chore(deps): bump the spring group across 4 directories with 4 updates

[dependabot]

Bumps the spring group with 4 updates in the / directory: org.springframework.boot:spring-boot-dependencies, org.springframework.security:spring-security-bom, org.springframework:spring-framework-bom and org.springdoc:springdoc-openapi-starter-webmvc-ui.
Bumps the spring group with 4 updates in the /partition-core directory: org.springframework.boot:spring-boot-dependencies, org.springframework.security:spring-security-bom, org.springframework:spring-framework-bom and org.springdoc:springdoc-openapi-starter-webmvc-ui.
Bumps the spring group with 3 updates in the /partition-core-plus directory: org.springframework.boot:spring-boot-dependencies, org.springframework.security:spring-security-bom and org.springframework:spring-framework-bom.
Bumps the spring group with 3 updates in the /provider/partition-azure directory: org.springframework.boot:spring-boot-dependencies, org.springframework.security:spring-security-bom and org.springframework:spring-framework-bom.

Updates org.springframework.boot:spring-boot-dependencies from 3.5.12 to 3.5.14

Release notes

Sourced from org.springframework.boot:spring-boot-dependencies's releases.

v3.5.14

🐞 Bug Fixes

• ApplicationPidFileWriter does not handle symlinks correctly #50173
• RandomValuePropertySource is not suitable for secrets #50172
• Cassandra auto-configuration misconfigures CqlSessionBuilder #50171
• ApplicationTemp does not handle symlinks correctly #50170
• Remote DevTools performs comparison incorrectly #50169
• spring.rabbitmq.ssl.verify-hostname is applied inconsistently #50168
• EnversRevisionRepositoriesRegistrar should reuse @EnableEnversRepositories rather than configuring the JPA counterpart #50035
• Annotations like @Ssl don't work on @Bean methods when using @ServiceConnection #50033
• Whole number values are ignored when configuring min and max expected values and SLO boundaries for a distribution summary meter #50021
• WebFlux Cloud Foundry links endpoint includes query string from received request in resolved links #50008
• 500 response from env endpoint when supplied pattern is invalid #49942
• HTTP method is lost when configuring excludes in EndpointRequest #49885
• Docker Compose support doesn't work with apache/artemis image #49865
• Honor HttpMethod for reactive additional endpoint paths #49864
• Docker Compose support doesn't work with apache/activemq image #49863
• Imports on a containing test class are ignored when a nested class has imports #49860

📔 Documentation

• Link to the observability section of the Lettuce documentation is broken #50092
• Javadoc for StaticResourceLocation.FAVICON doesn't describe icons location #50083
• MySamlRelyingPartyConfiguration is missing a Kotlin sample #50023
• Incorrect default value for management.httpexchanges.recording.include in configuration metadata #50010
• Link to the Kubernetes documentation when discussing startup probes #50007
• Update docs to encourage Java fundamentals for beginners that prefer to learn that way #49895
• Clarify that configuration property default values are not available through the Environment #49835

🔨 Dependency Upgrades

• Upgrade to Groovy 4.0.31 #49905
• Upgrade to Hibernate 6.6.49.Final #50140
• Upgrade to Jaxen 2.0.1 #50109
• Upgrade to Jaybird 6.0.5 #49907
• Upgrade to Jetty 12.0.34 #49908
• Upgrade to jOOQ 3.19.32 #50110
• Upgrade to Lombok 1.18.46 #50148
• Upgrade to MariaDB 3.5.8 #49909
• Upgrade to Micrometer 1.15.11 #49961
• Upgrade to Micrometer Tracing 1.5.11 #49962
• Upgrade to MySQL 9.7.0 #50161
• Upgrade to Neo4j Java Driver 5.28.13 #50074
• Upgrade to Reactor Bom 2024.0.17 #49963
• Upgrade to Spring AMQP 3.2.10 #49964
• Upgrade to Spring Authorization Server 1.5.7 #49965
• Upgrade to Spring Data Bom 2025.0.11 #49966
• Upgrade to Spring Framework 6.2.18 #49967
• Upgrade to Spring Kafka 3.3.15 #50129

... (truncated)

Commits

• 7d7b3ac Release v3.5.14
• 9dc5aa2 Polish
• f533a45 Do not follow symlinks when writing PID file
• f3b8eb0 Use SecureRandom in RandomValuePropertySource
• e22083a Enable hostname verification for SSL connections to Cassandra
• 5ceb1a2 Improve ApplicationTemp's temporary directory creation
• 4b0862c Use constant-time comparison for remote DevTools secret
• e4febe2 Apply verify-hostname consistently
• 2c2ffe5 Fix Windows test failure
• 0046a44 Protect against corrupt buildpack archives
• Additional commits viewable in compare view

Updates org.springframework.security:spring-security-bom from 6.5.9 to 6.5.11

Release notes

Sourced from org.springframework.security:spring-security-bom's releases.

6.5.11

🪲 Bug Fixes

• FormPostRedirectStrategy should not emit percent-encoded values into hidden form inputs #19136

🔨 Dependency Upgrades

• Bump antora from 3.2.0-alpha.11 to 3.2.0-alpha.12 in /docs #19185
• Bump ch.qos.logback:logback-classic from 1.5.32 to 1.5.34 #19299
• Bump com.fasterxml.jackson:jackson-bom from 2.18.6 to 2.18.7 #19129
• Bump com.fasterxml.jackson:jackson-bom from 2.18.7 to 2.18.8 #19297
• Bump gradle-wrapper from 8.14.4 to 8.14.5 #19159
• Bump org-bouncycastle from 1.80 to 1.80.2 #19204
• Bump org.apache.maven:maven-resolver-provider from 3.9.15 to 3.9.16 #19205
• Bump org.hibernate.orm:hibernate-core from 6.6.49.Final to 6.6.50.Final #19150
• Bump org.hibernate.orm:hibernate-core from 6.6.50.Final to 6.6.51.Final #19213
• Bump org.hibernate.orm:hibernate-core from 6.6.51.Final to 6.6.53.Final #19300
• Bump org.slf4j:slf4j-api from 2.0.17 to 2.0.18 #19173
• Bump org.springframework:spring-framework-bom from 6.2.18 to 6.2.19 #19293
• Bump spring-io/spring-gradle-build-action from 2.0.5 to 2.0.6 #19124
• Bump spring-io/spring-release-actions from 0.0.4 to 0.0.5 #19183
• Update micrometer-bom to 1.15.12 #19302
• Update to Micrometer 1.15.11 #19224
• Update to reactor-bom 2024.0.18 #19301

🔩 Build Updates

• Release 6.5.11 #19118

6.5.10

⭐ New Features

• Add CredentialRecordOwnerAuthorizationManager #19004
• Add XML Based shouldWriteHeadersEagerly tests #19017
• Clarify Session Management Persistence Documentation #18345
• Update FilterChainProxy#getFilters(String) javadoc #18258

🪲 Bug Fixes

• Add equals and hashcode to HttpMethodRequestMatcher #18914
• auth_time validation fails when SSO session is renewed #18839
• Fallback defaultTargetUrl if refererHeader is empty #18806
• Fix HttpSessionRequestCache#getMatchingRequest query string parsing #16914
• Fix documentation for Custom Authorization Manager #18362
• Improve serialVersionUID check in tests #18474
• Merge Handle null value in OnCommittedResponseWrapper header methods #18989
• OAuth2 client sessionManagement ineffective with DefaultOidcUser #18622

🔨 Dependency Upgrades

... (truncated)

Commits

• 73b0777 Release 6.5.11
• fd5dae5 Sync branch '6.5.x'
• 700a453 Bump ch.qos.logback:logback-classic from 1.5.32 to 1.5.34
• 3a394c6 Update micrometer-bom to 1.15.12
• 79f9bec Update to reactor-bom 2024.0.18
• 5b01936 Bump org.hibernate.orm:hibernate-core from 6.6.51.Final to 6.6.53.Final
• f9b4afd Bump com.fasterxml.jackson:jackson-bom from 2.18.7 to 2.18.8
• f325ddb Bump org.springframework:spring-framework-bom from 6.2.18 to 6.2.19
• 4adfdf6 Bump org.apache.maven:maven-resolver-provider from 3.9.15 to 3.9.16
• e91b81a Bump org-bouncycastle from 1.80 to 1.80.2
• Additional commits viewable in compare view

Updates org.springframework:spring-framework-bom from 6.2.17 to 6.2.19

Release notes

Sourced from org.springframework:spring-framework-bom's releases.

v6.2.19

⚠️ Security Fixes

This maintenance release fixes a high number of CVEs. You can learn more about this in the "Spring and Security In The Times Of AI" blog post. Here is the full list of 16 CVEs:

• CVE-2026-41838 "Spring Framework Predictable Session ID in WebSocket Module"
• CVE-2026-41839 "Spring Framework Escalation via Session Fixation in WebFlux"
• CVE-2026-41840 "Spring Framework Denial of Service via Multipart Requests in WebFlux"
• CVE-2026-41841 "Spring Framework Information Disclosure via Static Resource Cache in Spring MVC and WebFlux"
• CVE-2026-41842 "Spring Framework Denial of Service via Versioned Resources in Spring MVC and WebFlux"
• CVE-2026-41843 "Spring Framework Path Traversal via Versioned Static Resources in Spring MVC and WebFlux"
• CVE-2026-41844 "Spring Framework Open Redirect in Spring MVC and WebFlux"
• CVE-2026-41845 "Spring Framework Cross-site Scripting via JavaScriptUtils"
• CVE-2026-41846 "Spring Framework Cross-site Scripting via JSP Form Tags"
• CVE-2026-41848 "Spring Framework Denial of Service via AntPathMatcher"
• CVE-2026-41850 "Spring Framework Algorithmic Denial of Service via SpEL Expressions"
• CVE-2026-41851 "Spring Framework Denial of Service via Unbounded Cache in SpEL"
• CVE-2026-41852 "Spring Framework Arbitrary Method Invocation in SpEL Expressions"
• CVE-2026-41853 "Spring Framework Multipart Request Smuggling in Spring MVC and WebFlux"
• CVE-2026-41854 "Spring Framework Server-Side Request Forgery via UriComponentsBuilder"
• CVE-2026-41855 "Spring Framework Unsafe Deserialization via Jackson JMS Converters"

⭐ New Features

• Avoid too many character access attempts in AntPathMatcher #36886
• Track operations during SpEL expression evaluation #36887
• Ensure getters have non-void return types in SpEL #36888
• Expose ClassLoader from DefaultDeserializer #36839
• Refine default view name resolution #36794
• Refine Jackson JMS converters #36792
• Improve ABNF rule checks in RfcUriParser #36788
• Detect custom deserialized NullValue instances in AbstractValueAdaptingCache #36728
• Warn against unsafe static resource locations in MVC and WebFlux #36693
• Consistent compatibility with Woodstox as an alternative to Xerces #36683

🐞 Bug Fixes

• Data is lost for joined DataBuffer in DataBufferUtils #36874
• CronExpression skips days on midnight DST gap #36873
• Concurrency issue against shared cookie field in CookieLocaleResolver#setLocaleContext #36870
• Server Sent Event does not support multi-line comments #36867
• Regression in 6.2.0+: ConfigurationClassParser incorrectly removes component-scanned bean when the same class is also registered under a different name via XML #36849
• Bean Background Bootstrap and Lazy Init #36847
• Fix JSP tag processing #36798
• Fix script processing capabilities #36796
• Parsing failure for MIME type with quoted parameter values #36734
• Circular dependency between supplier-created beans is silently ignored on startup #36732
• Non-deterministic "Body token not expected" in org.springframework.http.codec.multipart.PartGenerator #36722
• Regression on value class parameter handling #36720
• Cache collisions in CachingResourceResolver #36718

... (truncated)

Commits

• 6214eae Release v6.2.19
• 76a36df Track operations during SpEL expression evaluation
• 3d47da9 Ensure getters have non-void return types in SpEL
• 519d733 Improve additional error messages in SpEL
• ec89834 Further improve pattern caching in SpEL
• b294371 Avoid too many character access attempts in AntPathMatcher
• 1829b42 Ensure consistent JSP tag attribute processing
• 86d9979 Refine JavaScriptUtils#javaScriptEscape
• 3aaec98 Prevent special prefixes in default view name resolution
• ee4e790 Add trusted packages to MappingJackson2MessageConverter
• Additional commits viewable in compare view

Updates org.springdoc:springdoc-openapi-starter-webmvc-ui from 2.8.14 to 2.8.17

Release notes

Sourced from org.springdoc:springdoc-openapi-starter-webmvc-ui's releases.

springdoc-openapi v2.8.17 released!

