• Improve WebAuthn Registration Page no-script Handling
• Support nonce-based Content Security Policy

• Set Content-Type to application/x-www-form-urlencoded in OpaqueTokenIntrospector

• Bump @antora/atlas-extension from 1.0.0-alpha.5 to 1.0.0-alpha.6 in /docs
• Bump actions/upload-artifact from 7.0.1 to 7.0.2
• Bump antora from 3.2.0 to 3.2.1 in /docs
• Bump ch.qos.logback:logback-classic from 1.6.3 to 1.6.4
• Bump ch.qos.logback:logback-classic from 1.6.4 to 1.6.5
• Bump com.fasterxml.jackson:jackson-bom from 2.22.2 to 2.22.3
• Bump com.webauthn4j:webauthn4j-core from 0.31.10.RELEASE to 0.31.11.RELEASE
• Bump gradle-wrapper from 9.7.1 to 9.8.0
• Bump gradle-wrapper from 9.8.0 to 9.8.1
• Bump io.spring.develocity.conventions from 0.0.26 to 0.0.27
• Bump io.spring.gradle:spring-security-project-plugin from 1.0.19 to 1.0.20
• Bump io.spring.gradle:spring-security-release-plugin from 1.0.19 to 1.0.20
• Bump org-jetbrains-kotlin from 2.4.20 to 2.4.21
• Bump org.apache.httpcomponents.client5:httpclient5 from 5.6.4 to 5.6.5
• Bump org.hibernate.orm:hibernate-core from 7.4.10.Final to 7.4.11.Final
• Bump org.hibernate.orm:hibernate-core from 7.4.11.Final to 7.4.12.Final
• Bump org.hibernate.orm:hibernate-core from 7.4.12.Final to 7.4.13.Final
• Bump org.htmlunit:htmlunit from 5.5.0 to 5.6.0
• Bump org.mockito:mockito-bom from 5.23.0 to 5.24.0
• Bump org.seleniumhq.selenium:selenium-java from 4.48.0 to 4.50.0
• Bump org.seleniumhq.selenium:selenium-java from 4.48.0 to 4.51.0
• Bump org.slf4j:slf4j-api from 2.0.19 to 2.0.20
• Bump spring-io/spring-github-workflows/.github/workflows/spring-merge-dependabot-pr.yml from bf2c65c148fb74b6bd54417222662ef587463765 to 0c67c5e7c6641a18e76c520114ed0251303e77ed
• Bump spring-io/spring-github-workflows/.github/workflows/spring-merge-dependabot-pr.yml from fa7e8a8f981064983e9468225e052f14af7c67d4 to 0c09eb4023e17dd6ca395a0f4e406a4f7506a58d
• Bump spring-io/spring-github-workflows/.github/workflows/spring-merge-dependabot-pr.yml from fa7e8a8f981064983e9468225e052f14af7c67d4 to 798bca4d6aecf03e5166d85789c33c20a65499e1
• Bump spring-io/spring-github-workflows/.github/workflows/spring-merge-dependabot-pr.yml from fa7e8a8f981064983e9468225e052f14af7c67d4 to bf2c65c148fb74b6bd54417222662ef587463765
• Bump spring-io/spring-release-actions/compute-next-version from 0.0.6 to 0.0.7
• Bump spring-io/spring-release-actions/schedule-milestone from 0.0.6 to 0.0.7
• Bump spring-io/spring-security-release-tools/.github/actions/send-notification from 1.0.18 to 1.0.19
• Bump spring-io/spring-security-release-tools/.github/workflows/build.yml from 1.0.18 to 1.0.19
• Bump spring-io/spring-security-release-tools/.github/workflows/build.yml from 1.0.18 to 1.0.20
• Bump spring-io/spring-security-release-tools/.github/workflows/deploy-artifacts.yml from 1.0.18 to 1.0.19
• Bump spring-io/spring-security-release-tools/.github/workflows/deploy-artifacts.yml from 1.0.19 to 1.0.20
• Bump spring-io/spring-security-release-tools/.github/workflows/deploy-schema.yml from 1.0.18 to 1.0.19
• Bump spring-io/spring-security-release-tools/.github/workflows/deploy-schema.yml from 1.0.18 to 1.0.20
• Bump spring-io/spring-security-release-tools/.github/workflows/release-announcements-publish.yml from 1.0.18 to 1.0.20
• Bump spring-io/spring-security-release-tools/.github/workflows/test.yml from 1.0.18 to 1.0.20
• Bump tools.jackson:jackson-bom from 3.2.2 to 3.2.3

Thank you to all the contributors who worked on this release:

@ziqin

• Avoid spring-core in password encoder validation
• Downgrade to Jackson 3.1
• Empty or null scope claim in dynamic client registration request should be lenient
• Ensure WebSession ID is not changed after token refresh (Reactive)
• Fix to allow null servlet request/response in ServletOAuth2AuthorizedClientExchangeFilterFunction
• Header Writers should not corrupt Jetty HttpFields state in reactive ResponseBodyEmitter handlers
• NPE with authenticationValidator in OAuth2AuthorizationCodeRequestValidatingFilter
• TokenType reference comparison is used in BearerTokenAuthentication

• Bump @antora/atlas-extension from 1.0.0-alpha.5 to 1.0.0-alpha.6 in /docs
• Bump actions/setup-java from 6.0.0 to 6.0.1
• Bump antora from 3.2.0 to 3.2.1 in /docs
• Bump antora from 3.2.0-rc.3 to 3.2.0 in /docs
• Bump com.webauthn4j:webauthn4j-core from 0.31.9.RELEASE to 0.31.10.RELEASE
• Bump gradle-wrapper from 9.7.0 to 9.7.1
• Bump io-spring-javaformat from 0.0.47 to 0.0.48
• Bump io.spring.develocity.conventions from 0.0.25 to 0.0.26
• Bump io.spring.gradle:spring-security-release-plugin from 1.0.15 to 1.0.16
• Bump io.spring.gradle:spring-security-release-plugin from 1.0.16 to 1.0.17
• Bump io.spring.gradle:spring-security-release-plugin from 1.0.17 to 1.0.19
• Bump io.spring.nullability:io.spring.nullability.gradle.plugin from 0.0.14 to 0.0.15
• Bump io.spring.nullability:io.spring.nullability.gradle.plugin from 0.0.15 to 0.0.16
• Bump org-jetbrains-kotlin from 2.4.10 to 2.4.20
• Bump org.hibernate.orm:hibernate-core from 7.4.5.Final to 7.4.6.Final
• Bump org.hibernate.orm:hibernate-core from 7.4.6.Final to 7.4.7.Final
• Bump org.hibernate.orm:hibernate-core from 7.4.7.Final to 7.4.10.Final
• Bump org.slf4j:slf4j-api from 2.0.18 to 2.0.19
• Bump spring-io/spring-release-actions/compute-next-version from 0.0.5 to 0.0.6
• Bump spring-io/spring-release-actions/compute-next-version from 0.0.6 to 0.0.7
• Bump spring-io/spring-release-actions/get-todays-release-version from 0.0.5 to 0.0.6
• Bump spring-io/spring-security-release-tools/.github/actions/send-notification from 1.0.17 to 1.0.18
• Bump spring-io/spring-security-release-tools/.github/workflows/build.yml from 1.0.17 to 1.0.18
• Bump spring-io/spring-security-release-tools/.github/workflows/deploy-artifacts.yml from 1.0.15 to 1.0.17
• Bump spring-io/spring-security-release-tools/.github/workflows/deploy-schema.yml from 1.0.15 to 1.0.17
• Bump spring-io/spring-security-release-tools/.github/workflows/release-announcements-publish.yml from 1.0.17 to 1.0.18
• Bump spring-io/spring-security-release-tools/.github/workflows/release-announcements-stage.yml from 1.0.16 to 1.0.17
• Bump tools.jackson:jackson-bom from 3.1.6 to 3.1.7

