chore: upgrade Spring User Framework to 5.3.1

[devondragon]

Bumps com.digitalsanctuary:ds-spring-user-framework from 5.3.0 to 5.3.1.

Why

5.3.1 fixes POST /user/resendRegistrationToken. Under 5.3.0 the endpoint bound the full registration UserDto, whose firstName/lastName/password/matchingPassword are @NotBlank, so the email-only payload resend-verification.js posts was rejected with HTTP 400 and no mail went out. That is the breakage this repo documented as a known limitation in docs/AUTHENTICATION.md and docs/CONFIGURATION.md. 5.3.1 binds ResendVerificationDto instead and returns 200.

Otherwise a patch release: no new public API, configuration keys, or behavior requiring changes here. (release notes)

Changes

• build.gradle — 5.3.0 → 5.3.1
• UserApiIntegrationTestFixed — three tests on the resend endpoint: an email-only body returns 200, an unknown address returns the identical generic body (anti-enumeration), a malformed email returns 400
• docs/AUTHENTICATION.md, docs/CONFIGURATION.md — replaced the known-limitation notes with current behavior
• README.md, docs/EXTENDING.md — version references
• CHANGELOG.md — 2026-08-18 entry

Testing

./gradlew clean build passes: 312 tests, 0 failures, 130 executed. The 182 skips are pre-existing @Disabled classes, unchanged by this PR.

The two positive resend tests were verified to fail against 5.3.0 and pass against 5.3.1, so they actually cover the fix. The malformed-email test passes on both versions (5.3.0 returned 400 for a different reason) and is there to keep validation covered.

Not done: playwright/tests/auth/email-verification.spec.ts:181 only asserts the resend page loads and never submits the form, so it would not have caught this bug and still won't. Making it submit needs the app running against a real database, which I could not verify in this environment, so I left it rather than add an unrun assertion.

[Copilot]

Pull request overview

This PR upgrades the demo app’s Spring User Framework dependency from 5.3.0 → 5.3.1 to pick up the framework-side fix for POST /user/resendRegistrationToken (email-only payload now binds correctly and returns 200), and updates this repo’s tests + documentation to reflect the restored behavior.

Changes:

• Bump com.digitalsanctuary:ds-spring-user-framework to 5.3.1.
• Add integration test coverage for the resend-verification endpoint, including anti-enumeration behavior and malformed-email validation.
• Update docs/README/changelog references to remove the prior “known limitation” and reflect the current behavior and version.

Reviewed changes

Copilot reviewed 6 out of 7 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
src/test/java/com/digitalsanctuary/spring/user/api/UserApiIntegrationTestFixed.java	Adds integration tests for /user/resendRegistrationToken (email-only payload, anti-enumeration response, malformed email).
build.gradle	Upgrades the framework dependency to 5.3.1.
docs/AUTHENTICATION.md	Updates the resend-verification section to describe the generic anti-enumeration response (removes prior broken-note).
docs/CONFIGURATION.md	Updates Mailpit/Docker-stack notes to reflect resend-verification working as of 5.3.1.
README.md	Updates the main branch’s documented framework version to 5.3.1.
docs/EXTENDING.md	Updates the documented framework version reference to 5.3.1.
CHANGELOG.md	Adds a 2026-08-18 entry documenting the upgrade and resend-verification fix + added tests.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.