Release 5.6.7

Closes gh-11686

.github/workflows/algolia-index.yml

@@ -5,10 +5,14 @@ on:
     - cron: '0 10 * * *' # Once per day at 10am UTC
   workflow_dispatch: # Manual trigger
 
+permissions:
+  contents: read
+
 jobs:
   update:
     name: Update Algolia Index
     runs-on: ubuntu-latest
+    if: ${{ github.repository == 'spring-projects/spring-security' }}
     steps:
       - name: Checkout Source
         uses: actions/checkout@v2

.github/workflows/antora-generate.yml

@@ -10,12 +10,21 @@ on:
 env:
   GH_ACTIONS_REPO_TOKEN: ${{ secrets.GH_ACTIONS_REPO_TOKEN }}
 
+permissions:
+  contents: read
+
 jobs:
   build:
     runs-on: ubuntu-latest
+    if: ${{ github.repository == 'spring-projects/spring-security' }}
     steps:
       - name: Checkout Source
         uses: actions/checkout@v2
+      - name: Set up gradle
+        uses: spring-io/spring-gradle-build-action@v1
+        with:
+          java-version: '11'
+          distribution: 'adopt'
       - name: Generate antora.yml
         run: ./gradlew :spring-security-docs:generateAntora
       - name: Extract Branch Name

.github/workflows/backport-bot.yml

@@ -0,0 +1,33 @@
+name: Backport Bot
+
+on:
+  issues:
+    types: [labeled]
+  pull_request:
+    types: [labeled]
+  push:
+    branches:
+      - '*.x'
+permissions:
+  contents: read
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    if: ${{ github.repository == 'spring-projects/spring-security' }}
+    permissions:
+      contents: read
+      issues: write
+      pull-requests: write
+    steps:
+      - uses: actions/checkout@v3
+      - uses: actions/setup-java@v3
+        with:
+          distribution: 'temurin'
+          java-version: '17'
+      - name: Download BackportBot
+        run: wget https://github.com/spring-io/backport-bot/releases/download/latest/backport-bot-0.0.1-SNAPSHOT.jar
+      - name: Backport
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GITHUB_EVENT: ${{ toJSON(github.event) }}
+        run: java -jar backport-bot-0.0.1-SNAPSHOT.jar --github.accessToken="$GITHUB_TOKEN" --github.event_name "$GITHUB_EVENT_NAME" --github.event "$GITHUB_EVENT"

.github/workflows/clean_build_artifacts.yml

@@ -3,9 +3,15 @@ on:
   schedule:
     - cron: '0 10 * * *' # Once per day at 10am UTC
 
+permissions:
+  contents: read
+
 jobs:
   main:
     runs-on: ubuntu-latest
+    if: ${{ github.repository == 'spring-projects/spring-security' }}
+    permissions:
+      contents: none
     steps:
       - name: Delete artifacts in cron job
         env:

.github/workflows/continuous-integration-workflow.yml

@@ -2,6 +2,8 @@ name: CI
 
 on:
   push:
+    branches:
+      - '**'
   schedule:
     - cron: '0 10 * * *' # Once per day at 10am UTC
   workflow_dispatch: # Manual trigger
@@ -16,19 +18,28 @@ env:
   STRUCTURE101_LICENSEID: ${{ secrets.STRUCTURE101_LICENSEID }}
   ARTIFACTORY_USERNAME: ${{ secrets.ARTIFACTORY_USERNAME }}
   ARTIFACTORY_PASSWORD: ${{ secrets.ARTIFACTORY_PASSWORD }}
-  RUN_JOBS: ${{ github.repository == 'spring-projects/spring-security' }}
+
+permissions:
+  contents: read
 