• Configure for Reproducible Builds
• Manually Set RequestedSessionId in Tests

Thank you to all the contributors who worked on this release:

@evgeniycheban, @petergphillips, and @seonwooj0810

• Polish onetimetoken references

• AuthenticatorTransport#values should include SMART_CARD
• Empty or null scope claim in dynamic client registration request should be lenient
• Fix HeaderWriterFilter race condition during async requests
• Fix TokenType comparison logic
• Fix typos in Javadocs
• NPE with authenticationValidator in OAuth2AuthorizationCodeRequestValidatingFilter
• SecurityContextHolderThreadLocalAccessor should not share SecurityContext instance across threads

• Bump @antora/atlas-extension from 1.0.0-alpha.5 to 1.0.0-alpha.6 in /docs
• Bump antora from 3.2.0 to 3.2.1 in /docs
• Bump antora from 3.2.0-rc.2 to 3.2.0-rc.3 in /docs
• Bump antora from 3.2.0-rc.3 to 3.2.0 in /docs
• Bump gradle-wrapper from 8.14.5 to 8.14.6
• Bump io-spring-javaformat from 0.0.47 to 0.0.48
• Bump io.spring.develocity.conventions from 0.0.25 to 0.0.27
• Bump io.spring.gradle:spring-security-project-plugin from 1.0.19 to 1.0.20
• Bump io.spring.gradle:spring-security-release-plugin from 1.0.15 to 1.0.17
• Bump io.spring.gradle:spring-security-release-plugin from 1.0.17 to 1.0.20
• Bump org.slf4j:slf4j-api from 2.0.18 to 2.0.19
• Bump org.slf4j:slf4j-api from 2.0.19 to 2.0.20
• Bump spring-io/spring-release-actions/compute-next-version from 0.0.5 to 0.0.6
• Bump spring-io/spring-release-actions/get-todays-release-version from 0.0.5 to 0.0.6
• Bump spring-io/spring-security-release-tools/.github/actions/send-notification from 1.0.17 to 1.0.18
• Bump spring-io/spring-security-release-tools/.github/workflows/build.yml from 1.0.15 to 1.0.17
• Bump spring-io/spring-security-release-tools/.github/workflows/deploy-artifacts.yml from 1.0.17 to 1.0.18
• Bump spring-io/spring-security-release-tools/.github/workflows/deploy-schema.yml from 1.0.17 to 1.0.18
• Bump spring-io/spring-security-release-tools/.github/workflows/release-announcements-publish.yml from 1.0.17 to 1.0.18
• Bump spring-io/spring-security-release-tools/.github/workflows/test.yml from 1.0.17 to 1.0.18
• Bump spring-io/spring-security-release-tools/.github/workflows/test.yml from ed473b4dafba053c63a453d2d88a89df3b3e18b3 to 9ca0acea761aa79d71c78cc462048c49ed5c4230

• Configure for Reproducible Builds

Thank you to all the contributors who worked on this release:

@Kehrlann, @bdshadow, @ngocnhan-tran1996, @therepanic, and @ttddyy

• @EnableMethodSecurity should pick up PermissionEvaluator bean
• Allow configurable DPoP Proof verifier
• Expose OAuth2AuthorizationCodeRequestValidatingFilter
• Ignore Apple touch icon requests (apple-touch-icon*.png) in the default RequestCache
• Ignore browserconfig.xml requests in the default RequestCache
• Ignore Chrome DevTools' .well-known/appspecific/com.chrome.devtools.json probe in the default RequestCache
• Ignore web app manifest requests (manifest.json / manifest.webmanifest) in the default RequestCache
• KerberosRestClient should rethrow original RestClientException
• Make authenticationSuccessHandler Configurable in Resource Server DSL
• Modernize the default RequestCache background-request ignore list
• Modernize the default RequestCache background-request ignore list
• Simplify ProviderManager null provider check
• Test cache full rejection and replay detection
• Update cryptography.adoc to use include-code

• Downgrade to Jackson 3.1
• Header Writers should not corrupt Jetty HttpFields state in reactive ResponseBodyEmitter handlers
• NoClassDefFound with version 7.1.0
• TokenType reference comparison is used in BearerTokenAuthentication

• Bump actions/setup-java from 6.0.0 to 6.0.1
• Bump antora from 3.2.0-rc.2 to 3.2.0
• Bump antora from 3.2.0-rc.3 to 3.2.0 in /docs
• Bump gradle-wrapper from 9.7.0 to 9.7.1
• Bump io-spring-javaformat from 0.0.47 to 0.0.48
• Bump io.spring.develocity.conventions from 0.0.25 to 0.0.26
• Bump io.spring.gradle:spring-security-release-plugin from 1.0.18 to 1.0.19
• Bump org-bouncycastle from 1.85 to 1.86
• Bump org-jetbrains-kotlin from 2.4.10 to 2.4.20
• Bump org.hibernate.orm:hibernate-core from 7.4.5.Final to 7.4.7.Final
• Bump org.hibernate.orm:hibernate-core from 7.4.7.Final to 7.4.8.Final
• Bump org.hibernate.orm:hibernate-core from 7.4.8.Final to 7.4.9.Final
• Bump org.hibernate.orm:hibernate-core from 7.4.9.Final to 7.4.10.Final
• Bump org.seleniumhq.selenium:htmlunit3-driver from 4.43.0 to 4.47.0
• Bump org.seleniumhq.selenium:selenium-java from 4.43.0 to 4.47.0
• Bump org.seleniumhq.selenium:selenium-java from 4.43.0 to 4.48.0
• Bump org.seleniumhq.selenium:selenium-java from 4.48.0 to 4.49.0
• Bump spring-io/spring-release-actions/compute-version from 0.0.6 to 0.0.7
• Bump spring-io/spring-release-actions/get-todays-release-version from 0.0.6 to 0.0.7
• Bump tools.jackson:jackson-bom from 3.1.6 to 3.2.2
• Update to HtmlUnit 5
• Update to Micrometer 1.18.0-M2
• Update to Node 24
• Update to Reactor 2026.0.0-M2
• Update to Spring Data 2026.1.0-M2
• Update to Spring Framework 7.1.0-M2
• Update to Spring LDAP 4.2.0-M1
• Update to spring-security-release-tools v1.0.18

• Bump io-micrometer from 1.18.0-M1 to 1.18.0-SNAPSHOT
• Configure for Reproducible Builds
• Turn Off Auto-merge for Maintenance Branch

Thank you to all the contributors who worked on this release:

@Siggen, @anthonydahanne, @avsan, @iain-henderson, @morokosi, @rwinch, and @sunghyun1999

• Add Implicit CorsConfigurationSource/PreFlightRequestHandler Detection to <cors> XML Namespace #19542
• Add Release Announcement Workflows #19573
• Validate account status in OneTimeTokenAuthenticationProvider #17656
• Fix Broken DefaultLoginPageGeneratingFilter Javadoc Link #19252
• Remove BeanResolver Null Checks #19209
• Remove Unnecessary AuthorizationDecision Cast #19283
• Update One-Time Token Docs for Renamed APIs #19274

• Find mixed-case names in InMemoryUserDetailsManager#changePassword #19540
• Correct validation logic in CasAuthenticationToken #19372
• Differentiate Forwarded and X-Forwarded headers in proxy docs #19477
• Fix OAuth2PushedAuthorizationRequestUri parsing #19445
• Update JavaDoc Links in Reference #19199
• Validate Parameter in setPostAuthenticationChecks #19277

• Bump ch.qos.logback:logback-classic from 1.6.1 to 1.6.2 #19555
• Bump ch.qos.logback:logback-classic from 1.6.2 to 1.6.3 #19559
• Bump com.fasterxml.jackson:jackson-bom from 2.22.1 to 2.22.2 #19565
• Bump com.nimbusds:oauth2-oidc-sdk from 11.38.1 to 11.38.2 #19462
• Bump org.apache.httpcomponents.client5:httpclient5 from 5.6.3 to 5.6.4 #19537
• Bump org.seleniumhq.selenium:htmlunit3-driver from 4.43.0 to 4.46.0 #19451
• Bump org.seleniumhq.selenium:selenium-java from 4.43.0 to 4.46.0 #19440

FAILURE: Build failed with an exception.

• Bump tools.jackson:jackson-bom from 3.2.1 to 3.2.2 #19560

• Disable CORS Tests Relying on HandlerMappingIntrospector #19543
• Disable Lowercase HTTP Method Firewall Test #19541
• Prepare for Spring Security 7.2 #19527
• Suppress removal Warnings on RestOperations/RestTemplate Usage #19544

Thank you to all the contributors who worked on this release:

@therepanic

• Fix Broken DefaultLoginPageGeneratingFilter Javadoc Link #19252
• Remove BeanResolver Null Checks #19209
• Remove Unnecessary AuthorizationDecision Cast #19283
• Update One-Time Token Docs for Renamed APIs #19274

• Correct validation logic in CasAuthenticationToken #19372
• Differentiate Forwarded and X-Forwarded headers in proxy docs #19477
• Find mixed-case names in InMemoryUserDetailsManager#changePassword #19539
• Fix OAuth2PushedAuthorizationRequestUri parsing #19445
• Update JavaDoc Links in Reference #19199
• Validate Parameter in setPostAuthenticationChecks #19277

