Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

fix(deps): update dependency org.springframework.security:spring-security-core to v6.3.2 [security] #1093

Merged
merged 1 commit into from
Aug 21, 2024
Merged

fix(deps): update dependency org.springframework.security:spring-security-core to v6.3.2 [security] #1093

merged 1 commit into from
Aug 21, 2024

Conversation

renovate[bot]
Copy link
Contributor

@renovate renovate bot commented Aug 20, 2024 •
edited by github-actions bot
Loading

Mend Renovate

This PR contains the following updates:

Package Change Age Adoption Passing Confidence
org.springframework.security:spring-security-core (source) 6.3.0 -> 6.3.2 age adoption passing confidence

GitHub Vulnerability Alerts

CVE-2024-38810

Missing Authorization When Using @​AuthorizeReturnObject in Spring Security 6.3.0 and 6.3.1 allows attacker to render security annotations inaffective.

Release Notes

spring-projects/spring-security (org.springframework.security:spring-security-core)

v6.3.2

Compare Source

v6.3.1

Compare Source

⭐ New Features
  • Clarify the behavior of Concurrent Session Management when an IdP is involved #​15071
  • Mention all required dependencies in LDAP documentation #​15245
  • Minor docs fix #​15144
🪲 Bug Fixes
  • AbstractRequestMatcherRegistry#requestMatchers should pick MvcRequestMatcher when using MockMvc #​15211
  • Assert WebSession is not null #​15179
  • DispatcherServletDelegatingRequestMatcher causes errors when running tests with MockMvc #​15197
  • Documentation clarification after #​12783 has been closed is needed. #​15208
  • Fix Java example in multitenanci.adoc #​15151
  • Fix Kotlin example in authorize-http-requests.adoc #​15129
  • Incorrect documentation for OIDC Back-Channel Logout #​15212
  • IpAddressMatcher.matches(String address) still accepts URLs #​15172
  • LDIF file on official documentation breaks the startup process #​15167
  • Link to article with remember-me-persistent-token strategy is broken #​15149
  • OpenSaml4AssertionValidator is not respecting clock skew settings #​15183
  • Resolving invalid CSRF token values is not consistent #​15186
  • spring-security/docs/modules/ROOT/pages/servlet/authorization /method-security #​15143
  • SpringOpaqueTokenIntrospector does not add scopes as granted authorities properly #​15165
🔨 Dependency Upgrades
  • Bump io.micrometer:micrometer-observation from 1.12.6 to 1.12.7 #​15225
  • Bump io.projectreactor:reactor-bom from 2023.0.6 to 2023.0.7 #​15229
  • Bump org.apache.directory.shared:shared-ldap from 0.9.15 to 0.9.19 #​15161
  • Bump org.apache.maven:maven-resolver-provider from 3.9.6 to 3.9.7 #​15168
  • Bump org.gretty:gretty from 4.1.3 to 4.1.4 #​15133
  • Bump org.hibernate.orm:hibernate-core from 6.4.8.Final to 6.4.9.Final #​15228
  • Bump org.hsqldb:hsqldb from 2.7.2 to 2.7.3 #​15193
  • Bump org.springframework.data:spring-data-bom from 2024.0.0 to 2024.0.1 #​15260
  • Bump org.springframework.ldap:spring-ldap-core from 3.2.3 to 3.2.4 #​15251
  • Bump org.springframework:spring-framework-bom from 6.1.7 to 6.1.8 #​15134
  • Bump org.springframework:spring-framework-bom from 6.1.8 to 6.1.9 #​15252
🔩 Build Updates
  • Bump @antora/collector-extension from 1.0.0-alpha.3 to 1.0.0-alpha.4 in /docs #​15159
  • Bump @springio/antora-extensions from 1.10.0 to 1.11.1 in /docs #​15141
  • Bump com.gradle.develocity from 3.17.4 to 3.17.5 #​15239
  • Bump gradle/gradle-build-action from 2 to 3 #​15157
  • Bump io-spring-javaformat from 0.0.41 to 0.0.42 #​15219
  • Bump org.jfrog.buildinfo:build-info-extractor-gradle from 4.33.15 to 4.33.16 #​15176
  • Bump org.jfrog.buildinfo:build-info-extractor-gradle from 4.33.16 to 4.33.17 #​15218
  • Bump org.jfrog.buildinfo:build-info-extractor-gradle from 4.33.17 to 4.33.19 #​15261
  • Bump spring-io/spring-doc-actions from 17ed79e to 5a57bcc #​15139
❤️ Contributors

Thank you to all the contributors who worked on this release:

@​dependabot[bot] and @​theHacker

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

Thanks for the PR!

Deployments, as required, will be available below:
Any successful deployments (not always required) will be available here

Please create PRs in draft mode. Mark as ready to enable:

After merge, new images are deployed in:

@renovate renovate bot requested a review from paulushcgcj as a code owner August 20, 2024 21:29
@renovate renovate bot enabled auto-merge (rebase) August 20, 2024 21:29
@renovate renovate bot requested a review from mamartinezmejia as a code owner August 20, 2024 21:29
@github-actions GitHub Actions
Copy link
Contributor

github-actions bot commented Aug 20, 2024 •
edited
Loading

Current changelog

Bug Fixes

  • deps: update dependency org.springframework.security:spring-security-core to v6.3.2 [security] (cc7d232)

@github-actions GitHub Actions
Copy link
Contributor

Overall Project NaN% NaN% 🍏

There is no coverage information present for the Files changed

@renovate renovate bot force-pushed the renovate/maven-org.springframework.security-spring-security-core-vulnerability branch from 1696912 to f407fc7 Compare August 20, 2024 22:50
@github-actions GitHub Actions
Copy link
Contributor

Overall Project NaN% NaN% 🍏

There is no coverage information present for the Files changed

@renovate renovate bot force-pushed the renovate/maven-org.springframework.security-spring-security-core-vulnerability branch from f407fc7 to 2d322f2 Compare August 20, 2024 23:40
@github-actions GitHub Actions
Copy link
Contributor

Overall Project NaN% NaN% 🍏

There is no coverage information present for the Files changed

@renovate renovate bot force-pushed the renovate/maven-org.springframework.security-spring-security-core-vulnerability branch from 2d322f2 to 6176a75 Compare August 21, 2024 01:00
@github-actions GitHub Actions
Copy link
Contributor

Overall Project NaN% NaN% 🍏

There is no coverage information present for the Files changed

@renovate renovate bot force-pushed the renovate/maven-org.springframework.security-spring-security-core-vulnerability branch from 6176a75 to cc7d232 Compare August 21, 2024 15:37
@github-actions GitHub Actions
Copy link
Contributor

Overall Project NaN% NaN% 🍏

There is no coverage information present for the Files changed

@renovate renovate bot merged commit a47ca57 into main Aug 21, 2024
21 of 25 checks passed
@renovate renovate bot deleted the renovate/maven-org.springframework.security-spring-security-core-vulnerability branch August 21, 2024 15:51
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@mamartinezmejia mamartinezmejia mamartinezmejia approved these changes

@paulushcgcj paulushcgcj Awaiting requested review from paulushcgcj paulushcgcj is a code owner

Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
1 participant
@mamartinezmejia