5.0.0: Tier 2 security & library-citizenship remediation (breaking) + Spring Boot 4.1.0 by devondragon · Pull Request #318 · devondragon/SpringUserFramework

chore(v5): start 5.0.0 line — set 5.0.0-SNAPSHOT, seed CHANGELOG/MIGRATION sections

devondragon

committed

fix(security): resolve email link base URL from configured appUrl/allowlist to prevent reset poisoning (H2, CWE-640)

devondragon

committed

fix(security): add unique constraint on token column (PasswordResetToken, VerificationToken)

devondragon

committed

fix(security): return uniform responses on registration/resend to prevent account enumeration

devondragon

committed

fix(security): require current credential for auth-method changes (remove/set password, passkey delete/rename)

devondragon

committed

fix(concurrency): unique role/privilege names + idempotent setup for multi-node startup

devondragon

committed

perf: lazy role/privilege fetch with EntityGraph on the auth path

devondragon

committed

refactor(model): replace @Data on entities with id-based equality and safe toString

devondragon

committed

refactor(events): carry ids/DTOs in async-consumed events to avoid detached-entity hazards

devondragon

committed

fix(arch): scope validation advice to library controllers; handle class-level constraint as 400

devondragon

committed

refactor: consolidate duplicate exception package into exceptions; remove empty api.data package

devondragon

committed

fix(arch): stop overriding consumer message bundle (additive registration); namespace library bean names

devondragon

committed

fix(arch): @AutoConfiguration entry point with toggleable cross-cutting @Enable* (I)

devondragon

committed

docs: add 5.0.x entries to MIGRATION.md table of contents

devondragon

committed

chore(deps): bump Spring Boot 4.0.6 -> 4.1.0 (dependabot #317)

devondragon

committed

fix(security): uniform passwordless registration response; audit guard denials

devondragon

committed

fix(arch): namespace remaining library bean names; volatile role-setup guard

devondragon

committed

fix(security): harden X-Forwarded-Host/Proto resolution in AppUrlResolver

devondragon

committed

fix(security): enforce brute-force lockout on WebAuthn credential changes

devondragon

committed

refactor: register EnvironmentPostProcessor via .imports

devondragon

committed

docs: document entity id-equality caveat; record review fixes in CHANGELOG/MIGRATION

devondragon

committed

fix: strip trailing slash from configured appUrl to honour no-trailing-slash contract

devondragon

committed

fix(roles): guard null/blank privilege names before getOrCreatePrivilege

devondragon

committed

Merge remote-tracking branch 'origin/main' into v5

devondragon

committed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

5.0.0: Tier 2 security & library-citizenship remediation (breaking) + Spring Boot 4.1.0#318

5.0.0: Tier 2 security & library-citizenship remediation (breaking) + Spring Boot 4.1.0#318
devondragon merged 24 commits into
mainfrom
v5

Commits on Jun 15, 2026

chore(v5): start 5.0.0 line — set 5.0.0-SNAPSHOT, seed CHANGELOG/MIGRATION sections

fix(security): resolve email link base URL from configured appUrl/allowlist to prevent reset poisoning (H2, CWE-640)

fix(security): add unique constraint on token column (PasswordResetToken, VerificationToken)

fix(security): return uniform responses on registration/resend to prevent account enumeration

fix(security): require current credential for auth-method changes (remove/set password, passkey delete/rename)

fix(concurrency): unique role/privilege names + idempotent setup for multi-node startup

perf: lazy role/privilege fetch with EntityGraph on the auth path

refactor(model): replace @Data on entities with id-based equality and safe toString

refactor(events): carry ids/DTOs in async-consumed events to avoid detached-entity hazards

fix(arch): scope validation advice to library controllers; handle class-level constraint as 400

refactor: consolidate duplicate exception package into exceptions; remove empty api.data package

fix(arch): stop overriding consumer message bundle (additive registration); namespace library bean names

fix(arch): @AutoConfiguration entry point with toggleable cross-cutting @Enable* (I)

docs: add 5.0.x entries to MIGRATION.md table of contents

chore(deps): bump Spring Boot 4.0.6 -> 4.1.0 (dependabot #317)

fix(security): uniform passwordless registration response; audit guard denials

fix(arch): namespace remaining library bean names; volatile role-setup guard

fix(security): harden X-Forwarded-Host/Proto resolution in AppUrlResolver

fix(security): enforce brute-force lockout on WebAuthn credential changes

refactor: register EnvironmentPostProcessor via .imports

docs: document entity id-equality caveat; record review fixes in CHANGELOG/MIGRATION

fix: strip trailing slash from configured appUrl to honour no-trailing-slash contract

fix(roles): guard null/blank privilege names before getOrCreatePrivilege

Merge remote-tracking branch 'origin/main' into v5