Skip to content
This repository was archived by the owner on Feb 28, 2025. It is now read-only.

Update dependency org.springframework.security:spring-security-cas to v6 #83

Open
wants to merge 1 commit into
base: 4.0.x
Choose a base branch
from
Open

Update dependency org.springframework.security:spring-security-cas to v6 #83

wants to merge 1 commit into from

Conversation

renovate[bot]
Copy link
Contributor

@renovate renovate bot commented Dec 9, 2023 •
edited
Loading

Mend Renovate

This PR contains the following updates:

Package Change Age Adoption Passing Confidence
org.springframework.security:spring-security-cas (source) 5.8.9 -> 6.2.1 age adoption passing confidence

Release Notes

spring-projects/spring-security (org.springframework.security:spring-security-cas)

v6.2.1

Compare Source

⭐ New Features

  • docs: make XML and Java/Kotlin consistent with AspectJExpressionPointcut #​14219
  • Document that Shibboleth Repository is Required for SAML Support #​14295
  • Fix typo in architecture.adoc #​14254
  • Fixing link in authentication/architecture.adoc #​13593
  • Integrate HandlerMappingIntrospector Caching #​14332
  • OAuth2 Resource Server is exposing server information. #​14278

🪲 Bug Fixes

  • Update Java Config Spring MVC documentation #​14234
  • add missing [tabs] fix typo in docs #​14208
  • AnnotationConfigurationException when using PreAuthorize, CGLIB and EnableMethodSecurity #​14267
  • Correct What's New in 6.2 reference to forServletPattern #​14200
  • Fix typo in getClaimAsMap docstring #​14183
  • Fix typo in the 'Authorizing Requests' example #​14169
  • fix wrong document about "jws-algorithms" #​14280
  • Improve error message when ServletRegistration API is unavailable #​14232
  • Update Javadoc Comments in AuthorizationEvent Class #​14175

🔨 Dependency Upgrades

  • Bump actions/checkout from 3 to 4 #​14323
  • Bump actions/setup-java from 3 to 4 #​14320
  • Bump ch.qos.logback:logback-classic from 1.4.11 to 1.4.13 #​14213
  • Bump ch.qos.logback:logback-classic from 1.4.13 to 1.4.14 #​14239
  • Bump com.unboundid:unboundid-ldapsdk from 6.0.10 to 6.0.11 #​14223
  • Bump Gamesight/slack-workflow-status from 1.0.1 to 1.2.0 #​14328
  • Bump Gradle Wrapper from 8.4 to 8.5 #​14222
  • Bump io.micrometer:micrometer-observation from 1.12.0 to 1.12.1 #​14284
  • Bump io.projectreactor:reactor-bom from 2023.0.0 to 2023.0.1 #​14289
  • Bump org-apache-maven-resolver from 1.9.16 to 1.9.17 #​14184
  • Bump org-apache-maven-resolver from 1.9.17 to 1.9.18 #​14197
  • Bump org-aspectj from 1.9.20.1 to 1.9.21 #​14271
  • Bump org.apache.maven:maven-resolver-provider from 3.9.5 to 3.9.6 #​14228
  • Bump org.hibernate.orm:hibernate-core from 6.3.1.Final to 6.3.2.Final #​14190
  • Bump org.jetbrains.kotlin:kotlin-bom from 1.9.20 to 1.9.21 #​14192
  • Bump org.jetbrains.kotlin:kotlin-gradle-plugin from 1.9.20 to 1.9.21 #​14191
  • Bump org.springframework.data:spring-data-bom from 2023.1.0 to 2023.1.1 #​14341
  • Bump org.springframework.ldap:spring-ldap-core from 3.2.0 to 3.2.1 #​14335
  • Bump org.springframework:spring-framework-bom from 6.1.0 to 6.1.1 #​14189
  • Bump org.springframework:spring-framework-bom from 6.1.1 to 6.1.2 #​14319
  • Bump sjohnr/slack-workflow-status from 1.pre.beta to 1.1.0 #​14318
  • Bump slackapi/slack-github-action from 1.19.0 to 1.24.0 #​14322
  • Bump spring-io/spring-gradle-build-action from 1 to 2 #​14321

❤️ Contributors

Thank you to all the contributors who worked on this release:

