chore(deps): update all dependencies (major)

[renovate]

This PR contains the following updates:

Package	Type	Update	Change	Age	Adoption	Passing	Confidence
actions/cache	action	major	v3 -> v4
actions/checkout	action	major	v3 -> v4
actions/setup-java	action	major	v3 -> v4
org.springframework.security:spring-security-core (source)	compile	major	5.8.11 -> 6.4.1

---

Release Notes

actions/cache (actions/cache)

v4

Compare Source

actions/checkout (actions/checkout)

v4

Compare Source

• Check out other refs/* by commit if provided, fall back to ref by @​orhantoy in https://github.com/actions/checkout/pull/1924

actions/setup-java (actions/setup-java)

v4

Compare Source

spring-projects/spring-security (org.springframework.security:spring-security-core)

v6.4.1

Compare Source

🪲 Bug Fixes

• Documentation images should render clearly in both light and dark mode #​16132
• Fix conflicting bean names between @EnableWebSecurity and @EnableWebSocketSecurity #​16113

🔩 Build Updates

• Update Antora UI Spring to v0.4.18 #​16112

❤️ Contributors

Thank you to all the contributors who worked on this release:

@​github-actions[bot] and @​ngocnhan-tran1996

v6.4.0

Compare Source

⭐ New Features

• Add @FunctionalInterface to AuthorizationEventPublisher #​15934
• Add DefaultResourcesFilter.webauthn() #​15970
• Add deprecation notice for missing leading slashes #​16020
• Code Cleanup #​15996
• Document passkeys dependencies #​16107
• Factor out some common object mocking in tests #​15396
• Fix saml2 authentication guide docs #​16017
• Improve documentation about CredentialsContainer #​15554
• Improve Documentation on Adding a Custom Security Filter #​15893
• Improve Error Message for Conflicting Filter Chains #​15992
• Make it easier to determine where a filter chain has been defined #​15874
• OIDC logout not working for JPA/JDBC OAuth2AuthorizationService because DefaultSaml2AuthenticatedPrincipal does not implement equality #​15346
• Polish JdbcOneTimeTokenService #​15997
• relying-party-registration doesn't allow placeholders in xml #​14645
• Support ServerExchangeRejectedHandler @Bean #​16063

🪲 Bug Fixes

• An empty-string bearer token should result in an appropriate HTTP status code #​16037
• AuthorizeReturnObject AOT support should register proxied class as well #​16106
• Correct class name reference in WebFilterChainProxy JavaDoc #​16004
• Fix typo javadoc some classes #​16022
• Initialize OpenSAML in OpenSamlAssertingPartyMetadataRepository #​16055
• IpAddressMatcher null pointer exception #​16104
• OpenSamlAssertingPartyMetadataRepository should initialize OpenSAML #​16042
• Support ServerWebExchangeFirewall @Bean #​15999
• UniqueSecurityAnnotationScanner throws ConcurrentModificationException #​15906

🔨 Dependency Upgrades

• Bump ch.qos.logback:logback-classic from 1.5.11 to 1.5.12 #​16005
• Bump com.fasterxml.jackson:jackson-bom from 2.18.0 to 2.18.1 #​16007
• Bump com.webauthn4j:webauthn4j-core from 0.28.1.RELEASE to 0.28.2.RELEASE #​16122
• Bump io.freefair.gradle:aspectj-plugin from 8.10.2 to 8.11 #​16123
• Bump io.micrometer:micrometer-observation from 1.14.0 to 1.14.1 #​16121
• Bump io.projectreactor:reactor-bom from 2023.0.11 to 2023.0.12 #​16079
• Bump org-bouncycastle from 1.78.1 to 1.79 #​16010
• Bump org.hibernate.orm:hibernate-core from 6.6.1.Final to 6.6.2.Final #​16048
• Bump org.hsqldb:hsqldb from 2.7.3 to 2.7.4 #​16028
• Bump org.htmlunit:htmlunit from 4.5.0 to 4.6.0 #​16044
• Bump org.junit:junit-bom from 5.11.2 to 5.11.3 #​15968
• Bump org.seleniumhq.selenium:htmlunit3-driver from 4.25.0 to 4.26.0 #​16043
• Bump org.seleniumhq.selenium:selenium-java from 4.25.0 to 4.26.0 #​16018
• Bump org.springframework.data:spring-data-bom from 2024.0.5 to 2024.1.0 #​16124
• Bump org.springframework.ldap:spring-ldap-core from 3.2.7 to 3.2.8 #​16097
• Bump org.springframework:spring-framework-bom from 6.2.0-RC3 to 6.2.0 #​16096

