[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
org.verapdf:validation-model (source)	1.30.2 → 1.30.3
org.springframework.security:spring-security-web (source)	7.1.1 → 7.1.2
org.springframework.security:spring-security-config (source)	7.1.1 → 7.1.2
org.springframework:spring-webmvc	7.0.9 → 7.0.10
org.springframework:spring-web	7.0.9 → 7.0.10
org.springframework:spring-tx	7.0.9 → 7.0.10
org.springframework:spring-test	7.0.9 → 7.0.10
org.springframework:spring-orm	7.0.9 → 7.0.10
org.springframework:spring-jdbc	7.0.9 → 7.0.10
org.springframework:spring-core	7.0.9 → 7.0.10
org.springframework:spring-context	7.0.9 → 7.0.10
org.springframework:spring-beans	7.0.9 → 7.0.10
org.springframework:spring-aspects	7.0.9 → 7.0.10
org.postgresql:postgresql (source)	42.7.13 → 42.7.14
org.apache.httpcomponents.client5:httpclient5 (source)	5.6.4 → 5.6.5
org.hibernate:hibernate-core (source)	6.6.58.Final → 6.6.59.Final

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Release Notes

spring-projects/spring-security (org.springframework.security:spring-security-web)

v7.1.2

Compare Source

🪲 Bug Fixes

• Avoid spring-core in password encoder validation
• Downgrade to Jackson 3.1
• Empty or null scope claim in dynamic client registration request should be lenient
• Ensure WebSession ID is not changed after token refresh (Reactive)
• Fix to allow null servlet request/response in ServletOAuth2AuthorizedClientExchangeFilterFunction
• Header Writers should not corrupt Jetty HttpFields state in reactive ResponseBodyEmitter handlers
• NPE with authenticationValidator in OAuth2AuthorizationCodeRequestValidatingFilter
• TokenType reference comparison is used in BearerTokenAuthentication

🔨 Dependency Upgrades

• Bump @antora/atlas-extension from 1.0.0-alpha.5 to 1.0.0-alpha.6 in /docs
• Bump actions/setup-java from 6.0.0 to 6.0.1
• Bump antora from 3.2.0 to 3.2.1 in /docs
• Bump antora from 3.2.0-rc.3 to 3.2.0 in /docs
• Bump com.webauthn4j:webauthn4j-core from 0.31.9.RELEASE to 0.31.10.RELEASE
• Bump gradle-wrapper from 9.7.0 to 9.7.1
• Bump io-spring-javaformat from 0.0.47 to 0.0.48
• Bump io.spring.develocity.conventions from 0.0.25 to 0.0.26
• Bump io.spring.gradle:spring-security-release-plugin from 1.0.15 to 1.0.16
• Bump io.spring.gradle:spring-security-release-plugin from 1.0.16 to 1.0.17
• Bump io.spring.gradle:spring-security-release-plugin from 1.0.17 to 1.0.19
• Bump io.spring.nullability:io.spring.nullability.gradle.plugin from 0.0.14 to 0.0.15
• Bump io.spring.nullability:io.spring.nullability.gradle.plugin from 0.0.15 to 0.0.16
• Bump org-jetbrains-kotlin from 2.4.10 to 2.4.20
• Bump org.hibernate.orm:hibernate-core from 7.4.5.Final to 7.4.6.Final
• Bump org.hibernate.orm:hibernate-core from 7.4.6.Final to 7.4.7.Final
• Bump org.hibernate.orm:hibernate-core from 7.4.7.Final to 7.4.10.Final
• Bump org.slf4j:slf4j-api from 2.0.18 to 2.0.19
• Bump spring-io/spring-release-actions/compute-next-version from 0.0.5 to 0.0.6
• Bump spring-io/spring-release-actions/compute-next-version from 0.0.6 to 0.0.7
• Bump spring-io/spring-release-actions/get-todays-release-version from 0.0.5 to 0.0.6
• Bump spring-io/spring-security-release-tools/.github/actions/send-notification from 1.0.17 to 1.0.18
• Bump spring-io/spring-security-release-tools/.github/workflows/build.yml from 1.0.17 to 1.0.18
• Bump spring-io/spring-security-release-tools/.github/workflows/deploy-artifacts.yml from 1.0.15 to 1.0.17
• Bump spring-io/spring-security-release-tools/.github/workflows/deploy-schema.yml from 1.0.15 to 1.0.17
• Bump spring-io/spring-security-release-tools/.github/workflows/release-announcements-publish.yml from 1.0.17 to 1.0.18
• Bump spring-io/spring-security-release-tools/.github/workflows/release-announcements-stage.yml from 1.0.16 to 1.0.17
• Bump tools.jackson:jackson-bom from 3.1.6 to 3.1.7

🔩 Build Updates

• Configure for Reproducible Builds
• Manually Set RequestedSessionId in Tests

❤️ Contributors

Thank you to all the contributors who worked on this release:

@​evgeniycheban, @​petergphillips, and @​seonwooj0810

spring-projects/spring-framework (org.springframework:spring-webmvc)

v7.0.10

⭐ New Features

• Align DelegatingMessageSource fallback implementation with AbstractMessageSource #​37383
• HttpEntity(T, MultiValueMap) stores an HttpHeaders unchecked, causing IncompatibleClassChangeError inside RestTemplate #​37358
• Recognize relocated Mockito MockAccess interface in ProxyProcessorSupport #​37342
• Runtime compatibility with JPA 4.0 M7 and corresponding Hibernate 8.0 snapshots #​37315
• Avoid Kotlin reflection in MethodParameter for non-suspending functions #​37300
• Revise underscore naming fallback in SimplePropertyRowMapper #​37297
• Avoid useless queue ops in ConcurrentLruCache.clear() #​37292
• PathMatchingResourcePatternResolver misses jars on java.class.path whose path contains % #​37280
• Remove redundant whitespace in exception messages #​37277
• OpenInView does no longer work with HibernateTransactionManager #​37273
• Lazily handle setClientInfo/setNetworkTimeout in LazyConnectionDataSourceProxy #​37261
• Avoid redundant filtering in FilteredMap.size() #​37256
• Support NaN and inifinite float values in toString() for synthesized annotations #​37244
• Use ArrayList instead of LinkedList in CompositeRetryListener #​37231
• redirectedUrl() argument in MockMvcResultMatchers should be @Nullable #​37230
• Published Gradle module file is missing javadocElements and sourcesElements #​37209
• Introduce a builder for SpelParserConfiguration #​37187
• Protobuf support classes all implement getMessageBuilder() #​37147
• Allow null contextPath in ServerHttpRequest.Builder #​37099
• Log broker availability events as String messages #​36856

🐞 Bug Fixes

• Avoid unnecessary dependent-bean registration for autowire-by-type #​37424
• Handle zero readTimeout in JdkClientHttpConnector #​37412
• Race condition in PartGenerator.CreateFileState can lose the completion signal #​37409
• Paused executor with late shutdown leaks its worker thread (and the closed context) after close #​37406
• Fix hanging retries for Flux-returning methods with caching #​37403
• Avoid serving stale values after failed refill in AbstractIdentityColumnMaxValueIncrementer #​37402
• Copy cookies in RenderingResponse.from() #​37378
• Avoid phantom keys in LinkedCaseInsensitiveMap.computeIfAbsent #​37351
• Fix single-value adaptation for primitive array types in TypeMappedAnnotation #​37349
• CssLinkResourceTransformer fails for invalid CSS links #​37336
• Fix cached ID reuse after commit failure in MySQLMaxValueIncrementer #​37322
• Fix connection leak in MySQLMaxValueIncrementer #​37321
• @CacheEvict truncates Flux results to the first element #​37309
• ConcurrentLruCache.clear() can miss entries added while it's running #​37287
• Enforce disk usage limit when spilling part to disk #​37285
• Prevent double size decrement in ConcurrentLruCache #​37268
• LogAccessor.debug(CharSequence) eagerly renders LogMessage since spring-core 7 switched from spring-jcl to commons-logging #​37266
• WebFlux loses empty multipart file when the file part is not last. #​37264
• Complete empty Uni instances from the Mutiny reactive adapter #​37259
• DefaultAsyncServerResponse.writeAsync() discards previously configured AsyncWebRequest timeout #​37257
• Provide missing native image hints for proxied hibernate 8 query types #​37251
• Provide missing native image hint for StatelessSession proxy created by SharedEntityManagerCreator. #​37249
• Provide missing native image reflection hint for hibernate PersistenceUnitInfoDescriptor. #​37247
• Sort duplicate key codes in SQLErrorCodes #​37235
• Handle zero readTimeout in JdkClientHttpRequestFactory #​37234
• Wrong reconnection attempt count in ReactorNettyTcpClient #​37223
• Stored procedure OUT parameter values are lost outside a transaction as of 7.0.9 #​37221
• Avoid int overflow in expiration time calculations in MockMvc and FlashMap #​37208
• ScheduledAnnotationBeanPostProcessor doesn't correctly support bean destruction #​37207
• Normalize function return parameter lookup in CallMetaDataContext #​37206
• Fix out-of-bounds read for truncated percent-escape in opaque host #​37203
• ClassFileTransformerAdapter deadlocks between two persistence units under load-time weaving #​37199
• Fix Kotlin value class handling for suspending AOP methods #​37191
• Update to NullAway 0.14.0 and fix new warnings #​37188
• ProtobufJsonEncoder emits JSON array when media type is ndjson #​37158
• streamingMediaTypes in ProtobufJsonEncoder not a subset of encodableMimeTypes #​37154
• Align DataBufferUtils$WriteCompletionHandler exception handling with the read() side #​37145
• DataBufferUtils.read() with NettyDataBuffer on JDK 25 hangs indefinitely #​37143
• Release queued body token buffers on multipart cancel #​37115
• Preserve async API version resolver order #​37096
• ClientResponse.mutate() builder can modify originalResponse headers. #​37086
• Custom reason is overwritten by i18n message in ResponseStatusException.updateAndGetBody() #​36984
• Generate compilable code for non-finite floating-point values #​36965
• Render parameter type names in ClassFileMethodMetadata #​36919
• Honor sourceStart offset in AbstractXMLStreamReader#getTextCharacters #​36914
• Fix reserveMethodNames to reserve each supplied name #​36912
• Replace thread-unsafe SimpleDateFormat with DateTimeFormatter in AbstractMockHttpServletRequestBuilder #​36772
• MockHttpServletRequest.isRequestedSessionIdValid() does not follow Servlet 6.1 Javadoc #​36631
• Map version from @HttpExchange to RequestMappingInfo #​36602
• Ensure that ConversionService.canConvert(Enum) no longer throws an exception #​34532

📔 Documentation

• Fix incorrect class names in WebFlux and MVC docs #​37467
• Document the XXE threat model of SourceHttpMessageConverter #​37407
• Update instructions for importing projects into Eclipse IDE #​37397
• Fix syntax errors in the reference manual #​37392
• Fix Kotlin example in Spring MVC test docs #​37388
• Document usage of type attribute in JSP <form:input> tag #​37376
• Make CONTRIBUTING.md self-contained and add AGENTS.md #​37372
• Clarify ConcurrentReferenceHashMap reference semantics #​37357
• Add missing enclosing single quotes in Javadoc #​37338
• Fix MockMvc async requests example in documentation #​37318
• Add closing braces to examples #​37305
• Fix typos in Javadoc #​37229
• Further updates to Data Binding Content in Web Sections of Documentation #​37228
• Add missing closing parenthesis in WebFlux config reference example #​37163
• Use <<id,text>> instead of xref: for local links in reference docs #​37161
• Fix broken internal xref links in reference docs #​37152
• Fix Kotlin examples in the reference manual #​37101
• Document combining @Retryable with proxy-based features #​37005
• Update recommendations for web data binding #​36789

🔨 Dependency Upgrades

• Upgrade to Micrometer 1.16.8 #​37440
• Upgrade to Reactor 2025.0.8 #​37374

❤️ Contributors

Thank you to all the contributors who worked on this release:

@​Gabriel-Gerhardt, @​Gimini-3, @​SebTardif, @​a-kogun, @​cj848, @​cookie-meringue, @​dmitrysulman, @​garvit-joshi, @​geonheeryu, @​guanchengang, @​hunseonglee, @​jhan0121, @​junhyeong9812, @​kodacme, @​lejuho, @​moonfruit, @​msridhar, @​ngocnhan-tran1996, @​noojung, @​renatomameli, @​rene-schakmann, @​shaggyinsomniac, @​timtebeek, and @​xoruddl

pgjdbc/pgjdbc (org.postgresql:postgresql)

v42.7.14

Security

• fix: a requireAuth value that excludes every authentication method, such as !password,!md5,!gss,!sspi,!scram-sha-256,!none, now refuses every method. A connection with such a value now fails with SQLState 08004. Before, the driver treated the value as if requireAuth were not set, and used any method the server asked for, even a cleartext password. This affects 42.7.11 through 42.7.13 GHSA-rhp9-mr79-r74h
• fix: a requireAuth value without a method in it, such as , or ,,, now fails with SQLState 22023. Before, the driver treated it as if requireAuth were not set. Commas at the very end of a value are still ignored, as in password,. This affects 42.7.11 through 42.7.13 GHSA-rhp9-mr79-r74h
• fix: a value shorter than its declared length, such as one from a ByteStreamWriter whose getLength() is larger than what writeTo() writes, is now padded with zeros. Before, the driver padded it with bytes of messages sent earlier on the same connection, so the stored value could contain SQL text and parameter values of earlier statements. This affects 42.7.4 through 42.7.13 GHSA-f64h-wr5q-3qf3

hibernate/hibernate-orm (org.hibernate:hibernate-core)

v6.6.59.Final

Compare Source

---

Configuration

📅 Schedule: (in timezone Europe/Zurich)

• Branch creation
  • "after 5pm on the first day of the month,on the first day of the month"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.