spring-projects · bostko · Aug 10, 2026
diff --git a/build.gradle b/build.gradle
@@ -1,6 +1,6 @@
 plugins {
 	id "io.spring.convention.root"
-	id "io.spring.security.release" version "1.0.11"
+	id "io.spring.security.release" version "1.0.15"
 }
 
 group = "org.springframework.security"

diff --git a/docs/modules/ROOT/examples/samples b/docs/modules/ROOT/examples/samples
diff --git a/docs/spring-authorization-server-docs.gradle b/docs/spring-authorization-server-docs.gradle
@@ -51,10 +51,8 @@ repositories {
 }
 
 dependencies {
-	implementation(platform("org.springframework.boot:spring-boot-dependencies:4.0.0-M2")) {
-		exclude group: "org.springframework.security", module: "spring-security-oauth2-authorization-server"
-	}
-	implementation platform("org.springframework.security:spring-security-bom:7.0.0-M2")
+	implementation(platform("org.springframework.boot:spring-boot-dependencies:4.1.0"))
+	implementation platform("org.springframework.security:spring-security-bom:7.1.0")
 	implementation "org.springframework.boot:spring-boot-starter-web"
 	implementation "org.springframework.boot:spring-boot-starter-thymeleaf"
 	implementation "org.springframework.boot:spring-boot-starter-security"
@@ -67,10 +65,10 @@ dependencies {
 	}
 	implementation "redis.clients:jedis"
 	implementation "org.springframework:spring-webflux"
-	implementation project(":spring-security-oauth2-authorization-server")
 	runtimeOnly "com.h2database:h2"
 	testRuntimeOnly "org.junit.platform:junit-platform-launcher"
 	testImplementation "org.springframework.boot:spring-boot-starter-test"
+	testImplementation "org.springframework.boot:spring-boot-starter-webmvc-test"
 	testImplementation "org.springframework.boot:spring-boot-starter-webclient"
 	testImplementation "org.springframework.security:spring-security-test"
 	testImplementation "com.github.codemonstur:embedded-redis:1.4.3"

diff --git a/docs/src/main/java/sample/extgrant/SecurityConfig.java b/docs/src/main/java/sample/extgrant/SecurityConfig.java
@@ -24,6 +24,7 @@
 import org.springframework.context.annotation.Configuration;
 import org.springframework.security.config.annotation.web.builders.HttpSecurity;
 import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
+import org.springframework.security.config.annotation.web.configurers.oauth2.server.authorization.OAuth2AuthorizationServerConfigurer;
 import org.springframework.security.oauth2.core.AuthorizationGrantType;
 import org.springframework.security.oauth2.core.ClientAuthenticationMethod;
 import org.springframework.security.oauth2.jwt.NimbusJwtEncoder;
@@ -32,7 +33,6 @@
 import org.springframework.security.oauth2.server.authorization.client.InMemoryRegisteredClientRepository;
 import org.springframework.security.oauth2.server.authorization.client.RegisteredClient;
 import org.springframework.security.oauth2.server.authorization.client.RegisteredClientRepository;
-import org.springframework.security.oauth2.server.authorization.config.annotation.web.configurers.OAuth2AuthorizationServerConfigurer;
 import org.springframework.security.oauth2.server.authorization.token.DelegatingOAuth2TokenGenerator;
 import org.springframework.security.oauth2.server.authorization.token.JwtGenerator;
 import org.springframework.security.oauth2.server.authorization.token.OAuth2AccessTokenGenerator;
@@ -52,7 +52,7 @@ SecurityFilterChain authorizationServerSecurityFilterChain(
 			OAuth2TokenGenerator<?> tokenGenerator) throws Exception {
 
