Spring Security 6.5: What's New, Release History & EOL Status

What Is New in Spring Security 6.5

How does Spring Security 6.5 improve observability with Micrometer?

Spring Security 6.5 now automatically propagates the security context into Micrometer's observation data.

• All security-related metrics inherit the current Authentication and SecurityContext without extra code.
• This matters if you rely on per-user latency or error rates in Grafana or Prometheus dashboards.
• In practice you only need to add the Micrometer dependency; the integration is plug-and-play.

implementation("org.springframework.boot:spring-boot-starter-actuator")
implementation("io.micrometer:micrometer-core")

What new OAuth 2.0 capabilities are introduced in Spring Security 6.5?

Spring Security 6.5 adds native support for OAuth 2.0 Demonstrating Proof of Possession (DPoP) and enables PKCE for confidential clients.

• DPoP protects access tokens from replay attacks by binding them to a cryptographic proof.
• Enable PKCE on confidential clients with a single setting:

ClientRegistration.withRegistrationId("my-client")
    .clientSettings(c -> c.requireProofKey(true))
    .build();

Most teams will enable DPoP on resource servers and PKCE on confidential clients to meet modern security standards.

How can I customize WebAuthn persistence and message conversion in Spring Security 6.5?

Spring Security 6.5 introduces JDBC persistence for WebAuthn credentials and lets you plug in a custom HttpMessageConverter for Passkeys.

• Define a JdbcWebAuthnRepository bean pointing at your datasource for out-of-the-box storage.
• Supply a custom converter via the DSL:

http
    .securityMatcher("/webauthn/**")
    .webAuthn(webAuthn -> webAuthn
        .messageConverter(myPasskeyConverter)
        .credentialCreationOptionsRepository(myOptionsRepo));

This flexibility is essential when integrating with legacy databases or proprietary JSON formats.

What breaking change affects metric key names in Spring Security 6.5?

The observation key security.security.reached.filter.section has been corrected to spring.security.reached.filter.section.

• Any dashboards, alerts, or scripts that query the old key must be updated.
• Failure to rename will result in missing data points after the upgrade.

How does Spring Security 6.5 support PKCE for confidential clients and what migration steps are needed?

PKCE can now be turned on for confidential clients by setting ClientRegistration.clientSettings.requireProofKey=true.

• Update your client registration configuration (both servlet and reactive).
• Test the flow against your authorization server to ensure the code_challenge is processed.
• Watch out for older clients that may not send a code_verifier; they will receive an error until they are updated.