@​ParkerM, @​YangSiJun528, @​aaron-to-go, @​ahmd-nabil, @​andreilisa, @​dependabot[bot], @​limvik, and @​prufrock

v6.2.0

Compare Source

⭐ New Features

  • AuthorizationManager[Before/After]ReactiveMethodInterceptor doesn't support Kotlin coroutines #​12080
  • Simplify configuration of OAuth2 Client component model #​11783

🪲 Bug Fixes

  • On Cancel, ObservationWebFilterDecorator Starts After-Filter Span without Stopping It #​14064
  • Authentication not propagated correctly after migrating to SB3 #​14112
  • Authorization does not show up on Features section #​14105
  • Fix obsolete comment and typos #​14060
  • Fix typo in documentation #​14130
  • improve render in headers.adoc #​14102
  • ReactiveRemoteJWKSource caches invalid response status into jwkSetURL #​14042
  • References to WebFlux docs do not link to them #​14108
  • relay_state should not be included in signing calculation when it is null #​14039
  • samesite set by Tomcat CookieProcessor ignored when creating XSRF-TOKEN cookie in CsrfTokenRepository #​14138
  • Security configuration is failed to be initialized in a Servlet 6.0 container #​14166
  • Spring Security documentation confuses "idempotent" with "read-only" in CSRF section #​14115
  • Spring Security metric names should not contain dashes #​14067
  • spring.security counters inaccurate due onComplete and cancel() #​14147
  • The latest "OAuth2AuthorizedClientManager" class is not AOT ready #​14094
  • UnboundIdContainer should be marked as not running at shutdown #​14095

🔨 Dependency Upgrades

  • Bump io-spring-javaformat from 0.0.39 to 0.0.40 #​14156
  • Bump io.micrometer:micrometer-observation from 1.12.0-RC1 to 1.12.0 #​14135
  • Bump io.projectreactor:reactor-bom from 2023.0.0-RC1 to 2023.0.0 #​14145
  • Bump org.junit:junit-bom from 5.10.0 to 5.10.1 #​14097
  • Bump org.springframework.data:spring-data-bom from 2023.1.0-RC1 to 2023.1.0 #​14172
  • Bump org.springframework.ldap:spring-ldap-core from 3.2.0-RC1 to 3.2.0 #​14155
  • Bump org.springframework:spring-framework-bom from 6.1.0-RC1 to 6.1.0-RC2 #​14055
  • Bump org.springframework:spring-framework-bom from 6.1.0-RC2 to 6.1.0 #​14157

❤️ Contributors

We'd like to thank all the contributors who worked on this release!

v6.1.6

Compare Source

⭐ New Features

  • Document that Shibboleth Repository is Required for SAML Support #​14294
  • Integrate HandlerMappingIntrospector Caching #​14128
  • OAuth2 Resource Server is exposing server information. #​14277
  • Resolve RequestMatcher at request-time #​14085

🪲 Bug Fixes

  • AnnotationConfigurationException when using PreAuthorize, CGLIB and EnableMethodSecurity #​14266
  • Authentication not propagated correctly after migrating to SB3 #​14111
  • Authorization does not show up on Features section #​14104
  • DefaultLoginPageGeneratingFilter should be able to handle AuthenticationExceptions without message #​14117
  • Fix broken link for servlet getting started page #​14119
  • Fix typo in method-security.adoc #​14059
  • fix wrong document about "jws-algorithms" #​14279
  • Improve error message when ServletRegistration API is unavailable #​14231
  • improve render in headers.adoc #​14101
  • On Cancel, ObservationWebFilterDecorator Starts After-Filter Span without Stopping It #​14063
  • ReactiveRemoteJWKSource caches invalid response status into jwkSetURL #​14041
  • References to WebFlux docs do not link to them #​14107
  • relay_state should not be included in signing calculation when it is null #​14038
  • samesite set by Tomcat CookieProcessor ignored when creating XSRF-TOKEN cookie in CsrfTokenRepository #​14131
  • Security configuration is failed to be initialized in a Servlet 6.0 container #​14165
  • Spring Security documentation confuses "idempotent" with "read-only" in CSRF section #​14114
  • Spring Security metric names should not contain dashes #​14066
  • spring.security counters inaccurate due onComplete and cancel() #​14146
  • Update Java Config Spring MVC documentation #​14233
  • Update logout.adoc: Replace Directives with Directive #​14062

