From 8525cbfd19fbebb095c57c7060b0602ecfc96727 Mon Sep 17 00:00:00 2001 From: Josh Cummings <3627351+jzheaux@users.noreply.github.com> Date: Thu, 3 Sep 2026 18:13:25 -0600 Subject: [PATCH 1/9] Fix Nullability Signed-off-by: Josh Cummings <3627351+jzheaux@users.noreply.github.com> --- .../task/DelegatingSecurityContextAsyncTaskExecutor.java | 2 +- .../client/oidc/session/InMemoryOidcSessionRegistry.java | 2 +- .../oauth2/client/oidc/session/OidcSessionRegistry.java | 4 +++- 3 files changed, 5 insertions(+), 3 deletions(-) diff --git a/core/src/main/java/org/springframework/security/task/DelegatingSecurityContextAsyncTaskExecutor.java b/core/src/main/java/org/springframework/security/task/DelegatingSecurityContextAsyncTaskExecutor.java index 194cf41044..8d0b395cbf 100644 --- a/core/src/main/java/org/springframework/security/task/DelegatingSecurityContextAsyncTaskExecutor.java +++ b/core/src/main/java/org/springframework/security/task/DelegatingSecurityContextAsyncTaskExecutor.java @@ -72,7 +72,7 @@ public class DelegatingSecurityContextAsyncTaskExecutor extends DelegatingSecuri } @Override - public final Future submit(Callable task) { + public final Future submit(Callable task) { return getDelegate().submit(wrap(task)); } diff --git a/oauth2/oauth2-client/src/main/java/org/springframework/security/oauth2/client/oidc/session/InMemoryOidcSessionRegistry.java b/oauth2/oauth2-client/src/main/java/org/springframework/security/oauth2/client/oidc/session/InMemoryOidcSessionRegistry.java index 13da5be113..ffcba6a037 100644 --- a/oauth2/oauth2-client/src/main/java/org/springframework/security/oauth2/client/oidc/session/InMemoryOidcSessionRegistry.java +++ b/oauth2/oauth2-client/src/main/java/org/springframework/security/oauth2/client/oidc/session/InMemoryOidcSessionRegistry.java @@ -50,7 +50,7 @@ public final class InMemoryOidcSessionRegistry implements OidcSessionRegistry { } @Override - public OidcSessionInformation removeSessionInformation(String clientSessionId) { + public @Nullable OidcSessionInformation removeSessionInformation(String clientSessionId) { OidcSessionInformation information = this.sessions.remove(clientSessionId); if (information != null) { this.logger.trace("Removed client session"); diff --git a/oauth2/oauth2-client/src/main/java/org/springframework/security/oauth2/client/oidc/session/OidcSessionRegistry.java b/oauth2/oauth2-client/src/main/java/org/springframework/security/oauth2/client/oidc/session/OidcSessionRegistry.java index e984dd5eee..ab0dfee49a 100644 --- a/oauth2/oauth2-client/src/main/java/org/springframework/security/oauth2/client/oidc/session/OidcSessionRegistry.java +++ b/oauth2/oauth2-client/src/main/java/org/springframework/security/oauth2/client/oidc/session/OidcSessionRegistry.java @@ -16,6 +16,8 @@ package org.springframework.security.oauth2.client.oidc.session; +import org.jspecify.annotations.Nullable; + import org.springframework.security.oauth2.client.oidc.authentication.logout.OidcLogoutToken; /** @@ -44,7 +46,7 @@ public interface OidcSessionRegistry { * @param clientSessionId the client session * @return any found {@link OidcSessionInformation}, could be {@code null} */ - OidcSessionInformation removeSessionInformation(String clientSessionId); + @Nullable OidcSessionInformation removeSessionInformation(String clientSessionId); /** * Deregister the OIDC Provider sessions referenced by the provided OIDC Logout Token From 137d2e81b7aa2f7bec06fa5979304312849d8497 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 31 Aug 2026 03:14:37 +0000 Subject: [PATCH 2/9] Bump io.spring.nullability:io.spring.nullability.gradle.plugin Bumps [io.spring.nullability:io.spring.nullability.gradle.plugin](https://github.com/spring-gradle-plugins/nullability-plugin) from 0.0.14 to 0.0.15. - [Release notes](https://github.com/spring-gradle-plugins/nullability-plugin/releases) - [Commits](https://github.com/spring-gradle-plugins/nullability-plugin/compare/v0.0.14...v0.0.15) --- updated-dependencies: - dependency-name: io.spring.nullability:io.spring.nullability.gradle.plugin dependency-version: 0.0.15 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] --- gradle/libs.versions.toml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/gradle/libs.versions.toml b/gradle/libs.versions.toml index 8ca14a96dc..1f918c6d8c 100644 --- a/gradle/libs.versions.toml +++ b/gradle/libs.versions.toml @@ -105,7 +105,7 @@ org-jfrog-buildinfo-build-info-extractor-gradle = "org.jfrog.buildinfo:build-inf org-sonarsource-scanner-gradle-sonarqube-gradle-plugin = "org.sonarsource.scanner.gradle:sonarqube-gradle-plugin:2.8.0.1969" org-instancio-instancio-junit = "org.instancio:instancio-junit:3.7.1" -spring-nullability = 'io.spring.nullability:io.spring.nullability.gradle.plugin:0.0.14' +spring-nullability = 'io.spring.nullability:io.spring.nullability.gradle.plugin:0.0.15' webauthn4j-core = 'com.webauthn4j:webauthn4j-core:0.31.9.RELEASE' com-password4j-password4j = { module = "com.password4j:password4j", version.ref = "com-password4j" } From a4707d9e1996504bc589f16760b17ce6f5d79061 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Wed, 2 Sep 2026 03:06:51 +0000 Subject: [PATCH 3/9] Bump org.hibernate.orm:hibernate-core from 7.4.6.Final to 7.4.7.Final Bumps [org.hibernate.orm:hibernate-core](https://github.com/hibernate/hibernate-orm) from 7.4.6.Final to 7.4.7.Final. - [Release notes](https://github.com/hibernate/hibernate-orm/releases) - [Changelog](https://github.com/hibernate/hibernate-orm/blob/7.4.7/changelog.txt) - [Commits](https://github.com/hibernate/hibernate-orm/compare/7.4.6...7.4.7) --- updated-dependencies: - dependency-name: org.hibernate.orm:hibernate-core dependency-version: 7.4.7.Final dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] --- gradle/libs.versions.toml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/gradle/libs.versions.toml b/gradle/libs.versions.toml index 1f918c6d8c..5012cd8776 100644 --- a/gradle/libs.versions.toml +++ b/gradle/libs.versions.toml @@ -68,7 +68,7 @@ org-bouncycastle-bcprov-jdk15on = { module = "org.bouncycastle:bcprov-jdk18on", org-eclipse-jetty-jetty-server = { module = "org.eclipse.jetty:jetty-server", version.ref = "org-eclipse-jetty" } org-eclipse-jetty-jetty-servlet = { module = "org.eclipse.jetty:jetty-servlet", version.ref = "org-eclipse-jetty" } org-hamcrest = "org.hamcrest:hamcrest:2.2" -org-hibernate-orm-hibernate-core = "org.hibernate.orm:hibernate-core:7.4.6.Final" +org-hibernate-orm-hibernate-core = "org.hibernate.orm:hibernate-core:7.4.7.Final" org-hsqldb = "org.hsqldb:hsqldb:2.7.4" org-jetbrains-dokka-dokka-gradle-plugin = { module = "org.jetbrains.dokka:dokka-gradle-plugin", version.ref = "org-jetbrains-dokka" } org-jetbrains-kotlin-kotlin-bom = { module = "org.jetbrains.kotlin:kotlin-bom", version.ref = "org-jetbrains-kotlin" } From 8130568ac62f956d789e43c63dbf96e76dd77fdc Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Thu, 3 Sep 2026 22:04:29 +0000 Subject: [PATCH 4/9] Bump