What's Changed

Fixes

• fix: Skip reset password requests with HEAD method (#2381) by @jbilandzija in https://github.com/cloudfoundry/uaa/pull/2389
• fix: Handle verify user requests with HEAD method by @jbilandzija in https://github.com/cloudfoundry/uaa/pull/2392
• fix: make kill more reliable by @swalchemist in https://github.com/cloudfoundry/uaa/pull/2347

Features

• feature: Store client authentication method in JWT by @strehle in https://github.com/cloudfoundry/uaa/pull/2385
• feature: Allow sending static key/value pairs to the configured IdP by @strehle in https://github.com/cloudfoundry/uaa/pull/2397

Dependency Bumps

• build(deps): bump versions.guavaVersion from 32.1.0-jre to 32.1.1-jre by @dependabot in https://github.com/cloudfoundry/uaa/pull/2393
• Bump Gradle to 8.2 by @strehle in https://github.com/cloudfoundry/uaa/pull/2396
• build(deps): bump versions.tomcatCargoVersion from 9.0.76 to 9.0.78 by @dependabot in https://github.com/cloudfoundry/uaa/pull/2400
• build(deps): bump versions.springBootVersion from 2.7.13 to 2.7.14 by @dependabot in https://github.com/cloudfoundry/uaa/pull/2409
• build(deps): bump k8s.io/client-go from 0.27.3 to 0.27.4 in /k8s by @dependabot in https://github.com/cloudfoundry/uaa/pull/2411

Misc

• Extend test coverage in OauthIDPWrapperFactoryBean by @strehle in https://github.com/cloudfoundry/uaa/pull/2399
• Add Introspection Claims Test by @strehle in https://github.com/cloudfoundry/uaa/pull/2404
• internal tests only: define more values in uaa.yml by @strehle in https://github.com/cloudfoundry/uaa/pull/2403
• Refactor: Add Instant to TimeService interface and use TimeService in UaaTokenStore by @strehle in https://github.com/cloudfoundry/uaa/pull/2315

New Contributors

• @jbilandzija made their first contribution in https://github.com/cloudfoundry/uaa/pull/2389

Full Changelog: https://github.com/cloudfoundry/uaa/compare/v76.16.0...v76.17.0

Test ONLY

• No need to consume it but created because of pipeline fixes

Full Changelog: https://github.com/cloudfoundry/uaa/compare/v76.15.0...v76.16.0

What's Changed

Fixes

• Fixes from version bump versions.bouncyCastleVersion from 1.73 to 1.75 by @dependabot in https://github.com/cloudfoundry/uaa/pull/2374 and https://github.com/cloudfoundry/uaa/pull/2382
• Fixes from version bump versions.springBootVersion from 2.7.12 to 2.7.13 by @dependabot in https://github.com/cloudfoundry/uaa/pull/2383
• Delete all user group members if user is deleted by @strehle in https://github.com/cloudfoundry/uaa/pull/2372

Features

• Credential Rotation: Support json key set in tokenKey by @strehle in https://github.com/cloudfoundry/uaa/pull/2343

Dependency Bumps

• build(deps): bump github.com/onsi/gomega from 1.27.7 to 1.27.8 in /k8s by @dependabot in https://github.com/cloudfoundry/uaa/pull/2350
• build(deps): bump commons-io:commons-io from 2.12.0 to 2.13.0 by @dependabot in https://github.com/cloudfoundry/uaa/pull/2352
• build(deps): bump versions.guavaVersion from 32.0.0-jre to 32.0.1-jre by @dependabot in https://github.com/cloudfoundry/uaa/pull/2357
• Upgrade Tomcat cargo version 9.0.76 by @strehle in https://github.com/cloudfoundry/uaa/pull/2361
• build(deps): bump org.eclipse.jgit:org.eclipse.jgit from 6.5.0.202303070854-r to 6.6.0.202305301015-r by @dependabot in https://github.com/cloudfoundry/uaa/pull/2369
• build(deps): bump versions.seleniumVersion from 4.9.1 to 4.10.0 by @dependabot in https://github.com/cloudfoundry/uaa/pull/2351
• build(deps): bump jasmine-core from 5.0.0 to 5.0.1 in /uaa by @dependabot in https://github.com/cloudfoundry/uaa/pull/2365
• build(deps): bump k8s.io/client-go from 0.27.2 to 0.27.3 in /k8s by @dependabot in https://github.com/cloudfoundry/uaa/pull/2373
• Bump jackson version 2.14.3 to 2.15.2 in https://github.com/cloudfoundry/uaa/pull/2377
• build(deps): bump org.json:json from 20230227 to 20230618 by @dependabot in https://github.com/cloudfoundry/uaa/pull/2379