 		OAuth2AuthorizationServerConfigurer authorizationServerConfigurer =
-				OAuth2AuthorizationServerConfigurer.authorizationServer();
+				new OAuth2AuthorizationServerConfigurer();
 
 		http
 			.securityMatcher(authorizationServerConfigurer.getEndpointsMatcher())

diff --git a/docs/src/main/java/sample/gettingstarted/SecurityConfig.java b/docs/src/main/java/sample/gettingstarted/SecurityConfig.java
@@ -34,6 +34,8 @@
 import org.springframework.security.config.Customizer;
 import org.springframework.security.config.annotation.web.builders.HttpSecurity;
 import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
+import org.springframework.security.config.annotation.web.configuration.OAuth2AuthorizationServerConfiguration;
+import org.springframework.security.config.annotation.web.configurers.oauth2.server.authorization.OAuth2AuthorizationServerConfigurer;
 import org.springframework.security.core.userdetails.User;
 import org.springframework.security.core.userdetails.UserDetails;
 import org.springframework.security.core.userdetails.UserDetailsService;
@@ -44,8 +46,6 @@
 import org.springframework.security.oauth2.server.authorization.client.InMemoryRegisteredClientRepository;
 import org.springframework.security.oauth2.server.authorization.client.RegisteredClient;
 import org.springframework.security.oauth2.server.authorization.client.RegisteredClientRepository;
-import org.springframework.security.oauth2.server.authorization.config.annotation.web.configuration.OAuth2AuthorizationServerConfiguration;
-import org.springframework.security.oauth2.server.authorization.config.annotation.web.configurers.OAuth2AuthorizationServerConfigurer;
 import org.springframework.security.oauth2.server.authorization.settings.AuthorizationServerSettings;
 import org.springframework.security.oauth2.server.authorization.settings.ClientSettings;
 import org.springframework.security.provisioning.InMemoryUserDetailsManager;
@@ -62,7 +62,7 @@ public class SecurityConfig {
 	public SecurityFilterChain authorizationServerSecurityFilterChain(HttpSecurity http)
 			throws Exception {
 		OAuth2AuthorizationServerConfigurer authorizationServerConfigurer =
-				OAuth2AuthorizationServerConfigurer.authorizationServer();
+				new OAuth2AuthorizationServerConfigurer();
 
 		// @formatter:off
 		http

diff --git a/docs/src/main/java/sample/jpa/service/authorization/JpaOAuth2AuthorizationService.java b/docs/src/main/java/sample/jpa/service/authorization/JpaOAuth2AuthorizationService.java
@@ -15,20 +15,8 @@
  */
 package sample.jpa.service.authorization;
 
-import java.time.Instant;
-import java.util.List;
-import java.util.Map;
-import java.util.Optional;
-import java.util.function.Consumer;
-
-import com.fasterxml.jackson.core.type.TypeReference;
-import com.fasterxml.jackson.databind.Module;
-import com.fasterxml.jackson.databind.ObjectMapper;
-import sample.jpa.entity.authorization.Authorization;
-import sample.jpa.repository.authorization.AuthorizationRepository;
-
 import org.springframework.dao.DataRetrievalFailureException;
-import org.springframework.security.jackson2.SecurityJackson2Modules;
+import org.springframework.security.jackson.SecurityJacksonModules;
 import org.springframework.security.oauth2.core.AuthorizationGrantType;
 import org.springframework.security.oauth2.core.OAuth2AccessToken;
 import org.springframework.security.oauth2.core.OAuth2DeviceCode;
@@ -44,16 +32,27 @@
 import org.springframework.security.oauth2.server.authorization.OAuth2TokenType;
 import org.springframework.security.oauth2.server.authorization.client.RegisteredClient;
 import org.springframework.security.oauth2.server.authorization.client.RegisteredClientRepository;
-import org.springframework.security.oauth2.server.authorization.jackson2.OAuth2AuthorizationServerJackson2Module;
+import org.springframework.security.oauth2.server.authorization.jackson.OAuth2AuthorizationServerJacksonModule;
 import org.springframework.stereotype.Component;
 import org.springframework.util.Assert;
 import org.springframework.util.StringUtils;
+import sample.jpa.entity.authorization.Authorization;
+import sample.jpa.repository.authorization.AuthorizationRepository;
+import tools.jackson.core.type.TypeReference;
+import tools.jackson.databind.JacksonModule;
+import tools.jackson.databind.json.JsonMapper;
+
+import java.time.Instant;
+import java.util.List;
+import java.util.Map;
+import java.util.Optional;
+import java.util.function.Consumer;
 
