Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Update spring security to v6 (major) #3046

Closed
wants to merge 1 commit into from
Closed

Update spring security to v6 (major) #3046

wants to merge 1 commit into from

Conversation

renovate[bot]
Copy link
Contributor

@renovate renovate bot commented Jul 26, 2023 •
edited
Loading

Mend Renovate

This PR contains the following updates:

Package Change Age Adoption Passing Confidence
org.springframework.security:spring-security-oauth2-core (source) 5.8.5 -> 6.1.3 age adoption passing confidence
org.springframework.security:spring-security-oauth2-jose (source) 5.8.5 -> 6.1.3 age adoption passing confidence
org.springframework.security:spring-security-oauth2-client (source) 5.8.5 -> 6.1.3 age adoption passing confidence
org.springframework.security:spring-security-oauth2-resource-server (source) 5.8.5 -> 6.1.3 age adoption passing confidence
org.springframework.security:spring-security-core (source) 5.8.5 -> 6.1.3 age adoption passing confidence
org.springframework.security:spring-security-config (source) 5.8.5 -> 6.1.3 age adoption passing confidence
org.springframework.security:spring-security-web (source) 5.8.5 -> 6.1.3 age adoption passing confidence
org.springframework.security:spring-security-crypto (source) 5.8.5 -> 6.1.3 age adoption passing confidence

Release Notes

spring-projects/spring-security (org.springframework.security:spring-security-oauth2-core)

v6.1.3

Compare Source

⭐ New Features

  • Add MvcRequestMatcher reference documentation #​13726
  • Refactor for readability #​13472
  • requestMatchers servlet validation error should include information about servlet paths #​13722
  • requestMatchers should not count servlets without mappings #​13724

🪲 Bug Fixes

  • Add return statement of the roleHierachy method in the servlet/author… #​13596
  • Fix typo in docs #​13637
  • Referrer Header is set in Reactive Web Applications by default, although doc says it is not. #​13590
  • RequestMatcherMetadataResponseResolver only shows last RelyingPartyRegistration #​13700
  • saml2Login should not override OpenSaml4AuthenticationProvider bean #​13655
  • The bean 'preFilterAuthorizationAdvisor', defined in class path resource could not be registered #​13580
  • Update links in adocs #​13632

🔨 Dependency Upgrades

❤️ Contributors

We'd like to thank all the contributors who worked on this release!

v6.1.2

Compare Source

⭐ New Features
  • Improve RequestMatcher Validation #​13557
  • Improve Security Filters Documentation #​13414
  • Optimize Querying of RequestCache -> continue parameter #​13488
  • Optimize Querying of RequestCache -> continue parameter #​13482
🪲 Bug Fixes
  • Error message should show underlying Client Authentication method #​13498
  • Javadoc for AuthorizationFilter#filterErrorDispatch is wrong #​13465
  • once-per-request="true" does not work in XML configuration #​13494
  • Spring Security 6 combined with AspectJ weaving of spring-security-aspects executes PreAuthorize twice #​13199
  • Unable to Find 'filterProcessingUrl' Method in Spring Security 6.1.1 Saml2LoginConfigurer Configuration #​13421
  • Unable to Use hasIpAddress() Method After Migrating to authorizeHttpRequests() in Spring Security 6 #​13478
  • update l179 of jwt docs #​13480
  • Use default PathPatternParser instance #​13464
🔨 Dependency Upgrades
  • Update io.projectreactor to 2022.0.9 #​13525
  • Update jakarta.websocket to 2.1.1 #​13526
  • Update micrometer-observation to 1.10.9 #​13524
  • Update org.springframework to 6.0.11 #​13527
  • Update org.springframework.data to 2022.0.8 #​13528
  • Update org.springframework.data to 2022.0.8 #​13522
❤️ Contributors

We'd like to thank all the contributors who worked on this release!

