Skip to content

chore(deps): bump org.springframework.security:spring-security-bom from 7.1.1 to 7.1.2 - #2792

Merged
NSeydoux merged 1 commit into
mainfrom
dependabot/maven/org.springframework.security-spring-security-bom-7.1.2
Oct 30, 2026
Merged

NSeydoux merged 1 commit into
mainfrom
dependabot/maven/org.springframework.security-spring-security-bom-7.1.2

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 30, 2026

Copy link
Copy Markdown
Contributor

Bumps org.springframework.security:spring-security-bom from 7.1.1 to 7.1.2.

Release notes

Sourced from org.springframework.security:spring-security-bom's releases.

7.1.2

🪲 Bug Fixes

  • Avoid spring-core in password encoder validation
  • Downgrade to Jackson 3.1
  • Empty or null scope claim in dynamic client registration request should be lenient
  • Ensure WebSession ID is not changed after token refresh (Reactive)
  • Fix to allow null servlet request/response in ServletOAuth2AuthorizedClientExchangeFilterFunction
  • Header Writers should not corrupt Jetty HttpFields state in reactive ResponseBodyEmitter handlers
  • NPE with authenticationValidator in OAuth2AuthorizationCodeRequestValidatingFilter
  • TokenType reference comparison is used in BearerTokenAuthentication

🔨 Dependency Upgrades

  • Bump @antora/atlas-extension from 1.0.0-alpha.5 to 1.0.0-alpha.6 in /docs
  • Bump actions/setup-java from 6.0.0 to 6.0.1
  • Bump antora from 3.2.0 to 3.2.1 in /docs
  • Bump antora from 3.2.0-rc.3 to 3.2.0 in /docs
  • Bump com.webauthn4j:webauthn4j-core from 0.31.9.RELEASE to 0.31.10.RELEASE
  • Bump gradle-wrapper from 9.7.0 to 9.7.1
  • Bump io-spring-javaformat from 0.0.47 to 0.0.48
  • Bump io.spring.develocity.conventions from 0.0.25 to 0.0.26
  • Bump io.spring.gradle:spring-security-release-plugin from 1.0.15 to 1.0.16
  • Bump io.spring.gradle:spring-security-release-plugin from 1.0.16 to 1.0.17
  • Bump io.spring.gradle:spring-security-release-plugin from 1.0.17 to 1.0.19
  • Bump io.spring.nullability:io.spring.nullability.gradle.plugin from 0.0.14 to 0.0.15
  • Bump io.spring.nullability:io.spring.nullability.gradle.plugin from 0.0.15 to 0.0.16
  • Bump org-jetbrains-kotlin from 2.4.10 to 2.4.20
  • Bump org.hibernate.orm:hibernate-core from 7.4.5.Final to 7.4.6.Final
  • Bump org.hibernate.orm:hibernate-core from 7.4.6.Final to 7.4.7.Final
  • Bump org.hibernate.orm:hibernate-core from 7.4.7.Final to 7.4.10.Final
  • Bump org.slf4j:slf4j-api from 2.0.18 to 2.0.19
  • Bump spring-io/spring-release-actions/compute-next-version from 0.0.5 to 0.0.6
  • Bump spring-io/spring-release-actions/compute-next-version from 0.0.6 to 0.0.7
  • Bump spring-io/spring-release-actions/get-todays-release-version from 0.0.5 to 0.0.6
  • Bump spring-io/spring-security-release-tools/.github/actions/send-notification from 1.0.17 to 1.0.18
  • Bump spring-io/spring-security-release-tools/.github/workflows/build.yml from 1.0.17 to 1.0.18
  • Bump spring-io/spring-security-release-tools/.github/workflows/deploy-artifacts.yml from 1.0.15 to 1.0.17
  • Bump spring-io/spring-security-release-tools/.github/workflows/deploy-schema.yml from 1.0.15 to 1.0.17
  • Bump spring-io/spring-security-release-tools/.github/workflows/release-announcements-publish.yml from 1.0.17 to 1.0.18
  • Bump spring-io/spring-security-release-tools/.github/workflows/release-announcements-stage.yml from 1.0.16 to 1.0.17
  • Bump tools.jackson:jackson-bom from 3.1.6 to 3.1.7

🔩 Build Updates

  • Configure for Reproducible Builds
  • Manually Set RequestedSessionId in Tests

❤️ Contributors

... (truncated)

Commits
  • e178580 Release 7.1.2
  • b3ac1db Update to Micrometer 1.17.2
  • adcdc57 Update to Spring LDAP 4.1.2
  • 8c40cbe Update to Reactor 2025.0.8
  • 4b09446 Update to Spring Data 2026.0.2
  • a8597b4 Update to Spring Framework 7.0.10
  • a8d08d8 Update to Framework 7.0.10-SNAPSHOT
  • a218e4c Configure Build for Internal CI
  • dccc819 Configure Workflows for Internal CI
  • c17fedc Remove OSS CI configuration
  • Additional commits viewable in compare view

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Bumps [org.springframework.security:spring-security-bom](https://github.com/spring-projects/spring-security) from 7.1.1 to 7.1.2.
- [Release notes](https://github.com/spring-projects/spring-security/releases)
- [Changelog](https://github.com/spring-projects/spring-security/blob/main/RELEASE.adoc)
- [Commits](spring-projects/spring-security@7.1.1...7.1.2)

---
updated-dependencies:
- dependency-name: org.springframework.security:spring-security-bom
  dependency-version: 7.1.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added the dependencies Pull requests that update a dependency file label Oct 30, 2026
@dependabot
dependabot Bot requested a review from a team as a code owner October 30, 2026 09:23
@dependabot dependabot Bot added the java Pull requests that update Java code label Oct 30, 2026
@NSeydoux
NSeydoux enabled auto-merge October 30, 2026 09:36
@NSeydoux
NSeydoux added this pull request to the merge queue Oct 30, 2026
Merged via the queue into main with commit 51121c6 Oct 30, 2026
11 of 13 checks passed
@NSeydoux
NSeydoux deleted the dependabot/maven/org.springframework.security-spring-security-bom-7.1.2 branch October 30, 2026 09:54
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file java Pull requests that update Java code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant