Issues

• Allow disabling per-filter events in SecurityObservationSettings

  status: waiting-for-triagetype: enhancement
  spring-projects/spring-security#19922 · Filter by author ThomasVitale opened on Oct 16, 2026

• Update to Micrometer 1.18.0-RC1

  in: buildtype: dependency-upgrade
  spring-projects/spring-security#19905 · Filter by author jgrandja opened on Oct 15, 2026 · 7.2.0-RC1

• Update to Spring LDAP 4.2.0-RC1

  in: buildtype: dependency-upgrade
  spring-projects/spring-security#19904 · Filter by author jgrandja opened on Oct 15, 2026 · 7.2.0-RC1

• Update to Reactor 2026.0.0-RC1

  in: buildtype: dependency-upgrade
  spring-projects/spring-security#19903 · Filter by author jgrandja opened on Oct 15, 2026 · 7.2.0-RC1

• Update to Spring Data 2026.1.0-RC1

  in: buildtype: dependency-upgrade
  spring-projects/spring-security#19902 · Filter by author jgrandja opened on Oct 15, 2026 · 7.2.0-RC1

• Update to Spring Framework 7.1.0-RC1

  in: buildtype: dependency-upgrade
  spring-projects/spring-security#19901 · Filter by author jgrandja opened on Oct 15, 2026 · 7.2.0-RC1

• Update to Micrometer 1.17.2

  in: buildtype: dependency-upgrade
  spring-projects/spring-security#19900 · Filter by author jgrandja opened on Oct 15, 2026 · 7.1.2

• Update to Spring LDAP 4.1.2

  in: buildtype: dependency-upgrade
  spring-projects/spring-security#19899 · Filter by author jgrandja opened on Oct 15, 2026 · 7.1.2

• Update to Reactor 2025.0.8

  in: buildtype: dependency-upgrade
  spring-projects/spring-security#19898 · Filter by author jgrandja opened on Oct 15, 2026 · 7.1.2

• Update to Spring Data 2026.0.2

  in: buildtype: dependency-upgrade
  spring-projects/spring-security#19897 · Filter by author jgrandja opened on Oct 15, 2026 · 7.1.2

• Update to Spring Framework 7.0.10

  in: buildtype: dependency-upgrade
  spring-projects/spring-security#19896 · Filter by author jgrandja opened on Oct 15, 2026 · 7.1.2

• Update to Micrometer 1.16.8

  in: buildtype: dependency-upgrade
  spring-projects/spring-security#19895 · Filter by author jgrandja opened on Oct 15, 2026 · 7.0.8

• Update to Spring LDAP 4.0.6

  in: buildtype: dependency-upgrade
  spring-projects/spring-security#19894 · Filter by author jgrandja opened on Oct 15, 2026 · 7.0.8

• Update to Reactor 2025.0.8

  in: buildtype: dependency-upgrade
  spring-projects/spring-security#19893 · Filter by author jgrandja opened on Oct 15, 2026 · 7.0.8

• Update to Spring Data 2025.1.8

  in: buildtype: dependency-upgrade
  spring-projects/spring-security#19892 · Filter by author jgrandja opened on Oct 15, 2026 · 7.0.8

• Update to Spring Framework 7.0.10

  in: buildtype: dependency-upgrade
  spring-projects/spring-security#19891 · Filter by author jgrandja opened on Oct 15, 2026 · 7.0.8

• Allow configuring the DPoP Proof verifier for the Authorization Server

  status: waiting-for-triagetype: enhancement
  spring-projects/spring-security#19881 · Filter by author timpeeters opened on Oct 14, 2026

• DPoP-bound access tokens rejected at Authorization Server protected endpoints

  status: waiting-for-triagetype: bug
  spring-projects/spring-security#19876 · Filter by author timpeeters opened on Oct 13, 2026

• BearerTokenAuthenticationEntryPoint emits resource_metadata="null" when the resource metadata parameter resolver returns null

  status: waiting-for-triagetype: bug
  spring-projects/spring-security#19874 · Filter by author kelseyh opened on Oct 12, 2026

• @EnableMultiFactorAuthentication.authorities should default to {}

  status: waiting-for-triagetype: enhancement
  spring-projects/spring-security#19868 · Filter by author Ali-Hassan33 opened on Oct 9, 2026

• Missing class StringUtils since 7.1.0, causing NoClassDefFoundError

  status: waiting-for-triagetype: bug
  spring-projects/spring-security#19867 · Filter by author ewan-escience opened on Oct 9, 2026
  1

• One-time token login does not set authentication details, and authenticationDetailsSource has no effect

  status: waiting-for-triagetype: bug
  spring-projects/spring-security#19863 · Filter by author jsunsoftware opened on Oct 9, 2026

• add jdcdaoimpl username to lowercase support

  status: waiting-for-triagetype: enhancement
  spring-projects/spring-security#19849 · Filter by author joshlong opened on Oct 8, 2026

• MapUserCredentialRepository leaves a stale owner index when a credential ID is reassigned

  status: waiting-for-triagetype: bug
  spring-projects/spring-security#19847 · Filter by author 789-yu opened on Oct 8, 2026

• OAuth2 Authorization Server accepts malformed PKCE code challenges

  status: waiting-for-triagetype: bug
  spring-projects/spring-security#19845 · Filter by author gtaylor-exactsciences opened on Oct 7, 2026
  3