Issues

• SubjectX500PrincipalExtractor could use the SAN or dNSName instead of CN

  status: waiting-for-triagetype: enhancement
  spring-projects/spring-security#20059 · Filter by author ah1508 opened on Nov 6, 2026

• RP-initiated logout is refused for good (invalid_token: sid) once the user's SSO session has been replaced

  status: waiting-for-triagetype: bug
  spring-projects/spring-security#20058 · Filter by author benallard opened on Nov 6, 2026

• Update spring-ldap to 4.0.7

  type: dependency-upgrade
  spring-projects/spring-security#20057 · Filter by author rwinch opened on Nov 6, 2026 · 7.0.9
  1

• Update micrometer to 1.16.9

  type: dependency-upgrade
  spring-projects/spring-security#20056 · Filter by author rwinch opened on Nov 6, 2026 · 7.0.9

• Update spring-ldap to 4.1.3

  type: dependency-upgrade
  spring-projects/spring-security#20055 · Filter by author rwinch opened on Nov 6, 2026 · 7.1.3

• Update micrometer to 1.17.3

  type: dependency-upgrade
  spring-projects/spring-security#20054 · Filter by author rwinch opened on Nov 6, 2026 · 7.1.3

• Update spring-ldap to 4.2.0

  type: dependency-upgrade
  spring-projects/spring-security#20053 · Filter by author rwinch opened on Nov 6, 2026 · 7.2.0

• Update micrometer to 1.18.0

  type: dependency-upgrade
  spring-projects/spring-security#20052 · Filter by author rwinch opened on Nov 6, 2026 · 7.2.0

• Update spring-framework to 7.0.11

  type: dependency-upgrade
  spring-projects/spring-security#20037 · Filter by author rwinch opened on Nov 5, 2026 · 7.1.3

• Update spring-framework to 7.1.0

  type: dependency-upgrade
  spring-projects/spring-security#20036 · Filter by author rwinch opened on Nov 5, 2026 · 7.2.0

• Update spring-data-bom to 2026.0.3

  type: dependency-upgrade
  spring-projects/spring-security#20035 · Filter by author rwinch opened on Nov 5, 2026 · 7.1.3

• Update spring-data-bom to 2026.1.0

  type: dependency-upgrade
  spring-projects/spring-security#20034 · Filter by author rwinch opened on Nov 5, 2026 · 7.2.0

• Update spring-framework to 7.0.11

  type: dependency-upgrade
  spring-projects/spring-security#20033 · Filter by author rwinch opened on Nov 5, 2026 · 7.0.9

• Update spring-data-bom to 2025.1.9

  type: dependency-upgrade
  spring-projects/spring-security#20032 · Filter by author rwinch opened on Nov 5, 2026 · 7.0.9

• Support enforcing Pushed Authorization Requests (require_pushed_authorization_requests: true)

  status: waiting-for-triagetype: enhancement
  spring-projects/spring-security#20031 · Filter by author scordio opened on Nov 3, 2026

• Update reactor to 2025.0.9

  type: dependency-upgrade
  spring-projects/spring-security#20027 · Filter by author rwinch opened on Nov 3, 2026 · 7.1.3

• Update reactor to 2025.0.9

  type: dependency-upgrade
  spring-projects/spring-security#20026 · Filter by author rwinch opened on Nov 3, 2026 · 7.0.9

• Update reactor to 2026.0.0

  type: dependency-upgrade
  spring-projects/spring-security#20025 · Filter by author rwinch opened on Nov 3, 2026 · 7.2.0

• JdbcUserCredentialRepository adds an empty-string transport when loading an empty transport set

  status: waiting-for-triagetype: bug
  spring-projects/spring-security#20024 · Filter by author ryujungkyun opened on Nov 3, 2026

• ClientRegistrations: an opt-in fromIssuerLocation that reads RFC 8414 first, for MCP clients

  status: waiting-for-triage
  spring-projects/spring-security#20022 · Filter by author mands opened on Nov 3, 2026

• Add native support for RFC 9207 (OAuth 2.0 Authorization Server Issuer Identification) in Authorization Server

  in: oauth2type: enhancement
  spring-projects/spring-security#20017 · Filter by author sjaeger-lxo opened on Nov 2, 2026
  1

• OidcUserInfo builder shoud accept Instant for the updateAt method

  status: waiting-for-triagetype: bug
  spring-projects/spring-security#20013 · Filter by author psevestre opened on Oct 31, 2026

• DPoP InMemoryCache: document the request-rate ceiling implied by maxRequestsPerKey

  status: waiting-for-triage
  spring-projects/spring-security#19996 · Filter by author sergioemancinas opened on Oct 27, 2026

• Allow the HTTP QUERY method in the default firewalls

  status: waiting-for-triagetype: enhancement
  spring-projects/spring-security#19995 · Filter by author kumarprabhashanand opened on Oct 26, 2026

• WebAuthn: authentication compares the signature counter against the registration-time value, not the stored signatureCount

  status: waiting-for-triagetype: bug
  spring-projects/spring-security#19994 · Filter by author codemato opened on Oct 26, 2026
  1