
- [Changelog](https://github.com/spring-io/spring-security-release-tools/blob/main/RELEASE.adoc )
- [Commits](729fed56d4...b92832ecbc
2026-03-20 14:55:38 -06:00
github-actions[bot]
96ceb535f4
Next development version
2026-03-16 18:13:58 +00:00
github-actions[bot]
0c54a55ae8
Release 6.5.9
2026-03-16 17:40:54 +00:00
Josh Cummings
01ff3b086a
Add Workflow for Deferring Issues
...
Signed-off-by: Josh Cummings <3627351+jzheaux@users.noreply.github.com>
2026-03-16 10:49:07 -06:00
Rob Winch
33e6f4bd3f
Merge Fix Jackson Deserializer for AuthenticationExtensionsClientOutputs
2026-03-16 11:57:07 -04:00
Robert Winch
cdd4b36d37
Update Antora UI Spring to v0.4.26
2026-03-16 08:26:19 -05:00
Robert Winch
7672f76fde
Bump io.projectreactor:reactor-bom from 2024.0.15 to 2024.0.16
2026-03-16 08:26:12 -05:00
Robert Winch
3db4999da4
Bump org.apache.maven:maven-resolver-provider from 3.9.13 to 3.9.14
2026-03-16 08:26:04 -05:00
dependabot[bot]
a708d2f61b
Bump org.springframework:spring-framework-bom from 6.2.16 to 6.2.17
...
Bumps [org.springframework:spring-framework-bom](https://github.com/spring-projects/spring-framework ) from 6.2.16 to 6.2.17.
- [Release notes](https://github.com/spring-projects/spring-framework/releases )
- [Commits](https://github.com/spring-projects/spring-framework/compare/v6.2.16...v6.2.17 )
---
updated-dependencies:
- dependency-name: org.springframework:spring-framework-bom
dependency-version: 6.2.17
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com>
2026-03-16 03:07:46 +00:00
Ziqin Wang
e726c05e76
Fix Jackson 2 deserializer for AuthenticationExtensionsClientOutputs
...
The deserializer is updated to properly ignore unknown extensions.
Closes gh-18643
Signed-off-by: Ziqin Wang <ziqin@wangziqin.net>
2026-03-15 15:04:14 +08:00
Ziqin Wang
a7039fb3e6
Test Jackson 2 deserializer with unknown primitive WebAuthn ext
...
Signed-off-by: Ziqin Wang <ziqin@wangziqin.net>
2026-03-15 15:03:28 +08:00
Ziqin Wang
88ea668f47
Test Jackson 2 deserializer with unknown obj/arr WebAuthn ext
...
Signed-off-by: Ziqin Wang <ziqin@wangziqin.net>
2026-03-15 15:03:17 +08:00
github-actions[bot]
03a5de1955
Update Antora Spring UI to v0.4.26
2026-03-13 17:45:05 +00:00
dependabot[bot]
06cbea383e
Bump org.apache.maven:maven-resolver-provider from 3.9.13 to 3.9.14
...
Bumps org.apache.maven:maven-resolver-provider from 3.9.13 to 3.9.14.
---
updated-dependencies:
- dependency-name: org.apache.maven:maven-resolver-provider
dependency-version: 3.9.14
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com>
2026-03-13 03:07:50 +00:00
Andrey Litvitski
e250236279
Read relayState from authenticationRequest
...
Closes gh-18243
Signed-off-by: Andrey Litvitski <andrey1010102008@gmail.com>
2026-03-12 10:30:11 -06:00
Josh Cummings
ef76ba040d
Require non-null authenticationRequest
...
Closes gh-18880
Signed-off-by: Josh Cummings <3627351+jzheaux@users.noreply.github.com>
2026-03-11 16:45:23 -06:00
dependabot[bot]
d69af716c8
Bump io.projectreactor:reactor-bom from 2024.0.15 to 2024.0.16
...
Bumps [io.projectreactor:reactor-bom](https://github.com/reactor/reactor ) from 2024.0.15 to 2024.0.16.
- [Release notes](https://github.com/reactor/reactor/releases )
- [Commits](https://github.com/reactor/reactor/compare/2024.0.15...2024.0.16 )
---
updated-dependencies:
- dependency-name: io.projectreactor:reactor-bom
dependency-version: 2024.0.16
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com>
2026-03-11 03:06:57 +00:00
Rob Winch
7e37aa2b75
Merge Fix CookieRequestCache parameters
2026-03-09 15:25:05 -04:00
Vishnutheep B
07bfe371b4
Fix CookieRequestCache parameters
...
Previously the parameters were not restored.
This commit ensures the parameters are restored.
Closes gh-18204
Signed-off-by: Vishnutheep B <vishnutheep@gmail.com>
2026-03-09 14:10:30 -05:00
Robert Winch
e12edf43f2
Bump @antora/collector-extension from 1.0.2 to 1.0.3 in /docs
2026-03-09 09:58:04 -05:00
dependabot[bot]
a499e56b9b
Bump org.apache.maven:maven-resolver-provider from 3.9.12 to 3.9.13
...
Bumps org.apache.maven:maven-resolver-provider from 3.9.12 to 3.9.13.
---
updated-dependencies:
- dependency-name: org.apache.maven:maven-resolver-provider
dependency-version: 3.9.13
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com>
2026-03-09 03:09:41 +00:00
dependabot[bot]
8c3f6ea0d4
Bump @antora/collector-extension from 1.0.2 to 1.0.3 in /docs
...
---
updated-dependencies:
- dependency-name: "@antora/collector-extension"
dependency-version: 1.0.3
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com>
2026-03-06 00:37:07 +00:00
Josh Cummings
e17d85e460
Add IDE Setup Documentation
...
Issue gh-17833
Signed-off-by: Josh Cummings <3627351+jzheaux@users.noreply.github.com>
2026-03-03 18:51:32 -07:00
dependabot[bot]
f12036db05
Bump actions/upload-artifact from 6.0.0 to 7.0.0
...
Bumps [actions/upload-artifact](https://github.com/actions/upload-artifact ) from 6.0.0 to 7.0.0.
- [Release notes](https://github.com/actions/upload-artifact/releases )
- [Commits](b7c566a772...bbbca2ddaa
2026-03-03 18:16:39 -07:00
dependabot[bot]
7b5c502a97
Bump org.hibernate.orm:hibernate-core from 6.6.43.Final to 6.6.44.Final
...
Bumps [org.hibernate.orm:hibernate-core](https://github.com/hibernate/hibernate-orm ) from 6.6.43.Final to 6.6.44.Final.
- [Release notes](https://github.com/hibernate/hibernate-orm/releases )
- [Changelog](https://github.com/hibernate/hibernate-orm/blob/6.6.44/changelog.txt )
- [Commits](https://github.com/hibernate/hibernate-orm/compare/6.6.43...6.6.44 )
---
updated-dependencies:
- dependency-name: org.hibernate.orm:hibernate-core
dependency-version: 6.6.44.Final
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com>
2026-03-03 17:47:07 -07:00
HaiYan
706b059ea8
Update logout.adoc
...
Directives should be Directive
Signed-off-by: HaiYan <haiyan_qi@hotmail.com>
2026-03-03 16:43:18 -07:00
Rob Winch
ea3b112bea
Fix Flaky Crypto Tests
2026-03-03 15:58:17 -06:00
Robert Winch
1261c229a3
Fix Flaky Crypto Tests
...
Previously the RsaSecretEncryptorTests were flaky because the assumed that a BadPaddigException would be thrown
when using things like different salt. However, given that the tests had random inputs (e.g. keys) there is the
possibility that, despite the fact that it can never be properly decrypted, the final bytes look like a valid
encrypted value.
This updates the tests to ensure that decrypt either throws an Exception or is not equal to the original
plaintext.
2026-03-03 14:52:28 -06:00
Josh Cummings
4501ae7d1c
Update Reactive Resource Server startup exceptations
...
Issue gh-16708
Signed-off-by: Josh Cummings <3627351+jzheaux@users.noreply.github.com>
2026-02-26 16:56:22 -07:00
Josh Cummings
48112d3d74
Polish Resource Server startup expectations
...
Issue gh-16708
Signed-off-by: Josh Cummings <3627351+jzheaux@users.noreply.github.com>
2026-02-26 16:56:22 -07:00
[CLOUD4] 한현
b8735abb63
Clarify Resource Server startup expectations
...
Clarify that Spring Boot defers OIDC discovery by default.
Closes gh-16708
Signed-off-by: [CLOUD4] 한현 <gusgus1467@naver.com>
2026-02-26 16:56:22 -07:00
Guillaume Husta
68a02ff176
Update Link to CRSF Docs in FAQ
...
Signed-off-by: Guillaume Husta <guillaume.husta@gmail.com>
2026-02-26 14:47:21 -07:00
