Joe Grandja
41524880c6
Fix auth_time claim should represent authentication time
...
Closes gh-18282
2026-04-07 15:44:57 -04:00
Josh Cummings
2361dc131e
Merge branch '6.5.x' into 7.0.x
2026-04-07 10:31:01 -06:00
dependabot[bot]
44d32815b1
Bump @springio/antora-extensions from 1.14.9 to 1.14.10 in /docs
...
Bumps [@springio/antora-extensions](https://github.com/spring-io/antora-extensions ) from 1.14.9 to 1.14.10.
- [Changelog](https://github.com/spring-io/antora-extensions/blob/main/CHANGELOG.adoc )
- [Commits](https://github.com/spring-io/antora-extensions/compare/v1.14.9...v1.14.10 )
---
updated-dependencies:
- dependency-name: "@springio/antora-extensions"
dependency-version: 1.14.10
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com>
2026-04-07 10:29:49 -06:00
dependabot[bot]
87c3335e01
Bump org.hibernate.orm:hibernate-core from 6.6.45.Final to 6.6.47.Final
...
Bumps [org.hibernate.orm:hibernate-core](https://github.com/hibernate/hibernate-orm ) from 6.6.45.Final to 6.6.47.Final.
- [Release notes](https://github.com/hibernate/hibernate-orm/releases )
- [Changelog](https://github.com/hibernate/hibernate-orm/blob/6.6.47/changelog.txt )
- [Commits](https://github.com/hibernate/hibernate-orm/compare/6.6.45...6.6.47 )
---
updated-dependencies:
- dependency-name: org.hibernate.orm:hibernate-core
dependency-version: 6.6.47.Final
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com>
2026-04-07 10:07:57 -06:00
dependabot[bot]
76e9d91f24
Bump @springio/antora-extensions from 1.14.9 to 1.14.10 in /docs
...
Bumps [@springio/antora-extensions](https://github.com/spring-io/antora-extensions ) from 1.14.9 to 1.14.10.
- [Changelog](https://github.com/spring-io/antora-extensions/blob/main/CHANGELOG.adoc )
- [Commits](https://github.com/spring-io/antora-extensions/compare/v1.14.9...v1.14.10 )
---
updated-dependencies:
- dependency-name: "@springio/antora-extensions"
dependency-version: 1.14.10
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com>
2026-04-07 10:06:09 -06:00
Joe Grandja
77fe9e892a
Merge branch '6.5.x' into 7.0.x
...
Closes gh-19022
2026-04-02 10:52:15 -04:00
Joe Grandja
eefbb4da64
Fix DefaultOidcUser.equals()
...
Closes gh-18622
2026-04-02 10:41:32 -04:00
Rob Winch
8f65f88dc0
Merge Add XML Based shouldWriteHeadersEagerly tests
...
Add XML Based shouldWriteHeadersEagerly tests
2026-04-01 12:58:09 -04:00
Rob Winch
a2793f31b4
Merge Add XML Based shouldWriteHeadersEagerly tests
...
Add XML Based shouldWriteHeadersEagerly tests
2026-04-01 12:53:29 -04:00
Robert Winch
64d8e6cc9b
Merge Add XML Based shouldWriteHeadersEagerly tests
2026-04-01 11:41:58 -05:00
Robert Winch
679a47a51d
Add XML Based shouldWriteHeadersEagerly tests
2026-04-01 11:37:39 -05:00
Josh Cummings
d4678c8e04
Add Missing Serialization Support
...
Closes gh-19013
Signed-off-by: Josh Cummings <3627351+jzheaux@users.noreply.github.com>
2026-03-31 15:55:09 -06:00
Josh Cummings
43b132bec6
Merge branch '6.5.x' into 7.0.x
2026-03-31 15:27:58 -06:00
Josh Cummings
08fca57d12
Add Missing Serialization Support
...
Closed gh-19012
Signed-off-by: Josh Cummings <3627351+jzheaux@users.noreply.github.com>
2026-03-31 13:58:35 -06:00
Josh Cummings
acabacb971
Update Test to find SuppressWarnings
...
Signed-off-by: Josh Cummings <3627351+jzheaux@users.noreply.github.com>
2026-03-31 13:47:52 -06:00
johnycho
1a130fca3c
Improve serialVersionUID check in tests
...
Signed-off-by: johnycho <shunnn215@gmail.com>
2026-03-31 13:47:50 -06:00
Josh Cummings
067f79dde5
Merge branch 'fix-17729' into 7.0.x
2026-03-30 17:19:31 -06:00
Josh Cummings
45758a5cec
Merge branch '6.5.x' into 7.0.x
2026-03-30 17:14:28 -06:00
Josh Cummings
52d98ab7af
Add Needed SuppressWarnings Annotations
...
Signed-off-by: Josh Cummings <3627351+jzheaux@users.noreply.github.com>
2026-03-30 17:14:17 -06:00
Josh Cummings
0b680be97b
Update Test to find SuppressWarnings
...
Signed-off-by: Josh Cummings <3627351+jzheaux@users.noreply.github.com>
2026-03-30 17:14:03 -06:00
johnycho
7c28b15471
Improve serialVersionUID check in tests
...
Signed-off-by: johnycho <shunnn215@gmail.com>
2026-03-30 14:26:12 -06:00
Rob Winch
abf3c866fb
Merge pull request #19005 from rwinch/7.0.x-CredentialRecordOwnerAuthorizationManager
...
Merge Add CredentialRecordOwnerAuthorizationManager
2026-03-29 23:46:35 -04:00
Rob Winch
5a4ada04ac
Merge pull request #19004 from rwinch/CredentialRecordOwnerAuthorizationManager
...
Add CredentialRecordOwnerAuthorizationManager
2026-03-29 23:46:03 -04:00
Robert Winch
c08329c0c5
Merge CredentialRecordOwnerAuthorizationManager
2026-03-29 22:24:21 -05:00
Robert Winch
a856baa6a8
Add CredentialRecordOwnerAuthorizationManager
...
Add CredentialRecordOwnerAuthorizationManager that verifies the
credential being deleted is owned by the currently authenticated user.
Also add an AuthorizationManager<Bytes> to WebAuthnRegistrationFilter
for the delete credential operation, defaulting to deny all, and wire it
up in WebAuthnConfigurer.
Per the WebAuthn specification [1], credential ids contain at least 16
bytes with at least 100 bits of entropy, making them practically
unguessable. The specification also advises that credential ids should
be kept private, as exposing them can leak personally identifying
information [2]. The CredentialRecordOwnerAuthorizationManager serves as
defense in depth: even if a credential id were somehow exposed, an
unauthorized user could not delete another user's credential.
[1] https://www.w3.org/TR/webauthn-3/#credential-id
[2] https://www.w3.org/TR/webauthn-3/#sctn-credential-id-privacy-leak
2026-03-29 21:54:27 -05:00
Josh Cummings
611786e4b5
Merge branch '6.5.x' into 7.0.x
2026-03-27 16:49:26 -06:00
Josh Cummings
ac63cf4fa5
Polish CustomAuthorizationManager Docs
...
Issue gh-13967
Signed-off-by: Josh Cummings <3627351+jzheaux@users.noreply.github.com>
2026-03-27 16:45:25 -06:00
as1605
f6bb55effb
Fix documentation for Custom Authorization Manager
...
Closes gh-13967
Signed-off-by: as1605 <1605.aditya.singh@gmail.com>
2026-03-27 16:45:25 -06:00
Josh Cummings
6020ab8e65
Polish CustomAuthorizationManager Docs
...
Issue gh-13967
Signed-off-by: Josh Cummings <3627351+jzheaux@users.noreply.github.com>
2026-03-27 16:36:00 -06:00
as1605
3076367168
Fix documentation for Custom Authorization Manager
...
Closes gh-13967
Signed-off-by: as1605 <1605.aditya.singh@gmail.com>
2026-03-27 16:36:00 -06:00
Josh Cummings
721b22d87a
Merge remote-tracking branch 'origin/6.5.x' into 7.0.x
2026-03-27 16:10:18 -06:00
Tran Ngoc Nhan
85b756cb74
Update FilterChainProxy#getFilters(String) javadoc
...
Closes gh-18157
Signed-off-by: Tran Ngoc Nhan <ngocnhan.tran1996@gmail.com>
2026-03-27 16:09:50 -06:00
Josh Cummings
0ce76d2c5d
Merge branch '6.5.x' into 7.0.x
2026-03-27 13:27:03 -06:00
dependabot[bot]
66cf02c6b0
Bump spring-io/spring-gradle-build-action from 2.0.5 to 2.0.6
...
Bumps [spring-io/spring-gradle-build-action](https://github.com/spring-io/spring-gradle-build-action ) from 2.0.5 to 2.0.6.
- [Release notes](https://github.com/spring-io/spring-gradle-build-action/releases )
- [Commits](efc55f07f4...c8668747d7
2026-03-27 13:26:10 -06:00
dependabot[bot]
7441ce7f16
Bump spring-io/spring-security-release-tools/.github/workflows/perform-release.yml
...