🔩 Build Updates

• Bump @antora/collector-extension from 1.0.0-beta.4 to 1.0.0-beta.5 in /docs #​16115
• fix assertions #​15937
• Remove unnecessary parentheses and add static final field MockPortResolver#getServerPort #​15875
• Update Antora UI Spring to v0.4.17 #​15929

❤️ Contributors

Thank you to all the contributors who worked on this release:

@​Chu3laMan, @​Kehrlann, @​Limm-jk, @​dcolazin, @​dependabot[bot], @​franticticktick, @​github-actions[bot], @​gzhao9, @​ig-jinwoo, @​jzheaux, @​kse-music, @​ngocnhan-tran1996, and @​nomoreFt

v6.3.5

Compare Source

⭐ New Features

• Support ServerExchangeRejectedHandler @Bean #​16062
• Supporting logout+jwt for back-channel logout with spring-webflux #​15702

🪲 Bug Fixes

• Align DelegatingAuthenticationConverter Constructors #​15949
• An empty-string bearer token should result in an appropriate HTTP status code #​16036
• IpAddressMatcher null pointer exception #​15527
• RequestMatcherDelegatingAuthorizationManager should be post-processable #​15981
• Support ServerWebExchangeFirewall @Bean #​15991
• Unhandled exception in CookieRequestCache results in 500 Internal Server Error #​15986
• Update logout.adoc: Fix Customizing Logout Success Example #​15956

🔨 Dependency Upgrades

• Bump ch.qos.logback:logback-classic from 1.5.11 to 1.5.12 #​16006
• Bump com.fasterxml.jackson:jackson-bom from 2.17.2 to 2.17.3 #​16032
• Bump io.micrometer:micrometer-observation from 1.12.12 to 1.12.13 #​16126
• Bump io.projectreactor:reactor-bom from 2023.0.11 to 2023.0.12 #​16082
• Bump org.hsqldb:hsqldb from 2.7.3 to 2.7.4 #​16033
• Bump org.springframework.data:spring-data-bom from 2024.0.5 to 2024.0.6 #​16125
• Bump org.springframework.ldap:spring-ldap-core from 3.2.7 to 3.2.8 #​16102
• Bump org.springframework:spring-framework-bom from 6.1.14 to 6.1.15 #​16101

🔩 Build Updates

• Bump @antora/collector-extension from 1.0.0-beta.4 to 1.0.0-beta.5 in /docs #​16117
• Update Antora UI Spring to v0.4.17 #​15930

❤️ Contributors

Thank you to all the contributors who worked on this release:

@​asimuleo, @​dependabot[bot], @​github-actions[bot], and @​kse-music

v6.3.4

Compare Source

🪲 Bug Fixes

• Annotation expression template processing should not fail on Class parameter types #​15711
• Disabling credentials erasure on custom AuthenticationManager is not working #​15808
• Documentation inconsistency in AuthorizationManager's verify method return type #​15822
• Methods annotated with @PostFilter are processed twice by PostFilterAuthorizationMethodInterceptor #​15676
• OidcBackChannelLogoutTokenValidator should not construct when missing OIDC Provider Issuer #​15868
• SecurityJackson2Modules.getModules(): Cannot load module org.springframework.security.cas.jackson2.CasJackson2Module #​15767
• The additionalParameters array parameter of OAuth2AuthorizationRequest causes the authorizationRequestUri to be incorrect #​15829

🔨 Dependency Upgrades

• Bump ch.qos.logback:logback-classic from 1.5.10 to 1.5.11 #​15926
• Bump io.micrometer:micrometer-observation from 1.12.10 to 1.12.11 #​15917
• Bump io.mockk:mockk from 1.13.12 to 1.13.13 #​15897
• Bump io.projectreactor:reactor-bom from 2023.0.10 to 2023.0.11 #​15925
• Bump jakarta.servlet.jsp.jstl:jakarta.servlet.jsp.jstl-api from 3.0.1 to 3.0.2 #​15694
• Bump org-eclipse-jetty from 11.0.23 to 11.0.24 #​15731
• Bump org.jfrog.buildinfo:build-info-extractor-gradle from 4.33.21 to 4.33.22 #​15761
• Bump org.junit:junit-bom from 5.10.4 to 5.10.5 #​15883
• Bump org.springframework.data:spring-data-bom from 2024.0.4 to 2024.0.5 #​15958
• Bump org.springframework.ldap:spring-ldap-core from 3.2.6 to 3.2.7 #​15944
• Bump org.springframework:spring-framework-bom from 6.1.13 to 6.1.14 #​15945

🔩 Build Updates

• Bump @antora/collector-extension from 1.0.0-beta.2 to 1.0.0-beta.3 in /docs #​15907
• Bump @springio/asciidoctor-extensions from 1.0.0-alpha.13 to 1.0.0-alpha.14 in /docs #​15836
• Migrate slack notifications to GChat #​15668
• Release 6.3.4 #​15964
• Update eclipse/vscode configuration to use -parameters #​15681

❤️ Contributors

Thank you to all the contributors who worked on this release:

@​dependabot[bot] and @​kse-music

v6.3.3

Compare Source

🪲 Bug Fixes

• ObservationRegistry is never post-processed #​15658

🔨 Dependency Upgrades

• Bump org-eclipse-jetty from 11.0.22 to 11.0.23 #​15664

❤️ Contributors

Thank you to all the contributors who worked on this release:

@​dependabot[bot]

v6.3.2

Compare Source

⭐ New Features

• ActiveDirectoryLdapAuthenticationProvider does not implement support for multiple urls #​15495
• Document the role of CredentialsContainer #​15321
• OIDC Backchannel Logout should allow logout tokens having typ header of logout+jwt #​15410

🪲 Bug Fixes

• A broken link in Spring Security reference #​15297
• Documentation for ServletBearerExchangeFilterFunction incomplete or incorrect #​15460
• EnableMethodSecurity should publish only one bean of each AuthorizationAdvisor #​15592
• Fix Compromised Password Checker Docs Sample Not Working #​15305
• Fix for #​15172 introduces significant performance degredation #​15324
• Pre/PostAuthorize should not ignore HandleAuthorizationDenied#handlerClass when ApplicationContext is not provided #​15535
• Update prerequisites documentation with Java 17 #​15340
• Use Correct Meta-Annotation in Kotlin Sample #​15472
• Using sec:authorize in JSPX causes 'java.lang.NullPointerException: Cannot invoke "jakarta.servlet.ServletRegistration.getClassName()" because "registration" is null' #​15440

🔨 Dependency Upgrades

• Bump ch.qos.logback:logback-classic from 1.5.6 to 1.5.7 #​15619
• Bump com.fasterxml.jackson:jackson-bom from 2.17.1 to 2.17.2 #​15374
• Bump com.github.spullara.mustache.java:compiler from 0.9.13 to 0.9.14 #​15373
• Bump io.micrometer:micrometer-observation from 1.12.7 to 1.12.8 #​15383
• Bump io.micrometer:micrometer-observation from 1.12.8 to 1.12.9 #​15581
• Bump io.mockk:mockk from 1.13.11 to 1.13.12 #​15430
• Bump io.projectreactor:reactor-bom from 2023.0.7 to 2023.0.8 #​15388
• Bump io.projectreactor:reactor-bom from 2023.0.8 to 2023.0.9 #​15597
• Bump jakarta.servlet.jsp.jstl:jakarta.servlet.jsp.jstl-api from 3.0.0 to 3.0.1 #​15582
• Bump org-apache-maven-resolver from 1.9.20 to 1.9.21 #​15372
• Bump org-apache-maven-resolver from 1.9.21 to 1.9.22 #​15545
• Bump org-eclipse-jetty from 11.0.21 to 11.0.22 #​15356
• Bump org.apache.maven:maven-resolver-provider from 3.9.7 to 3.9.8 #​15268
• Bump org.apache.maven:maven-resolver-provider from 3.9.8 to 3.9.9 #​15642
• Bump org.gretty:gretty from 4.1.4 to 4.1.5 #​15431
• Bump org.hibernate.orm:hibernate-core from 6.4.9.Final to 6.4.10.Final #​15530
• Bump org.jetbrains.kotlin:kotlin-bom from 1.9.24 to 1.9.25 #​15456
• Bump org.jetbrains.kotlin:kotlin-gradle-plugin from 1.9.24 to 1.9.25 #​15455
• Bump org.jfrog.buildinfo:build-info-extractor-gradle from 4.33.19 to 4.33.20 #​15267
• Bump org.junit:junit-bom from 5.10.2 to 5.10.3 #​15315
• Bump org.skyscreamer:jsonassert from 1.5.1 to 1.5.3 #​15336
• Bump org.slf4j:slf4j-api from 2.0.13 to 2.0.14 #​15529
• Bump org.slf4j:slf4j-api from 2.0.14 to 2.0.15 #​15546
• Bump org.slf4j:slf4j-api from 2.0.15 to 2.0.16 #​15571
• Bump org.springframework.data:spring-data-bom from 2024.0.1 to 2024.0.2 #​15421
• Bump org.springframework.data:spring-data-bom from 2024.0.2 to 2024.0.3 #​15643
• Bump org.springframework.ldap:spring-ldap-core from 3.2.4 to 3.2.6 #​15620
• Bump org.springframework:spring-framework-bom from 6.1.10 to 6.1.11 #​15402
• Bump org.springframework:spring-framework-bom from 6.1.11 to 6.1.12 #​15613
• Bump org.springframework:spring-framework-bom from 6.1.9 to 6.1.10 #​15279

🔩 Build Updates

• Automate check of expected branch version #​15310
• Bump @antora/collector-extension from 1.0.0-alpha.4 to 1.0.0-alpha.6 in /docs #​15449
• Bump @antora/collector-extension from 1.0.0-alpha.6 to 1.0.0-alpha.7 in /docs #​15482
• Bump @antora/collector-extension from 1.0.0-alpha.7 to 1.0.0-beta.1 in /docs #​15560
• Bump @antora/collector-extension from 1.0.0-beta.1 to 1.0.0-beta.2 in /docs #​15637
• Bump @springio/antora-extensions from 1.11.1 to 1.12.0 in /docs #​15418
• Bump @springio/antora-extensions from 1.12.0 to 1.13.0 in /docs #​15517
• Bump @springio/antora-extensions from 1.13.0 to 1.13.1 in /docs #​15561
• Bump @springio/antora-extensions from 1.13.1 to 1.14.2 in /docs #​15636
• Bump @springio/asciidoctor-extensions from 1.0.0-alpha.10 to 1.0.0-alpha.11 in /docs #​15419
• Bump @springio/asciidoctor-extensions from 1.0.0-alpha.11 to 1.0.0-alpha.12 in /docs #​15515
• Bump antora from 3.2.0-alpha.4 to 3.2.0-alpha.5 in /docs #​15329
• Bump antora from 3.2.0-alpha.5 to 3.2.0-alpha.6 in /docs #​15480
• Bump com.gradle.develocity from 3.17.5 to 3.17.6 #​15464
• Bump io-spring-javaformat from 0.0.42 to 0.0.43 #​15650
• Fix typos and formatting in documentation #​15380
• Migrate slack notifications to GChat #​15505
• Use explicit types instead of var #​15537

❤️ Contributors

Thank you to all the contributors who worked on this release:

@​Kehrlann, @​dependabot[bot], and @​tahakorkem

v6.3.1

Compare Source

⭐ New Features

• Clarify the behavior of Concurrent Session Management when an IdP is involved #​15071
• Mention all required dependencies in LDAP documentation #​15245
• Minor docs fix #​15144

🪲 Bug Fixes

• AbstractRequestMatcherRegistry#requestMatchers should pick MvcRequestMatcher when using MockMvc #​15211
• Assert WebSession is not null #​15179
• DispatcherServletDelegatingRequestMatcher causes errors when running tests with MockMvc #​15197
• Documentation clarification after #​12783 has been closed is needed. #​15208
• Fix Java example in multitenanci.adoc #​15151
• Fix Kotlin example in authorize-http-requests.adoc #​15129
• Incorrect documentation for OIDC Back-Channel Logout #​15212
• IpAddressMatcher.matches(String address) still accepts URLs #​15172
• LDIF file on official documentation breaks the startup process #​15167
• Link to article with remember-me-persistent-token strategy is broken #​15149
• OpenSaml4AssertionValidator is not respecting clock skew settings #​15183
• Resolving invalid CSRF token values is not consistent #​15186
• spring-security/docs/modules/ROOT/pages/servlet/authorization /method-security #​15143
• SpringOpaqueTokenIntrospector does not add scopes as granted authorities properly #​15165

🔨 Dependency Upgrades

• Bump io.micrometer:micrometer-observation from 1.12.6 to 1.12.7 #​15225
• Bump io.projectreactor:reactor-bom from 2023.0.6 to 2023.0.7 #​15229
• Bump org.apache.directory.shared:shared-ldap from 0.9.15 to 0.9.19 #​15161
• Bump org.apache.maven:maven-resolver-provider from 3.9.6 to 3.9.7 #​15168
• Bump org.gretty:gretty from 4.1.3 to 4.1.4 #​15133
• Bump org.hibernate.orm:hibernate-core from 6.4.8.Final to 6.4.9.Final #​15228
• Bump org.hsqldb:hsqldb from 2.7.2 to 2.7.3 #​15193
• Bump org.springframework.data:spring-data-bom from 2024.0.0 to 2024.0.1 #​15260
• Bump org.springframework.ldap:spring-ldap-core from 3.2.3 to 3.2.4 #​15251
• Bump org.springframework:spring-framework-bom from 6.1.7 to 6.1.8 #​15134
• Bump org.springframework:spring-framework-bom from 6.1.8 to 6.1.9 #​15252

🔩 Build Updates

• Bump @antora/collector-extension from 1.0.0-alpha.3 to 1.0.0-alpha.4 in /docs #​15159
• Bump @springio/antora-extensions from 1.10.0 to 1.11.1 in /docs #​15141
• Bump com.gradle.develocity from 3.17.4 to 3.17.5 #​15239
• Bump gradle/gradle-build-action from 2 to 3 #​15157
• Bump io-spring-javaformat from 0.0.41 to 0.0.42 #​15219
• Bump org.jfrog.buildinfo:build-info-extractor-gradle from 4.33.15 to 4.33.16 #​15176
• Bump org.jfrog.buildinfo:build-info-extractor-gradle from 4.33.16 to 4.33.17 #​15218
• Bump org.jfrog.buildinfo:build-info-extractor-gradle from 4.33.17 to 4.33.19 #​15261
• Bump spring-io/spring-doc-actions from 17ed79e to 5a57bcc #​15139

❤️ Contributors

Thank you to all the contributors who worked on this release:

