chore(deps): update all dependencies (major)

[renovate]

This PR contains the following updates:

Package	Type	Update	Change	Age	Adoption	Passing	Confidence
actions/cache	action	major	v3 -> v4
actions/checkout	action	major	v3 -> v4
actions/setup-java	action	major	v3 -> v4
org.yaml:snakeyaml	test	major	1.33 -> 2.3
org.springframework.security:spring-security-web (source)	compile	major	5.4.10 -> 6.4.1
org.springframework.security:spring-security-core (source)	compile	major	5.5.7 -> 6.4.1
org.springframework.security:spring-security-config (source)	compile	major	5.4.10 -> 6.4.1
org.springframework.boot:spring-boot-test-autoconfigure (source)	test	major	2.3.12.RELEASE -> 3.4.0
org.springframework.boot:spring-boot-test (source)	test	major	2.3.12.RELEASE -> 3.4.0
org.springframework.boot:spring-boot (source)	compile	major	2.3.12.RELEASE -> 3.4.0
org.springframework.boot:spring-boot-actuator (source)	compile	major	2.3.12.RELEASE -> 3.4.0
org.springframework:spring-webmvc	test	major	5.2.22.RELEASE -> 6.2.0
org.springframework:spring-test	test	major	5.2.22.RELEASE -> 6.2.0
org.springframework:spring-web	compile	major	5.2.22.RELEASE -> 6.2.0
org.springframework:spring-context	compile	major	5.2.22.RELEASE -> 6.2.0
org.springframework:spring-test	compile	major	5.2.22.RELEASE -> 6.2.0
org.springframework:spring-beans	compile	major	5.2.22.RELEASE -> 6.2.0
org.springframework.boot:spring-boot-configuration-processor (source)	optional	major	2.3.12.RELEASE -> 3.4.0
org.slf4j:slf4j-api (source, changelog)	compile	major	1.7.36 -> 2.0.16
org.slf4j:slf4j-simple (source, changelog)	test	major	1.7.36 -> 2.0.16
org.springframework:spring-webmvc	compile	major	5.2.22.RELEASE -> 6.2.0
org.yaml:snakeyaml	compile	major	1.33 -> 2.3
org.springframework:spring-aop	compile	major	5.2.22.RELEASE -> 6.2.0
org.springframework.data:spring-data-commons (source)	compile	major	2.7.2 -> 3.4.0
com.maxmind.geoip2:geoip2 (source)	compile	major	2.14.0 -> 4.2.1
net.sf.saxon:Saxon-HE (source)	compile	major	10.8 -> 12.5
com.google.guava:guava	compile	major	32.1.1-jre -> 33.3.1-jre
com.ibm.icu:icu4j (source)	compile	major	72.1 -> 76.1

---

Release Notes

actions/cache (actions/cache)

v4

Compare Source

actions/checkout (actions/checkout)

v4

Compare Source

• Check out other refs/* by commit if provided, fall back to ref by @​orhantoy in https://github.com/actions/checkout/pull/1924

actions/setup-java (actions/setup-java)

v4

Compare Source

spring-projects/spring-security (org.springframework.security:spring-security-web)

v6.4.1

Compare Source

🪲 Bug Fixes

• Documentation images should render clearly in both light and dark mode #​16132
• Fix conflicting bean names between @EnableWebSecurity and @EnableWebSocketSecurity #​16113

🔩 Build Updates

• Update Antora UI Spring to v0.4.18 #​16112

❤️ Contributors

Thank you to all the contributors who worked on this release:

@​github-actions[bot] and @​ngocnhan-tran1996

v6.4.0

Compare Source

⭐ New Features

• Add @FunctionalInterface to AuthorizationEventPublisher #​15934
• Add DefaultResourcesFilter.webauthn() #​15970
• Add deprecation notice for missing leading slashes #​16020
• Code Cleanup #​15996
• Document passkeys dependencies #​16107
• Factor out some common object mocking in tests #​15396
• Fix saml2 authentication guide docs #​16017
• Improve documentation about CredentialsContainer #​15554
• Improve Documentation on Adding a Custom Security Filter #​15893
• Improve Error Message for Conflicting Filter Chains #​15992
• Make it easier to determine where a filter chain has been defined #​15874
• OIDC logout not working for JPA/JDBC OAuth2AuthorizationService because DefaultSaml2AuthenticatedPrincipal does not implement equality #​15346
• Polish JdbcOneTimeTokenService #​15997
• relying-party-registration doesn't allow placeholders in xml #​14645
• Support ServerExchangeRejectedHandler @Bean #​16063

🪲 Bug Fixes

• An empty-string bearer token should result in an appropriate HTTP status code #​16037
• AuthorizeReturnObject AOT support should register proxied class as well #​16106
• Correct class name reference in WebFilterChainProxy JavaDoc #​16004
• Fix typo javadoc some classes #​16022
• Initialize OpenSAML in OpenSamlAssertingPartyMetadataRepository #​16055
• IpAddressMatcher null pointer exception #​16104
• OpenSamlAssertingPartyMetadataRepository should initialize OpenSAML #​16042
• Support ServerWebExchangeFirewall @Bean #​15999
• UniqueSecurityAnnotationScanner throws ConcurrentModificationException #​15906

🔨 Dependency Upgrades

• Bump ch.qos.logback:logback-classic from 1.5.11 to 1.5.12 #​16005
• Bump com.fasterxml.jackson:jackson-bom from 2.18.0 to 2.18.1 #​16007
• Bump com.webauthn4j:webauthn4j-core from 0.28.1.RELEASE to 0.28.2.RELEASE #​16122
• Bump io.freefair.gradle:aspectj-plugin from 8.10.2 to 8.11 #​16123
• Bump io.micrometer:micrometer-observation from 1.14.0 to 1.14.1 #​16121
• Bump io.projectreactor:reactor-bom from 2023.0.11 to 2023.0.12 #​16079
• Bump org-bouncycastle from 1.78.1 to 1.79 #​16010
• Bump org.hibernate.orm:hibernate-core from 6.6.1.Final to 6.6.2.Final #​16048
• Bump org.hsqldb:hsqldb from 2.7.3 to 2.7.4 #​16028
• Bump org.htmlunit:htmlunit from 4.5.0 to 4.6.0 #​16044
• Bump org.junit:junit-bom from 5.11.2 to 5.11.3 #​15968
• Bump org.seleniumhq.selenium:htmlunit3-driver from 4.25.0 to 4.26.0 #​16043
• Bump org.seleniumhq.selenium:selenium-java from 4.25.0 to 4.26.0 #​16018
• Bump org.springframework.data:spring-data-bom from 2024.0.5 to 2024.1.0 #​16124
• Bump org.springframework.ldap:spring-ldap-core from 3.2.7 to 3.2.8 #​16097
• Bump org.springframework:spring-framework-bom from 6.2.0-RC3 to 6.2.0 #​16096

🔩 Build Updates

• Bump @antora/collector-extension from 1.0.0-beta.4 to 1.0.0-beta.5 in /docs #​16115
• fix assertions #​15937
• Remove unnecessary parentheses and add static final field MockPortResolver#getServerPort #​15875
• Update Antora UI Spring to v0.4.17 #​15929

❤️ Contributors

Thank you to all the contributors who worked on this release:

@​Chu3laMan, @​Kehrlann, @​Limm-jk, @​dcolazin, @​dependabot[bot], @​franticticktick, @​github-actions[bot], @​gzhao9, @​ig-jinwoo, @​jzheaux, @​kse-music, @​ngocnhan-tran1996, and @​nomoreFt

v6.3.5

Compare Source

⭐ New Features

• Support ServerExchangeRejectedHandler @Bean #​16062
• Supporting logout+jwt for back-channel logout with spring-webflux #​15702

🪲 Bug Fixes

• Align DelegatingAuthenticationConverter Constructors #​15949
• An empty-string bearer token should result in an appropriate HTTP status code #​16036
• IpAddressMatcher null pointer exception #​15527
• RequestMatcherDelegatingAuthorizationManager should be post-processable #​15981
• Support ServerWebExchangeFirewall @Bean #​15991
• Unhandled exception in CookieRequestCache results in 500 Internal Server Error #​15986
• Update logout.adoc: Fix Customizing Logout Success Example #​15956

🔨 Dependency Upgrades

• Bump ch.qos.logback:logback-classic from 1.5.11 to 1.5.12 #​16006
• Bump com.fasterxml.jackson:jackson-bom from 2.17.2 to 2.17.3 #​16032
• Bump io.micrometer:micrometer-observation from 1.12.12 to 1.12.13 #​16126
• Bump io.projectreactor:reactor-bom from 2023.0.11 to 2023.0.12 #​16082
• Bump org.hsqldb:hsqldb from 2.7.3 to 2.7.4 #​16033
• Bump org.springframework.data:spring-data-bom from 2024.0.5 to 2024.0.6 #​16125
• Bump org.springframework.ldap:spring-ldap-core from 3.2.7 to 3.2.8 #​16102
• Bump org.springframework:spring-framework-bom from 6.1.14 to 6.1.15 #​16101

🔩 Build Updates

• Bump @antora/collector-extension from 1.0.0-beta.4 to 1.0.0-beta.5 in /docs #​16117
• Update Antora UI Spring to v0.4.17 #​15930

❤️ Contributors

Thank you to all the contributors who worked on this release:

@​asimuleo, @​dependabot[bot], @​github-actions[bot], and @​kse-music

v6.3.4

Compare Source

🪲 Bug Fixes

• Annotation expression template processing should not fail on Class parameter types #​15711
• Disabling credentials erasure on custom AuthenticationManager is not working #​15808
• Documentation inconsistency in AuthorizationManager's verify method return type #​15822
• Methods annotated with @PostFilter are processed twice by PostFilterAuthorizationMethodInterceptor #​15676
• OidcBackChannelLogoutTokenValidator should not construct when missing OIDC Provider Issuer #​15868
• SecurityJackson2Modules.getModules(): Cannot load module org.springframework.security.cas.jackson2.CasJackson2Module #​15767
• The additionalParameters array parameter of OAuth2AuthorizationRequest causes the authorizationRequestUri to be incorrect #​15829

🔨 Dependency Upgrades

• Bump ch.qos.logback:logback-classic from 1.5.10 to 1.5.11 #​15926
• Bump io.micrometer:micrometer-observation from 1.12.10 to 1.12.11 #​15917
• Bump io.mockk:mockk from 1.13.12 to 1.13.13 #​15897
• Bump io.projectreactor:reactor-bom from 2023.0.10 to 2023.0.11 #​15925
• Bump jakarta.servlet.jsp.jstl:jakarta.servlet.jsp.jstl-api from 3.0.1 to 3.0.2 #​15694
• Bump org-eclipse-jetty from 11.0.23 to 11.0.24 #​15731
• Bump org.jfrog.buildinfo:build-info-extractor-gradle from 4.33.21 to 4.33.22 #​15761
• Bump org.junit:junit-bom from 5.10.4 to 5.10.5 #​15883
• Bump org.springframework.data:spring-data-bom from 2024.0.4 to 2024.0.5 #​15958
• Bump org.springframework.ldap:spring-ldap-core from 3.2.6 to 3.2.7 #​15944
• Bump org.springframework:spring-framework-bom from 6.1.13 to 6.1.14 #​15945

🔩 Build Updates

• Bump @antora/collector-extension from 1.0.0-beta.2 to 1.0.0-beta.3 in /docs #​15907
• Bump @springio/asciidoctor-extensions from 1.0.0-alpha.13 to 1.0.0-alpha.14 in /docs #​15836
• Migrate slack notifications to GChat #​15668
• Release 6.3.4 #​15964
• Update eclipse/vscode configuration to use -parameters #​15681

❤️ Contributors

Thank you to all the contributors who worked on this release:

@​dependabot[bot] and @​kse-music

v6.3.3

Compare Source

🪲 Bug Fixes

• ObservationRegistry is never post-processed #​15658

🔨 Dependency Upgrades

• Bump org-eclipse-jetty from 11.0.22 to 11.0.23 #​15664

❤️ Contributors

Thank you to all the contributors who worked on this release:

@​dependabot[bot]

v6.3.2

Compare Source

⭐ New Features

• ActiveDirectoryLdapAuthenticationProvider does not implement support for multiple urls #​15495
• Document the role of CredentialsContainer #​15321
• OIDC Backchannel Logout should allow logout tokens having typ header of logout+jwt #​15410

🪲 Bug Fixes

• A broken link in Spring Security reference #​15297
• Documentation for ServletBearerExchangeFilterFunction incomplete or incorrect #​15460
• EnableMethodSecurity should publish only one bean of each AuthorizationAdvisor #​15592
• Fix Compromised Password Checker Docs Sample Not Working #​15305
• Fix for #​15172 introduces significant performance degredation #​15324
• Pre/PostAuthorize should not ignore HandleAuthorizationDenied#handlerClass when ApplicationContext is not provided #​15535
• Update prerequisites documentation with Java 17 #​15340
• Use Correct Meta-Annotation in Kotlin Sample #​15472
• Using sec:authorize in JSPX causes 'java.lang.NullPointerException: Cannot invoke "jakarta.servlet.ServletRegistration.getClassName()" because "registration" is null' #​15440

🔨 Dependency Upgrades

• Bump ch.qos.logback:logback-classic from 1.5.6 to 1.5.7 #​15619
• Bump com.fasterxml.jackson:jackson-bom from 2.17.1 to 2.17.2 #​15374
• Bump com.github.spullara.mustache.java:compiler from 0.9.13 to 0.9.14 #​15373
• Bump io.micrometer:micrometer-observation from 1.12.7 to 1.12.8 #​15383
• Bump io.micrometer:micrometer-observation from 1.12.8 to 1.12.9 #​15581
• Bump io.mockk:mockk from 1.13.11 to 1.13.12 #​15430
• Bump io.projectreactor:reactor-bom from 2023.0.7 to 2023.0.8 #​15388
• Bump io.projectreactor:reactor-bom from 2023.0.8 to 2023.0.9 #​15597
• Bump jakarta.servlet.jsp.jstl:jakarta.servlet.jsp.jstl-api from 3.0.0 to 3.0.1 #​15582
• Bump org-apache-maven-resolver from 1.9.20 to 1.9.21 #​15372
• Bump org-apache-maven-resolver from 1.9.21 to 1.9.22 #​15545
• Bump org-eclipse-jetty from 11.0.21 to 11.0.22 #​15356
• Bump org.apache.maven:maven-resolver-provider from 3.9.7 to 3.9.8 #​15268
• Bump org.apache.maven:maven-resolver-provider from 3.9.8 to 3.9.9 #​15642
• Bump org.gretty:gretty from 4.1.4 to 4.1.5 #​15431
• Bump org.hibernate.orm:hibernate-core from 6.4.9.Final to 6.4.10.Final #​15530
• Bump org.jetbrains.kotlin:kotlin-bom from 1.9.24 to 1.9.25 #​15456
• Bump org.jetbrains.kotlin:kotlin-gradle-plugin from 1.9.24 to 1.9.25 #​15455
• Bump org.jfrog.buildinfo:build-info-extractor-gradle from 4.33.19 to 4.33.20 #​15267
• Bump org.junit:junit-bom from 5.10.2 to 5.10.3 #​15315
• Bump org.skyscreamer:jsonassert from 1.5.1 to 1.5.3 #​15336
• Bump org.slf4j:slf4j-api from 2.0.13 to 2.0.14 #​15529
• Bump org.slf4j:slf4j-api from 2.0.14 to 2.0.15 #​15546
• Bump org.slf4j:slf4j-api from 2.0.15 to 2.0.16 #​15571
• Bump org.springframework.data:spring-data-bom from 2024.0.1 to 2024.0.2 #​15421
• Bump org.springframework.data:spring-data-bom from 2024.0.2 to 2024.0.3 #​15643
• Bump org.springframework.ldap:spring-ldap-core from 3.2.4 to 3.2.6 #​15620
• Bump org.springframework:spring-framework-bom from 6.1.10 to 6.1.11 #​15402
• Bump org.springframework:spring-framework-bom from 6.1.11 to 6.1.12 #​15613
• Bump org.springframework:spring-framework-bom from 6.1.9 to 6.1.10 #​15279

🔩 Build Updates

• Automate check of expected branch version #​15310
• Bump @antora/collector-extension from 1.0.0-alpha.4 to 1.0.0-alpha.6 in /docs #​15449
• Bump @antora/collector-extension from 1.0.0-alpha.6 to 1.0.0-alpha.7 in /docs #​15482
• Bump @antora/collector-extension from 1.0.0-alpha.7 to 1.0.0-beta.1 in /docs #​15560
• Bump @antora/collector-extension from 1.0.0-beta.1 to 1.0.0-beta.2 in /docs #​15637
• Bump @springio/antora-extensions from 1.11.1 to 1.12.0 in /docs #​15418
• Bump @springio/antora-extensions from 1.12.0 to 1.13.0 in /docs #​15517
• Bump @springio/antora-extensions from 1.13.0 to 1.13.1 in /docs #​15561
• Bump @springio/antora-extensions from 1.13.1 to 1.14.2 in /docs #​15636
• Bump @springio/asciidoctor-extensions from 1.0.0-alpha.10 to 1.0.0-alpha.11 in /docs #​15419
• Bump @springio/asciidoctor-extensions from 1.0.0-alpha.11 to 1.0.0-alpha.12 in /docs #​15515
• Bump antora from 3.2.0-alpha.4 to 3.2.0-alpha.5 in /docs #​15329
• Bump antora from 3.2.0-alpha.5 to 3.2.0-alpha.6 in /docs #​15480
• Bump com.gradle.develocity from 3.17.5 to 3.17.6 #​15464
• Bump io-spring-javaformat from 0.0.42 to 0.0.43 #​15650
• Fix typos and formatting in documentation #​15380
• Migrate slack notifications to GChat #​15505
• Use explicit types instead of var #​15537

❤️ Contributors

Thank you to all the contributors who worked on this release:

@​Kehrlann, @​dependabot[bot], and @​tahakorkem

v6.3.1

Compare Source

⭐ New Features

• Clarify the behavior of Concurrent Session Management when an IdP is involved #​15071
• Mention all required dependencies in LDAP documentation #​15245
• Minor docs fix #​15144

🪲 Bug Fixes

• AbstractRequestMatcherRegistry#requestMatchers should pick MvcRequestMatcher when using MockMvc #​15211
• Assert WebSession is not null #​15179
• DispatcherServletDelegatingRequestMatcher causes errors when running tests with MockMvc #​15197
• Documentation clarification after #​12783 has been closed is needed. #​15208
• Fix Java example in multitenanci.adoc #​15151
• Fix Kotlin example in authorize-http-requests.adoc #​15129
• Incorrect documentation for OIDC Back-Channel Logout #​15212
• IpAddressMatcher.matches(String address) still accepts URLs #​15172
• LDIF file on official documentation breaks the startup process #​15167
• Link to article with remember-me-persistent-token strategy is broken #​15149
• OpenSaml4AssertionValidator is not respecting clock skew settings #​15183
• Resolving invalid CSRF token values is not consistent #​15186
• spring-security/docs/modules/ROOT/pages/servlet/authorization /method-security #​15143
• SpringOpaqueTokenIntrospector does not add scopes as granted authorities properly #​15165

🔨 Dependency Upgrades

• Bump io.micrometer:micrometer-observation from 1.12.6 to 1.12.7 #​15225
• Bump io.projectreactor:reactor-bom from 2023.0.6 to 2023.0.7 #​15229
• Bump org.apache.directory.shared:shared-ldap from 0.9.15 to 0.9.19 #​15161
• Bump org.apache.maven:maven-resolver-provider from 3.9.6 to 3.9.7 #​15168
• Bump org.gretty:gretty from 4.1.3 to 4.1.4 #​15133
• Bump org.hibernate.orm:hibernate-core from 6.4.8.Final to 6.4.9.Final #​15228
• Bump org.hsqldb:hsqldb from 2.7.2 to 2.7.3 #​15193
• Bump org.springframework.data:spring-data-bom from 2024.0.0 to 2024.0.1 #​15260
• Bump org.springframework.ldap:spring-ldap-core from 3.2.3 to 3.2.4 #​15251
• Bump org.springframework:spring-framework-bom from 6.1.7 to 6.1.8 #​15134
• Bump org.springframework:spring-framework-bom from 6.1.8 to 6.1.9 #​15252

🔩 Build Updates

• Bump @antora/collector-extension from 1.0.0-alpha.3 to 1.0.0-alpha.4 in /docs #​15159
• Bump @springio/antora-extensions from 1.10.0 to 1.11.1 in /docs #​15141
• Bump com.gradle.develocity from 3.17.4 to 3.17.5 #​15239
• Bump gradle/gradle-build-action from 2 to 3 #​15157
• Bump io-spring-javaformat from 0.0.41 to 0.0.42 #​15219
• Bump org.jfrog.buildinfo:build-info-extractor-gradle from 4.33.15 to 4.33.16 #​15176
• Bump org.jfrog.buildinfo:build-info-extractor-gradle from 4.33.16 to 4.33.17 #​15218
• Bump org.jfrog.buildinfo:build-info-extractor-gradle from 4.33.17 to 4.33.19 #​15261
• Bump spring-io/spring-doc-actions from 17ed79e to 5a57bcc #​15139

❤️ Contributors

Thank you to all the

---

Configuration

📅 Schedule: Branch creation - "every weekend" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.