• Bump @springio/antora-extensions from 1.14.12 to 1.14.13 in /docs #19503
• Bump actions/checkout from 6.0.3 to 7.0.0 #19351
• Bump actions/checkout from 7.0.0 to 7.0.1 #19464
• Bump actions/setup-java from 5.2.0 to 5.3.0 #19352
• Bump actions/setup-java from 5.3.0 to 5.4.0 #19380
• Bump actions/setup-java from 5.4.0 to 5.5.0 #19430
• Bump actions/setup-java from 5.5.0 to 5.6.0 #19453
• Bump actions/setup-java from 5.6.0 to 5.7.0 #19501
• Bump antora from 3.2.0-alpha.12 to 3.2.0-rc.2 in /docs #19385
• Bump ch.qos.logback:logback-classic from 1.5.34 to 1.5.35 #19374
• Bump ch.qos.logback:logback-classic from 1.5.35 to 1.5.36 #19389
• Bump ch.qos.logback:logback-classic from 1.5.36 to 1.5.37 #19396
• Bump ch.qos.logback:logback-classic from 1.5.37 to 1.5.38 #19431
• Bump ch.qos.logback:logback-classic from 1.5.38 to 1.6.0 #19467
• Bump ch.qos.logback:logback-classic from 1.6.0 to 1.6.1 #19476
• Bump ch.qos.logback:logback-classic from 1.6.1 to 1.6.2 #19556
• Bump ch.qos.logback:logback-classic from 1.6.2 to 1.6.3 #19564
• Bump com.fasterxml.jackson:jackson-bom from 2.22.0 to 2.22.1 #19419
• Bump com.fasterxml.jackson:jackson-bom from 2.22.1 to 2.22.2 #19566
• Bump com.nimbusds:oauth2-oidc-sdk from 11.37.2 to 11.38.1 #19439
• Bump com.nimbusds:oauth2-oidc-sdk from 11.38.1 to 11.38.2 #19525
• Bump com.unboundid:unboundid-ldapsdk from 7.0.4 to 7.0.5 #19322
• Bump com.webauthn4j:webauthn4j-core from 0.31.6.RELEASE to 0.31.7.RELEASE #19313
• Bump com.webauthn4j:webauthn4j-core from 0.31.7.RELEASE to 0.31.8.RELEASE #19409
• Bump com.webauthn4j:webauthn4j-core from 0.31.8.RELEASE to 0.31.9.RELEASE #19496
• Bump gradle-wrapper from 9.5.1 to 9.6.0 #19360
• Bump gradle-wrapper from 9.6.0 to 9.6.1 #19393
• Bump gradle-wrapper from 9.6.1 to 9.7.0 #19516
• Bump io.spring.nullability:io.spring.nullability.gradle.plugin from 0.0.13 to 0.0.14 #19378
• Bump org-bouncycastle from 1.84 to 1.85 #19437
• Bump org-jetbrains-kotlin from 2.4.0 to 2.4.10 #19447
• Bump org-opensaml5 from 5.2.2 to 5.2.3 #19358
• Bump org.apache.httpcomponents.client5:httpclient5 from 5.6.1 to 5.6.2 #19401
• Bump org.apache.httpcomponents.client5:httpclient5 from 5.6.2 to 5.6.3 #19495
• Bump org.apache.httpcomponents.client5:httpclient5 from 5.6.3 to 5.6.4 #19538
• Bump org.apache.kerby:kerb-simplekdc from 2.1.1 to 2.1.2 #19387
• Bump org.hibernate.orm:hibernate-core from 7.4.0.Final to 7.4.1.Final #19312
• Bump org.hibernate.orm:hibernate-core from 7.4.1.Final to 7.4.2.Final #19364
• Bump org.hibernate.orm:hibernate-core from 7.4.2.Final to 7.4.3.Final #19402
• Bump org.hibernate.orm:hibernate-core from 7.4.3.Final to 7.4.4.Final #19416
• Bump org.hibernate.orm:hibernate-core from 7.4.4.Final to 7.4.5.Final #19443
• Bump org.junit:junit-bom from 6.1.0 to 6.1.1 #19395
• Bump org.junit:junit-bom from 6.1.1 to 6.1.2 #19442
• Bump org.junit:junit-bom from 6.1.2 to 6.1.3 #19524
• Bump org.junit:junit-bom from 6.1.2 to 6.1.3 #19519
• Bump org.seleniumhq.selenium:htmlunit3-driver from 4.43.0 to 4.45.0 #19365
• Bump org.seleniumhq.selenium:selenium-java from 4.43.0 to 4.45.0 #19344
• Bump tools.jackson:jackson-bom from 3.2.0 to 3.2.1 #19438
• Bump tools.jackson:jackson-bom from 3.2.1 to 3.2.2 #19562
• Release 7.1.1 #19310
• Upgrade to Micrometer 1.17.1 #19489
• Upgrade to Reactor 2025.0.7 #19488
• Upgrade to Spring Framework 7.0.9 #19487
• Upgrade to Spring LDAP 4.1.1 #19491

• Fix Broken DefaultLoginPageGeneratingFilter Javadoc Link #19252
• Remove BeanResolver Null Checks #19209
• Remove Unnecessary AuthorizationDecision Cast #19283
• Update One-Time Token Docs for Renamed APIs #19274

• Correct validation logic in CasAuthenticationToken #19372
• Differentiate Forwarded and X-Forwarded headers in proxy docs #19477
• Find mixed-case usernames in InMemoryUserDetailsManager#changePassword #19337
• Fix OAuth2PushedAuthorizationRequestUri parsing #19445
• Update JavaDoc Links in Reference #19199
• Validate Parameter in setPostAuthenticationChecks #19277

• Bump @springio/antora-extensions from 1.14.12 to 1.14.13 in /docs #19504
• Bump actions/checkout from 6.0.3 to 7.0.1 #19466
• Bump actions/setup-java from 5.2.0 to 5.7.0 #19505
• Bump antora from 3.2.0-alpha.12 to 3.2.0-rc.2 in /docs #19381
• Bump ch.qos.logback:logback-classic from 1.5.34 to 1.5.38 #19433
• Bump com.unboundid:unboundid-ldapsdk from 7.0.4 to 7.0.5 #19323
• Bump org.apache.kerby:kerb-simplekdc from 2.1.1 to 2.1.2 #19391

Thank you to all the contributors who worked on this release:

@ArzMeow, @big-cir, @junhyeong9812, @jyx-07, @ngocnhan-tran1996, @skdas20, @snowykte0426, and @therepanic

• Opaque token introspectors should not allow empty credentials #19201

• Bump @springio/antora-extensions from 1.14.11 to 1.14.12 in /docs #19235
• Bump actions/checkout from 6.0.2 to 6.0.3 #19271
• Bump antora from 3.2.0-alpha.11 to 3.2.0-alpha.12 in /docs #19181
• Bump ch.qos.logback:logback-classic from 1.5.32 to 1.5.33 #19228
• Bump ch.qos.logback:logback-classic from 1.5.33 to 1.5.34 #19268
• Bump com.fasterxml.jackson:jackson-bom from 2.21.2 to 2.21.3 #19133
• Bump com.fasterxml.jackson:jackson-bom from 2.21.3 to 2.22.0 #19246
• Bump com.google.code.gson:gson from 2.13.2 to 2.14.0 #19125
• Bump com.nimbusds:oauth2-oidc-sdk from 11.37 to 11.37.1 #19157
• Bump com.nimbusds:oauth2-oidc-sdk from 11.37 to 11.37.2 #19195
• Bump com.webauthn4j:webauthn4j-core from 0.31.3.RELEASE to 0.31.5.RELEASE #19148
• Bump com.webauthn4j:webauthn4j-core from 0.31.5.RELEASE to 0.31.6.RELEASE #19263
• Bump gradle-wrapper from 9.4.1 to 9.5.0 #19135
• Bump gradle-wrapper from 9.5.0 to 9.5.1 #19171
• Bump io-micrometer from 1.16.5 to 1.17.0 #19287
• Bump io.mockk:mockk from 1.14.9 to 1.14.11 #19244
• Bump io.projectreactor:reactor-bom from 2025.0.5 to 2025.0.6 #19296
• Bump org-jetbrains-kotlin from 2.3.20 to 2.3.21 #19126
• Bump org-jetbrains-kotlin from 2.3.21 to 2.4.0 #19264
• Bump org-opensaml5 from 5.2.1 to 5.2.2 #19176
• Bump org.apache.maven:maven-resolver-provider from 3.9.15 to 3.9.16 #19190
• Bump org.apereo.cas.client:cas-client-core from 4.1.0 to 4.1.1 #19200
• Bump org.hibernate.orm:hibernate-core from 7.3.1.Final to 7.3.2.Final #19119
• Bump org.hibernate.orm:hibernate-core from 7.3.2.Final to 7.3.3.Final #19149
• Bump org.hibernate.orm:hibernate-core from 7.3.3.Final to 7.3.4.Final #19165
• Bump org.hibernate.orm:hibernate-core from 7.3.4.Final to 7.3.5.Final #19191
• Bump org.hibernate.orm:hibernate-core from 7.3.5.Final to 7.3.6.Final #19211
• Bump org.hibernate.orm:hibernate-core from 7.3.6.Final to 7.4.0.Final #19226
• Bump org.jetbrains.kotlinx:kotlinx-coroutines-bom from 1.10.2 to 1.11.0 #19166
• Bump org.junit:junit-bom from 6.0.3 to 6.1.0 #19197
• Bump org.slf4j:slf4j-api from 2.0.17 to 2.0.18 #19169
• Bump org.springframework.data:spring-data-bom from 2025.1.5 to 2025.1.6 #19290
• Bump org.springframework.ldap:spring-ldap-core from 4.0.3 to 4.1.0 #19291
• Bump org.springframework:spring-framework-bom from 7.0.7 to 7.0.8 #19285
• Bump spring-io/spring-release-actions from 0.0.4 to 0.0.5 #19179
• Bump tools.jackson:jackson-bom from 3.1.2 to 3.1.3 #19147
• Bump tools.jackson:jackson-bom from 3.1.3 to 3.1.4 #19245
• Bump tools.jackson:jackson-bom from 3.1.4 to 3.2.0 #19286
• Update to spring-data-bom 2026.0.0 #19303