@​dependabot[bot] and @​theHacker

v6.3.0

Compare Source

⭐ New Features

• Add getters to OAuth2AuthorizedClientId #​13648
• Add timeout defaults to JwtDecoders #​14890
• doc: added hint to declare GrantedAuthorityDefaults as infrastructure bean #​15065
• Improve logging for Global Authentication #​14711
• Minor docs fix #​15043
• Minor Documentation update on import needed for using Kotlin DSL #​14969
• OAuth2 Client Authentication docs are incomplete #​14982
• Proofread CasAuthenticationFilter documentation #​14883
• Replace "Spring Boot 2.x" with "Spring Boot" #​14919
• Simplify Disabling application/x-www-form-urlencoded Encoding Client ID and Secret #​14859
• Support Specifying Identifier for relying-party-registrations Element #​14487
• Update What's New in 6.3 #​14918

🪲 Bug Fixes

• Do Not Invalidate Current Session When Its Registered #​15066
• Fix MethodAuthorizationDeniedPostProcessor does not exist in java doc #​14955
• fix docs error in AuthenticatedReactiveAuthorizationManager #​14979
• OIDC Logout section is not shown in the navbar #​15113
• Wrong information for RequestCacheAwareFilter in the Spring Security documentation. #​14996

🔨 Dependency Upgrades

• Bump ch.qos.logback:logback-classic from 1.5.5 to 1.5.6 #​14926
• Bump com.fasterxml.jackson:jackson-bom from 2.17.0 to 2.17.1 #​15010
• Bump com.gradle.develocity from 3.17.2 to 3.17.3 #​15051
• Bump com.gradle.develocity from 3.17.3 to 3.17.4 #​15104
• Bump io.micrometer:micrometer-observation from 1.12.5 to 1.12.6 #​15068
• Bump io.mockk:mockk from 1.13.10 to 1.13.11 #​15086
• Bump io.projectreactor:reactor-bom from 2023.0.5 to 2023.0.6 #​15076
• Bump org-apache-maven-resolver from 1.9.18 to 1.9.19 #​14940
• Bump org-apache-maven-resolver from 1.9.19 to 1.9.20 #​14987
• Bump org-aspectj from 1.9.22 to 1.9.22.1 #​15052
• Bump org-bouncycastle from 1.78 to 1.78.1 #​14929
• Bump org-eclipse-jetty from 11.0.20 to 11.0.21 #​15087
• Bump org.hibernate.orm:hibernate-core from 6.4.4.Final to 6.4.5.Final #​14948
• Bump org.hibernate.orm:hibernate-core from 6.4.5.Final to 6.4.6.Final #​14952
• Bump org.hibernate.orm:hibernate-core from 6.4.6.Final to 6.4.7.Final #​14962
• Bump org.hibernate.orm:hibernate-core from 6.4.7.Final to 6.4.8.Final #​14980
• Bump org.jetbrains.kotlin:kotlin-bom from 1.9.23 to 1.9.24 #​15025
• Bump org.jetbrains.kotlin:kotlin-gradle-plugin from 1.9.23 to 1.9.24 #​15026
• Bump org.jetbrains.kotlinx:kotlinx-coroutines-bom from 1.8.0 to 1.8.1 #​15053
• Bump org.jfrog.buildinfo:build-info-extractor-gradle from 4.33.13 to 4.33.15 #​14945
• Bump org.springframework.data:spring-data-bom from 2024.0.0-RC1 to 2024.0.0 #​15103
• Bump org.springframework:spring-framework-bom from 6.1.6 to 6.1.7 #​15088

🔩 Build Updates

• Attach Antora Docs to Pull Requests #​15061
• Bump com.github.spullara.mustache.java:compiler from 0.9.11 to 0.9.12 #​14986
• Bump com.github.spullara.mustache.java:compiler from 0.9.12 to 0.9.13 #​14999
• Bump io.spring.ge.conventions from 0.0.16 to 0.0.17 #​14963
• Bump io.spring.gradle:spring-security-release-plugin from 1.0.2 to 1.0.3 #​14928
• Consider Adding a Build Updates section to the release changelog #​15039

