Product changelog

AuthKit-Lite changelog

Versioned product history for the public Spring Boot authentication foundation.

v2.0.0 — Current

The current generation moves AuthKit-Lite to Spring Boot 4 and a Java 25 LTS baseline while simplifying local startup and expanding framework-native authentication support.

Changed

  • Upgraded to Spring Boot 4.1.1 and Java 25 LTS.
  • Modernized Spring Security around OAuth2 Resource Server JWT validation instead of a custom JWT filter.
  • Improved configuration, environment overrides, testing, and local startup.

Added

  • Optional WebAuthn/passkey registration and authentication using Spring Security's native support.
  • Zero-configuration H2 development startup with Flyway-managed H2 and MySQL schemas.
  • A browser API console, updated Postman workflow, Maven wrapper, and expanded developer/AI project documentation.

Security / Architecture

  • Short-lived HS256 access tokens are validated for signature, expiry, issuer, and audience.
  • Opaque refresh tokens are stored as SHA-256 hashes, rotate under a database lock, and reject replay.
  • Stateless Bearer-token APIs remain separated from session and CSRF state required by WebAuthn ceremonies.

v1.0.0 — Initial release

Initial public AuthKit-Lite foundation from the Spring Boot 3 generation.

  • JWT access and refresh-token authentication.
  • User registration, login, secure password handling, and protected REST APIs.
  • Role-based access control as a reusable authentication starting point.