v6.1.1

Compare Source

⭐ New Features

  • Add initial Native section to reference docs #​13236
  • Align Resource Server documentation with Boot's capabilities #​13239
  • Convert to Asciidoctor Tabs #​13407
  • Document How to Handle Method Security in Native Image #​13237
  • Improve javadoc about deprecation of .and() and non-Customizer methods #​13273
  • Make eclipse/vscode project import work #​13284
  • Mention that authorizeHttpRequests does not support GrantedAuthorityDefaults #​13229
  • mockOAuth2Login() does not work in collaboration with Spring Cloud Gateway and TokenRelayGatewayFilter #​13254
  • Use Antora name of security #​13331

🪲 Bug Fixes

  • Additional filters registered when using Custom DSL #​13282
  • AOT Fails to proxy #​13369
  • CasAuthenticationFilter.successfulAuthentication missing call to securityContextRepository.saveContext #​13243
  • DefaultAuthorizationCodeTokenResponseClient.getTokenResponse(OAuth2AuthorizationCodeGrantRequest) can return null #​13223
  • Deprecated hint on BasicAuthenticationFilter #​13279
  • Document missing OAuth2LoginAuthenticationFilter set AuthorizationRequestRepository #​13193
  • Fix Antora Warnings #​13294
  • Fix constant value in XContentTypeOptionsServerHttpHeadersWriter #​13221
  • Fix Documentation Title #​13318
  • Fix legacy-websocket-configuration cross-reference #​13206
  • Fix type on method-security.adoc #​13212
  • http://www.springframework.org/schema/security/spring-security.xsd returns 404 #​13209
  • Migration to EnableMethodSecurity break Transactional on custom PermissionEvaluator #​13218
  • No longer maintained net.sourceforge.nekohtml with known security issues #​13287
  • Provide meaningful error when invalid client-authentication-method is provided #​13309
  • Proxy Server section is not linked in nav #​13324
  • Use consistent list of micrometer tags in web observation handler #​13190
  • UserBuilder does not allow authorities to be overridden #​13290

🔨 Dependency Upgrades

❤️ Contributors

We'd like to thank all the contributors who worked on this release!

v6.1.0

Compare Source

v6.0.6

Compare Source

⭐ New Features

  • requestMatchers servlet validation error should include information about servlet paths #​13721
  • requestMatchers should not count servlets without mappings #​13720

🪲 Bug Fixes

  • Doc : typo in Custom DSLs section #​13325
  • Fix typo in docs #​13605
  • Referrer Header is set in Reactive Web Applications by default, although doc says it is not. #​13589
  • saml2Login should not override OpenSaml4AuthenticationProvider bean #​13654
  • The bean 'preFilterAuthorizationAdvisor', defined in class path resource could not be registered #​13579
  • Update links in adocs #​13565

🔨 Dependency Upgrades

❤️ Contributors

We'd like to thank all the contributors who worked on this release!

v6.0.5

Compare Source

⭐ New Features
  • Improve RequestMatcher Validation #​13556
  • Improve Security Filters Documentation #​13413
  • Optimize Querying of RequestCache -> continue parameter #​13487
  • Optimize Querying of RequestCache -> continue parameter #​13481
🪲 Bug Fixes
  • Error message should show underlying Client Authentication method #​13496
  • Javadoc for AuthorizationFilter#filterErrorDispatch is wrong #​13456
  • once-per-request="true" does not work in XML configuration #​13491
  • Spring Security 6 combined with AspectJ weaving of spring-security-aspects executes PreAuthorize twice #​13198
  • Unable to Find 'filterProcessingUrl' Method in Spring Security 6.1.1 Saml2LoginConfigurer Configuration #​13420
  • Unable to Use hasIpAddress() Method After Migrating to authorizeHttpRequests() in Spring Security 6 #​13477
  • Use default PathPatternParser instance #​13463
🔨 Dependency Upgrades
  • Update io.projectreactor to 2022.0.9 #​13518
  • Update jakarta.websocket to 2.1.1 #​13519
  • Update micrometer-observation to 1.10.9 #​13517
  • Update org.springframework to 6.0.11 #​13520
  • Update org.springframework.data to 2022.0.8 #​13521

v6.0.4

Compare Source

⭐ New Features

  • Add initial Native section to reference docs #​12029
  • Align Resource Server documentation with Boot's capabilities #​13238
  • Convert to Asciidoctor Tabs #​13406
  • Document How to Handle Method Security in Native Image #​13226
  • Error On Unsupported Client Authentication Methods #​13240
  • Make eclipse/vscode project import work #​12930
  • Mention that authorizeHttpRequests does not support GrantedAuthorityDefaults #​13228
  • mockOAuth2Login() does not work in collaboration with Spring Cloud Gateway and TokenRelayGatewayFilter #​13253
  • Use Antora name of security #​13330