❤️ Contributors

Thank you to all the contributors who worked on this release:

@​Crain-32, @​Kehrlann, @​MrJovanovic13, @​ch4mpy, @​dependabot[bot], @​joaquinjsb, @​kse-music, @​madorb, @​rishiraj88, and @​vvaadd

v6.2.8

Compare Source

⭐ New Features

• Support ServerExchangeRejectedHandler @Bean #​16061
• Support ServerWebExchangeFirewall @Bean #​15987

🪲 Bug Fixes

• Fix error when Bearer token is requested with empty string #​15940
• Make RequestMatcherDelegatingAuthorizationManager post-processable #​15978
• RequestMatcherDelegatingAuthorizationManager should be post-processable #​15948
• Unhandled exception in CookieRequestCache results in 500 Internal Server Error #​15985

🔨 Dependency Upgrades

• Bump io.micrometer:micrometer-observation from 1.12.12 to 1.12.13 #​16128
• Bump io.projectreactor:reactor-bom from 2023.0.11 to 2023.0.12 #​16081
• Bump org.hsqldb:hsqldb from 2.7.3 to 2.7.4 #​16031
• Bump org.springframework.data:spring-data-bom from 2023.1.11 to 2023.1.12 #​16127
• Bump org.springframework.ldap:spring-ldap-core from 3.2.7 to 3.2.8 #​16100
• Bump org.springframework:spring-framework-bom from 6.1.14 to 6.1.15 #​16099

🔩 Build Updates

• Bump @antora/collector-extension from 1.0.0-beta.4 to 1.0.0-beta.5 in /docs #​16120
• Update Antora UI Spring to v0.4.17 #​15931

❤️ Contributors

Thank you to all the contributors who worked on this release:

@​codeconsole, @​dependabot[bot], @​github-actions[bot], and @​jacknie84

v6.2.7

Compare Source

🪲 Bug Fixes

• Disabling credentials erasure on custom AuthenticationManager is not working #​15807
• Documentation inconsistency in AuthorizationManager's verify method return type #​15704
• Fix code format in OIDC Logout docs #​15566
• Fix OIDC Logout docs: Session Strategy vs. Registry #​15686
• Methods annotated with @PostFilter are processed twice by PostFilterAuthorizationMethodInterceptor #​15675
• Methods annotated with @PostFilter are processed twice by PostFilterAuthorizationMethodInterceptor #​15651
• SecurityJackson2Modules.getModules(): Cannot load module org.springframework.security.cas.jackson2.CasJackson2Module #​15766
• The additionalParameters array parameter of OAuth2AuthorizationRequest causes the authorizationRequestUri to be incorrect #​15828

🔨 Dependency Upgrades

• Bump Gradle Wrapper from 8.10.1 to 8.10.2 #​15841
• Bump io.micrometer:micrometer-observation from 1.12.10 to 1.12.11 #​15919
• Bump io.mockk:mockk from 1.13.12 to 1.13.13 #​15896
• Bump io.projectreactor:reactor-bom from 2023.0.10 to 2023.0.11 #​15927
• Bump jakarta.servlet.jsp.jstl:jakarta.servlet.jsp.jstl-api from 3.0.1 to 3.0.2 #​15693
• Bump org-eclipse-jetty from 11.0.23 to 11.0.24 #​15733
• Bump org.junit:junit-bom from 5.10.4 to 5.10.5 #​15880
• Bump org.springframework.data:spring-data-bom from 2023.1.10 to 2023.1.11 #​15962
• Bump org.springframework.ldap:spring-ldap-core from 3.2.6 to 3.2.7 #​15946
• Bump org.springframework:spring-framework-bom from 6.1.13 to 6.1.14 #​15947

