Skip to content

Conversation

@dependabot
Copy link
Contributor

@dependabot dependabot bot commented on behalf of github Aug 19, 2025

Bumps org.springframework.security:spring-security-bom from 7.0.0-M1 to 7.0.0-M2.

Release notes

Sourced from org.springframework.security:spring-security-bom's releases.

7.0.0-M2

⭐ New Features

  • Add ExpressionTemplateValueProvider #17448
  • Add META-INF/LICENSE.txt to published jars #17640
  • Add OAuth2User to OidcUser Conversion Params #17626
  • Apply missing diamond operators #17310
  • Clarify instructional nature when when withDefaultPasswordEncoder is used in documentation #17624
  • Correct @NonNull and @Nullable package name #17512
  • Enable Null checking in spring-security-core via JSpecify #17534
  • Enable Null checking in spring-security-crypto via JSpecify #17533
  • Extract spring-security-webauthn #17586
  • Improve authoritiesClaimName validation in JwtGrantedAuthoritiesConverter #17247
  • Improve Spring Boot's integration with PathPatternRequestMatcher.Builder #17746
  • Make stricter IP format check in IpAddressMatcher #17500
  • Polish document #17654
  • Polish ExpressionTemplateValueProvider JavaDoc #17666
  • Remove OpenSAML 4 support #17707
  • Replace "shameless coverage code" in SecurityNamespaceHandlerTests with meaningful tests #17689
  • Simplify error message for unsupported Security XSD versions #17488
  • Use 2004-present Copyright #17635

🪲 Bug Fixes

  • AuthorizationManager null safety annotation on generic type is incorrectly specified #17667
  • OpenSamlAssertingPartyDetails Should Be Serializable #17728

🔨 Dependency Upgrades

  • Bump com.fasterxml.jackson:jackson-bom from 2.19.1 to 2.19.2 #17589
  • Bump com.nimbusds:oauth2-oidc-sdk from 11.26 to 11.26.1 #17644
  • Bump com.webauthn4j:webauthn4j-core from 0.29.4.RELEASE to 0.29.5.RELEASE #17700
  • Bump com.webauthn4j:webauthn4j-core from 0.29.4.RELEASE to 0.29.5.RELEASE #17681
  • Bump com.webauthn4j:webauthn4j-core from 0.29.4.RELEASE to 0.29.5.RELEASE #17657
  • Bump io.micrometer:micrometer-observation from 1.14.9 to 1.14.10 #17697
  • Bump io.projectreactor:reactor-bom from 2025.0.0-M5 to 2025.0.0-M6 #17703
  • Bump io.spring.develocity.conventions from 0.0.23 to 0.0.24 #17619
  • Bump io.spring.develocity.conventions from 0.0.23 to 0.0.24 #17590
  • Bump io.spring.gradle:spring-security-release-plugin from 1.0.10 to 1.0.11 #17725
  • Bump io.spring.gradle:spring-security-release-plugin from 1.0.6 to 1.0.10 #17620
  • Bump io.spring.gradle:spring-security-release-plugin from 1.0.6 to 1.0.10 #17588
  • Bump io.spring.nullability:io.spring.nullability.gradle.plugin from 0.0.1 to 0.0.2 #17591
  • Bump org-eclipse-jetty from 11.0.25 to 11.0.26 #17743
  • Bump org-opensaml5 from 5.1.2 to 5.1.5 #17734
  • Bump org.assertj:assertj-core from 3.27.3 to 3.27.4 #17691
  • Bump org.assertj:assertj-core from 3.27.3 to 3.27.4 #17679
  • Bump org.assertj:assertj-core from 3.27.3 to 3.27.4 #17670
  • Bump org.gretty:gretty from 4.1.6 to 4.1.7 #17618
  • Bump org.gretty:gretty from 4.1.6 to 4.1.7 #17587
  • Bump org.hibernate.orm:hibernate-core from 7.0.6.Final to 7.0.8.Final #17649

... (truncated)

Commits
  • 70626fe Release 7.0.0-M2
  • d2b7023 Merge branch '6.5.x'
  • 9909dc6 Merge branch '6.4.x' into 6.5.x
  • 525601e Fix version 6.4.9-SNAPSHOT
  • 15a4d0d Fix version=6.5.3-SNAPSHOT
  • 34aac5d Merge branch '6.5.x'
  • 80b1a30 Merge branch '6.4.x' into 6.5.x
  • 644f780 Bump org.springframework.ldap:spring-ldap-core from 3.2.13 to 3.2.14
  • a26d6fc Bump org.springframework.data:spring-data-bom from 2024.1.8 to 2024.1.9
  • 74735a1 Bump org.hibernate.orm:hibernate-core from 6.6.23.Final to 6.6.26.Final
  • Additional commits viewable in compare view

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

@dependabot dependabot bot added the type: dependency-upgrade A dependency upgrade label Aug 19, 2025
Bumps [org.springframework.security:spring-security-bom](https://github.com/spring-projects/spring-security) from 7.0.0-M1 to 7.0.0-M2.
- [Release notes](https://github.com/spring-projects/spring-security/releases)
- [Changelog](https://github.com/spring-projects/spring-security/blob/main/RELEASE.adoc)
- [Commits](spring-projects/spring-security@7.0.0-M1...7.0.0-M2)

---
updated-dependencies:
- dependency-name: org.springframework.security:spring-security-bom
  dependency-version: 7.0.0-M2
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <[email protected]>
@dependabot dependabot bot force-pushed the dependabot/gradle/main/org.springframework.security-spring-security-bom-7.0.0-M2 branch from f3ac469 to 42e48d8 Compare August 19, 2025 14:05
@jgrandja jgrandja self-assigned this Aug 19, 2025
@jgrandja jgrandja added this to the 2.0.0-M2 milestone Aug 19, 2025
@jgrandja jgrandja merged commit 312edd5 into main Aug 19, 2025
12 checks passed
@dependabot dependabot bot deleted the dependabot/gradle/main/org.springframework.security-spring-security-bom-7.0.0-M2 branch August 19, 2025 14:10
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

type: dependency-upgrade A dependency upgrade

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant