Skip to content

6.0.0-RC1

Pre-release
Pre-release
Compare
Choose a tag to compare
@github-actions github-actions released this 18 Oct 03:42
· 5017 commits to main since this release
6.0.0-RC1
1ece9f3

⏪ Breaking Changes

  • RequestMatcherDelegatingAuthorizationManager should deny when no match #11958
  • Authentication(Web)Filter should return a 500 on AuthenticationServiceExceptions #9429
  • BasicAuthenticationFilter skips re-authentication if username changes and Authentication object is not UsernamePasswordAuthenticationToken #10347
  • Default to DelegatingSecurityContextRepository in SecurityContextConfigurer #12049
  • Default to Xor CSRF protection #11960
  • Default use of RequestAttributeSecurityContextRepository instead of NullSecurityContextRepository #11026
  • OidcUserAuthority should not automatically include ROLE_USER authority #7856
  • Remove deprecated constructors in PasswordEncoders #11985
  • Remove deprecated CsrfSpec.tokenFromMultipartDataEnabled #12020
  • Remove deprecated CsrfWebFilter.setTokenFromMultipartDataEnabled #12019
  • Remove Deprecated OpenSAML 3 Support #11789
  • Remove deprecated RequestMatcher methods from Java Configuration #11939
  • Remove OpenSAML3 support #10556
  • Remove WebSecurityConfigurerAdapter #11923
  • Remove WebSecurityConfigurerAdapter #10902
  • Resource Server Package Name Inconsistencies #7349
  • SAML 2.0 filters should be in the web package #8819
  • Update Defaults for Smarter Session Access #11454
  • Use MvcRequestMatcher by default if Spring MVC is present #11899
  • WebAuthenticationDetails#hashCode often returns zero #4133
  • XSS protection should be set to 0 by default per updated OWASP recommendation #9631

⭐ New Features

  • Add 'securityMatcher' as an alias of 'requestMatcher' #11945
  • Add native hint for OAuth2 Client's schemas #11920
  • Add native hint for the users JDBC schema #11907
  • Add static factory methods to RequestMatcher implementations #11978
  • Add XML support for shouldFilterAllDispatcherTypes #11971
  • automatically manage docs version (with collector) #11957
  • Change XML default use-authorization-manager="true" #11929
  • Default to shouldFilterAllDispatcherTypes=true in XML #11970
  • Deprecate HPKP security header #11937
  • Enabling authenticationIsRequired to be overridden for custom checks.… #10971
  • HttpSecurityConfiguration should configure ContentNegotiationStrategy #11922
  • Observability #11906
  • SessionManagementDsl.requireExplicitAuthenticationStrategy #11928
  • Simplify Java Configuration RequestMatcher Usage #11940
  • Smarter HttpSession Access #6125
  • Update What's New in 6.0 #12024

🪲 Bug Fixes

  • Build fails with missing project property cloneOutputDirectory #11981
  • Possible misconfiguration of SecurityContextRepository #12023
  • SAML Logout move onload script to body tag #11881
  • SecurityContextImpl does not have hints to resolve the Authentication #11987

🔨 Dependency Upgrades

  • Update to Spring Data 2022.0.0-RC1 #12066
  • Update to Spring LDAP 3.0.0-RC1 #12067
  • Upgrade to Update hibernate-core to 6.1.4.Final #12038
  • Upgrade to Update htmlunit to 2.65.1 #12039
  • Upgrade to Update htmlunit-driver to 2.65.0 #12034
  • Upgrade to Update io.spring.javaformat to 0.0.35 #12040
  • Upgrade to Update jackson-bom to 2.13.4.20221013 #12042
  • Upgrade to Update junit-bom to 5.9.1 #12036
  • Upgrade to Update logback-classic to 1.4.4 #12043
  • Upgrade to Update mockk to 1.13.2 #12041
  • Upgrade to Update org.jetbrains.kotlin to 1.7.20 #12037
  • Upgrade to Update org.mockito to 4.8.1 #12035
  • Upgrade to Update org.slf4j to 2.0.3 #12033
  • Upgrade to Update to Micrometer 1.10.0-RC1 #12046
  • Upgrade to Update to Reactor 2022.0.0-RC1 #12045
  • Upgrade to Update to Spring Framework 6.0.0-RC1 #12047
  • Upgrade Unboundid to 6.0.6 #10210

❤️ Contributors

We'd like to thank all the contributors who worked on this release!

Assets 2
Loading