 @Component
 public class JpaOAuth2AuthorizationService implements OAuth2AuthorizationService {
 	private final AuthorizationRepository authorizationRepository;
 	private final RegisteredClientRepository registeredClientRepository;
-	private final ObjectMapper objectMapper = new ObjectMapper();
+	private final JsonMapper objectMapper;
 
 	public JpaOAuth2AuthorizationService(AuthorizationRepository authorizationRepository, RegisteredClientRepository registeredClientRepository) {
 		Assert.notNull(authorizationRepository, "authorizationRepository cannot be null");
@@ -62,9 +61,12 @@ public JpaOAuth2AuthorizationService(AuthorizationRepository authorizationReposi
 		this.registeredClientRepository = registeredClientRepository;
 
 		ClassLoader classLoader = JpaOAuth2AuthorizationService.class.getClassLoader();
-		List<Module> securityModules = SecurityJackson2Modules.getModules(classLoader);
-		this.objectMapper.registerModules(securityModules);
-		this.objectMapper.registerModule(new OAuth2AuthorizationServerJackson2Module());
+
+		List<JacksonModule> securityModules = SecurityJacksonModules.getModules(classLoader);
+		objectMapper = JsonMapper.builder()
+				.addModules(securityModules)
+				.addModule(new OAuth2AuthorizationServerJacksonModule())
+				.build();
 	}
 
 	@Override

diff --git a/docs/src/main/java/sample/jpa/service/client/JpaRegisteredClientRepository.java b/docs/src/main/java/sample/jpa/service/client/JpaRegisteredClientRepository.java
@@ -20,37 +20,39 @@
 import java.util.Map;
 import java.util.Set;
 
-import com.fasterxml.jackson.core.type.TypeReference;
-import com.fasterxml.jackson.databind.Module;
-import com.fasterxml.jackson.databind.ObjectMapper;
+import org.springframework.security.jackson.SecurityJacksonModules;
+import org.springframework.security.oauth2.server.authorization.jackson.OAuth2AuthorizationServerJacksonModule;
 import sample.jpa.entity.client.Client;
 import sample.jpa.repository.client.ClientRepository;
 
-import org.springframework.security.jackson2.SecurityJackson2Modules;
 import org.springframework.security.oauth2.core.AuthorizationGrantType;
 import org.springframework.security.oauth2.core.ClientAuthenticationMethod;
 import org.springframework.security.oauth2.server.authorization.client.RegisteredClient;
 import org.springframework.security.oauth2.server.authorization.client.RegisteredClientRepository;
-import org.springframework.security.oauth2.server.authorization.jackson2.OAuth2AuthorizationServerJackson2Module;
 import org.springframework.security.oauth2.server.authorization.settings.ClientSettings;
 import org.springframework.security.oauth2.server.authorization.settings.TokenSettings;
 import org.springframework.stereotype.Component;
 import org.springframework.util.Assert;
 import org.springframework.util.StringUtils;
+import tools.jackson.core.type.TypeReference;
+import tools.jackson.databind.JacksonModule;
+import tools.jackson.databind.json.JsonMapper;
 
 @Component
 public class JpaRegisteredClientRepository implements RegisteredClientRepository {
 	private final ClientRepository clientRepository;
-	private final ObjectMapper objectMapper = new ObjectMapper();
+	private final JsonMapper objectMapper;
 
 	public JpaRegisteredClientRepository(ClientRepository clientRepository) {
 		Assert.notNull(clientRepository, "clientRepository cannot be null");
 		this.clientRepository = clientRepository;
 
 		ClassLoader classLoader = JpaRegisteredClientRepository.class.getClassLoader();
-		List<Module> securityModules = SecurityJackson2Modules.getModules(classLoader);
-		this.objectMapper.registerModules(securityModules);
-		this.objectMapper.registerModule(new OAuth2AuthorizationServerJackson2Module());
+		List<JacksonModule> securityModules = SecurityJacksonModules.getModules(classLoader);
+		this.objectMapper = JsonMapper.builder()
+				.addModules(securityModules)
+				.addModule(new OAuth2AuthorizationServerJacksonModule())
+				.build();
 	}
 
 	@Override

diff --git a/docs/src/main/java/sample/pkce/SecurityConfig.java b/docs/src/main/java/sample/pkce/SecurityConfig.java
@@ -22,7 +22,7 @@
 import org.springframework.security.config.Customizer;
 import org.springframework.security.config.annotation.web.builders.HttpSecurity;
 import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
-import org.springframework.security.oauth2.server.authorization.config.annotation.web.configurers.OAuth2AuthorizationServerConfigurer;
+import org.springframework.security.config.annotation.web.configurers.oauth2.server.authorization.OAuth2AuthorizationServerConfigurer;
 import org.springframework.security.web.SecurityFilterChain;
 import org.springframework.security.web.authentication.LoginUrlAuthenticationEntryPoint;
 import org.springframework.security.web.util.matcher.MediaTypeRequestMatcher;
@@ -40,7 +40,7 @@ public SecurityFilterChain authorizationServerSecurityFilterChain(HttpSecurity h
 			throws Exception {
 		// @fold:on
 		OAuth2AuthorizationServerConfigurer authorizationServerConfigurer =
-				OAuth2AuthorizationServerConfigurer.authorizationServer();
+				new OAuth2AuthorizationServerConfigurer();
 
 		// @formatter:off
 		http

diff --git a/docs/src/main/java/sample/redis/convert/BytesToClaimsHolderConverter.java b/docs/src/main/java/sample/redis/convert/BytesToClaimsHolderConverter.java
@@ -15,28 +15,28 @@
  */
 package sample.redis.convert;
 
-import com.fasterxml.jackson.databind.ObjectMapper;
+import org.springframework.data.redis.serializer.JacksonJsonRedisSerializer;
+import org.springframework.security.jackson.SecurityJacksonModules;
+import org.springframework.security.oauth2.server.authorization.jackson.OAuth2AuthorizationServerJacksonModule;
 import sample.redis.entity.OAuth2AuthorizationGrantAuthorization;
 
 import org.springframework.core.convert.converter.Converter;
 import org.springframework.data.convert.ReadingConverter;
-import org.springframework.data.redis.serializer.Jackson2JsonRedisSerializer;
-import org.springframework.security.jackson2.SecurityJackson2Modules;
-import org.springframework.security.oauth2.server.authorization.jackson2.OAuth2AuthorizationServerJackson2Module;
+import tools.jackson.databind.json.JsonMapper;
 
 @ReadingConverter
 public class BytesToClaimsHolderConverter
 		implements Converter<byte[], OAuth2AuthorizationGrantAuthorization.ClaimsHolder> {
 
-	private final Jackson2JsonRedisSerializer<OAuth2AuthorizationGrantAuthorization.ClaimsHolder> serializer;
+	private final JacksonJsonRedisSerializer<OAuth2AuthorizationGrantAuthorization.ClaimsHolder> serializer;
 
 	public BytesToClaimsHolderConverter() {
-		ObjectMapper objectMapper = new ObjectMapper();
-		objectMapper
-			.registerModules(SecurityJackson2Modules.getModules(BytesToClaimsHolderConverter.class.getClassLoader()));
-		objectMapper.registerModule(new OAuth2AuthorizationServerJackson2Module());
-		objectMapper.addMixIn(OAuth2AuthorizationGrantAuthorization.ClaimsHolder.class, ClaimsHolderMixin.class);
-		this.serializer = new Jackson2JsonRedisSerializer<>(objectMapper,
+		JsonMapper objectMapper = JsonMapper.builder()
+				.addModules(SecurityJacksonModules.getModules(BytesToClaimsHolderConverter.class.getClassLoader()))
+				.addModule(new OAuth2AuthorizationServerJacksonModule())
+				.addMixIn(OAuth2AuthorizationGrantAuthorization.ClaimsHolder.class, ClaimsHolderMixin.class)
+				.build();
+		this.serializer = new JacksonJsonRedisSerializer<>(objectMapper,
 				OAuth2AuthorizationGrantAuthorization.ClaimsHolder.class);
 	}
 

diff --git a/docs/src/main/java/sample/redis/convert/BytesToOAuth2AuthorizationRequestConverter.java b/docs/src/main/java/sample/redis/convert/BytesToOAuth2AuthorizationRequestConverter.java
@@ -15,26 +15,25 @@
  */
 package sample.redis.convert;
 
