Upgrading org.springframework.security:spring-security-core 5 to 6
Unknown5.8.16 → 6.5.11Security10New114Changed636Fixed303Other71
Fetching 65 releases from GitHub…47 / 65
SecurityLow · CVSS 3.7Spring Security Vulnerable to User Attribute Enumeration when Using DaoAuthenticationProviderGHSA-vxf7-qj7q-83fh · CVE-2026-22746 ↗
UnknownUpgrade verdict
DepDelta is still reading the notes for 18 of 65 releases, so breaking changes can't be ruled out yet.
In plain terms
- DepDelta is still reading the release notes in this range, so it can't rule out breaking changes yet.
- This page updates as the notes come in.
Must act Top 3 of 10 that need code or config changes
Adds io.micrometer:micrometer-observation 1.15.12.
Installs 9 packages in all (was 7).
What you must change
Security10
Spring Security Vulnerable to User Attribute Enumeration when Using DaoAuthenticationProvider
Low · CVSS 3.7Spring Security Core has a TOCTOU race condition when One-Time Token login with JdbcOneTimeTokenService is configured
Moderate · CVSS 4.8Spring Security annotation detection mechanism has authorization bypass
High · CVSS 7.5Spring Security authorization bypass for method security annotations on private methods
Critical · CVSS 9.1Spring Security Vulnerable to Authorization Bypass via Security Annotations
Moderate · CVSS 5.3Spring Security has a broken timing attack mitigation implemented in DaoAuthenticationProvide
Moderate · CVSS 5.3Spring Security Missing Authorization vulnerability
Moderate · CVSS 6.5Spring Framework has Authorization Bypass for Case Sensitive Comparisons
Moderate · CVSS 4.8Erroneous authentication pass in Spring Security
High · CVSS 8.2Broken Access Control in Spring Security With Direct Use of isFullyAuthenticated
High · CVSS 7.4API changes
Generated by DepDelta from published JVM bytecode. Not mixed with prose notes.
- added:
final class RoleHierarchyImpl.Builder.ImpliedRoles - added:
method RoleHierarchyImpl.Builder.ImpliedRoles.implies(String[]): RoleHierarchyImpl.Builder - added:
method RoleHierarchyImpl.Builder.build(): RoleHierarchyImpl - added:
method RoleHierarchyImpl.Builder.role(String): RoleHierarchyImpl.Builder.ImpliedRoles - added:
static final class RoleHierarchyImpl.Builder - added:
static method RoleHierarchyImpl.fromHierarchy(String): RoleHierarchyImpl - added:
static method RoleHierarchyImpl.withDefaultRolePrefix(): RoleHierarchyImpl.Builder - added:
static method RoleHierarchyImpl.withRolePrefix(String): RoleHierarchyImpl.Builder
- added:
ctor AuthorizeReturnObjectCoreHintsRegistrar(AuthorizationProxyFactory) - added:
ctor AuthorizeReturnObjectHintsRegistrar(AuthorizationProxyFactory, Class[]) - added:
ctor AuthorizeReturnObjectHintsRegistrar(AuthorizationProxyFactory, List) - added:
ctor PrePostAuthorizeExpressionBeanHintsRegistrar(Class[]) - added:
ctor PrePostAuthorizeExpressionBeanHintsRegistrar(List) - added:
ctor PrePostAuthorizeHintsRegistrar() - added:
final class AuthorizeReturnObjectCoreHintsRegistrar implements SecurityHintsRegistrar - added:
final class AuthorizeReturnObjectHintsRegistrar implements SecurityHintsRegistrar - added:
final class PrePostAuthorizeExpressionBeanHintsRegistrar implements SecurityHintsRegistrar - added:
final class PrePostAuthorizeHintsRegistrar implements SecurityHintsRegistrar - added:
interface SecurityHintsRegistrar - added:
method AuthorizeReturnObjectCoreHintsRegistrar.registerHints(RuntimeHints, ConfigurableListableBeanFactory): void - added:
method AuthorizeReturnObjectHintsRegistrar.registerHints(RuntimeHints, ConfigurableListableBeanFactory): void - added:
method PrePostAuthorizeExpressionBeanHintsRegistrar.registerHints(RuntimeHints, ConfigurableListableBeanFactory): void - added:
method PrePostAuthorizeHintsRegistrar.registerHints(RuntimeHints, ConfigurableListableBeanFactory): void - added:
method SecurityHintsRegistrar.registerHints(RuntimeHints, ConfigurableListableBeanFactory): void
- added:
class AuthenticationObservationContext extends Observation.Context - added:
class ObservationReactiveAuthenticationManager implements ReactiveAuthenticationManager - added:
ctor AuthenticationObservationContext() - added:
ctor AuthenticationObservationConvention() - added:
ctor ObservationAuthenticationManager(ObservationRegistry, AuthenticationManager) - added:
ctor ObservationReactiveAuthenticationManager(ObservationRegistry, ReactiveAuthenticationManager) - added:
ctor TestingAuthenticationToken(Object, Object, Collection) - added:
final class AuthenticationObservationConvention implements ObservationConvention - added:
final class ObservationAuthenticationManager implements AuthenticationManager - added:
method AbstractUserDetailsReactiveAuthenticationManager.setCompromisedPasswordChecker(ReactiveCompromisedPasswordChecker): void - added:
method AuthenticationObservationContext.getAuthenticationManagerClass(): Class - added:
method AuthenticationObservationContext.getAuthenticationRequest(): Authentication - added:
method AuthenticationObservationContext.getAuthenticationResult(): Authentication - added:
method AuthenticationObservationContext.setAuthenticationManagerClass(Class): void - added:
method AuthenticationObservationContext.setAuthenticationRequest(Authentication): void - added:
method AuthenticationObservationContext.setAuthenticationResult(Authentication): void - added:
method AuthenticationObservationConvention.getContextualName(AuthenticationObservationContext): String - added:
method AuthenticationObservationConvention.getLowCardinalityKeyValues(AuthenticationObservationContext): KeyValues - added:
method AuthenticationObservationConvention.getName(): String - added:
method AuthenticationObservationConvention.supportsContext(Observation.Context): boolean - added:
method AuthenticationTrustResolver.isAuthenticated(Authentication): boolean - added:
method AuthenticationTrustResolver.isFullyAuthenticated(Authentication): boolean - added:
method DelegatingReactiveAuthenticationManager.setContinueOnError(boolean): void - added:
method ObservationAuthenticationManager.authenticate(Authentication): Authentication - added:
method ObservationAuthenticationManager.setObservationConvention(ObservationConvention): void - added:
method ObservationReactiveAuthenticationManager.authenticate(Authentication): Mono - added:
method ObservationReactiveAuthenticationManager.setObservationConvention(ObservationConvention): void
- added:
ctor DaoAuthenticationProvider(PasswordEncoder) - added:
ctor DaoAuthenticationProvider(UserDetailsService) - added:
method AbstractUserDetailsAuthenticationProvider.setAlwaysPerformAdditionalChecksOnUser(boolean): void - added:
method DaoAuthenticationProvider.setCompromisedPasswordChecker(CompromisedPasswordChecker): void
- added:
class DefaultOneTimeToken implements OneTimeToken - added:
class GenerateOneTimeTokenRequest - added:
class InvalidOneTimeTokenException extends AuthenticationException - added:
class OneTimeTokenAuthenticationToken extends AbstractAuthenticationToken - added:
ctor DefaultOneTimeToken(String, String, Instant) - added:
ctor GenerateOneTimeTokenRequest(String) - added:
ctor GenerateOneTimeTokenRequest(String, Duration) - added:
ctor InMemoryOneTimeTokenService() - added:
ctor InvalidOneTimeTokenException(String) - added:
ctor JdbcOneTimeTokenService(JdbcOperations) - added:
ctor OneTimeTokenAuthenticationProvider(OneTimeTokenService, UserDetailsService) - added:
ctor OneTimeTokenAuthenticationToken(Object, Collection) - added:
ctor OneTimeTokenAuthenticationToken(Object, String) - added:
ctor OneTimeTokenAuthenticationToken(String) - added:
final class InMemoryOneTimeTokenService implements OneTimeTokenService - added:
final class JdbcOneTimeTokenService implements OneTimeTokenService, DisposableBean, InitializingBean - added:
final class OneTimeTokenAuthenticationProvider implements AuthenticationProvider - added:
interface OneTimeToken extends Serializable - added:
interface OneTimeTokenService - added:
method DefaultOneTimeToken.getExpiresAt(): Instant - added:
method DefaultOneTimeToken.getTokenValue(): String - added:
method DefaultOneTimeToken.getUsername(): String - added:
method GenerateOneTimeTokenRequest.getExpiresIn(): Duration - added:
method GenerateOneTimeTokenRequest.getUsername(): String - added:
method InMemoryOneTimeTokenService.consume(OneTimeTokenAuthenticationToken): OneTimeToken - added:
method InMemoryOneTimeTokenService.generate(GenerateOneTimeTokenRequest): OneTimeToken - added:
method InMemoryOneTimeTokenService.setClock(Clock): void - added:
method JdbcOneTimeTokenService.afterPropertiesSet(): void - added:
method JdbcOneTimeTokenService.cleanupExpiredTokens(): void - added:
method JdbcOneTimeTokenService.consume(OneTimeTokenAuthenticationToken): OneTimeToken - added:
method JdbcOneTimeTokenService.destroy(): void - added:
method JdbcOneTimeTokenService.generate(GenerateOneTimeTokenRequest): OneTimeToken - added:
method JdbcOneTimeTokenService.setCleanupCron(String): void - added:
method JdbcOneTimeTokenService.setClock(Clock): void - added:
method OneTimeToken.getExpiresAt(): Instant - added:
method OneTimeToken.getTokenValue(): String - added:
method OneTimeToken.getUsername(): String - added:
method OneTimeTokenAuthenticationProvider.authenticate(Authentication): Authentication - added:
method OneTimeTokenAuthenticationProvider.supports(Class): boolean - added:
method OneTimeTokenAuthenticationToken.getCredentials(): Object - added:
method OneTimeTokenAuthenticationToken.getPrincipal(): Object - added:
method OneTimeTokenAuthenticationToken.getTokenValue(): String - added:
method OneTimeTokenService.consume(OneTimeTokenAuthenticationToken): OneTimeToken - added:
method OneTimeTokenService.generate(GenerateOneTimeTokenRequest): OneTimeToken - added:
static method OneTimeTokenAuthenticationToken.authenticated(Object, Collection): OneTimeTokenAuthenticationToken - added:
static method OneTimeTokenAuthenticationToken.unauthenticated(Object, String): OneTimeTokenAuthenticationToken - added:
static method OneTimeTokenAuthenticationToken.unauthenticated(String): OneTimeTokenAuthenticationToken
- added:
ctor InMemoryReactiveOneTimeTokenService() - added:
ctor OneTimeTokenReactiveAuthenticationManager(ReactiveOneTimeTokenService, ReactiveUserDetailsService) - added:
final class InMemoryReactiveOneTimeTokenService implements ReactiveOneTimeTokenService - added:
final class OneTimeTokenReactiveAuthenticationManager implements ReactiveAuthenticationManager - added:
interface ReactiveOneTimeTokenService - added:
method InMemoryReactiveOneTimeTokenService.consume(OneTimeTokenAuthenticationToken): Mono - added:
method InMemoryReactiveOneTimeTokenService.generate(GenerateOneTimeTokenRequest): Mono - added:
method InMemoryReactiveOneTimeTokenService.setClock(Clock): void - added:
method OneTimeTokenReactiveAuthenticationManager.authenticate(Authentication): Mono - added:
method ReactiveOneTimeTokenService.consume(OneTimeTokenAuthenticationToken): Mono - added:
method ReactiveOneTimeTokenService.generate(GenerateOneTimeTokenRequest): Mono
- added:
class CompromisedPasswordDecision - added:
class CompromisedPasswordException extends AuthenticationException - added:
ctor CompromisedPasswordDecision(boolean) - added:
ctor CompromisedPasswordException(String) - added:
ctor CompromisedPasswordException(String, Throwable) - added:
interface CompromisedPasswordChecker - added:
interface ReactiveCompromisedPasswordChecker - added:
method CompromisedPasswordChecker.check(String): CompromisedPasswordDecision - added:
method CompromisedPasswordDecision.isCompromised(): boolean - added:
method ReactiveCompromisedPasswordChecker.check(String): Mono
- removed:
class RemoteAuthenticationException extends NestedRuntimeException - removed:
class RemoteAuthenticationManagerImpl implements RemoteAuthenticationManager, InitializingBean - removed:
class RemoteAuthenticationProvider implements AuthenticationProvider, InitializingBean - removed:
ctor RemoteAuthenticationException(String) - removed:
ctor RemoteAuthenticationManagerImpl() - removed:
ctor RemoteAuthenticationProvider() - removed:
interface RemoteAuthenticationManager - removed:
method RemoteAuthenticationManager.attemptAuthentication(String, String): Collection - removed:
method RemoteAuthenticationManagerImpl.afterPropertiesSet(): void - removed:
method RemoteAuthenticationManagerImpl.attemptAuthentication(String, String): Collection - removed:
method RemoteAuthenticationManagerImpl.getAuthenticationManager(): AuthenticationManager - removed:
method RemoteAuthenticationManagerImpl.setAuthenticationManager(AuthenticationManager): void - removed:
method RemoteAuthenticationProvider.afterPropertiesSet(): void - removed:
method RemoteAuthenticationProvider.authenticate(Authentication): Authentication - removed:
method RemoteAuthenticationProvider.getRemoteAuthenticationManager(): RemoteAuthenticationManager - removed:
method RemoteAuthenticationProvider.setRemoteAuthenticationManager(RemoteAuthenticationManager): void - removed:
method RemoteAuthenticationProvider.supports(Class): boolean
- changed:
class AuthorizationDecision → class AuthorizationDecision implements AuthorizationResult - added:
class AuthorizationDeniedException extends AccessDeniedException implements AuthorizationResult - added:
class AuthorizationObservationContext extends Observation.Context - added:
ctor AuthoritiesAuthorizationManager() - added:
ctor AuthorizationDeniedException(String) - added:
ctor AuthorizationDeniedException(String, AuthorizationResult) - added:
ctor AuthorizationObservationContext(Object) - added:
ctor AuthorizationObservationConvention() - added:
ctor ObservationAuthorizationManager(ObservationRegistry, AuthorizationManager) - added:
ctor ObservationReactiveAuthorizationManager(ObservationRegistry, ReactiveAuthorizationManager) - added:
ctor SingleResultAuthorizationManager(AuthorizationResult) - added:
final class AuthoritiesAuthorizationManager implements AuthorizationManager - added:
final class AuthorizationObservationConvention implements ObservationConvention - added:
final class ObservationAuthorizationManager implements AuthorizationManager, MessageSourceAware, MethodAuthorizationDeniedHandler - added:
final class ObservationReactiveAuthorizationManager implements ReactiveAuthorizationManager, MethodAuthorizationDeniedHandler - added:
final class SingleResultAuthorizationManager implements AuthorizationManager - added:
interface AuthorizationProxyFactory - added:
interface AuthorizationResult extends Serializable - added:
method AuthoritiesAuthorizationManager.check(Supplier, Collection): AuthorityAuthorizationDecision - added:
method AuthoritiesAuthorizationManager.setRoleHierarchy(RoleHierarchy): void - added:
method AuthorizationDeniedException.getAuthorizationResult(): AuthorizationResult - added:
method AuthorizationDeniedException.isGranted(): boolean - added:
method AuthorizationEventPublisher.publishAuthorizationEvent(Supplier, Object, AuthorizationResult): void - added:
method AuthorizationManager.authorize(Supplier, Object): AuthorizationResult - added:
method AuthorizationObservationContext.getAuthentication(): Authentication - added:
method AuthorizationObservationContext.getAuthorizationResult(): AuthorizationResult - added:
method AuthorizationObservationContext.getDecision(): AuthorizationDecision - added:
method AuthorizationObservationContext.getObject(): Object - added:
method AuthorizationObservationContext.setAuthentication(Authentication): void - added:
method AuthorizationObservationContext.setAuthorizationResult(AuthorizationResult): void - added:
method AuthorizationObservationContext.setDecision(AuthorizationDecision): void - added:
method AuthorizationObservationConvention.getContextualName(AuthorizationObservationContext): String - added:
method AuthorizationObservationConvention.getHighCardinalityKeyValues(AuthorizationObservationContext): KeyValues - added:
method AuthorizationObservationConvention.getLowCardinalityKeyValues(AuthorizationObservationContext): KeyValues - added:
method AuthorizationObservationConvention.getName(): String - added:
method AuthorizationObservationConvention.supportsContext(Observation.Context): boolean - added:
method AuthorizationProxyFactory.proxy(Object): Object - added:
method AuthorizationResult.isGranted(): boolean - added:
method ObservationAuthorizationManager.check(Supplier, Object): AuthorizationDecision - added:
method ObservationAuthorizationManager.handleDeniedInvocation(MethodInvocation, AuthorizationResult): Object - added:
method ObservationAuthorizationManager.handleDeniedInvocationResult(MethodInvocationResult, AuthorizationResult): Object - added:
method ObservationAuthorizationManager.setMessageSource(MessageSource): void - added:
method ObservationAuthorizationManager.setObservationConvention(ObservationConvention): void - added:
method ObservationReactiveAuthorizationManager.check(Mono, Object): Mono - added:
method ObservationReactiveAuthorizationManager.handleDeniedInvocation(MethodInvocation, AuthorizationResult): Object - added:
method ObservationReactiveAuthorizationManager.handleDeniedInvocationResult(MethodInvocationResult, AuthorizationResult): Object - added:
method ObservationReactiveAuthorizationManager.setObservationConvention(ObservationConvention): void - added:
method ReactiveAuthorizationManager.authorize(Mono, Object): Mono - added:
method SingleResultAuthorizationManager.authorize(Supplier, Object): AuthorizationResult - added:
method SingleResultAuthorizationManager.check(Supplier, Object): AuthorizationDecision - added:
method SpringAuthorizationEventPublisher.publishAuthorizationEvent(Supplier, Object, AuthorizationResult): void - added:
static method AuthorizationManagers.allOf(AuthorizationDecision, AuthorizationManager[]): AuthorizationManager - added:
static method AuthorizationManagers.anyOf(AuthorizationDecision, AuthorizationManager[]): AuthorizationManager - added:
static method AuthorizationManagers.not(AuthorizationManager): AuthorizationManager - added:
static method SingleResultAuthorizationManager.denyAll(): SingleResultAuthorizationManager - added:
static method SingleResultAuthorizationManager.permitAll(): SingleResultAuthorizationManager
- changed:
class AuthorizationDeniedEvent extends AuthorizationEvent → class AuthorizationDeniedEvent extends AuthorizationEvent implements ResolvableTypeProvider - changed:
class AuthorizationGrantedEvent extends AuthorizationEvent → class AuthorizationGrantedEvent extends AuthorizationEvent implements ResolvableTypeProvider - added:
ctor AuthorizationDeniedEvent(Supplier, Object, AuthorizationResult) - added:
ctor AuthorizationEvent(Supplier, Object, AuthorizationResult) - added:
ctor AuthorizationGrantedEvent(Supplier, Object, AuthorizationResult) - added:
method AuthorizationDeniedEvent.getResolvableType(): ResolvableType - added:
method AuthorizationEvent.getAuthorizationResult(): AuthorizationResult - added:
method AuthorizationGrantedEvent.getResolvableType(): ResolvableType
- changed:
final class AuthorizationManagerAfterMethodInterceptor implements Ordered, MethodInterceptor, PointcutAdvisor, AopInfrastructureBean → final class AuthorizationManagerAfterMethodInterceptor implements AuthorizationAdvisor - changed:
final class AuthorizationManagerAfterReactiveMethodInterceptor implements Ordered, MethodInterceptor, PointcutAdvisor, AopInfrastructureBean → final class AuthorizationManagerAfterReactiveMethodInterceptor implements AuthorizationAdvisor - changed:
final class AuthorizationManagerBeforeMethodInterceptor implements Ordered, MethodInterceptor, PointcutAdvisor, AopInfrastructureBean → final class AuthorizationManagerBeforeMethodInterceptor implements AuthorizationAdvisor - changed:
final class AuthorizationManagerBeforeReactiveMethodInterceptor implements Ordered, MethodInterceptor, PointcutAdvisor, AopInfrastructureBean → final class AuthorizationManagerBeforeReactiveMethodInterceptor implements AuthorizationAdvisor - changed:
final class PostAuthorizeAuthorizationManager implements AuthorizationManager → final class PostAuthorizeAuthorizationManager implements AuthorizationManager, MethodAuthorizationDeniedHandler - changed:
final class PostAuthorizeReactiveAuthorizationManager implements ReactiveAuthorizationManager → final class PostAuthorizeReactiveAuthorizationManager implements ReactiveAuthorizationManager, MethodAuthorizationDeniedHandler - changed:
final class PostFilterAuthorizationMethodInterceptor implements Ordered, MethodInterceptor, PointcutAdvisor, AopInfrastructureBean → final class PostFilterAuthorizationMethodInterceptor implements AuthorizationAdvisor - changed:
final class PostFilterAuthorizationReactiveMethodInterceptor implements Ordered, MethodInterceptor, PointcutAdvisor, AopInfrastructureBean → final class PostFilterAuthorizationReactiveMethodInterceptor implements AuthorizationAdvisor - changed:
final class PreAuthorizeAuthorizationManager implements AuthorizationManager → final class PreAuthorizeAuthorizationManager implements AuthorizationManager, MethodAuthorizationDeniedHandler - changed:
final class PreAuthorizeReactiveAuthorizationManager implements ReactiveAuthorizationManager → final class PreAuthorizeReactiveAuthorizationManager implements ReactiveAuthorizationManager, MethodAuthorizationDeniedHandler - changed:
final class PreFilterAuthorizationMethodInterceptor implements Ordered, MethodInterceptor, PointcutAdvisor, AopInfrastructureBean → final class PreFilterAuthorizationMethodInterceptor implements AuthorizationAdvisor - changed:
final class PreFilterAuthorizationReactiveMethodInterceptor implements Ordered, MethodInterceptor, PointcutAdvisor, AopInfrastructureBean → final class PreFilterAuthorizationReactiveMethodInterceptor implements AuthorizationAdvisor - added:
@interface AuthorizeReturnObject - added:
@interface HandleAuthorizationDenied - added:
ctor AuthorizationAdvisorProxyFactory(List) - added:
ctor AuthorizeReturnObjectMethodInterceptor() - added:
ctor AuthorizeReturnObjectMethodInterceptor(AuthorizationProxyFactory) - added:
ctor PrePostTemplateDefaults() - added:
ctor ThrowingMethodAuthorizationDeniedHandler() - added:
final class AuthorizationAdvisorProxyFactory implements AuthorizationProxyFactory, Iterable, AopInfrastructureBean, SmartInitializingSingleton - added:
final class AuthorizeReturnObjectMethodInterceptor implements AuthorizationAdvisor - added:
final class PrePostTemplateDefaults - added:
final class ThrowingMethodAuthorizationDeniedHandler implements MethodAuthorizationDeniedHandler - added:
interface AuthorizationAdvisor extends Ordered, MethodInterceptor, PointcutAdvisor, AopInfrastructureBean - added:
interface AuthorizationAdvisorProxyFactory.TargetVisitor - added:
interface AuthorizationProxy extends RawTargetAccess - added:
interface MethodAuthorizationDeniedHandler - added:
method AuthorizationAdvisorProxyFactory.TargetVisitor.visit(AuthorizationAdvisorProxyFactory, Object): Object - added:
method AuthorizationAdvisorProxyFactory.addAdvisor(AuthorizationAdvisor): void - added:
method AuthorizationAdvisorProxyFactory.afterSingletonsInstantiated(): void - added:
method AuthorizationAdvisorProxyFactory.iterator(): Iterator - added:
method AuthorizationAdvisorProxyFactory.proxy(Object): Object - added:
method AuthorizationAdvisorProxyFactory.setAdvisors(AuthorizationAdvisor[]): void - added:
method AuthorizationAdvisorProxyFactory.setAdvisors(Collection): void - added:
method AuthorizationAdvisorProxyFactory.setTargetVisitor(AuthorizationAdvisorProxyFactory.TargetVisitor): void - added:
method AuthorizationProxy.toAuthorizedTarget(): Object - added:
method AuthorizeReturnObjectMethodInterceptor.getAdvice(): Advice - added:
method AuthorizeReturnObjectMethodInterceptor.getOrder(): int - added:
method AuthorizeReturnObjectMethodInterceptor.getPointcut(): Pointcut - added:
method AuthorizeReturnObjectMethodInterceptor.invoke(MethodInvocation): Object - added:
method AuthorizeReturnObjectMethodInterceptor.isPerInstance(): boolean - added:
method AuthorizeReturnObjectMethodInterceptor.setAuthorizationProxyFactory(AuthorizationProxyFactory): void - added:
method AuthorizeReturnObjectMethodInterceptor.setOrder(int): void - added:
method AuthorizeReturnObjectMethodInterceptor.setPointcut(Pointcut): void - added:
method HandleAuthorizationDenied.handlerClass(): Class - added:
method Jsr250AuthorizationManager.setAuthoritiesAuthorizationManager(AuthorizationManager): void - added:
method MethodAuthorizationDeniedHandler.handleDeniedInvocation(MethodInvocation, AuthorizationResult): Object - added:
method MethodAuthorizationDeniedHandler.handleDeniedInvocationResult(MethodInvocationResult, AuthorizationResult): Object - added:
method PostAuthorizeAuthorizationManager.handleDeniedInvocation(MethodInvocation, AuthorizationResult): Object - added:
method PostAuthorizeAuthorizationManager.handleDeniedInvocationResult(MethodInvocationResult, AuthorizationResult): Object - added:
method PostAuthorizeAuthorizationManager.setApplicationContext(ApplicationContext): void - added:
method PostAuthorizeAuthorizationManager.setTemplateDefaults(AnnotationTemplateExpressionDefaults): void - added:
method PostAuthorizeAuthorizationManager.setTemplateDefaults(PrePostTemplateDefaults): void - added:
method PostAuthorizeReactiveAuthorizationManager.handleDeniedInvocation(MethodInvocation, AuthorizationResult): Object - added:
method PostAuthorizeReactiveAuthorizationManager.handleDeniedInvocationResult(MethodInvocationResult, AuthorizationResult): Object - added:
method PostAuthorizeReactiveAuthorizationManager.setApplicationContext(ApplicationContext): void - added:
method PostAuthorizeReactiveAuthorizationManager.setTemplateDefaults(AnnotationTemplateExpressionDefaults): void - added:
method PostAuthorizeReactiveAuthorizationManager.setTemplateDefaults(PrePostTemplateDefaults): void - added:
method PostFilterAuthorizationMethodInterceptor.setTemplateDefaults(AnnotationTemplateExpressionDefaults): void - added:
method PostFilterAuthorizationMethodInterceptor.setTemplateDefaults(PrePostTemplateDefaults): void - added:
method PostFilterAuthorizationReactiveMethodInterceptor.setTemplateDefaults(AnnotationTemplateExpressionDefaults): void - added:
method PostFilterAuthorizationReactiveMethodInterceptor.setTemplateDefaults(PrePostTemplateDefaults): void - added:
method PreAuthorizeAuthorizationManager.handleDeniedInvocation(MethodInvocation, AuthorizationResult): Object - added:
method PreAuthorizeAuthorizationManager.setApplicationContext(ApplicationContext): void - added:
method PreAuthorizeAuthorizationManager.setTemplateDefaults(AnnotationTemplateExpressionDefaults): void - added:
method PreAuthorizeAuthorizationManager.setTemplateDefaults(PrePostTemplateDefaults): void - added:
method PreAuthorizeReactiveAuthorizationManager.handleDeniedInvocation(MethodInvocation, AuthorizationResult): Object - added:
method PreAuthorizeReactiveAuthorizationManager.setApplicationContext(ApplicationContext): void - added:
method PreAuthorizeReactiveAuthorizationManager.setTemplateDefaults(AnnotationTemplateExpressionDefaults): void - added:
method PreAuthorizeReactiveAuthorizationManager.setTemplateDefaults(PrePostTemplateDefaults): void - added:
method PreFilterAuthorizationMethodInterceptor.setTemplateDefaults(AnnotationTemplateExpressionDefaults): void - added:
method PreFilterAuthorizationMethodInterceptor.setTemplateDefaults(PrePostTemplateDefaults): void - added:
method PreFilterAuthorizationReactiveMethodInterceptor.setTemplateDefaults(AnnotationTemplateExpressionDefaults): void - added:
method PreFilterAuthorizationReactiveMethodInterceptor.setTemplateDefaults(PrePostTemplateDefaults): void - added:
method PrePostTemplateDefaults.isIgnoreUnknown(): boolean - added:
method PrePostTemplateDefaults.setIgnoreUnknown(boolean): void - added:
method SecuredAuthorizationManager.setAuthoritiesAuthorizationManager(AuthorizationManager): void - added:
method ThrowingMethodAuthorizationDeniedHandler.handleDeniedInvocation(MethodInvocation, AuthorizationResult): Object - added:
method ThrowingMethodAuthorizationDeniedHandler.handleDeniedInvocationResult(MethodInvocationResult, AuthorizationResult): Object - added:
static field AuthorizationInterceptorsOrder.SECURE_RESULT: AuthorizationInterceptorsOrder - added:
static method AuthorizationAdvisorProxyFactory.TargetVisitor.defaults(): AuthorizationAdvisorProxyFactory.TargetVisitor - added:
static method AuthorizationAdvisorProxyFactory.TargetVisitor.defaultsSkipValueTypes(): AuthorizationAdvisorProxyFactory.TargetVisitor - added:
static method AuthorizationAdvisorProxyFactory.TargetVisitor.of(AuthorizationAdvisorProxyFactory.TargetVisitor[]): AuthorizationAdvisorProxyFactory.TargetVisitor - added:
static method AuthorizationAdvisorProxyFactory.withDefaults(): AuthorizationAdvisorProxyFactory - added:
static method AuthorizationAdvisorProxyFactory.withReactiveDefaults(): AuthorizationAdvisorProxyFactory - added:
static method AuthorizationManagerAfterMethodInterceptor.postAuthorize(AuthorizationManager): AuthorizationManagerAfterMethodInterceptor - added:
static method AuthorizationManagerBeforeMethodInterceptor.jsr250(AuthorizationManager): AuthorizationManagerBeforeMethodInterceptor - added:
static method AuthorizationManagerBeforeMethodInterceptor.preAuthorize(AuthorizationManager): AuthorizationManagerBeforeMethodInterceptor - added:
static method AuthorizationManagerBeforeMethodInterceptor.secured(AuthorizationManager): AuthorizationManagerBeforeMethodInterceptor
- added:
method AuthenticationException.getAuthenticationRequest(): Authentication - added:
method AuthenticationException.setAuthenticationRequest(Authentication): void
- added:
class AnnotationTemplateExpressionDefaults - added:
ctor AnnotationTemplateExpressionDefaults() - added:
final class SecurityAnnotationScanners - added:
interface SecurityAnnotationScanner - added:
method AnnotationTemplateExpressionDefaults.isIgnoreUnknown(): boolean - added:
method AnnotationTemplateExpressionDefaults.setIgnoreUnknown(boolean): void - added:
method SecurityAnnotationScanner.scan(Method, Class): Annotation - added:
method SecurityAnnotationScanner.scan(Parameter): Annotation - added:
static method SecurityAnnotationScanners.requireUnique(Class): SecurityAnnotationScanner - added:
static method SecurityAnnotationScanners.requireUnique(Class, AnnotationTemplateExpressionDefaults): SecurityAnnotationScanner - added:
static method SecurityAnnotationScanners.requireUnique(List): SecurityAnnotationScanner
- added:
static method AuthorityUtils.createAuthorityList(Collection): List
- added:
ctor ObservationSecurityContextChangedListener(ObservationRegistry) - added:
ctor ReactiveSecurityContextHolderThreadLocalAccessor() - added:
ctor SecurityContextHolderThreadLocalAccessor() - added:
final class ObservationSecurityContextChangedListener implements SecurityContextChangedListener - added:
final class ReactiveSecurityContextHolderThreadLocalAccessor implements ThreadLocalAccessor - added:
final class SecurityContextHolderThreadLocalAccessor implements ThreadLocalAccessor - added:
method ObservationSecurityContextChangedListener.securityContextChanged(SecurityContextChangedEvent): void - added:
method ReactiveSecurityContextHolderThreadLocalAccessor.getValue(): Mono - added:
method ReactiveSecurityContextHolderThreadLocalAccessor.key(): Object - added:
method ReactiveSecurityContextHolderThreadLocalAccessor.setValue(): void - added:
method ReactiveSecurityContextHolderThreadLocalAccessor.setValue(Mono): void - added:
method SecurityContextHolderThreadLocalAccessor.getValue(): SecurityContext - added:
method SecurityContextHolderThreadLocalAccessor.key(): Object - added:
method SecurityContextHolderThreadLocalAccessor.setValue(): void - added:
method SecurityContextHolderThreadLocalAccessor.setValue(SecurityContext): void
- added:
class InMemoryReactiveSessionRegistry implements ReactiveSessionRegistry - added:
class ReactiveSessionInformation implements Serializable - added:
ctor InMemoryReactiveSessionRegistry() - added:
ctor InMemoryReactiveSessionRegistry(ConcurrentMap, Map) - added:
ctor ReactiveSessionInformation(Object, String, Instant) - added:
interface ReactiveSessionRegistry - added:
method InMemoryReactiveSessionRegistry.getAllSessions(Object): Flux - added:
method InMemoryReactiveSessionRegistry.getSessionInformation(String): Mono - added:
method InMemoryReactiveSessionRegistry.removeSessionInformation(String): Mono - added:
method InMemoryReactiveSessionRegistry.saveSessionInformation(ReactiveSessionInformation): Mono - added:
method InMemoryReactiveSessionRegistry.updateLastAccessTime(String): Mono - added:
method ReactiveSessionInformation.getLastAccessTime(): Instant - added:
method ReactiveSessionInformation.getPrincipal(): Object - added:
method ReactiveSessionInformation.getSessionId(): String - added:
method ReactiveSessionInformation.invalidate(): Mono - added:
method ReactiveSessionInformation.isExpired(): boolean - added:
method ReactiveSessionInformation.refreshLastRequest(): Mono - added:
method ReactiveSessionInformation.setLastAccessTime(Instant): void - added:
method ReactiveSessionInformation.withSessionId(String): ReactiveSessionInformation - added:
method ReactiveSessionRegistry.getAllSessions(Object): Flux - added:
method ReactiveSessionRegistry.getSessionInformation(String): Mono - added:
method ReactiveSessionRegistry.removeSessionInformation(String): Mono - added:
method ReactiveSessionRegistry.saveSessionInformation(ReactiveSessionInformation): Mono - added:
method ReactiveSessionRegistry.updateLastAccessTime(String): Mono
- removed:
class EhCacheBasedUserCache implements UserCache, InitializingBean - removed:
ctor EhCacheBasedUserCache() - removed:
method EhCacheBasedUserCache.afterPropertiesSet(): void - removed:
method EhCacheBasedUserCache.getCache(): Ehcache - removed:
method EhCacheBasedUserCache.getUserFromCache(String): UserDetails - removed:
method EhCacheBasedUserCache.putUserInCache(UserDetails): void - removed:
method EhCacheBasedUserCache.removeUserFromCache(String): void - removed:
method EhCacheBasedUserCache.removeUserFromCache(UserDetails): void - removed:
method EhCacheBasedUserCache.setCache(Ehcache): void
- added:
method JdbcUserDetailsManager.setGrantedAuthorityMapper(RowMapper): void - added:
method JdbcUserDetailsManager.setUserDetailsMapper(RowMapper): void
- added:
method DelegatingSecurityContextTaskScheduler.getClock(): Clock - added:
method DelegatingSecurityContextTaskScheduler.schedule(Runnable, Instant): ScheduledFuture - added:
method DelegatingSecurityContextTaskScheduler.scheduleAtFixedRate(Runnable, Duration): ScheduledFuture - added:
method DelegatingSecurityContextTaskScheduler.scheduleAtFixedRate(Runnable, Instant, Duration): ScheduledFuture - added:
method DelegatingSecurityContextTaskScheduler.scheduleWithFixedDelay(Runnable, Duration): ScheduledFuture - added:
method DelegatingSecurityContextTaskScheduler.scheduleWithFixedDelay(Runnable, Instant, Duration): ScheduledFuture