Build(deps): Bump spring.security.version from 7.1.0 to 7.1.1 - #2020
Closed
dependabot[bot] wants to merge 1 commit into
Closed
dependabot[bot] wants to merge 1 commit into
dependabot[bot] wants to merge 1 commit into
Conversation
dependabot
Bot
added
dependencies
Bumps `spring.security.version` from 7.1.0 to 7.1.1. Updates `org.springframework.security:spring-security-bom` from 7.1.0 to 7.1.1 - [Release notes](https://github.com/spring-projects/spring-security/releases) - [Changelog](https://github.com/spring-projects/spring-security/blob/main/RELEASE.adoc) - [Commits](spring-projects/spring-security@7.1.0...7.1.1) Updates `org.springframework.security:spring-security-core` from 7.1.0 to 7.1.1 - [Release notes](https://github.com/spring-projects/spring-security/releases) - [Changelog](https://github.com/spring-projects/spring-security/blob/main/RELEASE.adoc) - [Commits](spring-projects/spring-security@7.1.0...7.1.1) Updates `org.springframework.security:spring-security-oauth2-jose` from 7.1.0 to 7.1.1 - [Release notes](https://github.com/spring-projects/spring-security/releases) - [Changelog](https://github.com/spring-projects/spring-security/blob/main/RELEASE.adoc) - [Commits](spring-projects/spring-security@7.1.0...7.1.1) Updates `org.springframework.security:spring-security-oauth2-resource-server` from 7.1.0 to 7.1.1 - [Release notes](https://github.com/spring-projects/spring-security/releases) - [Changelog](https://github.com/spring-projects/spring-security/blob/main/RELEASE.adoc) - [Commits](spring-projects/spring-security@7.1.0...7.1.1) --- updated-dependencies: - dependency-name: org.springframework.security:spring-security-bom dependency-version: 7.1.1 dependency-type: direct:production update-type: version-update:semver-patch - dependency-name: org.springframework.security:spring-security-core dependency-version: 7.1.1 dependency-type: direct:production update-type: version-update:semver-patch - dependency-name: org.springframework.security:spring-security-oauth2-jose dependency-version: 7.1.1 dependency-type: direct:development update-type: version-update:semver-patch - dependency-name: org.springframework.security:spring-security-oauth2-resource-server dependency-version: 7.1.1 dependency-type: direct:development update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
force-pushed
the
dependabot/maven/spring.security.version-7.1.1
branch
from
August 26, 2026 07:00
6f6f05a to
686fbd2
Compare
NiklasHerrmann21
added a commit
that referenced
this pull request
Aug 31, 2026
Pulls the pending Dependabot dependency bumps into this branch and also raises the legacy Spring Boot 3.x / Framework 6.x versions used by the spring-security-3 module to the same latest minor/patch releases already applied on the main-3.x line. 4.x line: - Spring Boot 4.1.0 → 4.1.1, Spring Framework 7.0.8 → 7.0.9, Spring Security 7.1.0 → 7.1.1 - Jetty 12.1.11 → 12.1.12, Reactor (core & test) 3.8.6 → 3.8.7 - JUnit Jupiter 6.1.2 → 6.1.3 - SpotBugs annotations 4.10.3 → 4.10.4, plugin 4.10.3.0 → 4.10.4.0 - logcaptor (test) 2.12.6 → 2.12.7 legacy3 (spring-security-3): - Spring Boot 3.5.14 → 3.5.16, Spring Framework 6.2.18 → 6.2.19, Spring Security 6.5.10 → 6.5.11, Reactor 3.8.2 → 3.8.7 Full reactor build (mvn clean install) green across all 13 modules.
