Migration Recipe for Spring Security 6.4 & 6.5, deprecations ahead of 7.0

[ghusta]

Hi

As https://github.com/openrewrite/rewrite-spring/blob/main/src/main/resources/META-INF/rewrite/spring-security-63.yml and https://github.com/openrewrite/rewrite-spring/blob/main/src/main/resources/META-INF/rewrite/spring-boot-34.yml exist,
would it be possible to add spring-security-64.yml ?

Basically it would be a copy paste of spring-security-63.yml.

However spring-security-oauth2-authorization-server should target 1.4.x.

[timtebeek]

Hi yes absolutely, thanks for noticing and sharing.. Would you want to add a first outline?

[ghusta]

OK I'll make a first proposal in the next few days.

[timtebeek]

Thanks a lot! Linking this helpful page as well for some new deprecation notices we could optionally pick up already as well.
https://docs.spring.io/spring-security/reference/6.4/whats-new.html

Some of those seem fairly straightforward drop in replacements that can typically be achieved with declarative recipes, and worth avoiding a warning.

AuthorizationManager#check is deprecated in favor of AuthorizationManager#authorize. This is primarily to allow the return type to be an interface instead of a concrete class. If you are invoking AuthorizationManager#check, please invoke AuthorizationManager#authorize instead.

[timtebeek]

Is see there's also a 6.5, with steps documented to go to 7.0

• https://docs.spring.io/spring-security/reference/whats-new.html
• https://docs.spring.io/spring-security/reference/migration-7/index.html

[ghusta]

I'm going to create a PR for Spring Security 6.4 with dependency upgrades first.
I will look at deprecations or replacements in code later.