Issues

• DPoP replay cache refuses all proofs of a key after 1,000 per window, which throttles service clients

  status: waiting-for-triage
  spring-projects/spring-security#20089 · Filter by author skyglass opened on Nov 13, 2026

• Protected resource metadata advertises tls_client_certificate_bound_access_tokens: true by default

  status: waiting-for-triagetype: enhancement
  spring-projects/spring-security#20085 · Filter by author wimdeblauwe opened on Nov 12, 2026

• JdbcOAuth2AuthorizationService: a token claim built with List.of(...) or Stream.toList() is saved but cannot be read back

  status: waiting-for-triagetype: bug
  spring-projects/spring-security#20084 · Filter by author wimdeblauwe opened on Nov 12, 2026
  1

• Authorization server metadata does not list none in token_endpoint_auth_methods_supported

  status: waiting-for-triagetype: bug
  spring-projects/spring-security#20083 · Filter by author wimdeblauwe opened on Nov 12, 2026

• Refresh token clients ignore requested scopes when the response omits scope

  status: waiting-for-triagetype: bug
  spring-projects/spring-security#20063 · Filter by author ryujungkyun opened on Nov 9, 2026

• Add printable-ASCII fast path to StrictHttpFirewall header and parameter validation

  status: waiting-for-triage
  spring-projects/spring-security#20061 · Filter by author seongjun-rpls opened on Nov 9, 2026

• SubjectX500PrincipalExtractor could use the SAN or dNSName instead of CN

  status: waiting-for-triagetype: enhancement
  spring-projects/spring-security#20059 · Filter by author ah1508 opened on Nov 6, 2026

• RP-initiated logout is refused for good (invalid_token: sid) once the user's SSO session has been replaced

  status: waiting-for-triagetype: bug
  spring-projects/spring-security#20058 · Filter by author benallard opened on Nov 6, 2026

• Update spring-ldap to 4.0.7

  type: dependency-upgrade
  spring-projects/spring-security#20057 · Filter by author rwinch opened on Nov 6, 2026 · 7.0.9
  1

• Update micrometer to 1.16.9

  type: dependency-upgrade
  spring-projects/spring-security#20056 · Filter by author rwinch opened on Nov 6, 2026 · 7.0.9

• Update spring-ldap to 4.1.3

  type: dependency-upgrade
  spring-projects/spring-security#20055 · Filter by author rwinch opened on Nov 6, 2026 · 7.1.3

• Update micrometer to 1.17.3

  type: dependency-upgrade
  spring-projects/spring-security#20054 · Filter by author rwinch opened on Nov 6, 2026 · 7.1.3

• Update spring-ldap to 4.2.0

  type: dependency-upgrade
  spring-projects/spring-security#20053 · Filter by author rwinch opened on Nov 6, 2026 · 7.2.0

• Update micrometer to 1.18.0

  type: dependency-upgrade
  spring-projects/spring-security#20052 · Filter by author rwinch opened on Nov 6, 2026 · 7.2.0

• Update spring-framework to 7.0.11

  type: dependency-upgrade
  spring-projects/spring-security#20037 · Filter by author rwinch opened on Nov 5, 2026 · 7.1.3

• Update spring-framework to 7.1.0

  type: dependency-upgrade
  spring-projects/spring-security#20036 · Filter by author rwinch opened on Nov 5, 2026 · 7.2.0

• Update spring-data-bom to 2026.0.3

  type: dependency-upgrade
  spring-projects/spring-security#20035 · Filter by author rwinch opened on Nov 5, 2026 · 7.1.3

• Update spring-data-bom to 2026.1.0

  type: dependency-upgrade
  spring-projects/spring-security#20034 · Filter by author rwinch opened on Nov 5, 2026 · 7.2.0

• Update spring-framework to 7.0.11

  type: dependency-upgrade
  spring-projects/spring-security#20033 · Filter by author rwinch opened on Nov 5, 2026 · 7.0.9

• Update spring-data-bom to 2025.1.9

  type: dependency-upgrade
  spring-projects/spring-security#20032 · Filter by author rwinch opened on Nov 5, 2026 · 7.0.9

• Support enforcing Pushed Authorization Requests (require_pushed_authorization_requests: true)

  status: waiting-for-triagetype: enhancement
  spring-projects/spring-security#20031 · Filter by author scordio opened on Nov 3, 2026

• Update reactor to 2025.0.9

  type: dependency-upgrade
  spring-projects/spring-security#20027 · Filter by author rwinch opened on Nov 3, 2026 · 7.1.3

• Update reactor to 2025.0.9

  type: dependency-upgrade
  spring-projects/spring-security#20026 · Filter by author rwinch opened on Nov 3, 2026 · 7.0.9

• Update reactor to 2026.0.0

  type: dependency-upgrade
  spring-projects/spring-security#20025 · Filter by author rwinch opened on Nov 3, 2026 · 7.2.0

• JdbcUserCredentialRepository adds an empty-string transport when loading an empty transport set

  status: waiting-for-triagetype: bug
  spring-projects/spring-security#20024 · Filter by author ryujungkyun opened on Nov 3, 2026
  1