-import com.fasterxml.jackson.databind.ObjectMapper;
-
 import org.springframework.core.convert.converter.Converter;
 import org.springframework.data.convert.ReadingConverter;
-import org.springframework.data.redis.serializer.Jackson2JsonRedisSerializer;
-import org.springframework.security.jackson2.SecurityJackson2Modules;
+import org.springframework.data.redis.serializer.JacksonJsonRedisSerializer;
+import org.springframework.security.jackson.SecurityJacksonModules;
 import org.springframework.security.oauth2.core.endpoint.OAuth2AuthorizationRequest;
-import org.springframework.security.oauth2.server.authorization.jackson2.OAuth2AuthorizationServerJackson2Module;
+import org.springframework.security.oauth2.server.authorization.jackson.OAuth2AuthorizationServerJacksonModule;
+import tools.jackson.databind.json.JsonMapper;
 
 @ReadingConverter
 public class BytesToOAuth2AuthorizationRequestConverter implements Converter<byte[], OAuth2AuthorizationRequest> {
 
-	private final Jackson2JsonRedisSerializer<OAuth2AuthorizationRequest> serializer;
+	private final JacksonJsonRedisSerializer<OAuth2AuthorizationRequest> serializer;
 
 	public BytesToOAuth2AuthorizationRequestConverter() {
-		ObjectMapper objectMapper = new ObjectMapper();
-		objectMapper.registerModules(
-				SecurityJackson2Modules.getModules(BytesToOAuth2AuthorizationRequestConverter.class.getClassLoader()));
-		objectMapper.registerModule(new OAuth2AuthorizationServerJackson2Module());
-		this.serializer = new Jackson2JsonRedisSerializer<>(objectMapper, OAuth2AuthorizationRequest.class);
+		JsonMapper objectMapper = JsonMapper.builder()
+				.addModules(SecurityJacksonModules.getModules(BytesToOAuth2AuthorizationRequestConverter.class.getClassLoader()))
+				.addModule(new OAuth2AuthorizationServerJacksonModule())
+				.build();
+		this.serializer = new JacksonJsonRedisSerializer<>(objectMapper, OAuth2AuthorizationRequest.class);
 	}
 
 	@Override

diff --git a/...c/main/java/sample/redis/convert/BytesToUsernamePasswordAuthenticationTokenConverter.java b/...c/main/java/sample/redis/convert/BytesToUsernamePasswordAuthenticationTokenConverter.java
@@ -15,25 +15,26 @@
  */
 package sample.redis.convert;
 
-import com.fasterxml.jackson.databind.ObjectMapper;
-
 import org.springframework.core.convert.converter.Converter;
 import org.springframework.data.convert.ReadingConverter;
-import org.springframework.data.redis.serializer.Jackson2JsonRedisSerializer;
+import org.springframework.data.redis.serializer.JacksonJsonRedisSerializer;
 import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
-import org.springframework.security.jackson2.SecurityJackson2Modules;
+import org.springframework.security.jackson.SecurityJacksonModules;
+import org.springframework.security.oauth2.server.authorization.jackson.OAuth2AuthorizationServerJacksonModule;
+import tools.jackson.databind.json.JsonMapper;
 
 @ReadingConverter
 public class BytesToUsernamePasswordAuthenticationTokenConverter
 		implements Converter<byte[], UsernamePasswordAuthenticationToken> {
 
-	private final Jackson2JsonRedisSerializer<UsernamePasswordAuthenticationToken> serializer;
+	private final JacksonJsonRedisSerializer<UsernamePasswordAuthenticationToken> serializer;
 
 	public BytesToUsernamePasswordAuthenticationTokenConverter() {
-		ObjectMapper objectMapper = new ObjectMapper();
-		objectMapper.registerModules(SecurityJackson2Modules
-			.getModules(BytesToUsernamePasswordAuthenticationTokenConverter.class.getClassLoader()));
-		this.serializer = new Jackson2JsonRedisSerializer<>(objectMapper, UsernamePasswordAuthenticationToken.class);
+		JsonMapper objectMapper = JsonMapper.builder()
+				.addModules(SecurityJacksonModules.getModules(BytesToUsernamePasswordAuthenticationTokenConverter.class.getClassLoader()))
+				.addModule(new OAuth2AuthorizationServerJacksonModule())
+				.build();;
+		this.serializer = new JacksonJsonRedisSerializer<>(objectMapper, UsernamePasswordAuthenticationToken.class);
 	}
 
 	@Override