Update dependency org.springframework.boot:spring-boot-starter-security to v3.5.9 #27

Open
renovate wants to merge 1 commits from renovate/org.springframework.boot-spring-boot-starter-security-3.x into main
Collaborator

This PR contains the following updates:

Package Type Update Change
org.springframework.boot:spring-boot-starter-security (source) compile patch 3.5.73.5.9

Release Notes

spring-projects/spring-boot (org.springframework.boot:spring-boot-starter-security)

v3.5.9

Compare Source

🐞 Bug Fixes

  • RabbitHealthIndicator reports an error when version is missing from the connection's server properties #​48486
  • Profiles retained during AOT processing are not configured in a native image #​48475
  • NullPointerException in UndertowWebServer.destroy() when using @DirtiesContext and Citrus Spring Boot Simulator #​48450
  • Redis health check reports an error when redis_version is missing from the INFO response #​48326
  • Parent's MeterRegistry beans are closed when child context closes #​48324
  • SpringBootTest.UseMainMethod.WHEN_AVAILABLE and ALWAYS are incompatible with package-private or parameter-less main method #​48271

📔 Documentation

  • Documentation has an outdated reference to the Jackson Kotlin Module #​48533
  • Caching documentation should clarify how to use a no-op implementation to run a test suite #​48531
  • Document that the default rolling policy for Log4j2 requires logging.file.path to be set #​48526
  • License header in build samples is displayed in the reference documentation #​48477
  • Configuring Two DataSources How-To code sample is inconsistent #​48448
  • Improve javadoc for when to use class names rather than class references #​48395
  • Document that org.aspectj.weaver.Advice must be on the classpath to enable support for Micrometer's annotations #​48359
  • Polish TestRestTemplate examples in the reference guide #​48335
  • Fix links to javadoc in the reference documentation #​48299
  • Clarify that @EnableBatchProcessing turns off all batch auto-configuration, including schema initialization #​48265
  • Kotlin auto-configuration examples are not annotated with @AutoConfiguration #​48227
  • Infinispan Cache Documentation is outdated #​48217
  • Revise "Use Liquibase for test-only migrations" section in reference manual #​48169

🔨 Dependency Upgrades

❤️ Contributors

Thank you to all the contributors who worked on this release:

@​banseok1216, @​berry120, @​dmitrysulman, @​geopark021, @​noojung, @​scottfrederick, @​vpavic, and @​youngledo

v3.5.8

Compare Source

⚠️ Noteworthy changes

🐞 Bug Fixes

  • Gradle war task does not exclude starter POMs from lib-provided #​48196
  • Testcontainers integration fails on Docker 29.0.0 #​48192
  • SslMeterBinder doesn't register metrics for dynamically added bundles if no bundles exist at bind time #​48180
  • Properties bound in the child management context ignore the parent's environment prefix #​48176
  • ssl.chain.expiry metrics doesn't update for dynamically registered SSL bundles #​48153
  • Auto-configuration exclusions are checked using a different class loader to the one that loads auto-configuration classes #​48129
  • New arm64 macbooks fail to bootBuildImage due to incorrect platform image #​48127
  • NullPointerException when using @ConditionalOnSingleCandidate with multiple manually registered singletons #​48123
  • Buildpack fails with recent Docker installs due to hardcoded version in URL #​48102
  • Image building may fail when specifying a platform if an image has already been built with a different platform #​48098
  • Undertow's ServletContext is destroy too early, making it unusable in @PreDestroy methods #​48061
  • PortInUseException incorrectly thrown on failure to bind port due to Netty IP misconfiguration #​48058
  • Auto-configured JCacheMetrics cannot be customized #​48056
  • WebSecurityCustomizer beans are excluded by WebMvcTest #​48054
  • Devtools Restarter does not work with a parameterless main method #​47987
  • Setting 'max-uri-tags' does not prevent unlimited meter growth on any AutoConfiguredCompositeMeterRegistry #​47923
  • Docker response 407 is not handled correctly resulting in no error message #​47900
  • spring-boot-maven-plugin process-aot goal does not find package-private main method #​47780

📔 Documentation

  • Revise AWS section of "Deploying to the Cloud" in reference manual #​48156
  • Fix typo in PortInUseException Javadoc #​48133
  • Correct section about required setters in "Type-safe Configuration Properties" #​48130
  • Document EndpointObjectMapper and management.endpoints.jackson.isolated-object-mapper #​48114
  • Document support for configuring servlet context init parameters using properties #​48111
  • Clarify how warnings about soon-to-expire SSL certificates are reported #​48062
  • Document how to use ContextPropagatingTaskDecorator for propagating trace context over thread boundaries #​48052
  • Use since attribute in configuration properties deprecation consistently #​47980
  • BootstrapContext#getOrElseThrow has incorrect reference to IllegalStateException #​47905
  • Clarify when BootstrapContext get methods may return null rather than throwing an exception or calling the fallback supplier #​47898
  • Document that Actuator endpoint may have at most one extension of each type #​47873
  • Limit Kotlin API documentation to Kotlin-specific APIs #​47859
  • Adapt AOTCache documentation to JEP 514 #​47274

🔨 Dependency Upgrades

❤️ Contributors

Thank you to all the contributors who worked on this release:

@​K-jun98, @​TerryTaoYY, @​hojooo, @​linw-bai, @​mipo256, @​namest504, @​ngocnhan-tran1996, @​nosan, @​scottfrederick, @​siva-sai-udaygiri, @​tschut, and @​vpavic


Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.


  • If you want to rebase/retry this PR, check this box

This PR has been generated by Renovate Bot.

This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [org.springframework.boot:spring-boot-starter-security](https://spring.io/projects/spring-boot) ([source](https://github.com/spring-projects/spring-boot)) | compile | patch | `3.5.7` → `3.5.9` | --- ### Release Notes <details> <summary>spring-projects/spring-boot (org.springframework.boot:spring-boot-starter-security)</summary> ### [`v3.5.9`](https://github.com/spring-projects/spring-boot/releases/tag/v3.5.9) [Compare Source](https://github.com/spring-projects/spring-boot/compare/v3.5.8...v3.5.9) #### :lady\_beetle: Bug Fixes - RabbitHealthIndicator reports an error when version is missing from the connection's server properties [#&#8203;48486](https://github.com/spring-projects/spring-boot/issues/48486) - Profiles retained during AOT processing are not configured in a native image [#&#8203;48475](https://github.com/spring-projects/spring-boot/issues/48475) - NullPointerException in UndertowWebServer.destroy() when using `@DirtiesContext` and Citrus Spring Boot Simulator [#&#8203;48450](https://github.com/spring-projects/spring-boot/issues/48450) - Redis health check reports an error when redis\_version is missing from the INFO response [#&#8203;48326](https://github.com/spring-projects/spring-boot/issues/48326) - Parent's MeterRegistry beans are closed when child context closes [#&#8203;48324](https://github.com/spring-projects/spring-boot/issues/48324) - SpringBootTest.UseMainMethod.WHEN\_AVAILABLE and ALWAYS are incompatible with package-private or parameter-less main method [#&#8203;48271](https://github.com/spring-projects/spring-boot/issues/48271) #### :notebook\_with\_decorative\_cover: Documentation - Documentation has an outdated reference to the Jackson Kotlin Module [#&#8203;48533](https://github.com/spring-projects/spring-boot/issues/48533) - Caching documentation should clarify how to use a no-op implementation to run a test suite [#&#8203;48531](https://github.com/spring-projects/spring-boot/issues/48531) - Document that the default rolling policy for Log4j2 requires logging.file.path to be set [#&#8203;48526](https://github.com/spring-projects/spring-boot/issues/48526) - License header in build samples is displayed in the reference documentation [#&#8203;48477](https://github.com/spring-projects/spring-boot/issues/48477) - Configuring Two DataSources How-To code sample is inconsistent [#&#8203;48448](https://github.com/spring-projects/spring-boot/issues/48448) - Improve javadoc for when to use class names rather than class references [#&#8203;48395](https://github.com/spring-projects/spring-boot/issues/48395) - Document that org.aspectj.weaver.Advice must be on the classpath to enable support for Micrometer's annotations [#&#8203;48359](https://github.com/spring-projects/spring-boot/issues/48359) - Polish TestRestTemplate examples in the reference guide [#&#8203;48335](https://github.com/spring-projects/spring-boot/issues/48335) - Fix links to javadoc in the reference documentation [#&#8203;48299](https://github.com/spring-projects/spring-boot/issues/48299) - Clarify that `@EnableBatchProcessing` turns off all batch auto-configuration, including schema initialization [#&#8203;48265](https://github.com/spring-projects/spring-boot/issues/48265) - Kotlin auto-configuration examples are not annotated with `@AutoConfiguration` [#&#8203;48227](https://github.com/spring-projects/spring-boot/issues/48227) - Infinispan Cache Documentation is outdated [#&#8203;48217](https://github.com/spring-projects/spring-boot/issues/48217) - Revise "Use Liquibase for test-only migrations" section in reference manual [#&#8203;48169](https://github.com/spring-projects/spring-boot/pull/48169) #### :hammer: Dependency Upgrades - Prevent upgrade to Netty 4.1.129.Final [#&#8203;48508](https://github.com/spring-projects/spring-boot/issues/48508) - Upgrade to AspectJ 1.9.25.1 [#&#8203;48557](https://github.com/spring-projects/spring-boot/issues/48557) - Upgrade to Hibernate 6.6.39.Final [#&#8203;48540](https://github.com/spring-projects/spring-boot/issues/48540) - Upgrade to Jetty 12.0.31 [#&#8203;48455](https://github.com/spring-projects/spring-boot/issues/48455) - Upgrade to jOOQ 3.19.29 [#&#8203;48456](https://github.com/spring-projects/spring-boot/issues/48456) - Upgrade to Logback 1.5.22 [#&#8203;48507](https://github.com/spring-projects/spring-boot/issues/48507) - Upgrade to MariaDB 3.5.7 [#&#8203;48558](https://github.com/spring-projects/spring-boot/issues/48558) - Upgrade to Micrometer 1.15.7 [#&#8203;48423](https://github.com/spring-projects/spring-boot/issues/48423) - Upgrade to Micrometer Tracing 1.5.7 [#&#8203;48424](https://github.com/spring-projects/spring-boot/issues/48424) - Upgrade to Netty 4.1.130.Final [#&#8203;48541](https://github.com/spring-projects/spring-boot/issues/48541) - Upgrade to Pooled JMS 3.1.8 [#&#8203;48559](https://github.com/spring-projects/spring-boot/issues/48559) - Upgrade to Pulsar 4.0.8 [#&#8203;48457](https://github.com/spring-projects/spring-boot/issues/48457) - Upgrade to Quartz 2.5.2 [#&#8203;48458](https://github.com/spring-projects/spring-boot/issues/48458) - Upgrade to Reactor Bom 2024.0.13 [#&#8203;48425](https://github.com/spring-projects/spring-boot/issues/48425) - Upgrade to Spring Authorization Server 1.5.5 [#&#8203;48426](https://github.com/spring-projects/spring-boot/issues/48426) - Upgrade to Spring Data Bom 2025.0.7 [#&#8203;48427](https://github.com/spring-projects/spring-boot/issues/48427) - Upgrade to Spring Framework 6.2.15 [#&#8203;48428](https://github.com/spring-projects/spring-boot/issues/48428) - Upgrade to Spring GraphQL 1.4.4 [#&#8203;48429](https://github.com/spring-projects/spring-boot/issues/48429) - Upgrade to Spring Integration 6.5.5 [#&#8203;48560](https://github.com/spring-projects/spring-boot/issues/48560) - Upgrade to Spring LDAP 3.3.5 [#&#8203;48430](https://github.com/spring-projects/spring-boot/issues/48430) - Upgrade to Spring Pulsar 1.2.13 [#&#8203;48431](https://github.com/spring-projects/spring-boot/issues/48431) - Upgrade to Spring Session 3.5.4 [#&#8203;48432](https://github.com/spring-projects/spring-boot/issues/48432) - Upgrade to Testcontainers 1.21.4 [#&#8203;48542](https://github.com/spring-projects/spring-boot/issues/48542) - Upgrade to UnboundID LDAPSDK 7.0.4 [#&#8203;48459](https://github.com/spring-projects/spring-boot/issues/48459) #### :heart: Contributors Thank you to all the contributors who worked on this release: [@&#8203;banseok1216](https://github.com/banseok1216), [@&#8203;berry120](https://github.com/berry120), [@&#8203;dmitrysulman](https://github.com/dmitrysulman), [@&#8203;geopark021](https://github.com/geopark021), [@&#8203;noojung](https://github.com/noojung), [@&#8203;scottfrederick](https://github.com/scottfrederick), [@&#8203;vpavic](https://github.com/vpavic), and [@&#8203;youngledo](https://github.com/youngledo) ### [`v3.5.8`](https://github.com/spring-projects/spring-boot/releases/tag/v3.5.8) [Compare Source](https://github.com/spring-projects/spring-boot/compare/v3.5.7...v3.5.8) #### :warning: Noteworthy changes - This release [contains a fix](https://github.com/spring-projects/spring-boot/issues/48104) to get Testcontainers working with modern Docker versions. If this causes problems in your setup, [you can downgrade the minimum Docker API](https://docs.spring.io/spring-boot/3.4/how-to/testing.html#howto.testing.testcontainers-api-downgrade), effectively reverting that change. #### :lady\_beetle: Bug Fixes - Gradle war task does not exclude starter POMs from lib-provided [#&#8203;48196](https://github.com/spring-projects/spring-boot/issues/48196) - Testcontainers integration fails on Docker 29.0.0 [#&#8203;48192](https://github.com/spring-projects/spring-boot/issues/48192) - SslMeterBinder doesn't register metrics for dynamically added bundles if no bundles exist at bind time [#&#8203;48180](https://github.com/spring-projects/spring-boot/issues/48180) - Properties bound in the child management context ignore the parent's environment prefix [#&#8203;48176](https://github.com/spring-projects/spring-boot/issues/48176) - ssl.chain.expiry metrics doesn't update for dynamically registered SSL bundles [#&#8203;48153](https://github.com/spring-projects/spring-boot/pull/48153) - Auto-configuration exclusions are checked using a different class loader to the one that loads auto-configuration classes [#&#8203;48129](https://github.com/spring-projects/spring-boot/pull/48129) - New arm64 macbooks fail to bootBuildImage due to incorrect platform image [#&#8203;48127](https://github.com/spring-projects/spring-boot/issues/48127) - NullPointerException when using `@ConditionalOnSingleCandidate` with multiple manually registered singletons [#&#8203;48123](https://github.com/spring-projects/spring-boot/issues/48123) - Buildpack fails with recent Docker installs due to hardcoded version in URL [#&#8203;48102](https://github.com/spring-projects/spring-boot/issues/48102) - Image building may fail when specifying a platform if an image has already been built with a different platform [#&#8203;48098](https://github.com/spring-projects/spring-boot/issues/48098) - Undertow's ServletContext is destroy too early, making it unusable in `@PreDestroy` methods [#&#8203;48061](https://github.com/spring-projects/spring-boot/issues/48061) - PortInUseException incorrectly thrown on failure to bind port due to Netty IP misconfiguration [#&#8203;48058](https://github.com/spring-projects/spring-boot/issues/48058) - Auto-configured JCacheMetrics cannot be customized [#&#8203;48056](https://github.com/spring-projects/spring-boot/issues/48056) - WebSecurityCustomizer beans are excluded by WebMvcTest [#&#8203;48054](https://github.com/spring-projects/spring-boot/issues/48054) - Devtools Restarter does not work with a parameterless main method [#&#8203;47987](https://github.com/spring-projects/spring-boot/pull/47987) - Setting 'max-uri-tags' does not prevent unlimited meter growth on any AutoConfiguredCompositeMeterRegistry [#&#8203;47923](https://github.com/spring-projects/spring-boot/issues/47923) - Docker response 407 is not handled correctly resulting in no error message [#&#8203;47900](https://github.com/spring-projects/spring-boot/issues/47900) - spring-boot-maven-plugin process-aot goal does not find package-private main method [#&#8203;47780](https://github.com/spring-projects/spring-boot/issues/47780) #### :notebook\_with\_decorative\_cover: Documentation - Revise AWS section of "Deploying to the Cloud" in reference manual [#&#8203;48156](https://github.com/spring-projects/spring-boot/pull/48156) - Fix typo in PortInUseException Javadoc [#&#8203;48133](https://github.com/spring-projects/spring-boot/issues/48133) - Correct section about required setters in "Type-safe Configuration Properties" [#&#8203;48130](https://github.com/spring-projects/spring-boot/issues/48130) - Document EndpointObjectMapper and management.endpoints.jackson.isolated-object-mapper [#&#8203;48114](https://github.com/spring-projects/spring-boot/issues/48114) - Document support for configuring servlet context init parameters using properties [#&#8203;48111](https://github.com/spring-projects/spring-boot/issues/48111) - Clarify how warnings about soon-to-expire SSL certificates are reported [#&#8203;48062](https://github.com/spring-projects/spring-boot/issues/48062) - Document how to use ContextPropagatingTaskDecorator for propagating trace context over thread boundaries [#&#8203;48052](https://github.com/spring-projects/spring-boot/issues/48052) - Use since attribute in configuration properties deprecation consistently [#&#8203;47980](https://github.com/spring-projects/spring-boot/pull/47980) - BootstrapContext#getOrElseThrow has incorrect reference to IllegalStateException [#&#8203;47905](https://github.com/spring-projects/spring-boot/issues/47905) - Clarify when BootstrapContext get methods may return null rather than throwing an exception or calling the fallback supplier [#&#8203;47898](https://github.com/spring-projects/spring-boot/issues/47898) - Document that Actuator endpoint may have at most one extension of each type [#&#8203;47873](https://github.com/spring-projects/spring-boot/issues/47873) - Limit Kotlin API documentation to Kotlin-specific APIs [#&#8203;47859](https://github.com/spring-projects/spring-boot/issues/47859) - Adapt AOTCache documentation to JEP 514 [#&#8203;47274](https://github.com/spring-projects/spring-boot/issues/47274) #### :hammer: Dependency Upgrades - Downgrade to Cassandra Driver 4.19.0 [#&#8203;47926](https://github.com/spring-projects/spring-boot/issues/47926) - Upgrade to AspectJ 1.9.25 [#&#8203;48005](https://github.com/spring-projects/spring-boot/issues/48005) - Upgrade to Caffeine 3.2.3 [#&#8203;48006](https://github.com/spring-projects/spring-boot/issues/48006) - Upgrade to Cassandra Driver 4.19.2 [#&#8203;48183](https://github.com/spring-projects/spring-boot/issues/48183) - Upgrade to DB2 JDBC 12.1.3.0 [#&#8203;48083](https://github.com/spring-projects/spring-boot/issues/48083) - Upgrade to Hibernate 6.6.36.Final [#&#8203;48148](https://github.com/spring-projects/spring-boot/issues/48148) - Upgrade to Jackson Bom 2.19.4 [#&#8203;48008](https://github.com/spring-projects/spring-boot/issues/48008) - Upgrade to Jetty 12.0.30 [#&#8203;48118](https://github.com/spring-projects/spring-boot/issues/48118) - Upgrade to Jetty Reactive HTTPClient 4.0.13 [#&#8203;48149](https://github.com/spring-projects/spring-boot/issues/48149) - Upgrade to jOOQ 3.19.28 [#&#8203;48084](https://github.com/spring-projects/spring-boot/issues/48084) - Upgrade to Logback 1.5.21 [#&#8203;48085](https://github.com/spring-projects/spring-boot/issues/48085) - Upgrade to Micrometer 1.15.6 [#&#8203;48009](https://github.com/spring-projects/spring-boot/issues/48009) - Upgrade to Micrometer Tracing 1.5.6 [#&#8203;48010](https://github.com/spring-projects/spring-boot/issues/48010) - Upgrade to MySQL 9.5.0 [#&#8203;48011](https://github.com/spring-projects/spring-boot/issues/48011) - Upgrade to Neo4j Java Driver 5.28.10 [#&#8203;48044](https://github.com/spring-projects/spring-boot/issues/48044) - Upgrade to Quartz 2.5.1 [#&#8203;48012](https://github.com/spring-projects/spring-boot/issues/48012) - Upgrade to R2DBC Postgresql 1.0.9.RELEASE [#&#8203;48013](https://github.com/spring-projects/spring-boot/issues/48013) - Upgrade to Reactor Bom 2024.0.12 [#&#8203;48014](https://github.com/spring-projects/spring-boot/issues/48014) - Upgrade to Spring Data Bom 2025.0.6 [#&#8203;48039](https://github.com/spring-projects/spring-boot/issues/48039) - Upgrade to Spring Framework 6.2.14 [#&#8203;48166](https://github.com/spring-projects/spring-boot/issues/48166) - Upgrade to Spring Integration 6.5.4 [#&#8203;48040](https://github.com/spring-projects/spring-boot/issues/48040) - Upgrade to Spring Kafka 3.3.11 [#&#8203;48041](https://github.com/spring-projects/spring-boot/issues/48041) - Upgrade to Spring Pulsar 1.2.12 [#&#8203;48042](https://github.com/spring-projects/spring-boot/issues/48042) - Upgrade to Spring Security 6.5.7 [#&#8203;48043](https://github.com/spring-projects/spring-boot/issues/48043) - Upgrade to Tomcat 10.1.49 [#&#8203;48086](https://github.com/spring-projects/spring-boot/issues/48086) #### :heart: Contributors Thank you to all the contributors who worked on this release: [@&#8203;K-jun98](https://github.com/K-jun98), [@&#8203;TerryTaoYY](https://github.com/TerryTaoYY), [@&#8203;hojooo](https://github.com/hojooo), [@&#8203;linw-bai](https://github.com/linw-bai), [@&#8203;mipo256](https://github.com/mipo256), [@&#8203;namest504](https://github.com/namest504), [@&#8203;ngocnhan-tran1996](https://github.com/ngocnhan-tran1996), [@&#8203;nosan](https://github.com/nosan), [@&#8203;scottfrederick](https://github.com/scottfrederick), [@&#8203;siva-sai-udaygiri](https://github.com/siva-sai-udaygiri), [@&#8203;tschut](https://github.com/tschut), and [@&#8203;vpavic](https://github.com/vpavic) </details> --- ### Configuration 📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0Mi4xOC4wIiwidXBkYXRlZEluVmVyIjoiNDIuNjIuMCIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOltdfQ==-->
renovate added 1 commit 2025-11-20 17:02:52 +01:00
Update dependency org.springframework.boot:spring-boot-starter-security to v3.5.8
Some checks failed
continuous-integration/drone/push Build is passing
continuous-integration/drone/pr Build is failing
475ffcfd53
renovate force-pushed renovate/org.springframework.boot-spring-boot-starter-security-3.x from 475ffcfd53 to 8434cdbc1e 2025-12-18 13:03:19 +01:00 Compare
renovate changed title from Update dependency org.springframework.boot:spring-boot-starter-security to v3.5.8 to Update dependency org.springframework.boot:spring-boot-starter-security to v3.5.9 2025-12-18 13:03:19 +01:00
Some checks failed
continuous-integration/drone/pr Build is failing
continuous-integration/drone/push Build is passing
This pull request can be merged automatically.
You are not authorized to merge this pull request.
View command line instructions

Checkout

From your project repository, check out a new branch and test the changes.
git fetch -u origin renovate/org.springframework.boot-spring-boot-starter-security-3.x:renovate/org.springframework.boot-spring-boot-starter-security-3.x
git checkout renovate/org.springframework.boot-spring-boot-starter-security-3.x
Sign in to join this conversation.
No Reviewers
No Label
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: bea/release-hive#27