NiklasHerrmann21
added a commit
that referenced
this pull request
Aug 31, 2026
* fix: ensure HybridTokenAuthenticator honours explicit service configurations for token validation The IAS and XSUAA delegate authenticators were constructed without their configurations, causing them to fall back to Environments.getCurrent() at request time instead of using the configurations explicitly passed to HybridTokenAuthenticator. The supplied HTTP client was similarly ignored by the delegates. The constructor now forwards all three inputs (iasConfig, xsuaaConfig, httpClient) to both delegates via the existing withServiceConfiguration / withHttpClient fluent API. Callers that follow the documented pattern of loading configurations from Environments.getCurrent() are unaffected — the delegates resolve to the same values they would have before. Adds HybridTokenAuthenticatorConfigurationTest with real delegates (no reflection-based mock replacement) to cover: - IAS token for an ambient binding is rejected when a different config is supplied - XSUAA token for an ambient binding is rejected when a different config is supplied - Explicitly supplied config is used even when no ambient config exists * docs: add 4.1.2 CHANGELOG entry and replace fixed version refs in README with 4.x README What's New section and related version callouts updated from hardcoded patch versions (4.0.1, 4.0.3, 7.0.5, 7.0.3) to version-agnostic 4.x / 7.x wording so the section stays accurate without per-release edits. * removed readme change from CHANGELOG.md * chore: Bump project version 4.1.1 → 4.1.2 across all modules, READMEs and samples * chore: update dependencies (Dependabot PRs #2020/#2021/#2025 + legacy3) Pulls the pending Dependabot dependency bumps into this branch and also raises the legacy Spring Boot 3.x / Framework 6.x versions used by the spring-security-3 module to the same latest minor/patch releases already applied on the main-3.x line. 4.x line: - Spring Boot 4.1.0 → 4.1.1, Spring Framework 7.0.8 → 7.0.9, Spring Security 7.1.0 → 7.1.1 - Jetty 12.1.11 → 12.1.12, Reactor (core & test) 3.8.6 → 3.8.7 - JUnit Jupiter 6.1.2 → 6.1.3 - SpotBugs annotations 4.10.3 → 4.10.4, plugin 4.10.3.0 → 4.10.4.0 - logcaptor (test) 2.12.6 → 2.12.7 legacy3 (spring-security-3): - Spring Boot 3.5.14 → 3.5.16, Spring Framework 6.2.18 → 6.2.19, Spring Security 6.5.10 → 6.5.11, Reactor 3.8.2 → 3.8.7 Full reactor build (mvn clean install) green across all 13 modules.
Contributor
Author
|
Looks like these dependencies are up-to-date now, so this is no longer needed. |
dependabot
Bot
deleted the
dependabot/maven/spring.security.version-7.1.1
branch
August 31, 2026 12:04
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps
spring.security.versionfrom 7.1.0 to 7.1.1.Updates
org.springframework.security:spring-security-bomfrom 7.1.0 to 7.1.1Release notes
Sourced from org.springframework.security:spring-security-bom's releases.
... (truncated)
Commits
a825937Release 7.1.174c91f8Update to Spring Data 2026.0.1b822214Update to Spring LDAP 4.1.139da00fUpdate to Micrometer 1.17.14be80b7Update to Reactor 2025.0.7564a677Update to Spring Framework 7.0.92930198Configure Build for Commercial Repositories25f9a91Configure with Commercial Workflowsbf8569fRemove OSS CI configurationdcee218Use jspecify Nullable in DPoPProofReplayValidatorUpdates
org.springframework.security:spring-security-corefrom 7.1.0 to 7.1.1Release notes
Sourced from org.springframework.security:spring-security-core's releases.
... (truncated)
Commits
a825937Release 7.1.174c91f8Update to Spring Data 2026.0.1b822214Update to Spring LDAP 4.1.139da00fUpdate to Micrometer 1.17.14be80b7Update to Reactor 2025.0.7564a677Update to Spring Framework 7.0.92930198Configure Build for Commercial Repositories25f9a91Configure with Commercial Workflowsbf8569fRemove OSS CI configurationdcee218Use jspecify Nullable in DPoPProofReplayValidatorUpdates
org.springframework.security:spring-security-oauth2-josefrom 7.1.0 to 7.1.1Release notes
Sourced from org.springframework.security:spring-security-oauth2-jose's releases.
... (truncated)
Commits
a825937Release 7.1.174c91f8Update to Spring Data 2026.0.1b822214Update to Spring LDAP 4.1.139da00fUpdate to Micrometer 1.17.14be80b7Update to Reactor 2025.0.7564a677Update to Spring Framework 7.0.92930198Configure Build for Commercial Repositories25f9a91Configure with Commercial Workflowsbf8569fRemove OSS CI configurationdcee218Use jspecify Nullable in DPoPProofReplayValidatorUpdates
org.springframework.security:spring-security-oauth2-resource-serverfrom 7.1.0 to 7.1.1Release notes
Sourced from org.springframework.security:spring-security-oauth2-resource-server's releases.
... (truncated)
Commits
a825937Release 7.1.174c91f8Update to Spring Data 2026.0.1b822214Update to Spring LDAP 4.1.139da00fUpdate to Micrometer 1.17.14be80b7Update to Reactor 2025.0.7564a677Update to Spring Framework 7.0.92930198Configure Build for Commercial Repositories25f9a91Configure with Commercial Workflowsbf8569fRemove OSS CI configurationdcee218Use jspecify Nullable in DPoPProofReplayValidator