Skip to content
This repository has been archived by the owner on Feb 28, 2024. It is now read-only.

Bump org.springframework.security:spring-security-web from 5.8.5 to 6.2.0 #120

Conversation

dependabot[bot]
Copy link

@dependabot dependabot bot commented on behalf of github Dec 1, 2023

Bumps org.springframework.security:spring-security-web from 5.8.5 to 6.2.0.

Release notes

Sourced from org.springframework.security:spring-security-web's releases.

6.2.0

⭐ New Features

  • AuthorizationManager[Before/After]ReactiveMethodInterceptor doesn't support Kotlin coroutines #12080
  • Simplify configuration of OAuth2 Client component model #11783

🪲 Bug Fixes

  • On Cancel, ObservationWebFilterDecorator Starts After-Filter Span without Stopping It #14064
  • Authentication not propagated correctly after migrating to SB3 #14112
  • Authorization does not show up on Features section #14105
  • Fix obsolete comment and typos #14060
  • Fix typo in documentation #14130
  • improve render in headers.adoc #14102
  • ReactiveRemoteJWKSource caches invalid response status into jwkSetURL #14042
  • References to WebFlux docs do not link to them #14108
  • relay_state should not be included in signing calculation when it is null #14039
  • samesite set by Tomcat CookieProcessor ignored when creating XSRF-TOKEN cookie in CsrfTokenRepository #14138
  • Security configuration is failed to be initialized in a Servlet 6.0 container #14166
  • Spring Security documentation confuses "idempotent" with "read-only" in CSRF section #14115
  • Spring Security metric names should not contain dashes #14067
  • spring.security counters inaccurate due onComplete and cancel() #14147
  • The latest "OAuth2AuthorizedClientManager" class is not AOT ready #14094
  • UnboundIdContainer should be marked as not running at shutdown #14095

🔨 Dependency Upgrades

  • Bump io-spring-javaformat from 0.0.39 to 0.0.40 #14156
  • Bump io.micrometer:micrometer-observation from 1.12.0-RC1 to 1.12.0 #14135
  • Bump io.projectreactor:reactor-bom from 2023.0.0-RC1 to 2023.0.0 #14145
  • Bump org.junit:junit-bom from 5.10.0 to 5.10.1 #14097
  • Bump org.springframework.data:spring-data-bom from 2023.1.0-RC1 to 2023.1.0 #14172
  • Bump org.springframework.ldap:spring-ldap-core from 3.2.0-RC1 to 3.2.0 #14155
  • Bump org.springframework:spring-framework-bom from 6.1.0-RC1 to 6.1.0-RC2 #14055
  • Bump org.springframework:spring-framework-bom from 6.1.0-RC2 to 6.1.0 #14157

❤️ Contributors

We'd like to thank all the contributors who worked on this release!

6.2.0-RC2

⭐ New Features

  • Propagate security context via channel interceptor #12532
  • RequestedUrlRedirectInvalidSessionStrategy can cause the HTTP method to change depending on the user agent #12797
  • RequestedUrlRedirectInvalidSessionStrategy doesn't take servlet context path into account #12795

... (truncated)

Commits
  • fd1b92b Release 6.2.0
  • 6511cad Bump org.springframework.data:spring-data-bom
  • b90ec16 Merge branch '6.1.x'
  • c0d2c3a Bump org.springframework.data:spring-data-bom
  • df3acda Merge branch '6.1.x'
  • 0ba2ac8 Merge branch '6.0.x' into 6.1.x
  • f7dcfba Bump org.springframework.data:spring-data-bom
  • 7edb123 Merge branch '6.1.x'
  • 3a9af74 Merge branch '6.0.x' into 6.1.x
  • 125f7d3 Merge branch '5.8.x' into 6.0.x
  • Additional commits viewable in compare view

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Bumps [org.springframework.security:spring-security-web](https://github.com/spring-projects/spring-security) from 5.8.5 to 6.2.0.
- [Release notes](https://github.com/spring-projects/spring-security/releases)
- [Changelog](https://github.com/spring-projects/spring-security/blob/main/RELEASE.adoc)
- [Commits](spring-projects/spring-security@5.8.5...6.2.0)

---
updated-dependencies:
- dependency-name: org.springframework.security:spring-security-web
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot bot added dependencies Pull requests that update a dependency file java Pull requests that update Java code labels Dec 1, 2023
@jahid1209 jahid1209 closed this Dec 11, 2023
Copy link
Author

dependabot bot commented on behalf of github Dec 11, 2023

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.

@dependabot dependabot bot deleted the dependabot/maven/org.springframework.security-spring-security-web-6.2.0 branch December 11, 2023 06:37
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
dependencies Pull requests that update a dependency file java Pull requests that update Java code
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant