spring/spring-boot
1
0
Fork 0
mirror of https://github.com/spring-projects/spring-boot.git synced 2026-09-17 12:09:16 +00:00
Code Issues Projects Releases Wiki Activity
60,061 Commits 24 Branches 394 Tags
55a6b4525cd9dc553777f284b5c23fb78daa9293
Commit Graph
60061 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Manu Sridharan 55a6b4525c Align @Nullable in returned Map with actual implementation 
See gh-50265

Signed-off-by: Manu Sridharan <msridhar@gmail.com>

Closes gh-50265
 2026-04-30 14:35:43 -07:00
Andy Wilkinson fc67e24820 Merge branch '3.5.x' into 4.0.x 
Closes gh-50260
 2026-04-30 13:44:06 +01:00
Andy Wilkinson 03eb75fbad Merge pull request #50095 from dlwldnjs1009 
* gh-50095:
  Always match the links endpoint with GET

Closes gh-50095
 2026-04-30 13:43:20 +01:00
Lee JiWon 2d3273e078 Always match the links endpoint with GET 
The links endpoint only supports GET, so its matcher is now hardcoded
to GET. withHttpMethod(...) continues to apply only to endpoint paths
and the behaviour is documented on its javadoc.

Signed-off-by: Lee JiWon <dlwldnjs1009@gmail.com>

See gh-50095
 2026-04-30 13:34:11 +01:00
Andy Wilkinson a0a344f4b4 Merge branch '3.5.x' into 4.0.x 
Fixes gh-50257
 2026-04-30 12:35:30 +01:00
Andy Wilkinson d2b62bc64f Fix CORS configuration in /cloudfoundryapplication security filter 
Previously, Spring Security wouldn't necessary allow cross-origin
requests to /cloudfoundryapplication, despite the underlying handler
mapping doing so.

Since 6.2, Spring Security enables CORS with default configuration if
there are any UrlBasedCorsConfigurationSource beans in the context.
This default configuration will then use a bean named
corsConfigurationSource as its source of CORS configuration. If it
doesn't find such a bean, it'll use the mvcHandlerMappingIntrospector
bean as a source. This latter case works as it means that the
CORS configuration of the underlying handler mapping is used.

In the case where a bean named corsConfigurationSource is used, this
will break /cloudfoundryapplication if the bean's CORS configuration
for /cloudfoundryapplication does not allow it. This has only been
a problem since Spring Boot 3.5 where we switched from using
ignoring() to using permitAll() to configure the security of
/cloudfoundryapplication.

To avoid a user-provided bean named corsConfigurationSource from
accidentally preventing access to /cloudfoundryapplication, we now
explicitly configure the filter chain's CORS support to use the same
CorsConfigurationSource as the handler mapping.

Fixes gh-50254
 2026-04-30 12:29:34 +01:00
Andy Wilkinson bd568905c0 Merge branch '3.5.x' into 4.0.x 2026-04-29 12:25:35 +01:00
Andy Wilkinson efeb44a400 Test the Gradle plugin against Gradle 9.5.0 
Closes gh-50238
 2026-04-28 16:05:30 +01:00
Andy Wilkinson ec7b9d4124 Upgrade to Gradle 9.5.0 
Closes gh-50236
 2026-04-28 15:37:37 +01:00
Stéphane Nicoll 813913ccb8 Merge branch '3.5.x' into 4.0.x 
Closes gh-50233
 2026-04-28 13:54:49 +02:00
Stéphane Nicoll fa8765717d Merge pull request #50225 from ares333 
* patch-1:
  Polish "Keep milliseconds precision in ThreadPoolTaskScheduleBuilder"
  Keep milliseconds precision in ThreadPoolTaskScheduleBuilder

Closes gh-50225
 2026-04-28 13:54:40 +02:00
Stéphane Nicoll 08c94440fd Polish "Keep milliseconds precision in ThreadPoolTaskScheduleBuilder" 
See gh-50225
 2026-04-28 13:49:59 +02:00
Ares 805e8af8d5 Keep milliseconds precision in ThreadPoolTaskScheduleBuilder 
This commit fixes ThreadPoolTaskExecutorBuilder#awaitTerminationPeriod
so that it does not lose millisecond precision.

See gh-50225

Signed-off-by: Ares <ares333@users.noreply.github.com>
 2026-04-28 13:46:08 +02:00
Stéphane Nicoll 684bce02a9 Remove merged artifact that was relocated 2026-04-27 11:06:01 +02:00
Stéphane Nicoll 4c7cedb738 Merge branch '3.5.x' into 4.0.x 
Closes gh-50229
 2026-04-27 11:04:35 +02:00
Stéphane Nicoll 37186284e4 Fix name of ReactiveOAuth2ResourceServerJwkConfiguration 
Closes gh-50226
 2026-04-27 11:01:09 +02:00
Stéphane Nicoll f71464b3c6 Merge branch '3.5.x' into 4.0.x 
Closes gh-50227
 2026-04-27 10:57:41 +02:00
Stéphane Nicoll fab53cce04 Merge pull request #50118 from vinhhieu21 
* fix-jws-algorithm-null-add:
  Polish "Reject unknown JWS algorithms configured on NimbusJwtDecoder"
  Reject unknown JWS algorithms configured on NimbusJwtDecoder

Closes gh-50118
 2026-04-27 10:55:30 +02:00
Stéphane Nicoll 73a7b7727d Polish "Reject unknown JWS algorithms configured on NimbusJwtDecoder" 
See gh-50118
 2026-04-27 10:19:00 +02:00
Hieu Bui Vinh 3f32906b05 Reject unknown JWS algorithms configured on NimbusJwtDecoder 
See gh-50118

Signed-off-by: Hieu Bui Vinh <buivinhhieu217@gmail.com>
 2026-04-27 10:18:33 +02:00
Stéphane Nicoll 6093fd42cb Merge branch '3.5.x' into 4.0.x 
Closes gh-50219
 2026-04-25 11:47:30 +02:00
Stéphane Nicoll eceb603342 Merge pull request #50210 from henriquejsza 
* gh-35236-testcontainers-lifecycle-docs:
  Polish "Document Testcontainers lifecycle caveat"
  Document Testcontainers lifecycle caveat

Closes gh-50210
 2026-04-25 11:47:02 +02:00
Stéphane Nicoll 2df7f83ceb Polish "Document Testcontainers lifecycle caveat" 
See gh-50210
 2026-04-25 11:46:42 +02:00
henriquejsza 69ddf5856f Document Testcontainers lifecycle caveat 
Document how Testcontainers-managed static containers can be stopped
before Spring's cached application context is closed or reused.

See gh-50210

Signed-off-by: henriquejsza <henriquejsza@gmail.com>
 2026-04-25 11:46:38 +02:00
Stéphane Nicoll 8a720b6bc5 Merge branch '3.5.x' into 4.0.x 2026-04-25 11:25:41 +02:00
Stéphane Nicoll 6d4a3e7592 Fix reference to Jetty classes 2026-04-25 11:23:55 +02:00
Stéphane Nicoll 3283c9264f Merge branch '3.5.x' into 4.0.x 
Closes gh-50217
 2026-04-25 11:21:07 +02:00
Stéphane Nicoll 2dfcbd795c Merge pull request #17144 from zxuhan7 
* gh-17144-document-jetty-multiple-connectors:
  Polish "Document configuring multiple connectors with Jetty"
  Document configuring multiple connectors with Jetty

Closes gh-17144
 2026-04-25 11:14:35 +02:00
Stéphane Nicoll 796ac7870d Polish "Document configuring multiple connectors with Jetty" 
See gh-17144
 2026-04-25 11:09:57 +02:00
zxuhan7 f9c0c65622 Document configuring multiple connectors with Jetty 
See gh-17144

Signed-off-by: zxuhan7 <zxuhan7@gmail.com>
 2026-04-25 10:52:45 +02:00
Stéphane Nicoll dfabb012e8 Merge branch '3.5.x' into 4.0.x 
Closes gh-50215
 2026-04-25 10:37:05 +02:00
Stéphane Nicoll 466e11ba06 Merge pull request #50205 from kwondh5217 
* fix/whitelabel-timestamp-html-escaping:
  Polish contribution
  Apply HTML escaping to timestamp attribute in Whitelabel error page