Misc

• Dependency refactoring by @strehle in https://github.com/cloudfoundry/uaa/pull/2362
• Remove deprecated code for performance logs by @strehle in https://github.com/cloudfoundry/uaa/pull/2363

Full Changelog: https://github.com/cloudfoundry/uaa/compare/v76.14.0...v76.15.0

What's Changed

• build(deps): bump versions.guavaVersion from 31.1-jre to 32.0.0-jre by @dependabot in https://github.com/cloudfoundry/uaa/pull/2345

Full Changelog: https://github.com/cloudfoundry/uaa/compare/v76.13.0...v76.14.0

What's Changed

Fixes

• Fix regression from 76.12.0 in https://github.com/cloudfoundry/uaa/pull/2340
• Exclude unsupported response types in exception by @mikeroda in https://github.com/cloudfoundry/uaa/pull/2329
• CVE-2023-20883: Spring-Boot bump from 2.7.11 to 2.7.12 by @dependabot in https://github.com/cloudfoundry/uaa/pull/2332

Dependency Bumps

• build(deps): bump commons-io:commons-io from 2.11.0 to 2.12.0 by @dependabot in https://github.com/cloudfoundry/uaa/pull/2327
• build(deps): bump k8s.io/apimachinery from 0.27.1 to 0.27.2 in /k8s by @dependabot in https://github.com/cloudfoundry/uaa/pull/2330
• build(deps): bump k8s.io/api from 0.27.1 to 0.27.2 in /k8s by @dependabot in https://github.com/cloudfoundry/uaa/pull/2331
• build(deps): bump k8s.io/client-go from 0.27.1 to 0.27.2 in /k8s by @dependabot in https://github.com/cloudfoundry/uaa/pull/2333
• build(deps): bump github.com/onsi/gomega from 1.27.6 to 1.27.7 in /k8s by @dependabot in https://github.com/cloudfoundry/uaa/pull/2337
• Bump jackson 2.14.2 to 2.14.3 by @strehle in https://github.com/cloudfoundry/uaa/pull/2336

Misc

• Rrefactor while condition by @bruce-ricard in https://github.com/cloudfoundry/uaa/pull/2341

Full Changelog: https://github.com/cloudfoundry/uaa/compare/v76.12.0...v76.13.0

DO NOT USE

Contains a regression with regards to OIDC IdPs. A fix has been included in release 76.13.0

What's Changed

Fixes

• KeyInfo fixes by @strehle in https://github.com/cloudfoundry/uaa/pull/2284
• fix: mysql 5 to mysql 8 back-and-restore by aligning collation shared in both mysql 5 and 8. by @Tallicia in https://github.com/cloudfoundry/uaa/pull/2326

Dependency Bumps

• build(deps): bump versions.seleniumVersion from 4.9.0 to 4.9.1 by @dependabot in https://github.com/cloudfoundry/uaa/pull/2319
• Upgrade Tomcat cargo version 9.0.75 by @strehle in https://github.com/cloudfoundry/uaa/pull/2321
• build(deps): bump jasmine-core from 4.6.0 to 5.0.0 in /uaa by @dependabot in https://github.com/cloudfoundry/uaa/pull/2323

Misc

• Fix flaky test by @strehle in https://github.com/cloudfoundry/uaa/pull/2314

Full Changelog: https://github.com/cloudfoundry/uaa/compare/v76.11.0...v76.12.0

What's Changed

Fixes

• Update gem setting to latest slate version by @strehle in https://github.com/cloudfoundry/uaa/pull/2257
• Fix issue https://github.com/cloudfoundry/uaa/issues/2303 in https://github.com/cloudfoundry/uaa/pull/2304
• Fix for ldap.ssl.skipverification by @cache-sk in https://github.com/cloudfoundry/uaa/pull/2273
• Fix auth code cleanup function in https://github.com/cloudfoundry/uaa/pull/2292

