spring-security 7.2.0-RC1

:star: New Features

• Improve WebAuthn Registration Page no-script Handling
• Support nonce-based Content Security Policy

:beetle: Bug Fixes

• Set Content-Type to application/x-www-form-urlencoded in OpaqueTokenIntrospector

:hammer: Dependency Upgrades

• Bump @antora/atlas-extension from 1.0.0-alpha.5 to 1.0.0-alpha.6 in /docs
• Bump actions/upload-artifact from 7.0.1 to 7.0.2
• Bump antora from 3.2.0 to 3.2.1 in /docs
• Bump ch.qos.logback:logback-classic from 1.6.3 to 1.6.4
• Bump ch.qos.logback:logback-classic from 1.6.4 to 1.6.5
• Bump com.fasterxml.jackson:jackson-bom from 2.22.2 to 2.22.3
• Bump com.webauthn4j:webauthn4j-core from 0.31.10.RELEASE to 0.31.11.RELEASE
• Bump gradle-wrapper from 9.7.1 to 9.8.0
• Bump gradle-wrapper from 9.8.0 to 9.8.1
• Bump io.spring.develocity.conventions from 0.0.26 to 0.0.27
• Bump io.spring.gradle:spring-security-project-plugin from 1.0.19 to 1.0.20
• Bump io.spring.gradle:spring-security-release-plugin from 1.0.19 to 1.0.20
• Bump org-jetbrains-kotlin from 2.4.20 to 2.4.21
• Bump org.apache.httpcomponents.client5:httpclient5 from 5.6.4 to 5.6.5
• Bump org.hibernate.orm:hibernate-core from 7.4.10.Final to 7.4.11.Final
• Bump org.hibernate.orm:hibernate-core from 7.4.11.Final to 7.4.12.Final
• Bump org.hibernate.orm:hibernate-core from 7.4.12.Final to 7.4.13.Final
• Bump org.htmlunit:htmlunit from 5.5.0 to 5.6.0
• Bump org.mockito:mockito-bom from 5.23.0 to 5.24.0
• Bump org.seleniumhq.selenium:selenium-java from 4.48.0 to 4.50.0
• Bump org.seleniumhq.selenium:selenium-java from 4.48.0 to 4.51.0
• Bump org.slf4j:slf4j-api from 2.0.19 to 2.0.20
• Bump spring-io/spring-github-workflows/.github/workflows/spring-merge-dependabot-pr.yml from bf2c65c148fb74b6bd54417222662ef587463765 to 0c67c5e7c6641a18e76c520114ed0251303e77ed
• Bump spring-io/spring-github-workflows/.github/workflows/spring-merge-dependabot-pr.yml from fa7e8a8f981064983e9468225e052f14af7c67d4 to 0c09eb4023e17dd6ca395a0f4e406a4f7506a58d
• Bump spring-io/spring-github-workflows/.github/workflows/spring-merge-dependabot-pr.yml from fa7e8a8f981064983e9468225e052f14af7c67d4 to 798bca4d6aecf03e5166d85789c33c20a65499e1
• Bump spring-io/spring-github-workflows/.github/workflows/spring-merge-dependabot-pr.yml from fa7e8a8f981064983e9468225e052f14af7c67d4 to bf2c65c148fb74b6bd54417222662ef587463765
• Bump spring-io/spring-release-actions/compute-next-version from 0.0.6 to 0.0.7
• Bump spring-io/spring-release-actions/schedule-milestone from 0.0.6 to 0.0.7
• Bump spring-io/spring-security-release-tools/.github/actions/send-notification from 1.0.18 to 1.0.19
• Bump spring-io/spring-security-release-tools/.github/workflows/build.yml from 1.0.18 to 1.0.19
• Bump spring-io/spring-security-release-tools/.github/workflows/build.yml from 1.0.18 to 1.0.20
• Bump spring-io/spring-security-release-tools/.github/workflows/deploy-artifacts.yml from 1.0.18 to 1.0.19
• Bump spring-io/spring-security-release-tools/.github/workflows/deploy-artifacts.yml from 1.0.19 to 1.0.20
• Bump spring-io/spring-security-release-tools/.github/workflows/deploy-schema.yml from 1.0.18 to 1.0.19
• Bump spring-io/spring-security-release-tools/.github/workflows/deploy-schema.yml from 1.0.18 to 1.0.20
• Bump spring-io/spring-security-release-tools/.github/workflows/release-announcements-publish.yml from 1.0.18 to 1.0.20
• Bump spring-io/spring-security-release-tools/.github/workflows/test.yml from 1.0.18 to 1.0.20
• Bump tools.jackson:jackson-bom from 3.2.2 to 3.2.3

:heart: Contributors

Thank you to all the contributors who worked on this release:

@ziqin

---

Source spring-projects/spring-security · 7.2.0-RC1 · 2026-10-22 · upstream release

Mirrored verbatim for indexing. All rights belong to the upstream project.