🔩 Build Updates

• Bump @antora/collector-extension from 1.0.0-beta.2 to 1.0.0-beta.3 in /docs #​15910
• Bump @springio/asciidoctor-extensions from 1.0.0-alpha.13 to 1.0.0-alpha.14 in /docs #​15838
• Bump Gradle Wrapper from 8.7 to 8.10 #​15609
• CORS documentation should use UrlBasedCorsConfigurationSource #​15769
• Migrate slack notifications to GChat #​15667
• Release 6.2.7 #​15965
• Update CORS document #​15784
• Update eclipse/vscode configuration to use -parameters #​15680

❤️ Contributors

Thank you to all the contributors who worked on this release:

@​Junhyunny, @​dependabot[bot], @​github-actions[bot], @​hwanders, and @​ngocnhan-tran1996

v6.2.6

Compare Source

⭐ New Features

• ActiveDirectoryLdapAuthenticationProvider does not implement support for multiple urls #​15494
• Document the role of CredentialsContainer #​15320
• OIDC Backchannel Logout should allow logout tokens having typ header of logout+jwt #​15277

🪲 Bug Fixes

• A broken link in Spring Security reference #​15288
• Correct HttpSessionCsrfTokenRepository Documentation #​15392
• Documentation for ServletBearerExchangeFilterFunction incomplete or incorrect #​15459
• Restrict automatic CORS configuration to UrlBasedCorsConfigurationSource #​15444
• Update prerequisites documentation with Java 17 #​15323
• Using sec:authorize in JSPX causes 'java.lang.NullPointerException: Cannot invoke "jakarta.servlet.ServletRegistration.getClassName()" because "registration" is null' #​15439

🔨 Dependency Upgrades

• Bump com.github.spullara.mustache.java:compiler from 0.9.13 to 0.9.14 #​15376
• Bump io.micrometer:micrometer-observation from 1.12.7 to 1.12.8 #​15381
• Bump io.micrometer:micrometer-observation from 1.12.8 to 1.12.9 #​15588
• Bump io.mockk:mockk from 1.13.11 to 1.13.12 #​15427
• Bump io.projectreactor:reactor-bom from 2023.0.7 to 2023.0.8 #​15389
• Bump io.projectreactor:reactor-bom from 2023.0.8 to 2023.0.9 #​15599
• Bump jakarta.servlet.jsp.jstl:jakarta.servlet.jsp.jstl-api from 3.0.0 to 3.0.1 #​15589
• Bump org-apache-maven-resolver from 1.9.20 to 1.9.21 #​15377
• Bump org-apache-maven-resolver from 1.9.21 to 1.9.22 #​15543
• Bump org-eclipse-jetty from 11.0.21 to 11.0.22 #​15358
• Bump org.apache.maven:maven-resolver-provider from 3.9.7 to 3.9.8 #​15271
• Bump org.apache.maven:maven-resolver-provider from 3.9.8 to 3.9.9 #​15645
• Bump org.jetbrains.kotlin:kotlin-bom from 1.9.24 to 1.9.25 #​15452
• Bump org.jetbrains.kotlin:kotlin-gradle-plugin from 1.9.24 to 1.9.25 #​15451
• Bump org.junit:junit-bom from 5.10.2 to 5.10.3 #​15314
• Bump org.skyscreamer:jsonassert from 1.5.1 to 1.5.3 #​15333
• Bump org.slf4j:slf4j-api from 2.0.13 to 2.0.14 #​15528
• Bump org.slf4j:slf4j-api from 2.0.14 to 2.0.15 #​15544
• Bump org.slf4j:slf4j-api from 2.0.15 to 2.0.16 #​15570
• Bump org.springframework.data:spring-data-bom from 2023.1.7 to 2023.1.8 #​15422
• Bump org.springframework.data:spring-data-bom from 2023.1.8 to 2023.1.9 #​15644
• Bump org.springframework.ldap:spring-ldap-core from 3.2.4 to 3.2.6 #​15618
• Bump org.springframework:spring-framework-bom from 6.1.10 to 6.1.11 [#​15404](https://redirect.github.com/spring-pr

---

Configuration

📅 Schedule: Branch creation - "every weekend" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.