Security & reliability hardening for 4.4.0 (Tier 1 remediation, MFA #313, session regen)#314

Open

devondragon wants to merge 55 commits into

mainfrom

Commits on Jun 12, 2026

ci: add Gradle build/test workflow (JDK 17 & 21) and CodeQL
devondragon
committed
test: fix LogoutSuccessServiceTest strict-stubbing failures from Spring Security 7 Referer read
devondragon
committed
fix(security): wire SessionRegistry into filter chain so session invalidation works (H1)
devondragon
committed
fix(security): invalidate sessions on password change/reset
devondragon
committed
fix(security): enforce enabled/locked account status on OAuth2/OIDC/WebAuthn login (H3)
devondragon
committed
fix(security): enable Spring Security factor merging so MFA login works (H4)
devondragon
committed
fix(arch): make JPA auditing conditional so it doesn't hijack consumer auditing (H5)
devondragon
committed

Commits on Jun 13, 2026

Commits on Jun 14, 2026