<commit_before>[[newInV4]]
== What's New in Version 4.0

Version 4.x of the plugin requires Grails 4 or higher; to use the plugin in Grails 2 or 3 applications use the latest 3.3.x, 3.2.x or 2.x.x version of the plugin.

In general, using the Spring Security plugin in Grails 4 is nearly identical to using it in Grails 2, other than obvious differences under the hood such as no longer using `web.xml`. The configuration settings are the same, and the processes for customizing how things work (changing settings, overriding and customizing Spring beans, etc.) are generally the same. There were no package or configuration name changes, so customizations and extensions should continue to work. The plugin now uses Spring Security 4 (currently 4.0.3.RELEASE), but the changes required were primarily internal and don't affect usage. There are new features in Spring Security 4 however, and the plugin will be updated in future releases to take advantage of those.

Spring Security 5 changed the way passwords are encoded and compared for matches. Formerly a salt was passed into the encoder when calling encode for the password.
To upgrade, you must migrate your password database data first to look like so by putting the salt in curly brackets before the password:
<commit_msg>Version 4 uses Spring Security 5 now (#636)<commit_after>[[newInV4]]
== What's New in Version 4.0

Version 4.x of the plugin requires Grails 4 or higher; to use the plugin in Grails 2 or 3 applications use the latest 3.3.x, 3.2.x or 2.x.x version of the plugin.

In general, using the Spring Security plugin in Grails 4 is nearly identical to using it in Grails 2, other than obvious differences under the hood such as no longer using `web.xml`. The configuration settings are the same, and the processes for customizing how things work (changing settings, overriding and customizing Spring beans, etc.) are generally the same. There were no package or configuration name changes, so customizations and extensions should continue to work. The plugin now uses Spring Security 5 (currently 5.1.13.RELEASE), but the changes required were primarily internal and don't affect usage. There are new features in Spring Security 5 however, and the plugin will be updated in future releases to take advantage of those.

Spring Security 5 changed the way passwords are encoded and compared for matches. Formerly a salt was passed into the encoder when calling encode for the password.
To upgrade, you must migrate your password database data first to look like so by putting the salt in curly brackets before the password:

{'fraction_non_alphanumeric': 0.039722329348245274, 'fraction_numerical': 0.01774006941766294, 'mean_word_length': 4.542735042735043, 'pattern_counts': {'":': 0, '<': 3, '<?xml version=': 0, '>': 3, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 2}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '1049613', 'n_tokens_mistral': 640, 'n_tokens_neox': 580, 'n_words': 417}