🪲 Bug Fixes

  • Additional filters registered when using Custom DSL #​13281
  • AffirmativeBased vs. AuthorizationManagers.anyOf(...) documentation #​13086
  • AOT Fails to proxy #​13368
  • AuthorizationAnnotationUtils.findUniqueAnnotation broken for synthetic methods #​13153
  • Clarify that Kotlin DSL needs an import #​13102
  • DefaultAuthorizationCodeTokenResponseClient.getTokenResponse(OAuth2AuthorizationCodeGrantRequest) can return null #​13222
  • Delete duplicate line from oauth2/client/core.adoc #​13233
  • Deprecated hint on BasicAuthenticationFilter #​13278
  • Document missing OAuth2LoginAuthenticationFilter set AuthorizationRequestRepository #​13192
  • Fix Antora Warnings #​13293
  • Fix code snippets in Authorize HttpServletRequest #​13125
  • Fix constant value in XContentTypeOptionsServerHttpHeadersWriter #​13220
  • Fix Documentation Title #​13317
  • Fix legacy-websocket-configuration cross-reference #​13205
  • http://www.springframework.org/schema/security/spring-security.xsd returns 404 #​13208
  • java.lang.IllegalArgumentException: Context does not have an entry for key [class io.micrometer.core.instrument.Timer$Sample] #​13133
  • Links between migration docs are out of date #​13156
  • Migration to EnableMethodSecurity break Transactional on custom PermissionEvaluator #​13217
  • No longer maintained net.sourceforge.nekohtml with known security issues #​13286
  • Proxy Server section is not linked in nav #​13323
  • RememberMeAuthenticationFilter does not use SecurityContextRepository configured in HttpSecurity #​13127
  • rolePrefix with empty string returns HTTP 400 as of version 6.0.3 #​13079
  • SAML login fails in Internet Explorer 11 #​13141
  • SimpleAroundFilterObservation.wrap calls scope.close() duplicated #​12787
  • Spring Boot 3.0 application failing to start with oauth2-resource-server and spring actuator #​13084
  • Spring Security SAML signature validation issue #​13182
  • The "http.sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS)" does not work if x.509 authentication is added. #​13008
  • Use consistent list of micrometer tags in web observation handler #​13179
  • X-XSS-Protection is now disabled #​13129

🔨 Dependency Upgrades

❤️ Contributors

We'd like to thank all the contributors who worked on this release!

v6.0.3

Compare Source

v6.0.2

Compare Source

⭐ New Features

  • CsrfTokenRequestAttributeHandler documentation should reflect that default is XorCsrfTokenRequestAttributeHandler #​12651
  • Document @EnableWebFluxSecurity requiring @Configuration in 6.0.0 #​12444
  • Move classpath checks to class member variable #​11437
  • Reenable R2dbcReactiveOAuth2AuthorizedClientServiceTests Tests #​12339
  • Revisit Session Management Documentation #​12680
  • Spring Security 6.0 Migration Guide Should Mention @Configuration Meta-Annotation Removal From Configuration Annotations #​12498
  • Update broken links, correct gradle command for Windows OS. #​12336

