Cwikius-Spring/spring-security
1
0
Fork 0
mirror of https://github.com/spring-projects/spring-security.git synced 2026-03-31 06:26:24 +00:00
Code Issues Packages Projects Releases Wiki Activity
20,685 Commits 50 Branches 376 Tags
Commit Graph

20685 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
dependabot[bot]
d5d466b0eb Bump org.jetbrains.dokka from 2.1.0 to 2.2.0 
Bumps [org.jetbrains.dokka](https://github.com/Kotlin/dokka) from 2.1.0 to 2.2.0.
- [Release notes](https://github.com/Kotlin/dokka/releases)
- [Commits](https://github.com/Kotlin/dokka/compare/v2.1.0...v2.2.0)

---
updated-dependencies:
- dependency-name: org.jetbrains.dokka
  dependency-version: 2.2.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-03-27 03:17:45 +00:00
dependabot[bot]
2970d2baf9 Bump org.jetbrains.dokka:dokka-gradle-plugin from 2.1.0 to 2.2.0 
Bumps [org.jetbrains.dokka:dokka-gradle-plugin](https://github.com/Kotlin/dokka) from 2.1.0 to 2.2.0.
- [Release notes](https://github.com/Kotlin/dokka/releases)
- [Commits](https://github.com/Kotlin/dokka/compare/v2.1.0...v2.2.0)

---
updated-dependencies:
- dependency-name: org.jetbrains.dokka:dokka-gradle-plugin
  dependency-version: 2.2.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-03-27 03:17:37 +00:00
dependabot[bot]
826f5d6d72 Bump spring-io/spring-gradle-build-action from 2.0.5 to 2.0.6 
Bumps [spring-io/spring-gradle-build-action](https://github.com/spring-io/spring-gradle-build-action) from 2.0.5 to 2.0.6.
- [Release notes](https://github.com/spring-io/spring-gradle-build-action/releases)
- [Commits](efc55f07f4...c8668747d7)

---
updated-dependencies:
- dependency-name: spring-io/spring-gradle-build-action
  dependency-version: 2.0.6
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-03-27 00:46:59 +00:00
Rob Winch
4704aea72a
Merge pull request #18991 from rwinch/main-gh-18970-null-oncommitted 
Merge Handle null value in OnCommittedResponseWrapper header methods
 2026-03-26 17:31:43 -04:00
Robert Winch
9f67afee42
Merge Handle null value in OnCommittedResponseWrapper header methods 2026-03-26 15:58:12 -05:00
Robert Winch
2848b95fe0
Merge Handle null value in OnCommittedResponseWrapper header methods 2026-03-26 15:44:49 -05:00
dependabot[bot]
aff736903d Bump picomatch from 2.3.1 to 2.3.2 in /javascript 
Bumps [picomatch](https://github.com/micromatch/picomatch) from 2.3.1 to 2.3.2.
- [Release notes](https://github.com/micromatch/picomatch/releases)
- [Changelog](https://github.com/micromatch/picomatch/blob/master/CHANGELOG.md)
- [Commits](https://github.com/micromatch/picomatch/compare/2.3.1...2.3.2)

---
updated-dependencies:
- dependency-name: picomatch
  dependency-version: 2.3.2
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-03-25 21:48:06 +00:00
Josh Cummings
0606ff152b Merge branch '7.0.x' 2026-03-25 15:20:07 -06:00
Josh Cummings
671a53e850 Merge branch '6.5.x' into 7.0.x 2026-03-25 15:19:59 -06:00
Josh Cummings
057e5181ea Adjust Formatting 
Issue gh-18805

Signed-off-by: Josh Cummings <3627351+jzheaux@users.noreply.github.com>
 2026-03-25 15:19:29 -06:00
Tran Ngoc Nhan
178ca56aaf Fallback defaultTargetUrl if refererHeader is empty 
Closes gh-18805

Signed-off-by: Tran Ngoc Nhan <ngocnhan.tran1996@gmail.com>
 2026-03-25 15:19:29 -06:00
Josh Cummings
a80447c65f Merge branch '7.0.x' 2026-03-25 15:11:59 -06:00
Josh Cummings
164fbaf007 Merge branch '6.5.x' into 7.0.x 2026-03-25 15:11:52 -06:00
dependabot[bot]
61ccf14953 Bump org.hibernate.orm:hibernate-core from 6.6.44.Final to 6.6.45.Final 
Bumps [org.hibernate.orm:hibernate-core](https://github.com/hibernate/hibernate-orm) from 6.6.44.Final to 6.6.45.Final.
- [Release notes](https://github.com/hibernate/hibernate-orm/releases)
- [Changelog](https://github.com/hibernate/hibernate-orm/blob/6.6.45/changelog.txt)
- [Commits](https://github.com/hibernate/hibernate-orm/compare/6.6.44...6.6.45)

---
updated-dependencies:
- dependency-name: org.hibernate.orm:hibernate-core
  dependency-version: 6.6.45.Final
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-03-25 15:11:27 -06:00
Josh Cummings
608b36bb1d Add docs-build to Dependabot Auto-Merge 
Signed-off-by: Josh Cummings <3627351+jzheaux@users.noreply.github.com>
 2026-03-25 14:45:37 -06:00
Robert Winch
51ce11cbd2
Move InetAddressMatcher to spring-security-core 
Closes gh-18979
 2026-03-25 15:25:57 -05:00
Robert Winch
c6e60c84f9 Add subsections to cors 
This helps make the docs look more uniform after adding
PreFlightRequestFilter docs in its own section

Issue gh-18926
 2026-03-25 16:04:42 -04:00
Robert Winch
4199240662 Add Support for PreFlightRequestFilter 
Closes gh-18926
 2026-03-25 16:04:42 -04:00
Robert Winch
0ef8a4ff27 Update to Spring Framework 7.0.7-SNAPSHOT 
Necessary to pick up Spring Framework's `PreFlightRequestFilter`

Issue gh-18926
 2026-03-25 16:04:42 -04:00
Josh Cummings
c749ead5f1 Publish KDoc for the Kotlin DSL 
Applies Dokka to any subproject using security-kotlin via DocsPlugin,
aggregates KDoc alongside Javadoc in syncAntoraAttachments, and adds
a Kotlin API entry to the reference docs navigation.

Closes gh-18968

Signed-off-by: Josh Cummings <3627351+jzheaux@users.noreply.github.com>
 2026-03-25 13:58:38 -06:00
Josh Cummings
622f75d346 Move Antora Tasks into DocsPlugin 
All Spring projects using io.spring.convention.docs are also using Antora,
so these tasks belong in the convention rather than each project's build script.

Issue gh-18968
 2026-03-25 13:58:38 -06:00
Joe Grandja
db67f36492 Fix ID Token auth_time validation (reactive) 
Issue gh-18839 gh-17246
 2026-03-25 14:28:00 -04:00
Joe Grandja
a8281a9c62 Merge branch '7.0.x' 2026-03-25 13:23:11 -04:00
Joe Grandja
65cf2586c5 Merge branch '6.5.x' into 7.0.x 
Closes gh-18978
 2026-03-25 12:40:43 -04:00
Joe Grandja
6e683f2286 Fix ID Token auth_time validation 
Closes gh-18839
 2026-03-25 11:33:55 -04:00
dependabot[bot]
f6f3b697fe Bump com.nimbusds:oauth2-oidc-sdk from 11.34 to 11.35 
Bumps [com.nimbusds:oauth2-oidc-sdk](https://bitbucket.org/connect2id/oauth-2.0-sdk-with-openid-connect-extensions) from 11.34 to 11.35.
- [Changelog](https://bitbucket.org/connect2id/oauth-2.0-sdk-with-openid-connect-extensions/src/master/CHANGELOG.txt)
- [Commits](https://bitbucket.org/connect2id/oauth-2.0-sdk-with-openid-connect-extensions/branches/compare/11.35..11.34)

---
updated-dependencies:
- dependency-name: com.nimbusds:oauth2-oidc-sdk
  dependency-version: '11.35'
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-03-25 03:17:16 +00:00
Josh Cummings
2c2666065f
Merge branch '7.0.x' 2026-03-24 13:39:37 -06:00
Josh Cummings
bae4cdd765
Adjust for Nullability 
Issue gh-18973

Signed-off-by: Josh Cummings <3627351+jzheaux@users.noreply.github.com>
 2026-03-24 13:39:27 -06:00
Josh Cummings
2a8976f2f0 Merge branch '7.0.x' 2026-03-23 18:13:15 -06:00
Josh Cummings
a7c3e842d6 Merge branch '6.5.x' into 7.0.x 2026-03-23 18:12:36 -06:00
Josh Cummings
b6e24db68c Return Mono.empty on Empty POST 
Closes gh-18973

Signed-off-by: Josh Cummings <3627351+jzheaux@users.noreply.github.com>
 2026-03-23 18:12:21 -06:00
Josh Cummings
5100bf3db9 Merge branch '7.0.x' 2026-03-23 17:53:41 -06:00
Josh Cummings
7dea8b8ca2 Merge branch '6.5.x' into 7.0.x 2026-03-23 17:53:14 -06:00
Daniel Garnier-Moiroux
aeb5fc1fb0 Fix HttpSessionRequestCache#getMatchingRequest query string parsing 
- URL parsing changed in framework 6.2, and fails when path contains a % sign.
- The HttpSessionRequestCache only needs to inspect the query string, not the full URL.

Fixes gh-16656

Signed-off-by: Daniel Garnier-Moiroux <git@garnier.wf>
 2026-03-23 17:52:17 -06:00
Eric Haag
91199e7202 Gracefully handle detached HEAD in branch version check 
Previously, the `CheckExpectedBranchVersionPlugin` would crash the Gradle
configuration phase if the project was in a detached HEAD state or not
in a Git repository, e.g., downloaded as a ZIP.

