Releases: spring-projects/spring-security
Releases · spring-projects/spring-security
5.5.4
🪲 Bug Fixes
- Documentation has wrong code example in the 'Customizing OpenSAML’s AuthnRequest Instance' section #10527
- Invalid_request failures in JwtTokenValidators are always turned into invalid_token errors #10561
- MissingCsrfTokenException message is misleading when not storing the CSRF tokens in the session #10531
- Multi-tenancy Documentation -
com.nimbusds.jwt.proc.JWTProcessordoes not have asetJWTClaimSetJWSKeySelectormethod #10520 - Multi-tenancy Documentation - JwtDecoder sample has multiple errors #10516
- Oauth2 Resource Server will not retry on first failure with Multi-tenancy #10484
- StaticServerHttpHeadersWriter should work with case-insensitive header names #10582
- WebInvocationPrivilegeEvaluator does not provide a way to pass a ServletContext #10435
🔨 Dependency Upgrades
- Update cas-client-core to 3.6.4 #10637
- Update hibernate-entitymanager to 5.4.33 #10635
- Update hsqldb to 2.6.1 #10636
- Update io.projectreactor to 2020.0.14 #10633
- Update io.spring.javaformat to 0.0.29 #10411
- Update jackson-bom to 2.12.6 #10630
- Update jackson-databind to 2.12.6 #10631
- Update jackson-datatype-jsr310 to 2.12.6 #10632
- Update logback-classic to 1.2.9 #10629
- Update org.jetbrains.kotlin to 1.5.32 #10638
- Update org.springframework to 5.3.14 #10639
- Update org.springframework.data to 2021.0.7 #10640
- Update reactor-netty to 1.0.14 #10634
- Update spring-ldap-core to 2.3.5.RELEASE #10641
5.4.10
🪲 Bug Fixes
- StaticServerHttpHeadersWriter should work with case-insensitive header names #10583
- Invalid_request failures in JwtTokenValidators are always turned into invalid_token errors #10562
- MissingCsrfTokenException message is misleading when not storing the CSRF tokens in the session #10532
- Documentation has wrong code example in the 'Customizing OpenSAML’s AuthnRequest Instance' section #10528
- Multi-tenancy Documentation -
com.nimbusds.jwt.proc.JWTProcessordoes not have asetJWTClaimSetJWSKeySelectormethod #10521 - Multi-tenancy Documentation - JwtDecoder sample has multiple errors #10517
- Oauth2 Resource Server will not retry on first failure with Multi-tenancy #10485
- WebInvocationPrivilegeEvaluator does not provide a way to pass a ServletContext #10437
5.3.13.RELEASE
🪲 Bug Fixes
- Reactive resource server tests failing #10660
- Gretty samples fail when using logback 1.2.9 #10643
- StaticServerHttpHeadersWriter should work with case-insensitive header names #10584
- Invalid_request failures in JwtTokenValidators are always turned into invalid_token errors #10563
- MissingCsrfTokenException message is misleading when not storing the CSRF tokens in the session #10533
- Multi-tenancy Documentation -
com.nimbusds.jwt.proc.JWTProcessordoes not have asetJWTClaimSetJWSKeySelectormethod #10522 - Multi-tenancy Documentation - JwtDecoder sample has multiple errors #10518
- Oauth2 Resource Server will not retry on first failure with Multi-tenancy #10486
🔨 Dependency Upgrades
5.2.15.RELEASE
🔨 Dependency Upgrades
- Update logback to 1.2.9 #10642
5.2.14.RELEASE
🪲 Bug Fixes
- StaticServerHttpHeadersWriter should work with case-insensitive header names #10585
- MissingCsrfTokenException message is misleading when not storing the CSRF tokens in the session #10534
- Multi-tenancy Documentation -
com.nimbusds.jwt.proc.JWTProcessordoes not have asetJWTClaimSetJWSKeySelectormethod #10523 - Multi-tenancy Documentation - JwtDecoder sample has multiple errors #10519
🔨 Dependency Upgrades
- Update to GAE 1.9.93 #10628
- Upgrade httpmime to 4.5.13 #10627
- Upgrade httpcore to 4.4.15 #10626
- Upgrade attoparser to 2.0.5.RELEASE #10625
- Update to hibernate-entitymanager 5.4.33 #10624
- Upgrade jboss logging to 3.3.3.Final #10623
- Upgrade jboss jandex to 2.0.5.Final #10622
- Upgrade Unbescape to 1.1.6.RELEASE #10621
- Update to thymeleaf-spring5 3.0.14 #10620
- Update to embedded Tomcat websocket 8.5.73 #10619
- Upgrade to embedded Apache Tomcat 9.0.56 #10618
- Upgrade Reactor to Dysprosium-SR25 #10617
- Upgrade Spring Framework to 5.2.19.RELEASE #10616
5.6.0
⭐ New Features
- DaoAuthenticationProviderTests#avg function doesn't return fraction #10426
- Docs Should Use Section Summary #10449
- MissingCsrfTokenException message is misleading when not storing the CSRF tokens in the session #10436
- Revamp OAuth 2.0 Login/Client reactive documentation #8174
- Revamp Reactive OAuth 2.0 Login documentation #10479
- Split up Documentation Further #10367
- Support Structure 101 License Id in Package Tangle Check #10443
🪲 Bug Fixes
- Adding keyInfo section to LogoutRequest from RP side #10450
- In saml2 LogoutRequest from RP doesn't contain KeyInfo #10438
- Oauth2 Resource Server will not retry on first failure with Multi-tenancy #10444
- Port Missing Integration Docs #10465
- SAML 2.0 JUnit Tests are being skipped #10215
- Various build time javadoc warnings fix #10423
🔨 Dependency Upgrades
- Update aspectj-plugin to 6.2.0 #10445
- Update com.nimbusds to 9.19 #10491
- Update hibernate-entitymanager to 5.6.1.Final #10495
- Update hsqldb to 2.6.1 #10496
- Update io.projectreactor to 2020.0.13 #10493
- Update logback-classic to 1.2.7 #10490
- Update org.springframework to 5.3.13 #10497
- Update reactor-netty to 1.0.13 #10494
❤️ Contributors
We'd like to thank all the contributors who worked on this release!
5.6.0-RC1
⏪ Breaking Changes
- Conditionally resolve bearer token from request parameters #10340
- DefaultBearerTokenResolver triggers processing of multipart content #10326
- getClaimAsBoolean should not be falsy #10148
- getClaimAsBoolean() should not be falsy #10356
⭐ New Features
- Add
saml2.ValidIssuersparameter into SAML 2.0 Assertion Validators #10335 - Add parameters converter support to AbstractWebClientReactiveOAuth2AccessTokenResponseClient #10336
- Add postProcess support to Saml2LogoutConfigurer, closes gh-10311 #10339
- Add saml2.ValidIssuers parameter into SAML 2.0 Assertion Validators #10341
- Add standard OAuth 2.0 error code invalid_redirect_uri #10370
- Add Supplier JwtDecoders #10310
- Allow Defining Custom SAML 2.0 Assertion Signature Validator #10264
- Allow setting custom BodyExtractor to the AbstractWebClientReactiveOAuth2AccessTokenResponseClient #10269
- AuthenticationPrincipal argument type cannot be primitive #10172
- Check for multiple access tokens per rfc 6750 #10302
- Deprecate Kotlin methods that have equivalents using reified types #10365
- Fix Antora cross-references that lead to other pages. #10345
- Fix typo in digest.adoc #10304
- Implement reactive support for JWT as an Authorization Grant #10327
- Implement reactive support for JWT as an Authorization Grant #10147
- Implement reactive support for JWT Client Authentication #10146
- Improve Method Security logging #10279
- Introduce JwtEncoder #9208
- JwtDecoders and NimbusJwtDecoder should use the same JWKSource #10312
- OAuth2LoginAuthenticationProvider information loss at exception handling #10228
- please support lazily doing issuer checks (and all other checks) on startup for oauth resource servers #9991
- Revamp OAuth 2.0 Client reactive documentation #10373
- Saml2WebSsoAuthenticationFilter adds authentication details #10306
- Saml2WebSsoAuthenticationFilter ignores the authentication details #7722
- Structure101 Build Plugin #9768
- Use Antora #5835
🔨 Dependency Upgrades
❤️ Contributors
We'd like to thank all the contributors who worked on this release!
5.5.3
⭐ New Features
- Allow defining custom SAML 2.0 Assertion Signature Validator #10317
- Add Documentation for Static Methods Classes for
mockJwt()andjwt()#10265
🪲 Bug Fixes
- ClaimAccessor#getClaimAsMap doesn't return null as documented #10371
- 5.5.X only works with spring-security-5.4.xsd schema (XML-based config) #10369
- SecurityNamespaceHandler: update schema version to 5.5 #10348
- JwtTimeStampValidator uses wrong error on token expiration #10328
- Fix typo #10313
- Saml2LoginConfigurer relyingPartyRegistrationRepository method does not return correct type #10257
- ACL docs refer to nonexistent sample apps #10237
- SAML 2.0 Login should allow
loginProcessingUrlwithout{registrationId}when providing anAuthenticationConverter#10176
🔨 Dependency Upgrades
- Update org.springframework.data to 2021.0.6 #10417
- Update org.springframework to 5.3.11 #10416
- Update org.jetbrains.kotlinx to 1.5.2 #10415
- Update org.jetbrains.kotlin to 1.5.31 #10414
- Update org.eclipse.jetty to 9.4.44.v20210927 #10413
- Update io.spring.nohttp to 0.0.10 #10412
- Update r2dbc-spi-test to 0.8.6.RELEASE #10410
- Update reactor-netty to 1.0.12 #10409
- Update io.projectreactor to 2020.0.12 #10408
- Update jackson-datatype-jsr310 to 2.12.5 #10407
- Update jackson-databind to 2.12.5 #10406
- Update jackson-bom to 2.12.5 #10405
- Update logback-classic to 1.2.6 #10404
❤️ Contributors
We'd like to thank all the contributors who worked on this release!
5.4.9
⭐ New Features
- Add Documentation for Static Methods Classes for
mockJwt()andjwt()#10266
🪲 Bug Fixes
- SAML 2.0 Login should allow
loginProcessingUrlwithout{registrationId}when providing anAuthenticationConverter#10342 - JwtTimeStampValidator uses wrong error on token expiration #10329
- Fix typo #10314
- Saml2LoginConfigurer relyingPartyRegistrationRepository method does not return correct type #10258
- MappedJwtClaimSetConverter#withDefaults doesn't remove claims from JWT as documented #10209
🔨 Dependency Upgrades
- Update to Spring Boot 2.4.11 #10418
5.3.12.RELEASE
⭐ New Features
- Add Documentation for Static Methods Classes for
mockJwt()andjwt()#10267
🪲 Bug Fixes
- JwtTimeStampValidator uses wrong error on token expiration #10330
- Fix typo #10315
- Saml2LoginConfigurer relyingPartyRegistrationRepository method does not return correct type #10259
- MappedJwtClaimSetConverter#withDefaults doesn't remove claims from JWT as documented #10179