[dependabot]

Bumps org.springframework.security:spring-security-crypto from 5.3.3.RELEASE to 7.1.2.

Release notes

Sourced from org.springframework.security:spring-security-crypto's releases.

7.1.2

🪲 Bug Fixes

• Avoid spring-core in password encoder validation
• Downgrade to Jackson 3.1
• Empty or null scope claim in dynamic client registration request should be lenient
• Ensure WebSession ID is not changed after token refresh (Reactive)
• Fix to allow null servlet request/response in ServletOAuth2AuthorizedClientExchangeFilterFunction
• Header Writers should not corrupt Jetty HttpFields state in reactive ResponseBodyEmitter handlers
• NPE with authenticationValidator in OAuth2AuthorizationCodeRequestValidatingFilter
• TokenType reference comparison is used in BearerTokenAuthentication

🔨 Dependency Upgrades

• Bump @antora/atlas-extension from 1.0.0-alpha.5 to 1.0.0-alpha.6 in /docs
• Bump actions/setup-java from 6.0.0 to 6.0.1
• Bump antora from 3.2.0 to 3.2.1 in /docs
• Bump antora from 3.2.0-rc.3 to 3.2.0 in /docs
• Bump com.webauthn4j:webauthn4j-core from 0.31.9.RELEASE to 0.31.10.RELEASE
• Bump gradle-wrapper from 9.7.0 to 9.7.1
• Bump io-spring-javaformat from 0.0.47 to 0.0.48
• Bump io.spring.develocity.conventions from 0.0.25 to 0.0.26
• Bump io.spring.gradle:spring-security-release-plugin from 1.0.15 to 1.0.16
• Bump io.spring.gradle:spring-security-release-plugin from 1.0.16 to 1.0.17
• Bump io.spring.gradle:spring-security-release-plugin from 1.0.17 to 1.0.19
• Bump io.spring.nullability:io.spring.nullability.gradle.plugin from 0.0.14 to 0.0.15
• Bump io.spring.nullability:io.spring.nullability.gradle.plugin from 0.0.15 to 0.0.16
• Bump org-jetbrains-kotlin from 2.4.10 to 2.4.20
• Bump org.hibernate.orm:hibernate-core from 7.4.5.Final to 7.4.6.Final
• Bump org.hibernate.orm:hibernate-core from 7.4.6.Final to 7.4.7.Final
• Bump org.hibernate.orm:hibernate-core from 7.4.7.Final to 7.4.10.Final
• Bump org.slf4j:slf4j-api from 2.0.18 to 2.0.19
• Bump spring-io/spring-release-actions/compute-next-version from 0.0.5 to 0.0.6
• Bump spring-io/spring-release-actions/compute-next-version from 0.0.6 to 0.0.7
• Bump spring-io/spring-release-actions/get-todays-release-version from 0.0.5 to 0.0.6
• Bump spring-io/spring-security-release-tools/.github/actions/send-notification from 1.0.17 to 1.0.18
• Bump spring-io/spring-security-release-tools/.github/workflows/build.yml from 1.0.17 to 1.0.18
• Bump spring-io/spring-security-release-tools/.github/workflows/deploy-artifacts.yml from 1.0.15 to 1.0.17
• Bump spring-io/spring-security-release-tools/.github/workflows/deploy-schema.yml from 1.0.15 to 1.0.17
• Bump spring-io/spring-security-release-tools/.github/workflows/release-announcements-publish.yml from 1.0.17 to 1.0.18
• Bump spring-io/spring-security-release-tools/.github/workflows/release-announcements-stage.yml from 1.0.16 to 1.0.17
• Bump tools.jackson:jackson-bom from 3.1.6 to 3.1.7

🔩 Build Updates

• Configure for Reproducible Builds
• Manually Set RequestedSessionId in Tests

❤️ Contributors

... (truncated)

Changelog

Sourced from org.springframework.security:spring-security-crypto's changelog.

= Release Process

The release process for Spring Security is entirely automated via the https://github.com/spring-io/spring-security-release-tools/blob/main/release-plugin/README.adoc[Spring Security Release Plugin] and https://github.com/spring-io/spring-security-release-tools/tree/main/.github/workflows[reusable workflows]. The following table outlines the steps that are taken by the automation.

WARNING: The 5.8.x branch does not have all of the improvements from the 6.x.x branches. See "Status (5.8.x)" for which steps are still manual.

In case of a failure, you can follow the links below to read about each step, which includes instructions for performing the step manually if applicable. See <<frequently-asked-questions,FAQ>> for troubleshooting tips.

[cols="1,1,1"] |=== | Step | Status (5.8.x) | Status (6.0.x+)

| <> | ✅ automated | ✅ automated

| <> | ✅ automated | ✅ automated

| <> | ✅ automated | ✅ automated

| <> | ✅ automated | ✅ automated

| <> | ✅ automated | ✅ automated

| <> | ✅ automated | ✅ automated

| <> | ✅ automated | ✅ automated

| <> | ❌ manual | ✅ automated

| <<close-create-milestone,Close milestone>> | ❌ manual | ✅ automated

... (truncated)

Commits

• e178580 Release 7.1.2
• b3ac1db Update to Micrometer 1.17.2
• adcdc57 Update to Spring LDAP 4.1.2
• 8c40cbe Update to Reactor 2025.0.8
• 4b09446 Update to Spring Data 2026.0.2
• a8597b4 Update to Spring Framework 7.0.10
• a8d08d8 Update to Framework 7.0.10-SNAPSHOT
• a218e4c Configure Build for Internal CI
• dccc819 Configure Workflows for Internal CI
• c17fedc Remove OSS CI configuration
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[jbonofre]

This needs updates feature definition.