This commit refactors the plugin to be lazy and adopts several Gradle best
practices:

- Prevents build crashes on Git failures by gracefully catching non-zero
  exit codes, e.g., when checked out in a detached HEAD state.
- Moves the branch validation out of the task's main execution action
  and into an `onlyIf` predicate, allowing Gradle to skip the task
  entirely instead of executing an early return. This makes the skip
  outcome and reason visible in a Build Scan, rather than making it
  appear as if it executed.
- Defers the Git `exec` call to the execution phase using a lazy provider.
- Makes the task configuration cache compatible by avoiding illegal
  `Project` access inside the execution-time `onlyIf` closure.
- Improves user-facing logs and adds actionable bypass instructions when
  the project version doesn't match the branch version.

Signed-off-by: Eric Haag <ehaag@gradle.com>
 2026-03-23 14:49:58 -04:00
Andrey Litvitski
2fda37de53 Fix equals nullability annotations for jspecify compliance 
In this commit, we added `@Nullable` to equals methods of classes that
support `jspecify` for consistency with other Spring projects and to
avoid bugs that caused other Spring projects to do this natively.

Closes: gh-18929, gh-18927

Signed-off-by: Andrey Litvitski <andrey1010102008@gmail.com>
 2026-03-23 09:25:57 -06:00
Andreas Asplund
330c565178 Implement equals and hashCode closes gh-18882 
Signed-off-by: Andreas Asplund <andreas@asplund.biz>
 2026-03-23 08:06:31 -06:00
Joe Grandja
1db0d4f83d Enable null-safety in spring-security-oauth2-authorization-server 
Closes gh-18937
 2026-03-23 05:07:14 -04:00
Joe Grandja
fe24bd3d0c Remove checkstyle suppressions for spring-security-oauth2-authorization-server 
Issue gh-18937
 2026-03-23 05:06:59 -04:00
dependabot[bot]
e6df831943 Bump com.fasterxml.jackson:jackson-bom from 2.21.1 to 2.21.2 
Bumps [com.fasterxml.jackson:jackson-bom](https://github.com/FasterXML/jackson-bom) from 2.21.1 to 2.21.2.
- [Commits](https://github.com/FasterXML/jackson-bom/compare/jackson-bom-2.21.1...jackson-bom-2.21.2)

---
updated-dependencies:
- dependency-name: com.fasterxml.jackson:jackson-bom
  dependency-version: 2.21.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-03-23 03:19:04 +00:00
Josh Cummings
f35b4aa518 Merge branch '7.0.x' 2026-03-20 21:28:22 -06:00
Josh Cummings
4542f58be7 Merge branch '6.5.x' into 7.0.x 2026-03-20 21:27:04 -06:00
Tran Ngoc Nhan
62f33d3fcf Add equals and hashCode to HttpMethodRequestMatcher 
Closes gh-18911

Signed-off-by: Tran Ngoc Nhan <ngocnhan.tran1996@gmail.com>
 2026-03-20 21:22:20 -06:00
Bae Jihong
e9f331c30c Add test code for setAuthorizationManagerFactory 
- add test for setAuthorizationManagerFactory that is a alternative to setTrustResolver and setDefaultRolePrefix

Closes gh-18412

Signed-off-by: Bae Jihong <dasog@naver.com>
 2026-03-20 20:16:54 -06:00
Bae Jihong
bc4cc434fe Refactor code to remove compiler warnings 
- replace setTrustResolver with setAuthorizationManagerFactory in MethodSecurityExpressionRootTests
- resolve raw type warning in ExpressionBasedMessageSecurityMetadataSourceFactoryTests

Closes gh-18412

Signed-off-by: Bae Jihong <dasog@naver.com>
 2026-03-20 20:16:54 -06:00
Bae Jihong
5a694869fa Add @SupressWarnings(deprecation) for existing functions 
- add @SupressWarnings(deprecation) because of deprecated part in logic

Closes gh-18412

Signed-off-by: Bae Jihong <dasog@naver.com>
 2026-03-20 20:16:54 -06:00
Bae Jihong
ee06badcb6 Add @SuppressWarnings(unchecked, rawtypes) on functions in deprecated class 
Closes gh-18412

Signed-off-by: Bae Jihong <dasog@naver.com>
 2026-03-20 20:16:54 -06:00
Bae Jihong
9b108df1dc Add @SuppressWarnings(deprecation) on tests 
- add on tests for deprecated class
- add on tests for specific deprecated function

Closes gh-18412

Signed-off-by: Bae Jihong <dasog@naver.com>
 2026-03-20 20:16:54 -06:00
Josh Cummings
d76fb7f2e6 Polish WebAttributes ApplicationContext Support 
Closes gh-8843

Signed-off-by: Josh Cummings <3627351+jzheaux@users.noreply.github.com>
 2026-03-20 16:44:40 -06:00
wonderfulrosemari
846794d31b Prefer dispatcher context for authorize tag beans 
Signed-off-by: wonderfulrosemari <whwlsgur1419@naver.com>
 2026-03-20 16:44:40 -06:00