🔨 Dependency Upgrades

  • Bump actions/checkout from 3 to 4 #​14310
  • Bump actions/setup-java from 3 to 4 #​14327
  • Bump ch.qos.logback:logback-classic from 1.4.11 to 1.4.13 #​14214
  • Bump ch.qos.logback:logback-classic from 1.4.13 to 1.4.14 #​14238
  • Bump com.unboundid:unboundid-ldapsdk from 6.0.10 to 6.0.11 #​14224
  • Bump Gamesight/slack-workflow-status from 1.0.1 to 1.2.0 #​14317
  • Bump Gradle Wrapper from 8.4 to 8.5 #​14218
  • Bump io-spring-javaformat from 0.0.39 to 0.0.40 #​14158
  • Bump io.micrometer:micrometer-observation from 1.10.12 to 1.10.13 #​14134
  • Bump io.projectreactor:reactor-bom from 2022.0.12 to 2022.0.13 #​14144
  • Bump io.projectreactor:reactor-bom from 2022.0.13 to 2022.0.14 #​14288
  • Bump org-aspectj from 1.9.20.1 to 1.9.21 #​14272
  • Bump org-eclipse-jetty from 11.0.17 to 11.0.18 #​14081
  • Bump org.springframework.data:spring-data-bom from 2022.0.11 to 2022.0.12 #​14173
  • Bump org.springframework:spring-framework-bom from 6.0.13 to 6.0.14 #​14159
  • Bump org.springframework:spring-framework-bom from 6.0.14 to 6.0.15 #​14312
  • Bump sjohnr/slack-workflow-status from 1.pre.beta to 1.1.0 #​14315
  • Bump slackapi/slack-github-action from 1.19.0 to 1.24.0 #​14316
  • Bump spring-io/spring-gradle-build-action from 1 to 2 #​14305

❤️ Contributors

Thank you to all the contributors who worked on this release:

@​Ruffeng, @​dependabot[bot], @​github-actions[bot], @​marbon87, and @​sadidshaikh

v6.1.5

Compare Source

⭐ New Features
  • Document how to publish an AuthenticationManager @Bean without WebSecurityConfigurerAdapter #​14015
  • Replace deprecated method #​13649
  • Use Gradle's Version Catalog #​13871
🪲 Bug Fixes
  • Dependency convergence failed: nimbus-jose-jwt #​13843
  • Docs custom AuthorizationManager fix #​13991
  • Fix snapshot_tests on CI workflow #​13878
  • Fix parsing of GET SAML logout requests #​13970
  • Saml-Metadata with special characters is corrupted #​13861
  • Saml2LogoutRequestMixin relayState property should be binding #​13942
🔨 Dependency Upgrades
  • Bump com.github.spullara.mustache.java:compiler from 0.9.10 to 0.9.11 #​13984
  • Bump com.github.spullara.mustache.java:compiler from 0.9.4 to 0.9.10 #​13891
  • Bump com.google.code.gson:gson from 2.8.6 to 2.8.9 #​13950
  • Bump com.gradle.enterprise from 3.12.3 to 3.12.6 #​13934
  • Bump com.unboundid:unboundid-ldapsdk from 6.0.9 to 6.0.10 #​13903
  • Bump Gradle Wrapper from 8.3 to 8.4 #​13974
  • Bump io.freefair.gradle:aspectj-plugin from 6.6-rc1 to 6.6.3 #​13935
  • Bump io.micrometer:micrometer-observation from 1.10.10 to 1.10.11 #​13945
  • Bump io.micrometer:micrometer-observation from 1.10.11 to 1.10.12 #​14001
  • Bump io.mockk:mockk from 1.13.7 to 1.13.8 #​13952
  • Bump io.projectreactor:reactor-bom from 2022.0.10 to 2022.0.11 #​13937
  • Bump io.projectreactor:reactor-bom from 2022.0.11 to 2022.0.12 #​14000
  • Bump io.spring.ge.conventions from 0.0.7 to 0.0.14 #​13985
  • Bump jakarta.xml.bind:jakarta.xml.bind-api from 4.0.0 to 4.0.1 #​13949
  • Bump org-aspectj from 1.9.20 to 1.9.20.1 #​13896
  • Bump org-eclipse-jetty from 11.0.15 to 11.0.16 #​13901
  • Bump org-eclipse-jetty from 11.0.16 to 11.0.17 #​13999
  • Bump org.jfrog.buildinfo:build-info-extractor-gradle from 4.29.0 to 4.29.4 #​13953
  • Bump org.slf4j:slf4j-api from 2.0.7 to 2.0.9 #​13938
  • Bump org.springframework.data:spring-data-bom from 2022.0.10 to 2022.0.11 #​14019
  • Bump org.springframework.data:spring-data-bom from 2022.0.9 to 2022.0.10 #​13951
  • Bump org.springframework.ldap:spring-ldap-core from 3.0.5 to 3.0.6 #​14007
  • Bump org.springframework:spring-framework-bom from 6.0.11 to 6.0.12 #​13904
  • Bump org.springframework:spring-framework-bom from 6.0.12 to 6.0.13 #​14006
  • Update to org.apereo.cas.client:cas-client-core 4.0.3 #​13947
❤️ Contributors

We'd like to thank all the contributors who worked on this release!

v6.1.4

Compare Source

⭐ New Features

🪲 Bug Fixes

  • CookieCsrfTokenRepository resets httpOnly to true in case a cookieCustomizer is set #​13659
  • CookieRequestCache ignores user Locale #​13796
  • Default Security Configuration adds WWW-Authenticate Twice #​13759
  • Fix inaccurate information about permitting the FORWARD dispatcher in Kotlin #​13729
  • OAuth2AuthenticationExceptionMixin doesn't work in JDK 17 #​13800
  • Problem uploading multipart file after migrating to latest Spring Security. #​13820
  • Saml2AuthenticationExceptionMixin doesn't work in JDK 17 #​13806
  • Spring ACL and native compilation fail to process datasource properties #​13814

❤️ Contributors

We'd like to thank all the contributors who worked on this release!

v6.1.3

Compare Source

⭐ New Features

  • Add MvcRequestMatcher reference documentation #​13726
  • Refactor for readability #​13472
  • requestMatchers servlet validation error should include information about servlet paths #​13722
  • requestMatchers should not count servlets without mappings #​13724

🪲 Bug Fixes

  • Add return statement of the roleHierachy method in the servlet/author… #​13596
  • Fix typo in docs #​13637
  • Referrer Header is set in Reactive Web Applications by default, although doc says it is not. #​13590
  • RequestMatcherMetadataResponseResolver only shows last RelyingPartyRegistration #​13700
  • saml2Login should not override OpenSaml4AuthenticationProvider bean #​13655
  • The bean 'preFilterAuthorizationAdvisor', defined in class path resource could not be registered #​13580
  • Update links in adocs #​13632

🔨 Dependency Upgrades

❤️ Contributors

We'd like to thank all the contributors who worked on this release!

v6.1.2

Compare Source

⭐ New Features

  • Improve RequestMatcher Validation #​13557
  • Improve Security Filters Documentation #​13414
  • Optimize Querying of RequestCache -> continue parameter #​13488
  • Optimize Querying of RequestCache -> continue parameter #​13482

🪲 Bug Fixes

  • Error message should show underlying Client Authentication method #​13498
  • Javadoc for AuthorizationFilter#filterErrorDispatch is wrong #​13465
  • once-per-request="true" does not work in XML configuration #​13494
  • Spring Security 6 combined with AspectJ weaving of spring-security-aspects executes PreAuthorize twice #​13199
  • Unable to Find 'filterProcessingUrl' Method in Spring Security 6.1.1 Saml2LoginConfigurer Configuration #​13421
  • Unable to Use hasIpAddress() Method After Migrating to authorizeHttpRequests() in Spring Security 6 #​13478
  • update l179 of jwt docs #​13480
  • Use default PathPatternParser instance #​13464

🔨 Dependency Upgrades

  • Update io.projectreactor to 2022.0.9 #​13525
  • Update jakarta.websocket to 2.1.1 #​13526
  • Update micrometer-observation to 1.10.9 #​13524
  • Update org.springframework to 6.0.11 #​13527
  • Update org.springframework.data to 2022.0.8 #​13528
  • Update org.springframework.data to 2022.0.8 #​13522

❤️ Contributors

We'd like to thank all the contributors who worked on this release!

