79.6.0

⚠️ Known Issues

• CSRF token mismatch errors due to __Host- prefixed cookies with incorrect Path, causing browsers to reject them.

✨ New Features

• Add per-IdP CA certificate trust for OIDC/OAuth2, LDAP, and SAML by @duanemay in #4019
• Support ne and not SCIM filter operators by @duanemay in #4033
• id token enhancer by @fhanik in #4035

🛠️ Stability & Fixes

• Refactor password change by @strehle in #3989
• Improve signature validation by @duanemay in #3998
• Propagate externalGroupsWhitelist for bootstrapped OAuth/OIDC identity providers by @duanemay in #4005
• Fix deprecated Gradle Kotlin DSL delegate providers (Gradle 9.6) by @duanemay in #4004
• fix: block spoofable IP headers (X-Client-IP, X-Real-IP) from rate limiting by @strehle in #4001
• Fix SSRF via jwks_uri by @strehle in #4000
• Persist SAML entityID for the default identity zone during bootstrap by @duanemay in #4031
• Fix authorization code consumption by @joemahady-comm in #4006
• Fix double submit csrf cookie by @joemahady-comm in #4010
• Implement SAML SLO signature validation by @joemahady-comm in #4015
• Fix expiring code redemption by @joemahady-comm in #4011
• Fix SAML RelayState allowlist validation by @joemahady-comm in #4014
• Fix bcrypt timing by @joemahady-comm in #4007
• Fix OIDC ID-token nonce against session by @joemahady-comm in #4012
• Fix ineffective jwt+rotate+!revocable combination by @joemahady-comm in #4013
• Fix: skipSslValidation does not skip validation for certificate chains by @duanemay in #4043

📦 Maintenance & Internal

• Move test LDAP config out of production uaa.yml defaults by @egorpak528 in #4030

⬆️ Dependency Bumps

• build(deps): bump org.eclipse.jgit:org.eclipse.jgit from 7.7.0.202606012155-r to 7.7.1.202607240634-r by @dependabot[bot] in #4002
• build(deps): bump brace-expansion from 5.0.7 to 5.0.8 in /uaa by @duanemay in #4003
• build(deps): bump commons-codec:commons-codec from 1.22.0 to 1.22.1 by @dependabot[bot] in #4016
• build(deps): bump github/codeql-action from 4 to 4.37.3 by @dependabot[bot] in #4017
• build(deps): bump docker/login-action from 4 to 4.5.2 by @dependabot[bot] in #4018
• build(deps): bump github/codeql-action from 4.37.3 to 4.37.4 by @dependabot[bot] in #4021
• build(deps): bump docker/login-action from 4.5.2 to 4.6.0 by @dependabot[bot] in #4020
• build(deps): bump brace-expansion from 5.0.8 to 5.0.9 in /uaa by @dependabot[bot] in #4022
• build(deps): bump org.springdoc:springdoc-openapi-starter-webmvc-ui from 3.0.3 to 3.1.0 by @dependabot[bot] in #4023
• build(deps): bump github/codeql-action from 4.37.4 to 4.37.5 by @dependabot[bot] in #4024
• build(deps): bump github/codeql-action from 4.37.5 to 4.37.6 by @dependabot[bot] in #4026
• build(deps): bump org.sonarqube from 7.3.1.8318 to 7.4.0.8496 by @dependabot[bot] in #4029
• build(deps): bump gradle-wrapper from 9.6.1 to 9.7.0 by @dependabot[bot] in #4028
• build(deps): bump com.icegreen:greenmail from 2.1.11 to 2.1.12 by @dependabot[bot] in #4027
• build(deps): bump the selenium group with 3 updates by @dependabot[bot] in #4032
• build(deps): bump github/codeql-action from 4.37.6 to 4.37.7 by @dependabot[bot] in #4034
• Bump Tomcat to 11.0.25 by @duanemay in #4037
• build(deps): bump org.json:json from 20260719 to 20260814 by @dependabot[bot] in #4036
• build(deps): bump jasmine-core from 6.3.0 to 7.0.1 in /uaa by @dependabot[bot] in #4042
• build(deps): bump jasmine from 6.3.0 to 7.0.0 in /uaa by @dependabot[bot] in #4041
• build(deps): bump com.google.guava:guava from 33.6.0-jre to 33.7.0-jre in the guava group by @dependabot[bot] in #4044
• build(deps): bump com.google.guava:guava from 33.7.0-jre to 33.7.1-jre in the guava group by @dependabot[bot] in #4046
• Bump spring boot 4.1.0 to 4.1.1 by @strehle in #4045

New Contributors

• @egorpak528 made their first contribution in #4030

Full Changelog: v79.5.0...v79.6.0