Closes gh-50205
 2026-04-25 10:33:38 +02:00
Stéphane Nicoll b1ffa65f95 Polish contribution 
See gh-50205
 2026-04-25 10:25:56 +02:00
Daeho Kwon f273f5ec35 Apply HTML escaping to timestamp attribute in Whitelabel error page 
See gh-50205

Signed-off-by: Daeho Kwon <trewq231@naver.com>
 2026-04-25 10:10:56 +02:00
Andy Wilkinson afc61f922c Merge branch '3.5.x' into 4.0.x 
Closes gh-50213
 2026-04-25 07:47:49 +01:00
Andy Wilkinson f280d12729 Polish InvalidConfigurationPropertyValueException javadoc 
Closes gh-50212
 2026-04-25 07:47:20 +01:00
Andy Wilkinson b02f7ddea3 Fix Partitioned session cooke attribute configuration with Tomcat 
Fixes gh-50201
 2026-04-24 15:06:38 +01:00
Stéphane Nicoll 47c591fe6f Merge branch '3.5.x' into 4.0.x 
Closes gh-50198
 2026-04-24 08:40:51 +02:00
Stéphane Nicoll 054bbae2d1 Merge pull request #50193 from johnnypwong 
* fix-typo-doc-spring-security-provider:
  Fix typo in OAuth2 client registration documentation

Closes gh-50193
 2026-04-24 08:40:24 +02:00
Johnny Wong fc627d4bd4 Fix typo in OAuth2 client registration documentation 
See gh-50193

Signed-off-by: Johnny Wong <37771832+johnnypwong@users.noreply.github.com>
 2026-04-24 08:39:12 +02:00
Stéphane Nicoll b1921b4438 Merge branch '3.5.x' into 4.0.x 
Closes gh-50196
 2026-04-24 08:38:01 +02:00
Stéphane Nicoll 33c7a013bb Merge pull request #50167 from dependabot[bot] 
* dependabot/npm_and_yarn/antora/fast-xml-parser-5.7.1:
  Bump fast-xml-parser from 5.5.11 to 5.7.1 in /antora

Closes gh-50167
 2026-04-24 08:37:48 +02:00
dependabot[bot] debaca0fb7 Bump fast-xml-parser from 5.5.11 to 5.7.1 in /antora 
Bumps [fast-xml-parser](https://github.com/NaturalIntelligence/fast-xml-parser) from 5.5.11 to 5.7.1.
- [Release notes](https://github.com/NaturalIntelligence/fast-xml-parser/releases)
- [Changelog](https://github.com/NaturalIntelligence/fast-xml-parser/blob/master/CHANGELOG.md)
- [Commits](https://github.com/NaturalIntelligence/fast-xml-parser/compare/v5.5.11...v5.7.1)

---
updated-dependencies:
- dependency-name: fast-xml-parser
  dependency-version: 5.7.1
  dependency-type: indirect
...

See gh-50167

Signed-off-by: dependabot[bot] <support@github.com>
 2026-04-24 08:36:11 +02:00
Andy Wilkinson 0f6adbcb6f Next development version (v4.0.7-SNAPSHOT) 2026-04-23 13:54:24 +01:00
Andy Wilkinson 9e4048a03f Merge branch '3.5.x' into 4.0.x 2026-04-23 13:54:24 +01:00
Andy Wilkinson 20bb11c398 Next development version (v3.5.15-SNAPSHOT) 2026-04-23 13:54:21 +01:00
Andy Wilkinson 98daa8ea30 Merge branch '3.5.x' into 4.0.x 2026-04-23 11:33:21 +01:00
Andy Wilkinson 9dc5aa2863 Polish 
See gh-50170
 2026-04-23 11:33:08 +01:00
Andy Wilkinson 874f6294b9 Fix default security with actuator but without health 
Closes gh-50188
 2026-04-23 08:57:18 +01:00
Andy Wilkinson e41b3bf731 Enable hostname verification for SSL connections to Elasticsearch 
Closes gh-50187
 2026-04-23 08:56:21 +01:00