spring-projects/spring-security 5.0.17.RELEASE

on GitHub

⭐ New Features

• HTTP Host header attack #8640

🪲 Bug Fixes

• Remove unused field 'digester' in Md4PasswordEncoder #8578
• ACL : AclImpl.hashCode leads to StackOverflowError #8572
• Blocking in WebSessionServerCsrfTokenRepository #8547
• Fix AntPathRequestMatcher Javadoc #8529
• Document NoOpPasswordEncoder will not be removed #8524
• Fix non-standard HTTP method for CsrfWebFilter #8518

🔨 Dependency Upgrades

• Update to Jython 2.5.3 #8638
• Update to okhttp 3.12.12 #8637
• Update to mockwebserver 3.12.12 #8636