🪲 Bug Fixes

  • 200 response is returned when ObservationMarkingRequestRejectedHandler is in use #​12548
  • @EnableReactiveMethodSecurity#useAuthorizationManager should be true #​12506
  • A typo in form login doc #​12678
  • Adjusts setRequestHandler javadoc in CsrfWebFilter #​12467
  • AuthorizationManager method security documentation should use AnnotationMatchingPointcut #​12517
  • DefaultSavedRequest.doesRequestMatch does not work, when matchingRequestParameterName is set #​12671
  • Document XMLObject retreival for Asserting Party metadata #​12729
  • Document XMLObject retreival for Asserting Party metadata #​12728
  • Duplicate words. #​12471
  • Fix CSRF protection provided by @EnableWebSocketSecurity / Stomp #​12378
  • gradlew nativeTest fails with Failed to instantiate [org.springframework.security.test.context.support.WithUserDetailsSecurityContextFactory]: No default constructor found #​12614
  • Jackson serialization of DefaultSaml2AuthenticatedPrincipal: LinkedMultiValueMap is not in the allowlist #​12459
  • javax.json.bind.Jsonb to jakarta.json.bind.Jsonb #​12616
  • NimbusJwtDecoder unknown KID scenario is not correctly tested #​12495
  • No provider found for OAuth2AuthorizationCodeAuthenticationToken when running Spring Native Reactive app using OAuth2 #​12615
  • NPE in HttpSecurity#addFilterBefore when mixing custom DSL and standard #​12687
  • Security observations are not setting their parent osbervation #​12524
  • SessionManagementConfigurer ignores custom SecurityContextRepository for SessionManagementFilter #​12579
  • Spring Security 6.0.1 ObservationFilterChainDecorator produce wrong instrument names #​12490
  • SwitchUserFilter not working in Spring Security 6 #​12511
  • Update expression-based.adoc #​12363
  • Update multitenancy.adoc #​12474
  • WebTestUtilsTestRuntimeHints should only be invoked for Servlet #​12622
  • Wrong name of the filter in the SecurityContextHolderFilter diagram #​12527

🔨 Dependency Upgrades

❤️ Contributors

We'd like to thank all the contributors who worked on this release!

v6.0.1

Compare Source

⭐ New Features
  • Add EnableWebSecurity migration steps to 5.8 guide #​12354
  • Replace deprecated set-state set-output GitHub Action's commands #​12299
🪲 Bug Fixes
  • codes in spring security docs fail to work #​12342
  • codes in spring security docs fail to work #​12341
  • DefaultLdapAuthoritiesPopulator throws NullPointerException #​12409
  • Error in ACLS document #​12270
  • Fix AuthorizationFilter diagram in docs #​12288
  • Incorrect Javadoc for class ExpressionAuthorizationDecision #​12435
  • Incorrect sample code in securityMatcher migration docs #​12303
  • Incorrect sample code in securityMatcher migration docs #​12302
  • It's not possible to disable micrometer obversability #​12268
  • ProxyFactoryBean on AuthenticationManager does not work in native mode #​12367
  • SecurityContextHolderFilter does not apply to async dispatch #​12369
  • SecurityContextHolderFilter does not apply to async dispatch #​12368
🔨 Dependency Upgrades
❤️ Contributors

We'd like to thank all the contributors who worked on this release!

v6.0.0

Compare Source

⏪ Breaking Changes
  • CsrfAuthenticationStrategy is not consistent with CsrfFilter #​12235
  • Register FilterChainProxy for all dispatcher types #​12180
⭐ New Features
  • Add test runtime hints for annotations using @WithSecurityContext #​12215
  • Add WebTestUtils test runtime hints #​12216
  • Align with Servlet API 6 #​12146
  • Document Configure Default SessionAuthenticationStrategy #​12192
  • Document DelegatingSecurityContextRepository #​12185
  • Improve deprecation notice in WebSecurityConfigurerAdapter #​12262
  • Log a warning when AuthorizationGrantType does not exactly match a pre-defined constant #​12234
  • Migration guide for the removal of CAS #​12163
  • Polish Span and Meter Names #​12225
  • Register FilterChainProxy for All Dispatcher Types Migration Steps #​12212
  • Restructure 6.0 Migration Guide #​12242
  • Support Jakarta WebSocket 2.1 #​12148
🪲 Bug Fixes
  • CsrfAuthenticationStrategy does not check for existing token #​12241
  • Ensure instrumentation names align with semantic conventions #​12156
  • Incorrect scope map fix #​12207
  • SAML logout: Incorrect log messages #​12210
  • Saml2MetadataFilter response should configure writer to UTF-8 #​12223
🔨 Dependency Upgrades
  • Update micrometer-observation to 1.10.1 #​12250
  • Update org.springframework to 6.0.0 #​12255
  • Update org.springframework.data to 2022.0.0 #​12256
  • Update r2dbc-h2 to 1.0.0.RELEASE #​12251
  • Update slf4j-api to 2.0.4 #​12254
  • Update spring-ldap-core to 3.0.0 #​12257
❤️ Contributors

We'd like to thank all the contributors who worked on this release!

v5.8.6

Compare Source

⭐ New Features
  • Closes #​11450 - Add Java beans configuration for Remmember Me Docs #​13570
  • Dependencies are resolved from appropriate repositories #​13582
  • requestMatchers servlet validation error should include information about servlet paths #​13667
  • requestMatchers should not count servlets without mappings #​13666
🪲 Bug Fixes
  • Fix Bearer Token RestTemplate Support example #​13434
  • Referrer Header is set in Reactive Web Applications by default, although doc says it is not. #​13561
  • The bean 'preFilterAuthorizationAdvisor', defined in class path resource could not be registered #​13572
🔨 Dependency Upgrades
  • Update io.projectreactor to 2020.0.35 #​13702
  • Update org.aspectj to 1.9.20 #​13704
  • Update org.springframework.data to 2021.2.15 #​13705
  • Update reactor-netty to 1.0.35 #​13703
❤️ Contributors

We'd like to thank all the contributors who worked on this release!

Configuration

📅 Schedule: Branch creation - "after 7am and before 11am every weekday" in timezone Europe/London, Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

  • If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate. View repository job log here.

@renovate renovate bot requested a review from a team as a code owner July 26, 2023 09:11
@renovate renovate bot requested review from rajakm and mounikahmcts July 26, 2023 09:11
@renovate renovate bot added the dependencies Pull requests that update a dependency file label Jul 26, 2023
@renovate renovate bot force-pushed the renovate/major-spring-security branch 10 times, most recently from 504028a to 457e1d5 Compare August 1, 2023 09:50
@renovate renovate bot force-pushed the renovate/major-spring-security branch 14 times, most recently from d232920 to 7fd3357 Compare August 10, 2023 10:26
@renovate renovate bot force-pushed the renovate/major-spring-security branch 2 times, most recently from 634c641 to c308ede Compare August 11, 2023 08:42
@renovate renovate bot force-pushed the renovate/major-spring-security branch 7 times, most recently from 8b11a14 to 1c3a90a Compare August 25, 2023 12:30
@renovate renovate bot force-pushed the renovate/major-spring-security branch 18 times, most recently from 83143eb to e13ae56 Compare August 31, 2023 14:23
@renovate renovate bot force-pushed the renovate/major-spring-security branch from e13ae56 to 8eea992 Compare August 31, 2023 15:07
@HarryH96 HarryH96 closed this Sep 4, 2023
@HarryH96 HarryH96 deleted the renovate/major-spring-security branch September 4, 2023 10:27
@renovate
Copy link
Contributor Author

renovate bot commented Sep 4, 2023 •
edited
Loading

Renovate Ignore Notification

Because you closed this PR without merging, Renovate will ignore this update. You will not get PRs for any future 6.x releases. But if you manually upgrade to 6.x then Renovate will re-enable minor and patch updates automatically.

If you accidentally closed this PR, or if you changed your mind: rename this PR to get a fresh replacement PR.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@rajakm rajakm Awaiting requested review from rajakm rajakm was automatically assigned from hmcts/civil-admins

@mounikahmcts mounikahmcts Awaiting requested review from mounikahmcts mounikahmcts was automatically assigned from hmcts/civil-admins

Assignees
No one assigned
Labels
dependencies Pull requests that update a dependency file
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
1 participant
@HarryH96