spring-io/spring-security-release-tools/.github/workflows/deploy-artifacts.yml Bumps [spring-io/spring-security-release-tools/.github/workflows/deploy-artifacts.yml](https://github.com/spring-io/spring-security-release-tools) from 1.0.15 to 1.0.17. - [Release notes](https://github.com/spring-io/spring-security-release-tools/releases) - [Changelog](https://github.com/spring-io/spring-security-release-tools/blob/main/RELEASE.adoc) - [Commits](https://github.com/spring-io/spring-security-release-tools/compare/b92832ecbc7cbe969201e6beafbde0ee400cf095...3f6cc7ffc137ca160061749d5f34dc30d5f36986) --- updated-dependencies: - dependency-name: spring-io/spring-security-release-tools/.github/workflows/deploy-artifacts.yml dependency-version: 1.0.17 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] --- .github/workflows/continuous-integration-workflow.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/continuous-integration-workflow.yml b/.github/workflows/continuous-integration-workflow.yml index 78c15f422d..63c8470034 100644 --- a/.github/workflows/continuous-integration-workflow.yml +++ b/.github/workflows/continuous-integration-workflow.yml @@ -30,7 +30,7 @@ jobs: deploy-artifacts: name: Deploy Artifacts needs: [ build ] - uses: spring-io/spring-security-release-tools/.github/workflows/deploy-artifacts.yml@b92832ecbc7cbe969201e6beafbde0ee400cf095 # v1.0.15 + uses: spring-io/spring-security-release-tools/.github/workflows/deploy-artifacts.yml@3f6cc7ffc137ca160061749d5f34dc30d5f36986 # v1.0.17 with: should-deploy-artifacts: ${{ needs.build.outputs.should-deploy-artifacts }} default-publish-milestones-central: true From 7ea44bbb264f72d616cc24bdab3fed5becf8720f Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Fri, 4 Sep 2026 00:35:28 +0000 Subject: [PATCH 5/9] Bump antora from 3.2.0-rc.3 to 3.2.0 in /docs Bumps [antora](https://gitlab.com/antora/antora/tree/HEAD/packages/antora) from 3.2.0-rc.3 to 3.2.0. - [Changelog](https://gitlab.com/antora/antora/blob/main/CHANGELOG.adoc) - [Commits](https://gitlab.com/antora/antora/compare/v3.2.0-rc.3...v3.2.0) --- updated-dependencies: - dependency-name: antora dependency-version: 3.2.0 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] --- docs/package.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/package.json b/docs/package.json index 253ac52433..a45936ea48 100644 --- a/docs/package.json +++ b/docs/package.json @@ -1,6 +1,6 @@ { "dependencies": { - "antora": "3.2.0-rc.3", + "antora": "3.2.0", "@antora/atlas-extension": "1.0.0-alpha.5", "@antora/collector-extension": "1.0.3", "@asciidoctor/tabs": "1.0.0-beta.6", From b39e300395ce9ca31d5b5fac12aa91c29e08d70a Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Fri, 4 Sep 2026 00:35:25 +0000 Subject: [PATCH 6/9] Bump spring-io/spring-release-actions/compute-version Bumps [spring-io/spring-release-actions/compute-version](https://github.com/spring-io/spring-release-actions) from 0.0.5 to 0.0.6. - [Release notes](https://github.com/spring-io/spring-release-actions/releases) - [Commits](https://github.com/spring-io/spring-release-actions/compare/a1f321783a0769dd2aea4fad6c2ae2f95a52b885...1b8671612c3eb3d9b9763e2d7b66f1a80d00ee95) --- updated-dependencies: - dependency-name: spring-io/spring-release-actions/compute-version dependency-version: 0.0.6 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] --- .github/workflows/defer-issues.