v6.1.1

Compare Source

⭐ New Features
  • Add initial Native section to reference docs #​13236
  • Align Resource Server documentation with Boot's capabilities #​13239
  • Convert to Asciidoctor Tabs #​13407
  • Document How to Handle Method Security in Native Image #​13237
  • Improve javadoc about deprecation of .and() and non-Customizer methods #​13273
  • Make eclipse/vscode project import work #​13284
  • Mention that authorizeHttpRequests does not support GrantedAuthorityDefaults #​13229
  • mockOAuth2Login() does not work in collaboration with Spring Cloud Gateway and TokenRelayGatewayFilter #​13254
  • Use Antora name of security #​13331
🪲 Bug Fixes
  • Additional filters registered when using Custom DSL #​13282
  • AOT Fails to proxy #​13369
  • CasAuthenticationFilter.successfulAuthentication missing call to securityContextRepository.saveContext #​13243
  • DefaultAuthorizationCodeTokenResponseClient.getTokenResponse(OAuth2AuthorizationCodeGrantRequest) can return null #​13223
  • Deprecated hint on BasicAuthenticationFilter #​13279
  • Document missing OAuth2LoginAuthenticationFilter set AuthorizationRequestRepository #​13193
  • Fix Antora Warnings #​13294
  • Fix constant value in XContentTypeOptionsServerHttpHeadersWriter #​13221
  • Fix Documentation Title #​13318
  • Fix legacy-websocket-configuration cross-reference #​13206
  • Fix type on method-security.adoc #​13212
  • http://www.springframework.org/schema/security/spring-security.xsd returns 404 #​13209
  • Migration to EnableMethodSecurity break Transactional on custom PermissionEvaluator #​13218
  • No longer maintained net.sourceforge.nekohtml with known security issues #​13287
  • Provide meaningful error when invalid client-authentication-method is provided #​13309
  • Proxy Server section is not linked in nav #​13324
  • Use consistent list of micrometer tags in web observation handler #​13190
  • UserBuilder does not allow authorities to be overridden #​13290
🔨 Dependency Upgrades
❤️ Contributors

We'd like to thank all the contributors who worked on this release!

v6.1.0

Compare Source

⭐ New Features

  • Explain the rational about deprecating .and() and non-lambda DSL methods #​13094
  • Revisit CSRF Documentation #​13089

🪲 Bug Fixes

  • AffirmativeBased vs. AuthorizationManagers.anyOf(...) documentation #​13087
  • AuthorizationAnnotationUtils.findUniqueAnnotation broken for synthetic methods #​13154
  • Clarify that Kotlin DSL needs an import #​13103
  • CookieCsrfTokenRepository overwrites previous Set-Cookie response headers #​13075
  • Fix code snippets in Authorize HttpServletRequest #​13126
  • Fix invalid link in ref doc #​12573
  • fix javadoc typo #​12884
  • Fix typo cas.adoc #​13116
  • Links between migration docs are out of date #​13157
  • RememberMeAuthenticationFilter does not use SecurityContextRepository configured in HttpSecurity #​13128
  • rolePrefix with empty string returns HTTP 400 as of version 6.0.3 #​13083
  • SAML login fails in Internet Explorer 11 #​13142
  • SimpleAroundFilterObservation.wrap calls scope.close() duplicated #​13150
  • Spring Boot 3.0 application failing to start with oauth2-resource-server and spring actuator #​13122
  • Update acls.adoc #​13078
  • Update architecture.adoc #​13077
  • Web Security Expression section of Documentation is obsolete or it does not work #​12974

🔨 Dependency Upgrades

❤️ Contributors

We'd like to thank all the contributors who worked on this release!

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate. View repository job log here.

@renovate renovate bot force-pushed the renovate/major-spring-security branch 2 times, most recently from a6968ac to ed1f3b6 Compare December 19, 2023 07:03
@renovate renovate bot force-pushed the renovate/major-spring-security branch from ed1f3b6 to 41f262a Compare January 15, 2024 03:30
@renovate renovate bot force-pushed the renovate/major-spring-security branch from 41f262a to cd7790a Compare January 24, 2024 14:27
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Reviewers
No reviews
Assignees
No one assigned
Labels
type: dependency upgrade
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
0 participants