Dependency Bumps

• build(deps): bump versions.springBootVersion from 2.7.10 to 2.7.11 by @dependabot in https://github.com/cloudfoundry/uaa/pull/2295
• build(deps): bump org.seleniumhq.selenium:selenium-java from 4.8.3 to 4.9.0 by @dependabot in https://github.com/cloudfoundry/uaa/pull/2300
• build(deps): bump org.seleniumhq.selenium:selenium-http-jdk-client from 4.8.3 to 4.9.0 by @dependabot in https://github.com/cloudfoundry/uaa/pull/2299
• Update UAA image reference in k8s to 76.10.0 by @strehle in https://github.com/cloudfoundry/uaa/pull/2306
• Consolidate selenium version by @strehle in https://github.com/cloudfoundry/uaa/pull/2307
• build(deps): bump nokogiri from 1.13.10 to 1.14.3 in /uaa/slate by @dependabot in https://github.com/cloudfoundry/uaa/pull/2276
• Bump mariadb from 2.7.8 to 2.7.9 by @strehle in https://github.com/cloudfoundry/uaa/pull/2308
• Bump Gradle to 8.1.1 by @strehle in https://github.com/cloudfoundry/uaa/pull/2312

Misc

• TDD: add test for userinfo compare by @strehle in https://github.com/cloudfoundry/uaa/pull/2294
• TDD for UaaTokenStore: count DB usage in performExpirationClean by @strehle in https://github.com/cloudfoundry/uaa/pull/2293
• Test PR 2273 by @strehle in https://github.com/cloudfoundry/uaa/pull/2313

New Contributors

• @cache-sk made their first contribution in https://github.com/cloudfoundry/uaa/pull/2273

Full Changelog: https://github.com/cloudfoundry/uaa/compare/v76.10.0...v76.11.0

What's Changed

Fixes

• Update Spring Boot from 2.7.10 to 2.7.11 in https://github.com/cloudfoundry/uaa/pull/2297, Fixes CVE-2023-20873, CVE-2023-20862, CVE-2023-20863
• Fix: Fixing performance while calling containsAll over list by @saurabh-rahate in https://github.com/cloudfoundry/uaa/pull/2272
• Fix indexOf Checks in KeystoneAuthenticationManager by @adrianhoelzl-sap in https://github.com/cloudfoundry/uaa/pull/2268
• fix for code smells by @strehle in https://github.com/cloudfoundry/uaa/pull/2285
• fix: incorrect elapsed time determination by @bruce-ricard in https://github.com/cloudfoundry/uaa/pull/2281

Features

• Feature: Add 2 new options to JWT token policy by @strehle in https://github.com/cloudfoundry/uaa/pull/2116, Solution for issues https://github.com/cloudfoundry/uaa/issues/2109 and https://github.com/cloudfoundry/uaa/issues/1816

Dependency Bumps

• Remove unused Variable in LoginInfoEndpoint.evaluateLoginHint by @adrianhoelzl-sap in https://github.com/cloudfoundry/uaa/pull/2270
• refactor UAA token store: use good time types by @bruce-ricard in https://github.com/cloudfoundry/uaa/pull/2271
• build(deps): bump org.apache.directory.api:api-ldap-model from 2.1.2 to 2.1.3 by @dependabot in https://github.com/cloudfoundry/uaa/pull/2274
• build(deps): bump k8s.io/client-go from 0.26.3 to 0.27.0 in /k8s by @dependabot in https://github.com/cloudfoundry/uaa/pull/2277
• build(deps): bump versions.bouncyCastleVersion from 1.72 to 1.73 by @dependabot in https://github.com/cloudfoundry/uaa/pull/2278
• build(deps): bump org.owasp.esapi:esapi from 2.5.1.0 to 2.5.2.0 by @dependabot in https://github.com/cloudfoundry/uaa/pull/2282
• Remove unnecessary References to "apache.directory" Library by @adrianhoelzl-sap in https://github.com/cloudfoundry/uaa/pull/2269
• build(deps): bump k8s.io/client-go from 0.27.0 to 0.27.1 in /k8s by @dependabot in https://github.com/cloudfoundry/uaa/pull/2286
• Upgrade Tomcat cargo version 9.0.74 by @strehle in https://github.com/cloudfoundry/uaa/pull/2290

New Contributors

• @saurabh-rahate made their first contribution in https://github.com/cloudfoundry/uaa/pull/2272