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/defer-issues.yml b/.github/workflows/defer-issues.yml index e9f852842a..163f7d162d 100644 --- a/.github/workflows/defer-issues.yml +++ b/.github/workflows/defer-issues.yml @@ -18,7 +18,7 @@ jobs: uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Compute Version id: compute-version - uses: spring-io/spring-release-actions/compute-version@a1f321783a0769dd2aea4fad6c2ae2f95a52b885 # 0.0.5 + uses: spring-io/spring-release-actions/compute-version@1b8671612c3eb3d9b9763e2d7b66f1a80d00ee95 # 0.0.6 - name: Get Today's Release Version id: todays-release uses: spring-io/spring-release-actions/get-todays-release-version@1b8671612c3eb3d9b9763e2d7b66f1a80d00ee95 # 0.0.6 From e05cec1b7dd3950200254fb4a61420b1bc691f14 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Fri, 4 Sep 2026 00:35:18 +0000 Subject: [PATCH 7/9] Bump spring-io/spring-release-actions/schedule-milestone Bumps [spring-io/spring-release-actions/schedule-milestone](https://github.com/spring-io/spring-release-actions) from 0.0.5 to 0.0.6. - [Release notes](https://github.com/spring-io/spring-release-actions/releases) - [Commits](https://github.com/spring-io/spring-release-actions/compare/a1f321783a0769dd2aea4fad6c2ae2f95a52b885...1b8671612c3eb3d9b9763e2d7b66f1a80d00ee95) --- updated-dependencies: - dependency-name: spring-io/spring-release-actions/schedule-milestone dependency-version: 0.0.6 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] --- .github/workflows/defer-issues.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/defer-issues.yml b/.github/workflows/defer-issues.yml index 163f7d162d..408a5c4cae 100644 --- a/.github/workflows/defer-issues.yml +++ b/.github/workflows/defer-issues.yml @@ -32,7 +32,7 @@ jobs: with: version: ${{ steps.todays-release.outputs.release-version }} - name: Schedule Next Milestone - uses: spring-io/spring-release-actions/schedule-milestone@a1f321783a0769dd2aea4fad6c2ae2f95a52b885 # 0.0.5 + uses: spring-io/spring-release-actions/schedule-milestone@1b8671612c3eb3d9b9763e2d7b66f1a80d00ee95 # 0.0.6 with: version: ${{ steps.next-version.outputs.version }} version-date: ${{ steps.next-version.outputs.version-date }} From a501e214f4eb51965eb4becba34198ec18783d27 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Fri, 4 Sep 2026 00:35:11 +0000 Subject: [PATCH 8/9] Bump spring-io/spring-security-release-tools/.github/actions/send-notification Bumps [spring-io/spring-security-release-tools/.github/actions/send-notification](https://github.com/spring-io/spring-security-release-tools) from 1.0.15 to 1.0.17. - [Release notes](https://github.com/spring-io/spring-security-release-tools/releases) - [Changelog](https://github.com/spring-io/spring-security-release-tools/blob/main/RELEASE.adoc) - [Commits](https://github.com/spring-io/spring-security-release-tools/compare/b92832ecbc7cbe969201e6beafbde0ee400cf095...3f6cc7ffc137ca160061749d5f34dc30d5f36986) --- updated-dependencies: - dependency-name: spring-io/spring-security-release-tools/.github/actions/send-notification dependency-version: 1.0.17 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] --- .github/workflows/check-snapshots.yml | 2 +- .github/workflows/continuous-integration-workflow.yml | 2 +- .github/workflows/pr-build-workflow.yml | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/.github/workflows/check-snapshots.yml b/.github/workflows/check-snapshots.yml index 2414893011..48044bae29 100644 --- a/.github/workflows/check-snapshots.yml +++ b/.github/workflows/check-snapshots.yml @@ -31,6 +31,6 @@ jobs: runs-on: ubuntu-latest steps: - name: Send Notification - uses: spring-io/spring-security-release-tools/.github/actions/send-notification@b92832ecbc7cbe969201e6beafbde0ee400cf095 # v1.0.15 + uses: spring-io/spring-security-release-tools/.github/actions/send-notification@3f6cc7ffc137ca160061749d5f34dc30d5f36986 # v1.0.17 with: webhook-url: ${{ secrets.SPRING_SECURITY_CI_GCHAT_WEBHOOK_URL }} diff --git a/.github/workflows/continuous-integration-workflow.yml b/.github/workflows/continuous-integration-workflow.yml index 63c8470034..b737842312 100644 --- a/.github/workflows/continuous-integration-workflow.yml +++ b/.github/workflows/continuous-integration-workflow.yml @@ -51,6 +51,6 @@ jobs: runs-on: ubuntu-latest steps: - name: Send Notification - uses: spring-io/spring-security-release-tools/.github/actions/send-notification@b92832ecbc7cbe969201e6beafbde0ee400cf095 # v1.0.15 + uses: spring-io/spring-security-release-tools/.github/actions/send-notification@3f6cc7ffc137ca160061749d5f34dc30d5f36986 # v1.0.17 with: webhook-url: ${{ secrets.SPRING_SECURITY_CI_GCHAT_WEBHOOK_URL }} diff --git a/.github/workflows/pr-build-workflow.yml b/.github/workflows/pr-build-workflow.yml index d17c45373a..6a6c6d3dd9 100644 --- a/.github/workflows/pr-build-workflow.yml +++ b/.github/workflows/pr-build-workflow.yml @@ -46,6 +46,6 @@ jobs: runs-on: ubuntu-latest steps: - name: Send Notification - uses: spring-io/spring-security-release-tools/.github/actions/send-notification@b92832ecbc7cbe969201e6beafbde0ee400cf095 # v1.0.15 + uses: spring-io/spring-security-release-tools/.github/actions/send-notification@3f6cc7ffc137ca160061749d5f34dc30d5f36986 # v1.0.17 with: webhook-url: ${{ secrets.SPRING_SECURITY_CI_GCHAT_WEBHOOK_URL }} From 9ad6b51aec0c3a4e9fdf3ddee72af2284e6110f3 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Fri, 4 Sep 2026 00:35:10 +0000 Subject: [PATCH 9/9] Bump spring-io/spring-security-release-tools/.github/workflows/release-announcements-publish.yml Bumps [spring-io/spring-security-release-tools/.github/workflows/release-announcements-publish.yml](https://github.com/spring-io/spring-security-release-tools) from 1.0.16 to 1.0.17. - [Release notes](https://github.com/spring-io/spring-security-release-tools/releases) - [Changelog](https://github.com/spring-io/spring-security-release-tools/blob/main/RELEASE.adoc) - [Commits](https://github.com/spring-io/spring-security-release-tools/compare/d6c65d3013c0888e2c9cbae9f4beda610994776c...3f6cc7ffc137ca160061749d5f34dc30d5f36986) --- updated-dependencies: - dependency-name: spring-io/spring-security-release-tools/.github/workflows/release-announcements-publish.yml dependency-version: 1.0.17 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] --- .github/workflows/release-announcements-publish.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/release-announcements-publish.yml b/.github/workflows/release-announcements-publish.yml index 36f0feed2e..15ee461dc4 100644 --- a/.github/workflows/release-announcements-publish.yml +++ b/.github/workflows/release-announcements-publish.yml @@ -24,7 +24,7 @@ jobs: name: Publish Release Announcements needs: [ deploy-schema ] if: ${{ !github.event.repository.fork }} - uses: spring-io/spring-security-release-tools/.github/workflows/release-announcements-publish.yml@d6c65d3013c0888e2c9cbae9f4beda610994776c # v1.0.16 + uses: spring-io/spring-security-release-tools/.github/workflows/release-announcements-publish.yml@3f6cc7ffc137ca160061749d5f34dc30d5f36986 # v1.0.17 with: version: ${{ inputs.version }} secrets: inherit