6.0.0

Release date: 20 July 2026

• FORGE-590
  Upgrade plugin to support brXM 17, JDK21, and Spring Security 7.0.6

5.0.1

Release date: TBD

• FORGE-559
  Fix Spring Security 6 endpoint configuration for binary servlet resources: add missing /content/** security-none pattern required because the /binaries servlet internally translates requests to /content/** paths. Adds a realistic public/protected endpoint model to the demo and documents the Spring Security 6 endpoint configuration guide in the README.

5.0.0

Release date: 05 September 2024

• FORGE-525
  Upgrade plugin to support brXM 16, JDK17

4.0.0

Release date: 27 June 2022

• HIPFORGE-421
  Upgrade plugin to support brXM 15, mainly build on Java 11 and upgrade the demo project to version 15.
• Dependency management: extend from hippo-cms7-project 15 to inherit versions, notably:
  - Spring framework dependency version goes from 5.2.1.RELEASE to 5.3.18
  - Spring Security dependency version goes from 5.2.1.RELEASE to 5.6.1
  Note that the dependencies have 'provided' scope so the dependencies are not pulled in.

3.1.0 (Unreleased)

Release date: TBD

• HIPFORGE-353
  - Bump (provided) Spring dependency version from 5.2.1.RELEASE to 5.2.8.RELEASE
  - Bump (provided) Spring Security dependency version from 5.2.1.RELEASE to 5.3.4.RELEASE
  - Bump (provided) commons-beanutils dependency version from 1.8.0 to 1.9.4

3.0.0

Release date: 06 March 2020

• HIPFORGE-328 - Spring Security Support for brXM v14.0

2.1.0

Release date: 17 December 2019

• HIPFORGE-245 - Upgrade for Spring 5.2.1.RELEASE and Bloomreach CMS version 13.2 and up. If there's already an applicationContext-security.xml in your project, add an entry to allow "_cmssessioncontext", see Configuration page.
• Make the Essentials installer plugin work again and improve its log messages on exception.

2.0.0

Release date: 18 January 2019

• HIPFORGE-245 - Upgrade for Spring 5.1.1.RELEASE and Bloomreach CMS version 13.0

1.1.3

Release date: 22 March 2017

• Fixing NPE when user is not found.
• Supporting org.onehippo.forge.security.support.springsecurity.authentication.HippoUser providing user's first name, last name and e-mail address as UserDetails object of Spring Security Authentication.

1.1.2

• Removing org.springframework.dao.DataAccessException in API because it is pulled in by spring-tx jar which is not included by HST-2 any more.
• Upgrading Spring Security Framework to 4.0.4.
• Adding dependency exclusions in Spring Security Framework dependencies because it is safer for HST-2 to pull in Spring Framework dependencies.
• Adding basic authentication example in a commented block.

1.1.1

• Use delegating repository instead of pooling repository when authenticating a user.

1.1.0

• Compatible with Spring Security 4.0.x and Hippo CMS 10

0.03.01

• Let SpringSecurityValve extend org.hippoecm.hst.core.container.AbstractBaseOrderableValve
• Polishing demo project and improving site/javadoc documentation

0.03.00

• Upgrading Spring Security Framework dependency and Hippo CMS 7.8
• Adding URL exclusions example in demo to bypass authentication on requests from Channel Manager

0.02.05

• Remove project specific components. The followings were removed because they were too project specific and not generic enough:
  • HippoEmailUserDetailsServiceImpl
  • HippoUserDetailsServiceImpl
  • HippoUsernamePasswordAuthenticationFilter
  • Hippo Specific Authentication Login/Logout/Remember Me filters (HippoLoginFilter, HippoLogoutFilter, HippoTokenBasedRememberMeServices, etc) and components
• HIPPLUG-666: Avoid NPE when password is not stored in UserDetails
• Note: Please do not use the released versions [0.02.01, 0.02.04] because they have some project specific additions which will not be supported in the future.

0.02.01

• Better support of Spring Security within the Channel Manager
• Add the support of Remember Me
• Enable user authentication using their email

0.01.00

• Initial release.