From 3d5b15cd76e916143aa1196eecb79e951a2a7508 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Tue, 9 Sep 2025 11:30:00 +0000 Subject: [PATCH 1/2] deps(deps): bump org.springframework.security:spring-security-crypto Bumps [org.springframework.security:spring-security-crypto](https://github.com/spring-projects/spring-security) from 6.2.1 to 6.5.3. - [Release notes](https://github.com/spring-projects/spring-security/releases) - [Changelog](https://github.com/spring-projects/spring-security/blob/main/RELEASE.adoc) - [Commits](https://github.com/spring-projects/spring-security/compare/6.2.1...6.5.3) --- updated-dependencies: - dependency-name: org.springframework.security:spring-security-crypto dependency-version: 6.5.3 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] --- build.gradle.kts | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/build.gradle.kts b/build.gradle.kts index b56438b..b68b895 100644 --- a/build.gradle.kts +++ b/build.gradle.kts @@ -23,7 +23,7 @@ dependencies { // Integration test dependencies testImplementation("org.bouncycastle:bcprov-jdk18on:1.81") - testImplementation("org.springframework.security:spring-security-crypto:6.2.1") + testImplementation("org.springframework.security:spring-security-crypto:6.5.3") testImplementation("commons-logging:commons-logging:1.3.5") } From 00793df2e71c91f53f8c544f9515d68b7e5f7e40 Mon Sep 17 00:00:00 2001 From: Sebastian Veit Date: Tue, 9 Sep 2025 13:22:48 +0200 Subject: [PATCH 2/2] deps: bump org.springframework.security:spring-security-crypto to 6.5.3 - Updated Spring Security Crypto from 6.2.1 to 6.5.3 - Fixed SpringSecurityIntegrationTest to handle new behavior: Spring Security 6.5.3+ now throws IllegalArgumentException for passwords longer than 72 bytes instead of silently truncating - Updated test to verify the exception is thrown and adjusted assertions to work with the new behavior - All tests passing with the updated dependency Signed-off-by: Sebastian Veit --- .../SpringSecurityIntegrationTest.java | 23 +++++++++++-------- 1 file changed, 13 insertions(+), 10 deletions(-) diff --git a/src/test/java/com/lucimber/crypto/bcrypt/integration/SpringSecurityIntegrationTest.java b/src/test/java/com/lucimber/crypto/bcrypt/integration/SpringSecurityIntegrationTest.java index 6e9ec00..c059203 100644 --- a/src/test/java/com/lucimber/crypto/bcrypt/integration/SpringSecurityIntegrationTest.java +++ b/src/test/java/com/lucimber/crypto/bcrypt/integration/SpringSecurityIntegrationTest.java @@ -195,27 +195,30 @@ void shouldHandlePasswordTruncationLikeSpring() { String longPassword = "a".repeat(100); String truncatedTo72 = "a".repeat(72); - // Spring Security hash - String springHashLong = springEncoder.encode(longPassword); + // Spring Security 6.5.3+ now throws exception for passwords > 72 bytes + assertThrows(IllegalArgumentException.class, () -> { + springEncoder.encode(longPassword); + }, "Spring Security 6.5.3+ throws exception for passwords > 72 bytes"); - // Spring should verify truncated version - assertTrue(springEncoder.matches(truncatedTo72, springHashLong), - "Spring truncates at 72 bytes"); + // Spring Security should work with exactly 72 bytes + String springHash72 = springEncoder.encode(truncatedTo72); + assertTrue(springEncoder.matches(truncatedTo72, springHash72), + "Spring should handle 72-byte passwords"); - // Our implementation should also verify + // Our implementation truncates internally and should verify Password truncatedPwd = new Password(truncatedTo72); - Hash hash = new Hash(springHashLong); + Hash hash = new Hash(springHash72); assertTrue(service.verify(truncatedPwd, hash), - "Our implementation should handle truncation like Spring"); + "Our implementation should verify Spring's 72-byte hash"); - // Generate with our implementation + // Generate with our implementation (which truncates internally) Password longPwd = new Password(longPassword); Hash ourHash = service.hash(longPwd); // Spring should verify with truncated password assertTrue(springEncoder.matches(truncatedTo72, ourHash.getValue()), - "Spring should verify our truncated hash"); + "Spring should verify our truncated hash with 72-byte password"); } @Test