Bumps [spring-io/spring-security-release-tools/.github/workflows/perform-release.yml](https://github.com/spring-io/spring-security-release-tools ) from 1.0.14 to 1.0.15.
- [Release notes](https://github.com/spring-io/spring-security-release-tools/releases )
- [Changelog](https://github.com/spring-io/spring-security-release-tools/blob/main/RELEASE.adoc )
- [Commits](729fed56d4...b92832ecbc
2026-03-27 13:25:46 -06:00
dependabot[bot]
9dbcd8cf00
Bump spring-io/spring-security-release-tools/.github/workflows/update-scheduled-release-version.yml
...
Bumps [spring-io/spring-security-release-tools/.github/workflows/update-scheduled-release-version.yml](https://github.com/spring-io/spring-security-release-tools ) from 1.0.14 to 1.0.15.
- [Release notes](https://github.com/spring-io/spring-security-release-tools/releases )
- [Changelog](https://github.com/spring-io/spring-security-release-tools/blob/main/RELEASE.adoc )
- [Commits](729fed56d4...b92832ecbc
2026-03-27 13:25:35 -06:00
Josh Cummings
e6db4418b0
Merge branch '6.5.x' into 7.0.x
2026-03-27 13:22:44 -06:00
Josh Cummings
835d6c1fbd
Add Issuer Validation to withIssuerLocation Snippets
...
Closes gh-19000
Signed-off-by: Josh Cummings <3627351+jzheaux@users.noreply.github.com>
2026-03-27 13:22:24 -06:00
Josh Cummings
9fb3e14989
Merge branch '6.5.x' into 7.0.x
2026-03-27 12:14:41 -06:00
Josh Cummings
2c90edd7b7
Merge branch '6.5.x' into 7.0.x
2026-03-27 12:12:27 -06:00
Josh Cummings
95b2cdf7f4
Clarify JavaDoc
...
Removed note about DelegatingJwtGrantedAuthoritiesConverter from
ExpressionJwtGrantedAuthoritiesConverter and further explained in
DelegatingJwtGrantedAuthoritiesConverter where it comes in handy.
Issue gh-18300
Signed-off-by: Josh Cummings <3627351+jzheaux@users.noreply.github.com>
2026-03-27 11:48:56 -06:00
Rob Winch
f0e71a8bc4
Merge pull request #18990 from rwinch/7.0.x-gh-18970-null-oncommitted
...
Merge Handle null value in OnCommittedResponseWrapper header methods
2026-03-26 17:33:33 -04:00
Rob Winch
3ecf84855e
Merge pull request #18989 from rwinch/gh-18970-null-oncommitted
...
Merge Handle null value in OnCommittedResponseWrapper header methods
2026-03-26 17:29:33 -04:00
Robert Winch
2848b95fe0
Merge Handle null value in OnCommittedResponseWrapper header methods
2026-03-26 15:44:49 -05:00
Robert Winch
0039bc0cf0
Handle null value in OnCommittedResponseWrapper header methods
...
Closes gh-18970
2026-03-26 14:50:44 -05:00
Josh Cummings
671a53e850
Merge branch '6.5.x' into 7.0.x
2026-03-25 15:19:59 -06:00
Josh Cummings
057e5181ea
Adjust Formatting
...
Issue gh-18805
Signed-off-by: Josh Cummings <3627351+jzheaux@users.noreply.github.com>
2026-03-25 15:19:29 -06:00
Tran Ngoc Nhan
178ca56aaf
Fallback defaultTargetUrl if refererHeader is empty
...
Closes gh-18805
Signed-off-by: Tran Ngoc Nhan <ngocnhan.tran1996@gmail.com>
2026-03-25 15:19:29 -06:00
Josh Cummings
164fbaf007
Merge branch '6.5.x' into 7.0.x
2026-03-25 15:11:52 -06:00
dependabot[bot]
61ccf14953
Bump org.hibernate.orm:hibernate-core from 6.6.44.Final to 6.6.45.Final
...
Bumps [org.hibernate.orm:hibernate-core](https://github.com/hibernate/hibernate-orm ) from 6.6.44.Final to 6.6.45.Final.
- [Release notes](https://github.com/hibernate/hibernate-orm/releases )
- [Changelog](https://github.com/hibernate/hibernate-orm/blob/6.6.45/changelog.txt )
- [Commits](https://github.com/hibernate/hibernate-orm/compare/6.6.44...6.6.45 )
---
updated-dependencies:
- dependency-name: org.hibernate.orm:hibernate-core
dependency-version: 6.6.45.Final
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com>
2026-03-25 15:11:27 -06:00
