All pull requests

Pull requests

• feat(web): allow HTTP QUERY in the default firewalls

  status: waiting-for-triage
  #20030·Sudhakar7J opened Nov 3, 2026·4 tasks done·

  ·
  1

• fix(webauthn): verify assertion against stored signature count

  status: waiting-for-triage
  #20029·Sudhakar7J opened Nov 3, 2026·2 tasks done·

  ·
  1

• fix(webauthn): empty transport set no longer yields empty-string transport

  status: waiting-for-triage
  #20028·Sudhakar7J opened Nov 3, 2026·1 task done·

  ·
  1

• Preserve empty transports in JDBC credential records

  status: waiting-for-triage
  #20023·ryujungkyun opened Nov 3, 2026·

  ·
  1

• Add OidcUserInfo.Builder#updatedAt(Instant)

  status: waiting-for-triage
  #20020·KaranCodez opened Nov 2, 2026·

  ·
  1

• Modernize assertions in DaoAuthenticationProviderTests and JaasAuthenticationProviderTests

  status: waiting-for-triage
  #20019·siddiqueirshad opened Nov 2, 2026·

  ·

• Bump org-aspectj from 1.9.25.1 to 1.9.26

  in: buildtype: dependency-upgrade
  #20016·dependabot[bot] opened Nov 2, 2026Bot·

  ·

• Bump org.springframework.ldap:spring-ldap-core from 4.0.5 to 4.0.6

  in: buildtype: dependency-upgrade
  #20015·dependabot[bot] opened Nov 2, 2026Bot·

  ·

• Add CSP nonce to the default OAuth2 consent page

  status: waiting-for-triage
  #20014·Thanatos9404 opened Nov 1, 2026·

  ·

• Bump github/codeql-action/analyze from 4.38.3 to 4.39.1

  in: buildtype: dependency-upgradetype: task
  #20008·dependabot[bot] opened Oct 30, 2026Bot·

  ·

• Bump spring-io/spring-security-release-tools/.github/workflows/test.yml from 1.0.20 to 1.1.1

  in: buildtype: dependency-upgradetype: task
  #20007·dependabot[bot] opened Oct 30, 2026Bot·

  ·

• Bump spring-io/spring-security-release-tools/.github/actions/send-notification from 1.0.20 to 1.1.1

  in: buildtype: dependency-upgradetype: task
  #20005·dependabot[bot] opened Oct 30, 2026Bot·

  ·

• Bump spring-io/spring-security-release-tools/.github/workflows/ci-test.yml from 07569de2cd704c6870976fe8f16f7b3cb550d08f to a003088f632cf03f78dc838bb4f722e133aa65b0

  in: buildtype: dependency-upgradetype: task
  #20004·dependabot[bot] opened Oct 30, 2026Bot·

  ·

• Bump actions/setup-java from 6.0.1 to 6.1.0

  in: buildtype: dependency-upgradetype: task
  #20003·dependabot[bot] opened Oct 30, 2026Bot·

  ·

• Support for Delegating Security Context Executors and for Task Decorator

  status: waiting-for-triage
  #20002·eager-zh opened Oct 29, 2026·

  ·

• Add XML guidance to authorizeRequests warning

  status: waiting-for-triage
  #20001·ArnojRajiv opened Oct 29, 2026·

  ·
  1

• withRoles leaks its role filter into withAuthorities

  status: waiting-for-triage
  #20000·lim950808 opened Oct 29, 2026·

  ·

• Tolerate duplicate authorities in AuthorityAuthorizationManager

  status: waiting-for-triage
  #19999·lim950808 opened Oct 29, 2026·

  ·

• Pass servlet request to authorization failure handler

  status: waiting-for-triage
  #19998·beyondwin opened Oct 28, 2026·

  ·

• Update Antora UI Spring to v0.4.26

  status: waiting-for-triage
  #19997·github-actions[bot] opened Oct 27, 2026Bot·

  ·

• Expose OAuth 2.0 endpoint request parameters

  status: waiting-for-triage
  #19993·yeomin4242 opened Oct 26, 2026·

  ·
  1

• Bump org.springframework:spring-framework-bom from 7.0.9 to 7.0.10

  in: buildtype: dependency-upgrade
  #19992·dependabot[bot] opened Oct 26, 2026Bot·

  ·

• Bump org.springframework.data:spring-data-bom from 2025.1.7 to 2025.1.8

  in: buildtype: dependency-upgrade
  #19991·dependabot[bot] opened Oct 26, 2026Bot·

  ·

• Bump io.projectreactor:reactor-bom from 2025.0.7 to 2025.0.8

  in: buildtype: dependency-upgrade
  #19988·dependabot[bot] opened Oct 26, 2026Bot·

  ·

• Bump serialize-javascript from 7.1.2 to 7.1.4 in /javascript

  dependenciesjavascript
  #19987·dependabot[bot] opened Oct 25, 2026Bot·

  ·