On behalf of the team and everyone who has contributed, I am pleased to announce that the Spring Security 5.8.8, 6.0.8, 6.1.5 and 6.2.0-RC2 versions are available now.

Please refer to the releases page for more detail on what is included in each release. In particular, you can review the release notes for each milestone that will make up the 6.2.0 release (6.2.0-M1, 6.2.0-M2, 6.2.0-M3, 6.2.0-RC1, 6.2.0-RC2) next month.

We encourage you to take the latest release candidate for a spin and provide any feedback you have! Some notable changes available in the 6.2 release candidate include:

• Add with() method to apply SecurityConfigurerAdapter #13432
• Automatically enable .cors() if CorsConfigurationSource bean is present #5011
• Simplify configuration of OAuth2 Client component model #13587 (blog post, docs)
• Add OIDC Back-channel Logout Support #7845 (docs)
• Test coverage for virtual threads #12790, #12791
• Add servlet pattern support to AuthorizeHttpRequests #13857 (docs)

To update your project to use the release candidate for Gradle builds, add the following to build.gradle:

ext['spring-security.version'] = '6.2.0-RC2'

repositories {
    ...
    maven { url 'https://repo.spring.io/milestone' }
}

Or for Maven builds, add the following to pom.xml:

<properties>
  <spring-security.version>6.2.0-RC2</spring-security.version>
</properties>
<repositories>
  ...
  <repository>
    <id>spring-milestones</id>
    <name>Spring Milestones</name>
    <url>https://repo.spring.io/milestone</url>
    <snapshots>
      <enabled>false</enabled>
    </snapshots>
  </repository>
</repositories>

Note: Spring Security 6.2.0-RC2 requires Spring Framework 6.1.0-RC1.

Support

As always, we look forward to hearing your feedback on GitHub and your questions on StackOverflow!

Project Page | GitHub | Issues | Documentation