From ddcdd461e674214a282e99f7fc1999c69f1ca6a2 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Tue, 8 Sep 2026 18:14:06 +0000 Subject: [PATCH 1/3] Bump io.spring.nullability:io.spring.nullability.gradle.plugin Bumps [io.spring.nullability:io.spring.nullability.gradle.plugin](https://github.com/spring-gradle-plugins/nullability-plugin) from 0.0.15 to 0.0.16. - [Release notes](https://github.com/spring-gradle-plugins/nullability-plugin/releases) - [Commits](https://github.com/spring-gradle-plugins/nullability-plugin/compare/v0.0.15...v0.0.16) --- updated-dependencies: - dependency-name: io.spring.nullability:io.spring.nullability.gradle.plugin dependency-version: 0.0.16 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] --- gradle/libs.versions.toml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/gradle/libs.versions.toml b/gradle/libs.versions.toml index 3c6bb58328..8d19039f1c 100644 --- a/gradle/libs.versions.toml +++ b/gradle/libs.versions.toml @@ -105,7 +105,7 @@ org-jfrog-buildinfo-build-info-extractor-gradle = "org.jfrog.buildinfo:build-inf org-sonarsource-scanner-gradle-sonarqube-gradle-plugin = "org.sonarsource.scanner.gradle:sonarqube-gradle-plugin:2.8.0.1969" org-instancio-instancio-junit = "org.instancio:instancio-junit:3.7.1" -spring-nullability = 'io.spring.nullability:io.spring.nullability.gradle.plugin:0.0.15' +spring-nullability = 'io.spring.nullability:io.spring.nullability.gradle.plugin:0.0.16' webauthn4j-core = 'com.webauthn4j:webauthn4j-core:0.31.10.RELEASE' com-password4j-password4j = { module = "com.password4j:password4j", version.ref = "com-password4j" } From 864c082a38185d50ba0bb56cdd21e9baa31cdeac Mon Sep 17 00:00:00 2001 From: Josh Cummings <3627351+jzheaux@users.noreply.github.com> Date: Tue, 8 Sep 2026 12:23:08 -0600 Subject: [PATCH 2/3] Mark addGrantedAuthorityCollection Value Parameter Nullable The io.spring.nullability plugin 0.0.16 upgrade tightens NullAway analysis and flags the raw Collection element passed into addGrantedAuthorityCollection(Collection, Object) as possibly null, even though the method already null-checks it internally. See gh-19670 Signed-off-by: Josh Cummings <3627351+jzheaux@users.noreply.github.com> --- .../mapping/MapBasedAttributes2GrantedAuthoritiesMapper.java | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/core/src/main/java/org/springframework/security/core/authority/mapping/MapBasedAttributes2GrantedAuthoritiesMapper.java b/core/src/main/java/org/springframework/security/core/authority/mapping/MapBasedAttributes2GrantedAuthoritiesMapper.java index 74dc86e95a..c970a4159c 100755 --- a/core/src/main/java/org/springframework/security/core/authority/mapping/MapBasedAttributes2GrantedAuthoritiesMapper.java +++ b/core/src/main/java/org/springframework/security/core/authority/mapping/MapBasedAttributes2GrantedAuthoritiesMapper.java @@ -26,6 +26,8 @@ import java.util.Map; import java.util.Set; import java.util.StringTokenizer; +import org.jspecify.annotations.Nullable; + import org.springframework.beans.factory.InitializingBean; import org.springframework.security.core.GrantedAuthority; import org.springframework.security.core.authority.SimpleGrantedAuthority; @@ -121,7 +123,7 @@ public class MapBasedAttributes2GrantedAuthoritiesMapper * to the given result collection. * @param value The value to convert to a GrantedAuthority Collection */ - private void addGrantedAuthorityCollection(Collection result, Object value) { + private void addGrantedAuthorityCollection(Collection result, @Nullable Object value) { if (value == null) { return; } From 25c71e28a8a48458885f27a0c6efa399c01590ef Mon Sep 17 00:00:00 2001 From: Josh Cummings <3627351+jzheaux@users.noreply.github.com> Date: Tue, 8 Sep 2026 12:35:18 -0600 Subject: [PATCH 3/3] Skip Null List Elements When Mapping CAS Attributes To Authorities The io.spring.nullability plugin 0.0.16 upgrade tightens NullAway analysis and flags list elements from the unannotated, raw List attribute value as possibly null. A null element has no value to contribute to an authority, consistent with how a null attribute value as a whole is already skipped. See gh-19670 Signed-off-by: Josh Cummings <3627351+jzheaux@users.noreply.github.com> --- ...tedAuthorityFromAssertionAttributesUserDetailsService.java | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/cas/src/main/java/org/springframework/security/cas/userdetails/GrantedAuthorityFromAssertionAttributesUserDetailsService.java b/cas/src/main/java/org/springframework/security/cas/userdetails/GrantedAuthorityFromAssertionAttributesUserDetailsService.java index 517120aa46..720fef5df6 100644 --- a/cas/src/main/java/org/springframework/security/cas/userdetails/GrantedAuthorityFromAssertionAttributesUserDetailsService.java +++ b/cas/src/main/java/org/springframework/security/cas/userdetails/GrantedAuthorityFromAssertionAttributesUserDetailsService.java @@ -61,7 +61,9 @@ public final class GrantedAuthorityFromAssertionAttributesUserDetailsService if (value != null) { if (value instanceof List) { for (Object o : (List) value) { - grantedAuthorities.add(createSimpleGrantedAuthority(o)); + if (o != null) { + grantedAuthorities.add(createSimpleGrantedAuthority(o)); + } } } else {