Added

• Add support for the @Range constraint validation annotation
• Auto-set nullable: true for Kotlin nullable types in schema properties

Changed

• Upgrade Spring Boot to version 3.5.13
• Upgrade swagger-core to version 2.2.47
• Upgrade swagger-ui to version 5.32.2

Fixed

• #3259 – Fix an issue with annotated types with generics on parameters
• #3255 – Handle $ref nullable wrapping and OAS 3.1 support
• #3245 – Upgrade swagger-core from 2.2.43 to 2.2.45 (fixes schema resolution issues)
• #3241 – Generic error responses from multiple @ControllerAdvice are still nondeterministic across OS
• #3236 – Preserve YAML group URLs in Swagger UI
• Fix PropertyResolverUtils to retain a JsonNode when reading an ExtensionProperty annotation
• Fix handling of default values for LocalDate

New Contributors

• @​soowanx made their first contribution in springdoc/springdoc-openapi#3247
• @​pcalouche made their first contribution in springdoc/springdoc-openapi#3254
• @​sisco70 made their first contribution in springdoc/springdoc-openapi#3255
• @​thejeff77 made their first contribution in springdoc/springdoc-openapi#3256
• @​mcclellanmj made their first contribution in springdoc/springdoc-openapi#3259

Full Changelog: springdoc/springdoc-openapi@v2.8.16...v2.8.17

springdoc-openapi v2.8.16 released!

Added

• #3208 - Add support for springdoc.swagger-ui.document-title property to customize the browser tab title

Changed

• Upgrade Spring Boot to version 3.5.11
• Upgrade swagger-core to version 2.2.43
• Upgrade swagger-ui to version 5.32.0
• Upgrade Scalar to version 0.5.55

Fixed

• #3230 – Scalar source URLs resolve to null/<groupName> on second request when using GroupedOpenApi
• #3226 – Propagate @JsonView context when resolving Page<T> schema in PageOpenAPIConverter
• #3205 – springdoc-ui does not work with native compile GraalVM 25
• #3219 – Upgrade swagger-core from 2.2.42 to 2.2.43 (fixes schema resolution issues)

... (truncated)

Changelog

Sourced from org.springdoc:springdoc-openapi-starter-webmvc-ui's changelog.

[2.8.17] - 2026-04-12

Added

• Add support for the @Range constraint validation annotation
• Auto-set nullable: true for Kotlin nullable types in schema properties

Changed

• Upgrade Spring Boot to version 3.5.13
• Upgrade swagger-core to version 2.2.47
• Upgrade swagger-ui to version 5.32.2

Fixed

• #3259 – Fix an issue with annotated types with generics on parameters
• #3255 – Handle $ref nullable wrapping and OAS 3.1 support
• #3245 – Upgrade swagger-core from 2.2.43 to 2.2.45 (fixes schema resolution issues)
• #3241 – Generic error responses from multiple @ControllerAdvice are still nondeterministic across OS
• #3236 – Preserve YAML group URLs in Swagger UI
• Fix PropertyResolverUtils to retain a JsonNode when reading an ExtensionProperty annotation
• Fix handling of default values for LocalDate

[2.8.16] - 2026-02-27

Added

• Add support for springdoc.swagger-ui.document-title property to customize the browser tab title

Changed

• Upgrade Spring Boot to version 3.5.11
• Upgrade swagger-core to version 2.2.43
• Upgrade swagger-ui to version 5.32.0
• Upgrade Scalar to version 0.5.55

Fixed

• #3230 – Scalar source URLs resolve to null/<groupName> on second request when using GroupedOpenApi
• #3226 – Propagate @JsonView context when resolving Page<T> schema in PageOpenAPIConverter
• #3205 – springdoc-ui does not work with native compile GraalVM 25
• #3219 – Upgrade swagger-core from 2.2.42 to 2.2.43 (fixes schema resolution issues)
• #3193 – OpenApi field in SpringDocConfigProperties does not comply with camelCase naming conventions
• #3161 – Prevent duplicate _links in allOf child schemas extending RepresentationModel
• Fix type annotation not considered when Kotlin is not present
• Fix property resolution for parameter default values

[2.8.15] - 2026-01-01

Added

... (truncated)

Commits

• 07e7739 [maven-release-plugin] prepare release v2.8.17
• 2019f83 CHANGELOG.md update
• 90db507 upgrade swagger-ui to version 5.32.2
• 5964baa Upgrade swagger-api.version to 2.2.47
• 7a19bca Fixes tests for #3255
• 0b0ebab Merge pull request #3259 from mcclellanmj/bug-parameterized-types
• 6b9b69e Fixes tests for #3255
• 6462e32 Merge pull request #3256 from thejeff77/feat/kotlin-nullable-schema-properties
• f634f54 Merge pull request #3255 from sisco70/patch-1
• 386e459 Merge pull request #3254 from pcalouche/update-spring-boot
• Additional commits viewable in compare view

Updates org.springdoc:springdoc-openapi-starter-webmvc-ui from 2.8.14 to 2.8.17

Release notes

Sourced from org.springdoc:springdoc-openapi-starter-webmvc-ui's releases.

springdoc-openapi v2.8.17 released!

Added

• Add support for the @Range constraint validation annotation
• Auto-set nullable: true for Kotlin nullable types in schema properties

Changed

• Upgrade Spring Boot to version 3.5.13
• Upgrade swagger-core to version 2.2.47
• Upgrade swagger-ui to version 5.32.2

Fixed

• #3259 – Fix an issue with annotated types with generics on parameters
• #3255 – Handle $ref nullable wrapping and OAS 3.1 support
• #3245 – Upgrade swagger-core from 2.2.43 to 2.2.45 (fixes schema resolution issues)
• #3241 – Generic error responses from multiple @ControllerAdvice are still nondeterministic across OS
• #3236 – Preserve YAML group URLs in Swagger UI
• Fix PropertyResolverUtils to retain a JsonNode when reading an ExtensionProperty annotation
• Fix handling of default values for LocalDate

New Contributors

• @​soowanx made their first contribution in springdoc/springdoc-openapi#3247
• @​pcalouche made their first contribution in springdoc/springdoc-openapi#3254
• @​sisco70 made their first contribution in springdoc/springdoc-openapi#3255
• @​thejeff77 made their first contribution in springdoc/springdoc-openapi#3256
• @​mcclellanmj made their first contribution in springdoc/springdoc-openapi#3259

Full Changelog: springdoc/springdoc-openapi@v2.8.16...v2.8.17

springdoc-openapi v2.8.16 released!

Added

• #3208 - Add support for springdoc.swagger-ui.document-title property to customize the browser tab title

Changed

• Upgrade Spring Boot to version 3.5.11
• Upgrade swagger-core to version 2.2.43
• Upgrade swagger-ui to version 5.32.0
• Upgrade Scalar to version 0.5.55

Fixed

• #3230 – Scalar source URLs resolve to null/<groupName> on second request when using GroupedOpenApi
• #3226 – Propagate @JsonView context when resolving Page<T> schema in PageOpenAPIConverter
• #3205 – springdoc-ui does not work with native compile GraalVM 25
• #3219 – Upgrade swagger-core from 2.2.42 to 2.2.43 (fixes schema resolution issues)

... (truncated)

Changelog

Sourced from org.springdoc:springdoc-openapi-starter-webmvc-ui's changelog.

[2.8.17] - 2026-04-12

Added

• Add support for the @Range constraint validation annotation
• Auto-set nullable: true for Kotlin nullable types in schema properties

Changed

• Upgrade Spring Boot to version 3.5.13
• Upgrade swagger-core to version 2.2.47
• Upgrade swagger-ui to version 5.32.2

Fixed

• #3259 – Fix an issue with annotated types with generics on parameters
• #3255 – Handle $ref nullable wrapping and OAS 3.1 support
• #3245 – Upgrade swagger-core from 2.2.43 to 2.2.45 (fixes schema resolution issues)
• #3241 – Generic error responses from multiple @ControllerAdvice are still nondeterministic across OS
• #3236 – Preserve YAML group URLs in Swagger UI
• Fix PropertyResolverUtils to retain a JsonNode when reading an ExtensionProperty annotation
• Fix handling of default values for LocalDate

[2.8.16] - 2026-02-27

Added

• Add support for springdoc.swagger-ui.document-title property to customize the browser tab title

Changed

• Upgrade Spring Boot to version 3.5.11
• Upgrade swagger-core to version 2.2.43
• Upgrade swagger-ui to version 5.32.0
• Upgrade Scalar to version 0.5.55

Fixed

• #3230 – Scalar source URLs resolve to null/<groupName> on second request when using GroupedOpenApi
• #3226 – Propagate @JsonView context when resolving Page<T> schema in PageOpenAPIConverter
• #3205 – springdoc-ui does not work with native compile GraalVM 25
• #3219 – Upgrade swagger-core from 2.2.42 to 2.2.43 (fixes schema resolution issues)
• #3193 – OpenApi field in SpringDocConfigProperties does not comply with camelCase naming conventions
• #3161 – Prevent duplicate _links in allOf child schemas extending RepresentationModel
• Fix type annotation not considered when Kotlin is not present
• Fix property resolution for parameter default values

[2.8.15] - 2026-01-01

Added

... (truncated)

Commits

• 07e7739 [maven-release-plugin] prepare release v2.8.17
• 2019f83 CHANGELOG.md update
• 90db507 upgrade swagger-ui to version 5.32.2
• 5964baa Upgrade swagger-api.version to 2.2.47
• 7a19bca Fixes tests for #3255
• 0b0ebab Merge pull request #3259 from mcclellanmj/bug-parameterized-types
• 6b9b69e Fixes tests for #3255
• 6462e32 Merge pull request #3256 from thejeff77/feat/kotlin-nullable-schema-properties
• f634f54 Merge pull request #3255 from sisco70/patch-1
• 386e459 Merge pull request #3254 from pcalouche/update-spring-boot
• Additional commits viewable in compare view

Updates org.springframework.boot:spring-boot-dependencies from 3.5.12 to 3.5.14

Release notes

Sourced from org.springframework.boot:spring-boot-dependencies's releases.

v3.5.14

🐞 Bug Fixes

• ApplicationPidFileWriter does not handle symlinks correctly #50173
• RandomValuePropertySource is not suitable for secrets #50172
• Cassandra auto-configuration misconfigures CqlSessionBuilder #50171
• ApplicationTemp does not handle symlinks correctly #50170
• Remote DevTools performs comparison incorrectly #50169
• spring.rabbitmq.ssl.verify-hostname is applied inconsistently #50168
• EnversRevisionRepositoriesRegistrar should reuse @EnableEnversRepositories rather than configuring the JPA counterpart #50035
• Annotations like @Ssl don't work on @Bean methods when using @ServiceConnection #50033
• Whole number values are ignored when configuring min and max expected values and SLO boundaries for a distribution summary meter #50021
• WebFlux Cloud Foundry links endpoint includes query string from received request in resolved links #50008
• 500 response from env endpoint when supplied pattern is invalid #49942
• HTTP method is lost when configuring excludes in EndpointRequest #49885
• Docker Compose support doesn't work with apache/artemis image #49865
• Honor HttpMethod for reactive additional endpoint paths #49864
• Docker Compose support doesn't work with apache/activemq image #49863
• Imports on a containing test class are ignored when a nested class has imports #49860

📔 Documentation

• Link to the observability section of the Lettuce documentation is broken #50092
• Javadoc for StaticResourceLocation.FAVICON doesn't describe icons location #50083
• MySamlRelyingPartyConfiguration is missing a Kotlin sample #50023
• Incorrect default value for management.httpexchanges.recording.include in configuration metadata #50010
• Link to the Kubernetes documentation when discussing startup probes #50007
• Update docs to encourage Java fundamentals for beginners that prefer to learn that way #49895
• Clarify that configuration property default values are not available through the Environment #49835

🔨 Dependency Upgrades

• Upgrade to Groovy 4.0.31 #49905
• Upgrade to Hibernate 6.6.49.Final #50140
• Upgrade to Jaxen 2.0.1 #50109
• Upgrade to Jaybird 6.0.5 #49907
• Upgrade to Jetty 12.0.34 #49908
• Upgrade to jOOQ 3.19.32 #50110
• Upgrade to Lombok 1.18.46 #50148
• Upgrade to MariaDB 3.5.8 #49909
• Upgrade to Micrometer 1.15.11 #49961
• Upgrade to Micrometer Tracing 1.5.11 #49962
• Upgrade to MySQL 9.7.0 #50161
• Upgrade to Neo4j Java Driver 5.28.13 #50074
• Upgrade to Reactor Bom 2024.0.17 #49963
• Upgrade to Spring AMQP 3.2.10 #49964
• Upgrade to Spring Authorization Server 1.5.7 #49965
• Upgrade to Spring Data Bom 2025.0.11 #49966
• Upgrade to Spring Framework 6.2.18 #49967
• Upgrade to Spring Kafka 3.3.15 #50129

... (truncated)

Commits

• 7d7b3ac Release v3.5.14
• 9dc5aa2 Polish
• f533a45 Do not follow symlinks when writing PID file
• f3b8eb0 Use SecureRandom in RandomValuePropertySource
• e22083a Enable hostname verification for SSL connections to Cassandra
• 5ceb1a2 Improve ApplicationTemp's temporary directory creation
• 4b0862c Use constant-time comparison for remote DevTools secret
• e4febe2 Apply verify-hostname consistently
• 2c2ffe5 Fix Windows test failure
• 0046a44 Protect against corrupt buildpack archives
• Additional commits viewable in compare view

Updates org.springframework.security:spring-security-bom from 6.5.9 to 6.5.11

Release notes

Sourced from org.springframework.security:spring-security-bom's releases.

6.5.11

🪲 Bug Fixes

• FormPostRedirectStrategy should not emit percent-encoded values into hidden form inputs #19136

🔨 Dependency Upgrades

• Bump antora from 3.2.0-alpha.11 to 3.2.0-alpha.12 in /docs #19185
• Bump ch.qos.logback:logback-classic from 1.5.32 to 1.5.34 #19299
• Bump com.fasterxml.jackson:jackson-bom from 2.18.6 to 2.18.7 #19129
• Bump com.fasterxml.jackson:jackson-bom from 2.18.7 to 2.18.8 #19297
• Bump gradle-wrapper from 8.14.4 to 8.14.5 #19159
• Bump org-bouncycastle from 1.80 to 1.80.2 #19204
• Bump org.apache.maven:maven-resolver-provider from 3.9.15 to 3.9.16 #19205
• Bump org.hibernate.orm:hibernate-core from 6.6.49.Final to 6.6.50.Final #19150
• Bump org.hibernate.orm:hibernate-core from 6.6.50.Final to 6.6.51.Final #19213
• Bump org.hibernate.orm:hibernate-core from 6.6.51.Final to 6.6.53.Final #19300
• Bump org.slf4j:slf4j-api from 2.0.17 to 2.0.18 #19173
• Bump org.springframework:spring-framework-bom from 6.2.18 to 6.2.19 #19293
• Bump spring-io/spring-gradle-build-action from 2.0.5 to 2.0.6 #19124
• Bump spring-io/spring-release-actions from 0.0.4 to 0.0.5 #19183
• Update micrometer-bom to 1.15.12 #19302
• Update to Micrometer 1.15.11 #19224
• Update to reactor-bom 2024.0.18 #19301

🔩 Build Updates

• Release 6.5.11 #19118

6.5.10

⭐ New Features

• Add CredentialRecordOwnerAuthorizationManager #19004
• Add XML Based shouldWriteHeadersEagerly tests #19017
• Clarify Session Management Persistence Documentation #18345
• Update FilterChainProxy#getFilters(String) javadoc #18258

🪲 Bug Fixes

• Add equals and hashcode to HttpMethodRequestMatcher #18914
• auth_time validation fails when SSO session is renewed #18839
• Fallback defaultTargetUrl if refererHeader is empty #18806
• Fix HttpSessionRequestCache#getMatchingRequest query string parsing #16914
• Fix documentation for Custom Authorization Manager #18362
• Improve serialVersionUID check in tests #18474
• Merge Handle null value in OnCommittedResponseWrappe...

  Description has been truncated

[github-actions]

Validation Status

• ✓ No Merge Conflicts
• ✓ Branch is Up-to-date
• ℹ️ Dependabot Build Handled by dependabot-validation.yml

[github-actions]

Validation Status

• ✓ No Merge Conflicts
• ✓ Branch is Up-to-date
• ℹ️ Dependabot Build Handled by dependabot-validation.yml

[github-actions]

Validation Status

• ✅ Dependency Update Build Successful

[github-actions]

Validation Status

• ✓ No Merge Conflicts
• ✓ Branch is Up-to-date
• ℹ️ Dependabot Build Handled by dependabot-validation.yml

[github-actions]

Validation Status

• ✓ No Merge Conflicts
• ✓ Branch is Up-to-date
• ℹ️ Dependabot Build Handled by dependabot-validation.yml

[github-actions]

Validation Status

• ✅ Dependency Update Build Successful

[github-actions]

Validation Status

• ✓ No Merge Conflicts
• ✓ Branch is Up-to-date
• ℹ️ Dependabot Build Handled by dependabot-validation.yml

[github-actions]

Validation Status

• ✓ No Merge Conflicts
• ✓ Branch is Up-to-date
• ℹ️ Dependabot Build Handled by dependabot-validation.yml

[github-actions]

Validation Status

• ✅ Dependency Update Build Successful

[github-actions]

Validation Status

• ✓ No Merge Conflicts
• ✓ Branch is Up-to-date
• ℹ️ Dependabot Build Handled by dependabot-validation.yml

[github-actions]

Validation Status

• ✓ No Merge Conflicts
• ✓ Branch is Up-to-date
• ℹ️ Dependabot Build Handled by dependabot-validation.yml

[github-actions]

Validation Status

• ✅ Dependency Update Build Successful

[github-actions]

Validation Status

• ✓ No Merge Conflicts
• ✓ Branch is Up-to-date
• ℹ️ Dependabot Build Handled by dependabot-validation.yml

[github-actions]

Validation Status

• ✓ No Merge Conflicts
• ✓ Branch is Up-to-date
• ℹ️ Dependabot Build Handled by dependabot-validation.yml

[github-actions]

Validation Status

• ✅ Dependency Update Build Successful

[github-actions]

Validation Status

• ✓ No Merge Conflicts
• ✓ Branch is Up-to-date
• ℹ️ Dependabot Build Handled by dependabot-validation.yml

[github-actions]

Validation Status

• ✓ No Merge Conflicts
• ✓ Branch is Up-to-date
• ℹ️ Dependabot Build Handled by dependabot-validation.yml

[github-actions]

Validation Status

• ✅ Dependency Update Build Successful

[github-actions]

Validation Status

• ✓ No Merge Conflicts
• ✓ Branch is Up-to-date
• ℹ️ Dependabot Build Handled by dependabot-validation.yml

[github-actions]

Validation Status

• ✓ No Merge Conflicts
• ✓ Branch is Up-to-date
• ℹ️ Dependabot Build Handled by dependabot-validation.yml

[github-actions]

Validation Status

• ✅ Dependency Update Build Successful

[github-actions]

Validation Status

• ✓ No Merge Conflicts
• ✓ Branch is Up-to-date
• ℹ️ Dependabot Build Handled by dependabot-validation.yml

[github-actions]

Validation Status

• ✓ No Merge Conflicts
• ✓ Branch is Up-to-date
• ℹ️ Dependabot Build Handled by dependabot-validation.yml

[github-actions]

Validation Status

• ✅ Dependency Update Build Successful

[github-actions]

Validation Status

• ✓ No Merge Conflicts
• ✓ Branch is Up-to-date
• ℹ️ Dependabot Build Handled by dependabot-validation.yml

[github-actions]

Validation Status

• ✓ No Merge Conflicts
• ✓ Branch is Up-to-date
• ℹ️ Dependabot Build Handled by dependabot-validation.yml

[github-actions]

Validation Status

• ✅ Dependency Update Build Successful

[github-actions]

Validation Status

• ✓ No Merge Conflicts
• ✓ Branch is Up-to-date
• ℹ️ Dependabot Build Handled by dependabot-validation.yml

[github-actions]

Validation Status

• ✓ No Merge Conflicts
• ✓ Branch is Up-to-date
• ℹ️ Dependabot Build Handled by dependabot-validation.yml

[github-actions]

Validation Status

• ✅ Dependency Update Build Successful

[github-actions]

Validation Status

• ✅ Dependency Update Build Successful

[github-actions]

Validation Status

• ✓ No Merge Conflicts
• ✓ Branch is Up-to-date
• ℹ️ Dependabot Build Handled by dependabot-validation.yml

[github-actions]

Validation Status

• ✓ No Merge Conflicts
• ✓ Branch is Up-to-date
• ℹ️ Dependabot Build Handled by dependabot-validation.yml