• Release 7.1.0 #19218

• FormPostRedirectStrategy should not emit percent-encoded values into hidden form inputs #19137
• AbstractAuthenticationFilterConfigurer should not automatically pick up servlet path #19128
• Principal Extractor should select the left-most RDN attribute value #19254

• Bump antora from 3.2.0-alpha.11 to 3.2.0-alpha.12 in /docs #19184
• Bump ch.qos.logback:logback-classic from 1.5.32 to 1.5.34 #19266
• Bump com.webauthn4j:webauthn4j-core from 0.31.3.RELEASE to 0.31.5.RELEASE #19151
• Bump com.webauthn4j:webauthn4j-core from 0.31.5.RELEASE to 0.31.6.RELEASE #19265
• Bump gradle-wrapper from 8.14.4 to 8.14.5 #19160
• Bump io-micrometer from 1.16.5 to 1.16.6 #19292
• Bump io.mockk:mockk from 1.14.9 to 1.14.11 #19247
• Bump io.projectreactor:reactor-bom from 2025.0.5 to 2025.0.6 #19298
• Bump org-bouncycastle from 1.80 to 1.80.2 #19193
• Bump org.apache.maven:maven-resolver-provider from 3.9.15 to 3.9.16 #19192
• Bump org.slf4j:slf4j-api from 2.0.17 to 2.0.18 #19174
• Bump org.springframework.data:spring-data-bom from 2025.1.5 to 2025.1.6 #19294
• Bump org.springframework.ldap:spring-ldap-core from 4.0.3 to 4.0.4 #19289
• Bump org.springframework:spring-framework-bom from 7.0.7 to 7.0.8 #19288
• Bump spring-io/spring-release-actions from 0.0.4 to 0.0.5 #19182
• Update to Micrometer 1.16.5 #19225

• Release 7.0.6 #19239

• FormPostRedirectStrategy should not emit percent-encoded values into hidden form inputs #19136

• Bump antora from 3.2.0-alpha.11 to 3.2.0-alpha.12 in /docs #19185
• Bump ch.qos.logback:logback-classic from 1.5.32 to 1.5.34 #19299
• Bump com.fasterxml.jackson:jackson-bom from 2.18.6 to 2.18.7 #19129
• Bump com.fasterxml.jackson:jackson-bom from 2.18.7 to 2.18.8 #19297
• Bump gradle-wrapper from 8.14.4 to 8.14.5 #19159
• Bump org-bouncycastle from 1.80 to 1.80.2 #19204
• Bump org.apache.maven:maven-resolver-provider from 3.9.15 to 3.9.16 #19205
• Bump org.hibernate.orm:hibernate-core from 6.6.49.Final to 6.6.50.Final #19150
• Bump org.hibernate.orm:hibernate-core from 6.6.50.Final to 6.6.51.Final #19213
• Bump org.hibernate.orm:hibernate-core from 6.6.51.Final to 6.6.53.Final #19300
• Bump org.slf4j:slf4j-api from 2.0.17 to 2.0.18 #19173
• Bump org.springframework:spring-framework-bom from 6.2.18 to 6.2.19 #19293
• Bump spring-io/spring-gradle-build-action from 2.0.5 to 2.0.6 #19124
• Bump spring-io/spring-release-actions from 0.0.4 to 0.0.5 #19183
• Update micrometer-bom to 1.15.12 #19302
• Update to Micrometer 1.15.11 #19224
• Update to reactor-bom 2024.0.18 #19301

• Release 6.5.11 #19118