Merge branch '7.1.x'

# Conflicts:
#	gradle/libs.versions.toml

cas/src/main/java/org/springframework/security/cas/userdetails/GrantedAuthorityFromAssertionAttributesUserDetailsService.java

@@ -61,7 +61,9 @@ public final class GrantedAuthorityFromAssertionAttributesUserDetailsService
 			if (value != null) {
 				if (value instanceof List) {
 					for (Object o : (List<?>) value) {
-						grantedAuthorities.add(createSimpleGrantedAuthority(o));
+						if (o != null) {
+							grantedAuthorities.add(createSimpleGrantedAuthority(o));
+						}
 					}
 				}
 				else {

core/src/main/java/org/springframework/security/core/authority/mapping/MapBasedAttributes2GrantedAuthoritiesMapper.java

@@ -26,6 +26,8 @@ import java.util.Map;
 import java.util.Set;
 import java.util.StringTokenizer;
 
+import org.jspecify.annotations.Nullable;
+
 import org.springframework.beans.factory.InitializingBean;
 import org.springframework.security.core.GrantedAuthority;
 import org.springframework.security.core.authority.SimpleGrantedAuthority;
@@ -121,7 +123,7 @@ public class MapBasedAttributes2GrantedAuthoritiesMapper
 	 * to the given result collection.
 	 * @param value The value to convert to a GrantedAuthority Collection
 	 */
-	private void addGrantedAuthorityCollection(Collection<GrantedAuthority> result, Object value) {
+	private void addGrantedAuthorityCollection(Collection<GrantedAuthority> result, @Nullable Object value) {
 		if (value == null) {
 			return;
 		}

core/src/main/java/org/springframework/security/task/DelegatingSecurityContextAsyncTaskExecutor.java

@@ -72,7 +72,7 @@ public class DelegatingSecurityContextAsyncTaskExecutor extends DelegatingSecuri
 	}
 
 	@Override
-	public final <T> Future<T> submit(Callable<T> task) {
+	public final <T extends @Nullable Object> Future<T> submit(Callable<T> task) {
 		return getDelegate().submit(wrap(task));
 	}
 

gradle/libs.versions.toml

@@ -104,7 +104,7 @@ org-hidetake-gradle-ssh-plugin = "org.hidetake:gradle-ssh-plugin:2.10.1"
 org-jfrog-buildinfo-build-info-extractor-gradle = "org.jfrog.buildinfo:build-info-extractor-gradle:6.0.4"
 org-sonarsource-scanner-gradle-sonarqube-gradle-plugin = "org.sonarsource.scanner.gradle:sonarqube-gradle-plugin:2.8.0.1969"
 org-instancio-instancio-junit = "org.instancio:instancio-junit:3.7.1"
-spring-nullability = 'io.spring.nullability:io.spring.nullability.gradle.plugin:0.0.14'
+spring-nullability = 'io.spring.nullability:io.spring.nullability.gradle.plugin:0.0.16'
 webauthn4j-core = 'com.webauthn4j:webauthn4j-core:0.31.10.RELEASE'
 com-password4j-password4j = { module = "com.password4j:password4j", version.ref = "com-password4j" }
 

oauth2/oauth2-client/src/main/java/org/springframework/security/oauth2/client/oidc/session/InMemoryOidcSessionRegistry.java

@@ -50,7 +50,7 @@ public final class InMemoryOidcSessionRegistry implements OidcSessionRegistry {
 	}
 
 	@Override
-	public OidcSessionInformation removeSessionInformation(String clientSessionId) {
+	public @Nullable OidcSessionInformation removeSessionInformation(String clientSessionId) {
 		OidcSessionInformation information = this.sessions.remove(clientSessionId);
 		if (information != null) {
 			this.logger.trace("Removed client session");

oauth2/oauth2-client/src/main/java/org/springframework/security/oauth2/client/oidc/session/OidcSessionRegistry.java

@@ -16,6 +16,8 @@
 
 package org.springframework.security.oauth2.client.oidc.session;
 
+import org.jspecify.annotations.Nullable;
+
 import org.springframework.security.oauth2.client.oidc.authentication.logout.OidcLogoutToken;
 
 /**
@@ -44,7 +46,7 @@ public interface OidcSessionRegistry {
 	 * @param clientSessionId the client session
 	 * @return any found {@link OidcSessionInformation}, could be {@code null}
 	 */
-	OidcSessionInformation removeSessionInformation(String clientSessionId);
+	@Nullable OidcSessionInformation removeSessionInformation(String clientSessionId);
 
 	/**
 	 * Deregister the OIDC Provider sessions referenced by the provided OIDC Logout Token