Full Changelog: https://github.com/cloudfoundry/uaa/compare/v76.9.0...v76.10.0

What's Changed

Fixes

• Fix missing whitelist check for authority mapping by @strehle in https://github.com/cloudfoundry/uaa/pull/2263

Dependency Bumps

• build(deps): bump org.passay:passay from 1.6.2 to 1.6.3 by @dependabot in https://github.com/cloudfoundry/uaa/pull/2247
• build(deps): bump k8s.io/client-go from 0.26.2 to 0.26.3 in /k8s by @dependabot in https://github.com/cloudfoundry/uaa/pull/2249
• build(deps): bump org.postgresql:postgresql from 42.5.4 to 42.6.0 by @dependabot in https://github.com/cloudfoundry/uaa/pull/2246
• build(deps): bump jasmine from 4.5.0 to 4.6.0 in /uaa by @dependabot in https://github.com/cloudfoundry/uaa/pull/2242
• build(deps): bump jasmine-core from 4.5.0 to 4.6.0 in /uaa by @dependabot in https://github.com/cloudfoundry/uaa/pull/2241
• build(deps): bump versions.springBootVersion from 2.7.9 to 2.7.10 by @dependabot in https://github.com/cloudfoundry/uaa/pull/2254
• Bump mariadb from 2.7.7 to 2.7.8 by @strehle in https://github.com/cloudfoundry/uaa/pull/2255
• build(deps): bump github.com/onsi/gomega from 1.27.4 to 1.27.5 in /k8s by @dependabot in https://github.com/cloudfoundry/uaa/pull/2258
• Bump snakeyaml from 1.33 to 2.0 by @strehle in https://github.com/cloudfoundry/uaa/pull/2219
• build(deps): bump org.seleniumhq.selenium:selenium-java from 4.8.1 to 4.8.3 by @dependabot in https://github.com/cloudfoundry/uaa/pull/2259
• build(deps): bump org.seleniumhq.selenium:selenium-http-jdk-client from 4.8.1 to 4.8.3 by @dependabot in https://github.com/cloudfoundry/uaa/pull/2260
• build(deps): bump github.com/onsi/gomega from 1.27.5 to 1.27.6 in /k8s by @dependabot in https://github.com/cloudfoundry/uaa/pull/2266
• build(deps): bump org.apache.santuario:xmlsec from 3.0.1 to 3.0.2 by @dependabot in https://github.com/cloudfoundry/uaa/pull/2267

Misc

• Refactor snakeyaml usage: Use newer method signatures by @strehle in https://github.com/cloudfoundry/uaa/pull/2237
• fix: Use short-circuit or operator in UserIdConversionEndpoints.checkFilter by @adrianhoelzl-sap in https://github.com/cloudfoundry/uaa/pull/2265

New Contributors

• @jaristiz made their first contribution in https://github.com/cloudfoundry/uaa/pull/2252
• @adrianhoelzl-sap made their first contribution in https://github.com/cloudfoundry/uaa/pull/2265

Full Changelog: https://github.com/cloudfoundry/uaa/compare/v76.8.0...v76.9.0

What's Changed

Features

• Increase the client redirect_uri length limit by @hsinn0 @jaristiz @peterhaochen47 in https://github.com/cloudfoundry/uaa/pull/2245

Dependency Bumps

• Upgrade Tomcat cargo version 9.0.73 by @strehle in https://github.com/cloudfoundry/uaa/pull/2222
• Update jQuery version to v3.6.3 by @strehle in https://github.com/cloudfoundry/uaa/pull/2226
• build(deps): bump org.eclipse.jgit:org.eclipse.jgit by @dependabot in https://github.com/cloudfoundry/uaa/pull/2232
• build(deps): bump com.icegreen:greenmail from 1.6.14 to 2.0.0 by @dependabot in https://github.com/cloudfoundry/uaa/pull/2227
• build(deps): bump rack from 2.0.9.2 to 2.1.4.3 in /uaa/slate by @dependabot in https://github.com/cloudfoundry/uaa/pull/2234
• build(deps): bump github.com/onsi/gomega from 1.27.2 to 1.27.3 by @dependabot in /k8s in https://github.com/cloudfoundry/uaa/pull/2238
• build(deps): bump github.com/onsi/gomega from 1.27.3 to 1.27.4 by @dependabot in /k8s in https://github.com/cloudfoundry/uaa/pull/2239

Fixes

• Fix selenium issue by @strehle in https://github.com/cloudfoundry/uaa/pull/2236

Full Changelog: https://github.com/cloudfoundry/uaa/compare/v76.7.0...v76.8.0

What's Changed

Fixes

• Fix pemEncodePublicKey by @strehle in https://github.com/cloudfoundry/uaa/pull/2210

Dependency Bumps

• build(deps): bump org.json:json from 20220924 to 20230227 by @dependabot in https://github.com/cloudfoundry/uaa/pull/2212
• build(deps): bump com.icegreen:greenmail from 1.6.13 to 1.6.14 by @dependabot in https://github.com/cloudfoundry/uaa/pull/2207
• build(deps): bump github.com/onsi/gomega from 1.27.1 to 1.27.2 in /k8s by @dependabot in https://github.com/cloudfoundry/uaa/pull/2211
• Bump Gradle to 8.0.1 by @strehle in https://github.com/cloudfoundry/uaa/pull/2197
• build(deps): bump k8s.io/client-go from 0.26.1 to 0.26.2 in /k8s by @dependabot in https://github.com/cloudfoundry/uaa/pull/2218

Full Changelog: https://github.com/cloudfoundry/uaa/compare/v76.6.0...v76.7.0

What's Changed

Features

• Configure Content Security Policy script-src by @jameshochadel in https://github.com/cloudfoundry/uaa/pull/2168

Fixes

• Documentation fix by @strehle in https://github.com/cloudfoundry/uaa/pull/2151
• Fix: add scope parameter if defined in password grant by @strehle in https://github.com/cloudfoundry/uaa/pull/2155
• Fix k8s start of SAML SP by @strehle in https://github.com/cloudfoundry/uaa/pull/2156
• wip: Updating usage of postgres SQL for v15 to avoid system tables in… by @Tallicia in https://github.com/cloudfoundry/uaa/pull/2166
• Fix SAML config: convert SamlConfig toLower by @strehle in https://github.com/cloudfoundry/uaa/pull/2158

Dependency bumps

• Bump Gradle to 7.6 by @strehle in https://github.com/cloudfoundry/uaa/pull/2139
• build(deps): bump github.com/onsi/gomega from 1.24.1 to 1.24.2 in /k8s by @dependabot in https://github.com/cloudfoundry/uaa/pull/2140
• build(deps): bump versions.springBootVersion from 2.7.6 to 2.7.7 by @dependabot in https://github.com/cloudfoundry/uaa/pull/2146
• build(deps): bump greenmail from 1.6.11 to 1.6.12 by @dependabot in https://github.com/cloudfoundry/uaa/pull/2148
• build(deps): bump nimbus-jose-jwt from 9.25.6 to 9.26 by @dependabot in https://github.com/cloudfoundry/uaa/pull/2149
• build(deps): bump nimbus-jose-jwt from 9.26 to 9.27 by @dependabot in https://github.com/cloudfoundry/uaa/pull/2152
• build(deps): bump nimbus-jose-jwt from 9.27 to 9.28 by @dependabot in https://github.com/cloudfoundry/uaa/pull/2154
• Upgrade Tomcat cargo version 9.0.71 by @strehle in https://github.com/cloudfoundry/uaa/pull/2164
• build(deps): bump github.com/onsi/gomega from 1.24.2 to 1.25.0 in /k8s by @dependabot in https://github.com/cloudfoundry/uaa/pull/2167
• build(deps): bump k8s.io/client-go from 0.26.0 to 0.26.1 in /k8s by @dependabot in https://github.com/cloudfoundry/uaa/pull/2171
• fix: bump rack from 2.1.4.2 to 2.0.9.2 in /uaa/slate by @strehle in https://github.com/cloudfoundry/uaa/pull/2177
• build(deps): bump versions.springBootVersion from 2.7.7 to 2.7.8 by @dependabot in https://github.com/cloudfoundry/uaa/pull/2176
• build(deps): bump nimbus-jose-jwt from 9.28 to 9.29 by @dependabot in https://github.com/cloudfoundry/uaa/pull/2182
• build(deps): bump github.com/onsi/gomega from 1.25.0 to 1.26.0 in /k8s by @dependabot in https://github.com/cloudfoundry/uaa/pull/2184
• build(deps): bump com.nimbusds:nimbus-jose-jwt from 9.29 to 9.30.1 by @dependabot in https://github.com/cloudfoundry/uaa/pull/2187
• build(deps): bump com.icegreen:greenmail from 1.6.12 to 1.6.13 by @dependabot in https://github.com/cloudfoundry/uaa/pull/2191
• build(deps): bump org.postgresql:postgresql from 42.5.1 to 42.5.3 by @dependabot in https://github.com/cloudfoundry/uaa/pull/2192
• build(deps): bump com.nimbusds:nimbus-jose-jwt from 9.30.1 to 9.30.2 by @dependabot in https://github.com/cloudfoundry/uaa/pull/2198
• build(deps): bump org.postgresql:postgresql from 42.5.3 to 42.5.4 by @dependabot in https://github.com/cloudfoundry/uaa/pull/2199
• build(deps): bump github.com/onsi/gomega from 1.26.0 to 1.27.0 in /k8s by @dependabot in https://github.com/cloudfoundry/uaa/pull/2200
• build(deps): bump golang.org/x/net from 0.6.0 to 0.7.0 in /k8s by @dependabot in https://github.com/cloudfoundry/uaa/pull/2201
• build(deps): bump versions.springBootVersion from 2.7.8 to 2.7.9 by @dependabot in https://github.com/cloudfoundry/uaa/pull/2204
• build(deps): bump github.com/onsi/gomega from 1.27.0 to 1.27.1 in /k8s by @dependabot in https://github.com/cloudfoundry/uaa/pull/2202
• build(deps): bump com.nimbusds:nimbus-jose-jwt from 9.30.2 to 9.31 by @dependabot in https://github.com/cloudfoundry/uaa/pull/2203

New Contributors

• @jameshochadel made their first contribution in https://github.com/cloudfoundry/uaa/pull/2168

Full Changelog: https://github.com/cloudfoundry/uaa/compare/v76.5.0...v76.6.0

What's Changed

• Docs for setting up ldap local (#2107) in https://github.com/cloudfoundry/uaa/pull/2108
• build(deps): bump postgresql from 42.5.0 to 42.5.1 in https://github.com/cloudfoundry/uaa/pull/2110
• build(deps): bump versions.springBootVersion from 2.7.5 to 2.7.6 https://github.com/cloudfoundry/uaa/pull/2111
• build(deps): bump esapi from 2.5.0.0 to 2.5.1.0 https://github.com/cloudfoundry/uaa/pull/2118
• RateLimit Change: Use nanoTime time instead of currentTimeMillis https://github.com/cloudfoundry/uaa/pull/2105
• Rate limit: protected status page https://github.com/cloudfoundry/uaa/pull/2112
• build(deps): bump org.eclipse.jgit from 6.3.0.202209071007-r to 6.4.0.202211300538-r https://github.com/cloudfoundry/uaa/pull/2123
• Upgrade Tomcat cargo version 9.0.70 https://github.com/cloudfoundry/uaa/pull/2127
• build(deps): bump nokogiri from 1.13.9 to 1.13.10 in /uaa/slate https://github.com/cloudfoundry/uaa/pull/2128
• No trace method dispatch https://github.com/cloudfoundry/uaa/pull/2129
• Feature: Add private_key_jwt for OIDC Identity Providers https://github.com/cloudfoundry/uaa/pull/2106
• delete: dead code https://github.com/cloudfoundry/uaa/pull/2133
• build(deps): bump k8s.io/client-go from 0.25.4 to 0.26.0 in /k8s https://github.com/cloudfoundry/uaa/pull/2131
• build(deps): bump nimbus-jose-jwt from 9.24.4 to 9.25.6 https://github.com/cloudfoundry/uaa/pull/2135

Full Changelog: https://github.com/cloudfoundry/uaa/compare/v76.4.0...v76.5.0

Feature

• Support refresh token rotation (#1969)
• Add a section decsribing how to run local UAA server with PostgreSQL (#2091)

Fixes

• Fix error "rawPassword cannot be null" and prevent null in password encoder (#2101)
• Increase randomness of passcode (#2072)

Dependency bumps

• Bump nimbus-jose-jwt from 8.23 to 9.24.4 (#2075)
• Use jackson in jsonpath and exclude json-smart library (#2076)
• build(deps): bump passay from 1.6.1 to 1.6.2 (#2077)
• build(deps): bump github.com/onsi/gomega from 1.22.1 to 1.23.0 (#2080)
• build(deps): bump jasmine-core from 4.4.0 to 4.5.0 (#2082)
• build(deps): bump jasmine from 4.4.0 to 4.5.0 (#2083)
• build(deps): bump javase from 3.5.0 to 3.5.1 (#2088)
• build(deps): bump github.com/onsi/gomega from 1.23.0 to 1.24.0 (#2090)
• build(deps): bump github.com/onsi/gomega from 1.24.0 to 1.24.1 in /k8s (#2092)
• build(deps): bump k8s.io/client-go from 0.25.3 to 0.25.4 (#2096)
• Upgrade Tomcat cargo version 9.0.69 (#2099)
• Bump snakeyaml 1.33 (#2104)
• Bump mariadb version 2.7.7 (#2103)

Full Changelog

• https://github.com/cloudfoundry/uaa/compare/v76.3.0...v76.4.0

Experimental Feature

• UAA Rate Limiting on API level, Howto

Full Changelog

• https://github.com/cloudfoundry/uaa/compare/v76.2.0...v76.3.0

Feature

• Set LDAP connection timeout to 30 minutes (#2063)

Fixes

• Revert codestore random generator (#2070)
• Jackson Update 2.13.4.2 because of CVE-2022-42003

Dependency bumps

• Fix sonar smells (#2049)
• Bump greenmail from 1.6.10 to 1.6.11 (#2050)
• Add test for copy-to-clipboard functionality in passcode page 0 (#2051)
• Bump github.com/onsi/gomega from 1.20.2 to 1.21.1 in /k8s (#2052)
• Update UAA server debug mode run options 0 (#2054)
• Bump k8s.io/client-go from 0.25.2 to 0.25.3 in /k8s (#2061)
• Bump commons-rng-core from 1.4 to 1.5 (#2057)
• Bump commons-rng-simple from 1.4 to 1.5 (#2056)
• Bump github.com/onsi/gomega from 1.21.1 to 1.22.1 in /k8s (#2058)
• Upgrade Tomcat cargo version 9.0.68 (#2064)
• Bump versions.springBootVersion from 2.7.4 to 2.7.5 (#2065)
• Bump nokogiri from 1.13.6 to 1.13.9 in /uaa/slate (#2066)
• Refactor refreshAccessToken() (#2069)

Full Changelog

• https://github.com/cloudfoundry/uaa/compare/v76.1.0...v76.2.0

Regression fixes

• Regression with broken copy button (#2034)
• Regression with legacy redirect patterns (#2035)

Security fixes

• Bump snakeyaml version from 1.30 to 1.32 (#2023), solves CVE-2022-38751 and CVE-2022-38752

Dependency bumps

• Bumps api-ldap-model from 1.0.3 to 2.1.2
• Bump xmlsec from 3.0.0 to 3.0.1 (#2026)
• Bump k8s.io/client-go from 0.25.0 to 0.25.1 (#2028)
• Bump jQuery version to v3.6.1 (#2033)
• Bump versions.springBootVersion from 2.7.3 to 2.7.4 (#2040)
• Bump k8s.io/client-go from 0.25.1 to 0.25.2 in /k8s (#2037)
• Bump json from 20220320 to 20220924 (#2042)
• Bump Tomcat cargo version 9.0.67 (#2045)
• Bump commons-text from 1.9 to 1.10.0 (#2047)
• Bump versions.bouncyCastleVersion from 1.71.1 to 1.72 (#2048)

Full Changelog

• https://github.com/cloudfoundry/uaa/compare/v76.0.0...v76.1.0

Security fixes

• Added Content-Security-Policy headers for responses (#1981)

Breaking Changes

• Removed the deprecated google analytics feature (#2022)

Dependency bumps

• Bump github.com/onsi/gomega from 1.20.0 to 1.20.2 in /k8s (#2012) and (#2010)
• Bump jasmine from 4.3.0 to 4.4.0 in /uaa (#2013)
• Bump jasmine-core from 4.3.0 to 4.4.0 in /uaa (#2014)
• Bump k8s.io/client-go from 0.24.4 to 0.25.0 in /k8s (#2006)
• Bump postgresql from 42.4.2 to 42.5.0 (#2009)

Notes

• MFA feature is being deprecated and will be removed in a future release (#2024)

Full Changelog

• https://github.com/cloudfoundry/uaa/compare/v75.23.0...v76.0.0

Bug Fixes

• Fix issue https://github.com/cloudfoundry/uaa/issues/1983 by https://github.com/cloudfoundry/uaa/pull/1993
• Bump postgresql from 42.3.36 to 42.4.2 (solves CVE-2022-31197) https://github.com/cloudfoundry/uaa/pull/1996

Features

• Move inline javascript to an external .js file https://github.com/cloudfoundry/uaa/pull/1977
• Feat port 74.5.33 https://github.com/cloudfoundry/uaa/pull/1986
• Feat port 74.5.41 https://github.com/cloudfoundry/uaa/pull/1978
• Feat port 74.5.36 in https://github.com/cloudfoundry/uaa/pull/1974
• Feat port 74.5.43 https://github.com/cloudfoundry/uaa/pull/1979

Dependency bumps

• Bump versions.springBootVersion from 2.7.2 to 2.7.3 https://github.com/cloudfoundry/uaa/pull/1995
• Bump versions.bouncyCastleVersion from 1.71 to 1.71.1 https://github.com/cloudfoundry/uaa/pull/2004
• Bump k8s.io/client-go from 0.24.3 to 0.24.4 in /k8s https://github.com/cloudfoundry/uaa/pull/1998
• Bump Gradle to 7.5.1 https://github.com/cloudfoundry/uaa/pull/1992 https://github.com/cloudfoundry/uaa/pull/1972
• Bump mariadb version 2.7.6 https://github.com/cloudfoundry/uaa/pull/1990
• Bump greenmail from 1.6.9 to 1.6.10 https://github.com/cloudfoundry/uaa/pull/1976

Full Changelog

• https://github.com/cloudfoundry/uaa/compare/v75.22.0...v75.23.0

Bug Fixes

• Fix SAML login flow by configuring JSESSIONID cookie https://github.com/cloudfoundry/uaa/pull/1957
• Remove xalan, fixes CVE-2022-34169 https://github.com/cloudfoundry/uaa/pull/1965
• Make DB test script compatible with postgres 13 docker image https://github.com/cloudfoundry/uaa/pull/1967
• Fix postgres migration test failure https://github.com/cloudfoundry/uaa/pull/1968
• Upport 74.5.35 https://github.com/cloudfoundry/uaa/pull/1966
• Integration test password check https://github.com/cloudfoundry/uaa/pull/1970
• Sonar findings https://github.com/cloudfoundry/uaa/pull/1971
• Documentation update sample curl output https://github.com/cloudfoundry/uaa/pull/1931
• Test for JWT Bearer Endpoint Docs https://github.com/cloudfoundry/uaa/pull/1942

Features

• Flyway support version 7 and adding mysql 8 support https://github.com/cloudfoundry/uaa/pull/1950
• Issue a refresh token for JWT Bearer Token Grant request https://github.com/cloudfoundry/uaa/pull/1935
• Added dependabot support for 74.5.x branch https://github.com/cloudfoundry/uaa/pull/1936
• Update infos for community https://github.com/cloudfoundry/uaa/pull/1934

Dependency bumps

• Bump versions.springBootVersion from 2.7.1 to 2.7.2 https://github.com/cloudfoundry/uaa/pull/1954
• Bump spring-framework-bom from 5.3.21 to 5.3.22 https://github.com/cloudfoundry/uaa/pull/1943
• Bump Tomcat cargo version 9.0.65 https://github.com/cloudfoundry/uaa/pull/1955
• Bump k8s.io/client-go from 0.24.2 to 0.24.3 in /k8s https://github.com/cloudfoundry/uaa/pull/1945
• Bump Gradle to 7.4.2 https://github.com/cloudfoundry/uaa/pull/1932
• Bump esapi from 2.4.0.0 to 2.5.0.0 https://github.com/cloudfoundry/uaa/pull/1948
• Bump tzinfo from 1.2.2 to 1.2.10 https://github.com/cloudfoundry/uaa/pull/1960
• Bump github.com/onsi/gomega from 1.19.0 https://github.com/cloudfoundry/uaa/pull/1953
• Bump jasmine from 4.2.1 to 4.3.0 in /uaa https://github.com/cloudfoundry/uaa/pull/1961
• Bump jasmine-core from 4.2.0 to 4.3.0 in https://github.com/cloudfoundry/uaa/pull/1962

Full Changelog

• https://github.com/cloudfoundry/uaa/compare/v75.21.0...v75.22.0