Skip to content

Conversation

dependabot[bot]
Copy link
Contributor

@dependabot dependabot bot commented on behalf of github Apr 22, 2025

Bumps org.springframework.security:spring-security-bom from 6.5.0-M3 to 6.5.0-RC1.

Release notes

Sourced from org.springframework.security:spring-security-bom's releases.

6.5.0-RC1

⭐ New Features

  • Add AuthenticationEntryPoint for DPoP #16900
  • Add DestinationPathPatternMessageMatcher #16635
  • Add link to docs zip file to the reference #16800
  • Add MatchResult to MessageMatcher #16766
  • Add not null validation for UserDetailsChecker in AbstractUserDetailsAuthenticationProvider #16710
  • Add RelayState-based Authentication Request Respository #14793
  • Add request_uri in OAuth2ParameterNames #16947
  • Add support for access token in body parameter as per rfc 6750 Sec. 2.2 #15819
  • Add Support Postgres To JdbcUserCredentialRepository #16839
  • Add support ResolvableTypeProvider to AuthorizationEvent #16762
  • Add toString to IpAddressMatcher #16818
  • Add XML support for HttpsRedirectFilter #16775
  • Allow retrieving username from SAML Assertion Attributes #12136
  • Deprecate ConfigAttribute #16774
  • Deprecate SecurityConfig #16773
  • Deprecate SecurityMetadataSource and implementations #16772
  • Deprecate usages of PathMatcher in Web Socket support #16500
  • Ensure ID Token is updated after refresh token #16589
  • Explain behaviour with XMLHttpRequest on 401 response #16280
  • Fix attribute name in http.adoc #16790
  • Improve entity fetching from db #16727
  • Include AuthenticationRequest in AuthenticationException #16505
  • Jackson deserialization of ClientAuthenticationMethods should recognize all values #16826
  • Make DPoP IatClaimValidator public to allow configuring clock and clockSkew #16921
  • Method Security templates support use deep non-aliased attributes #16550
  • OAuth2 Client Authentication section of docs uses deprecated classes #16925
  • PathPatternRequestMatcher Include Optional Servlet Path in the pattern #16765
  • Polish Pattern Matching Usage #16493
  • Prepare oauth2-client deprecations for removal in Spring Security 7 #16913
  • Prepare Request Matching for Spring Framework Changes #16417
  • Prevent downgraded usage of DPoP-bound access tokens #16937
  • Removed Unnecessary Code in Documentation #16739
  • Replace dynamic error message with static "Access Denied" #16528
  • Saml2WebSsoAuthenticationFilter should allow requests through when SAMLResponse is absent #16000
  • Simplify Response Validation in OpenSaml5AuthenticationProvider #16915
  • Support Customizing Set of OpenSAML Validators #15578
  • Update HandlerMappingIntrospector Usage in Cache filter support #16536
  • Update DeferredCsrfToken to implement Supplier #16905
  • Update HandlerMappingIntrospector Usage in CORS support #16657
  • Update HandlerMappingIntrospector Usage in CORS support #16501
  • Update ServerOAuth2AuthorizedClientExchangeFilterFunction javadoc #16789
  • Update test object factories to Tests naming convention #16686
  • Use SpringCacheBasedTicketCache in cas.adoc #16847
  • Use Tests naming convention for WebAuthn test object factories #16865

🪲 Bug Fixes

... (truncated)

Commits
  • 6273ba5 Release 6.5.0-RC1
  • 3a1c905 Merge branch '6.4.x'
  • 3cfdc49 Merge branch '6.4.x' (early part)
  • 56a0a54 Revert "Release 6.5.0-RC1"
  • 1ccd600 Merge branch '6.3.x' into 6.4.x
  • 7a302a9 Merge branch '6.3.x' (early part) into 6.4.x
  • e47a671 Update to io.spring.gradle:spring-security-release-plugin:1.0.5
  • a4d7ac2 Next development version
  • b9cae82 Next development version
  • e8aef09 Release 6.4.5
  • Additional commits viewable in compare view

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Bumps [org.springframework.security:spring-security-bom](https://github.com/spring-projects/spring-security) from 6.5.0-M3 to 6.5.0-RC1.
- [Release notes](https://github.com/spring-projects/spring-security/releases)
- [Changelog](https://github.com/spring-projects/spring-security/blob/main/RELEASE.adoc)
- [Commits](spring-projects/spring-security@6.5.0-M3...6.5.0-RC1)

---
updated-dependencies:
- dependency-name: org.springframework.security:spring-security-bom
  dependency-version: 6.5.0-RC1
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot bot added the type: dependency-upgrade A dependency upgrade label Apr 22, 2025
@jgrandja jgrandja self-assigned this Apr 22, 2025
@jgrandja jgrandja added this to the 1.5.0-RC1 milestone Apr 22, 2025
@jgrandja jgrandja merged commit 14f1e70 into main Apr 22, 2025
9 checks passed
@dependabot dependabot bot deleted the dependabot/gradle/main/org.springframework.security-spring-security-bom-6.5.0-RC1 branch April 22, 2025 09:21
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
type: dependency-upgrade A dependency upgrade
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant