23 Commits
Author SHA1 Message Date
Andy Wilkinson f7bb983335 Merge branch '4.1.x'
Closes gh-51588
2026-09-04 16:20:05 +01:00
Andy Wilkinson 154a77cae9 Make reactive resource server back off with custom security
Previously, the auto-configuration of reactive OAuth 2 resource
server based web security did not back off when a custom
SecurityWebFilterChain was defined. This did not match the
equivalent servlet-based auto-configuration which backs off when
a custom SecurityFilterChain is defined.

This commit updates the reactive auto-configuration to behave in
the same way as the servlet auto-configuration. A new annotation,
@ConditionalOnDefaultReactiveWebSecurity, is introduced. The
existing servlet-specific annotation,
@ConditionalOnDefaultWebSecurity is deprecated and a replacement
named @ConditionalOnDefaultServletWebSecurity is introduced.

Fixes gh-50778
2026-09-04 16:08:58 +01:00
Phillip Webb 7538153cc1 Merge branch '4.1.x'
Closes gh-51451
2026-08-25 12:43:08 -07:00
Phillip Webb cd5d2decf9 Merge branch '4.0.x' into 4.1.x
Closes gh-51450
2026-08-25 12:43:03 -07:00
Phillip Webb 53c04499b4 Create properties despite used-defined ClientRegistrationRepository
Update `OAuth2ClientConfigurations` so that properties are created
regardless of a user-defined `ClientRegistrationRepository` bean.

Fixes gh-51447
2026-08-25 12:41:23 -07:00
Venkata Naga Sai Srikanth Gollapudi 87c4755a86 Harmonize use of Collections and Maps in configuration properties
See gh-50367

Signed-off-by: Venkata Naga Sai Srikanth Gollapudi <42247688+gollapudisrikanth@users.noreply.github.com>
2026-07-15 11:37:31 +02:00
Doehyun Baek f7c2c0b2a6 Align documentation with changes made during 4.1's development
Signed-off-by: Doehyun Baek <doehyunbaek@gmail.com>

See gh-50800
2026-06-24 15:44:05 +01:00
Phillip Webb 6f409f7dd6 Polish code for upcoming Spring Security nullability changes
Update code and tests in preparation of upcoming Spring Security
`Nullable` annotation updates.
2026-04-07 22:27:19 -07:00
Andy Wilkinson 6c8cd183bd Merge branch '3.5.x' into 4.0.x
Closes gh-49327
2026-02-26 09:38:10 +00:00
Andy Wilkinson 0ffffee4bf Upgrade to Nullability Plugin 0.0.9
Closes gh-48638
2026-01-08 11:59:51 +00:00
Stéphane Nicoll 724f706f34 Move auto-configuration for WebTestClient in autoconfigure
Closes gh-47892
2025-10-31 12:05:25 +01:00
Phillip Webb de39cc6659 Adapt to upstream Spring Security changes
Adapt to https://github.com/spring-projects/spring-security/issues/16300

See gh-47499
2025-10-20 11:21:24 -07:00
Yanming Zhou 609b0b444e Use JsonMapper instead of ObjectMapper where feasible
See gh-47503

Signed-off-by: Yanming Zhou <zhouyanming@gmail.com>
2025-10-20 13:16:52 +02:00
Phillip Webb c2e68c0911 Refactor security auto-configuration package structure
Refactor security auto-configuration package structure and classes to
create distinct web configurations.

Closes gh-14412
2025-10-16 14:10:08 -07:00
Phillip Webb 8f89bd304f Polish code to fix warnings 2025-10-14 21:51:25 -07:00
Moritz Halbritter b0b5b1b463 Add nullability annotations to tests in module/spring-boot-security-oauth2-client
See gh-47263
2025-10-13 15:15:50 +02:00
Andy WilkinsonandPhillip Webb 9eb05ebb10 Create spring-boot-resttestclient and spring-boot-webtestclient modules
Create `spring-boot-resttestclient` and `spring-boot-webtestclient`
modules to hold test client auto-configuration and `TestRestTemplate`
code.

Previous these classes were contained in `spring-boot-resetclient-test`
and `spring-boot-webclient-test` which was incorrect since the `-test`
modules should hold code need to test the given modules, not supporting
test classes.

See gh-46356

Co-authored-by: Phillip Webb <phil.webb@broadcom.com>
2025-10-09 22:12:39 -07:00
Andy Wilkinson 5348880b69 Modularize spring-boot-test-autoconfigure
This commit modularizes spring-boot-test-autoconfigure. It now
contains only the code that's central to test auto-configuration.
Feature-specific functionality has moved out into -test modules,
some existing and some newly created. For example, `@DataJpaTest` can
now be found in spring-boot-data-jpa-test.

Closes gh-47322
2025-09-25 13:11:35 +01:00
Phillip WebbandMoritz Halbritter 239f384ac0 Update PropertyMapper to better support nullability
Refactor `PropertyMapper` so that it no longer calls adapter or
predicate methods by default when the source value is `null`. This
effectively makes all default calls the same as using
`alwaysWhenNotNull` in the previous generation of the code.

For the limited times when you do need to deal with `null` values, the
new `always()` method can be used.

For example,

	map.from(source::method).to(destination::method);

Will not call `destination.method(...)` if `source.method()` returns
`null`.

Where as:

	map.from(source::method).always().to(destination::method);

Will call  `destination.method(null)` if `source.method()` returns
`null`.

This update provides clearer semantics for the API and allows for better
JSpecify nullability annotations. It has also simplified much of our
existing property mapper code.

Closes gh-47024

Co-authored-by: Moritz Halbritter <moritz.halbritter@broadcom.com>
2025-09-05 14:43:33 -07:00
Andy Wilkinson d353038c58 Update Jackson support to require Jackson 3
Closes gh-45535
2025-09-02 11:37:09 +01:00
Moritz Halbritter 5a59dcf0f1 Add nullability annotations to module/spring-boot-security-oauth2-client
See gh-46587
2025-08-06 10:13:39 +02:00
Moritz Halbritter c0f1f641ce Make auto-configurations final and remove public members
Closes gh-32883
2025-07-29 09:48:49 +02:00
Phillip Webb decc32dde3 Restructure project directories to better fit Gradle
Closes gh-46358
2025-07-10 17:54:08 -07:00