Skip to content

fix(deps): update dependency org.springframework.security:spring-security-bom to v6

Jednotné přihlášení test requested to merge renovate/major-spring-security into main

This MR contains the following updates:

Package Type Update Change
org.springframework.security:spring-security-bom (source) import major 5.8.3 -> 6.0.3

Release Notes

spring-projects/spring-security

v6.0.3

Compare Source

⭐ New Features

  • Add new DaoAuthenticationProvider constructor #​12874
  • Clarify documentation code snippet(s) (unclear where static imported methods come from) #​12992
  • Documentation should mention that an empty SecurityContext should also be saved #​12941
  • Expression-Based Access Control do not working as explain in spring security document for 6.0.2 also tried 6.0.5 the issue persist #​12932
  • Incomplete documentation regarding Hierarchical roles. #​12766
  • Remove deprecated SecurityContextPersistenceFilter from docs #​12690

🐞 Bug Fixes

  • @EnableReactiveMethodSecurity causes premature initialization of the ObservationRegistry and prevents it from being post-processed #​12780
  • Broken links in form login section of docs #​12822
  • chore: typo, removed extra "s" in word implementationss #​12882
  • EntityId ignored in xml relying-party-registration #​12777
  • Fix a javadoc typo in ReactiveAuthorizationManager #​13000
  • Fix a javadoc typo in ReactiveAuthorizationManager #​12983
  • Fix broken links in form login section #​12823
  • Fix docs typo #​12745
  • Fix documentation code block bug. #​12980
  • Fix typo architecture.adoc #​12851
  • fix typo in RequestCacheResultMatcher #​12814
  • HttpSessionSecurityContextRepository fails to create a session because of the deferred security context support #​12919
  • JdkSerializationRedisSerializer is not able to serialize Saml2LogoutRequest because of a lambda encoder #​12767
  • MessageMatcherDelegatingAuthorizationManager not extracting path variables for authorization context #​12540
  • Missing spring-security-oauth2 xsds after release #​12806
  • NimbusReactiveJwtDecoder.JwkSetUriReactiveJwtDecoderBuilder holds a reference to JWSVerificationKeySelector before ConfigurableJWTProcessor.setJWSKeySelector is executed #​13005
  • NoSuchElementException in org.springframework.security.web.server.ObservationWebFilterChainDecoratorAroundWebFilterObservationSimpleAroundWebFilterObservation.start(ObservationWebFilterChainDecorator.java:274 #​12829
  • Observation Spans are not nested correctly in Webflux #​12849
  • RelyingPartyRegistrations should not fail when SPSSODescriptor elements are present #​13055
  • Saml2 RelyingPartyRegistration.nameIdFormat is ignored and not set in AuthnRequest from OpenSamlAuthenticationRequestResolver #​12936
  • Spring Security 6.0.2 ObservationFilterChainDecorator produce wrong instrument names #​12811
  • SwitchUserFilter should use HttpSessionSecurityContextRepository by default #​12836

🔨 Dependency Upgrades

❤ Contributors

We'd like to thank all the contributors who worked on this release!

v6.0.2

Compare Source

⭐ New Features

  • CsrfTokenRequestAttributeHandler documentation should reflect that default is XorCsrfTokenRequestAttributeHandler #​12651
  • Document @EnableWebFluxSecurity requiring @Configuration in 6.0.0 #​12444
  • Move classpath checks to class member variable #​11437
  • Reenable R2dbcReactiveOAuth2AuthorizedClientServiceTests Tests #​12339
  • Revisit Session Management Documentation #​12680
  • Spring Security 6.0 Migration Guide Should Mention @Configuration Meta-Annotation Removal From Configuration Annotations #​12498
  • Update broken links, correct gradle command for Windows OS. #​12336

🐞 Bug Fixes

  • 200 response is returned when ObservationMarkingRequestRejectedHandler is in use #​12548
  • @EnableReactiveMethodSecurity#useAuthorizationManager should be true #​12506
  • A typo in form login doc #​12678
  • Adjusts setRequestHandler javadoc in CsrfWebFilter #​12467
  • AuthorizationManager method security documentation should use AnnotationMatchingPointcut #​12517
  • DefaultSavedRequest.doesRequestMatch does not work, when matchingRequestParameterName is set #​12671
  • Document XMLObject retreival for Asserting Party metadata #​12729
  • Document XMLObject retreival for Asserting Party metadata #​12728
  • Duplicate words. #​12471
  • Fix CSRF protection provided by @EnableWebSocketSecurity / Stomp #​12378
  • gradlew nativeTest fails with Failed to instantiate [org.springframework.security.test.context.support.WithUserDetailsSecurityContextFactory]: No default constructor found #​12614
  • Jackson serialization of DefaultSaml2AuthenticatedPrincipal: LinkedMultiValueMap is not in the allowlist #​12459
  • javax.json.bind.Jsonb to jakarta.json.bind.Jsonb #​12616
  • NimbusJwtDecoder unknown KID scenario is not correctly tested #​12495
  • No provider found for OAuth2AuthorizationCodeAuthenticationToken when running Spring Native Reactive app using OAuth2 #​12615
  • NPE in HttpSecurity#addFilterBefore when mixing custom DSL and standard #​12687
  • Security observations are not setting their parent osbervation #​12524
  • SessionManagementConfigurer ignores custom SecurityContextRepository for SessionManagementFilter #​12579
  • Spring Security 6.0.1 ObservationFilterChainDecorator produce wrong instrument names #​12490
  • SwitchUserFilter not working in Spring Security 6 #​12511
  • Update expression-based.adoc #​12363
  • Update multitenancy.adoc #​12474
  • WebTestUtilsTestRuntimeHints should only be invoked for Servlet #​12622
  • Wrong name of the filter in the SecurityContextHolderFilter diagram #​12527

🔨 Dependency Upgrades

❤ Contributors

We'd like to thank all the contributors who worked on this release!

v6.0.1

Compare Source

⭐ New Features

  • Add EnableWebSecurity migration steps to 5.8 guide #​12354
  • Replace deprecated set-state set-output GitHub Action's commands #​12299

🐞 Bug Fixes

  • codes in spring security docs fail to work #​12342
  • codes in spring security docs fail to work #​12341
  • DefaultLdapAuthoritiesPopulator throws NullPointerException #​12409
  • Error in ACLS document #​12270
  • Fix AuthorizationFilter diagram in docs #​12288
  • Incorrect Javadoc for class ExpressionAuthorizationDecision #​12435
  • Incorrect sample code in securityMatcher migration docs #​12303
  • Incorrect sample code in securityMatcher migration docs #​12302
  • It's not possible to disable micrometer obversability #​12268
  • ProxyFactoryBean on AuthenticationManager does not work in native mode #​12367
  • SecurityContextHolderFilter does not apply to async dispatch #​12369
  • SecurityContextHolderFilter does not apply to async dispatch #​12368

🔨 Dependency Upgrades

❤ Contributors

We'd like to thank all the contributors who worked on this release!

v6.0.0

Compare Source

⏪ Breaking Changes

  • CsrfAuthenticationStrategy is not consistent with CsrfFilter #​12235
  • Register FilterChainProxy for all dispatcher types #​12180

⭐ New Features

  • Add test runtime hints for annotations using @WithSecurityContext #​12215
  • Add WebTestUtils test runtime hints #​12216
  • Align with Servlet API 6 #​12146
  • Document Configure Default SessionAuthenticationStrategy #​12192
  • Document DelegatingSecurityContextRepository #​12185
  • Improve deprecation notice in WebSecurityConfigurerAdapter #​12262
  • Log a warning when AuthorizationGrantType does not exactly match a pre-defined constant #​12234
  • Migration guide for the removal of CAS #​12163
  • Polish Span and Meter Names #​12225
  • Register FilterChainProxy for All Dispatcher Types Migration Steps #​12212
  • Restructure 6.0 Migration Guide #​12242
  • Support Jakarta WebSocket 2.1 #​12148

🐞 Bug Fixes

  • CsrfAuthenticationStrategy does not check for existing token #​12241
  • Ensure instrumentation names align with semantic conventions #​12156
  • Incorrect scope map fix #​12207
  • SAML logout: Incorrect log messages #​12210
  • Saml2MetadataFilter response should configure writer to UTF-8 #​12223

🔨 Dependency Upgrades

  • Update micrometer-observation to 1.10.1 #​12250
  • Update org.springframework to 6.0.0 #​12255
  • Update org.springframework.data to 2022.0.0 #​12256
  • Update r2dbc-h2 to 1.0.0.RELEASE #​12251
  • Update slf4j-api to 2.0.4 #​12254
  • Update spring-ldap-core to 3.0.0 #​12257

❤ Contributors

We'd like to thank all the contributors who worked on this release!

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever MR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this MR and you won't be reminded about this update again.

  • If you want to rebase/retry this MR, check this box

This MR has been generated by Renovate Bot.

Edited by Jednotné přihlášení test

Merge request reports