 jobs:
   prerequisites:
     name: Pre-requisites for building
     runs-on: ubuntu-latest
+    if: ${{ github.repository == 'spring-projects/spring-security' }}
     outputs:
       runjobs: ${{ steps.continue.outputs.runjobs }}
+      project_version: ${{ steps.continue.outputs.project_version }}
     steps:
+      - uses: actions/checkout@v2
       - id: continue
         name: Determine if should continue
-        if: env.RUN_JOBS == 'true'
-        run: echo "::set-output name=runjobs::true"
+        run: |
+          # Run jobs if in upstream repository
+          echo "::set-output name=runjobs::true"
+          # Extract version from gradle.properties
+          version=$(cat gradle.properties | grep "version=" | awk -F'=' '{print $2}')
+          echo "::set-output name=project_version::$version"
   build_jdk_11:
     name: Build JDK 11
     needs: [prerequisites]
@@ -40,18 +51,14 @@ jobs:
     steps:
       - uses: actions/checkout@v2
       - name: Set up JDK 11
-        uses: actions/setup-java@v1
+        uses: actions/setup-java@v2
         with:
           java-version: '11'
-      - name: Setup gradle user name
-        run: |
-          mkdir -p ~/.gradle
-          echo 'systemProp.user.name=spring-builds+github' >> ~/.gradle/gradle.properties
-      - name: Cache Gradle packages
-        uses: actions/cache@v2
-        with:
-          path: ~/.gradle/caches
-          key: ${{ runner.os }}-gradle-${{ hashFiles('**/*.gradle') }}
+          distribution: 'adopt'
+      - name: Set up Gradle
+        uses: gradle/gradle-build-action@v2
+      - name: Set up gradle user name
+        run: echo 'systemProp.user.name=spring-builds+github' >> gradle.properties
       - name: Build with Gradle
         env:
           GRADLE_ENTERPRISE_CACHE_USERNAME: ${{ secrets.GRADLE_ENTERPRISE_CACHE_USER }}
@@ -65,14 +72,11 @@ jobs:
     if: needs.prerequisites.outputs.runjobs
     steps:
       - uses: actions/checkout@v2
-      - name: Set up JDK
-        uses: actions/setup-java@v1
+      - name: Set up gradle
+        uses: spring-io/spring-gradle-build-action@v1
         with:
           java-version: '11'
-      - name: Setup gradle user name
-        run: |
-          mkdir -p ~/.gradle
-          echo 'systemProp.user.name=spring-builds+github' >> ~/.gradle/gradle.properties
+          distribution: 'adopt'
       - name: Snapshot Tests
         run: |
           export GRADLE_ENTERPRISE_CACHE_USERNAME="$GRADLE_ENTERPRISE_CACHE_USER"
@@ -86,20 +90,21 @@ jobs:
     if: needs.prerequisites.outputs.runjobs
     steps:
       - uses: actions/checkout@v2
-      - name: Set up JDK
-        uses: actions/setup-java@v1
+      - name: Set up gradle
+        uses: spring-io/spring-gradle-build-action@v1
         with:
           java-version: '11'
-      - name: Setup gradle user name
-        run: |
-          mkdir -p ~/.gradle
-          echo 'systemProp.user.name=spring-builds+github' >> ~/.gradle/gradle.properties
+          distribution: 'adopt'
       - name: Check samples project
+        env:
+          LOCAL_REPOSITORY_PATH: ${{ github.workspace }}/build/publications/repos
+          SAMPLES_INIT_SCRIPT: ${{ github.workspace }}/build/includeRepo/spring-security-ci.gradle
         run: |
           export GRADLE_ENTERPRISE_CACHE_USERNAME="$GRADLE_ENTERPRISE_CACHE_USER"
           export GRADLE_ENTERPRISE_CACHE_PASSWORD="$GRADLE_ENTERPRISE_CACHE_PASSWORD"
           export GRADLE_ENTERPRISE_ACCESS_KEY="$GRADLE_ENTERPRISE_SECRET_ACCESS_KEY"
-          ./gradlew checkSamples --stacktrace
+          ./gradlew publishMavenJavaPublicationToLocalRepository
+          ./gradlew checkSamples -PsamplesInitScript="$SAMPLES_INIT_SCRIPT" -PlocalRepositoryPath="$LOCAL_REPOSITORY_PATH" --stacktrace
   check_tangles:
     name: Check for Package Tangles
     needs: [ prerequisites ]
@@ -107,14 +112,11 @@ jobs:
     if: needs.prerequisites.outputs.runjobs
     steps:
       - uses: actions/checkout@v2
-      - name: Set up JDK
-        uses: actions/setup-java@v1
+      - name: Set up gradle
+        uses: spring-io/spring-gradle-build-action@v1
         with:
           java-version: '11'
-      - name: Setup gradle user name
-        run: |
-          mkdir -p ~/.gradle
-          echo 'systemProp.user.name=spring-builds+github' >> ~/.gradle/gradle.properties
+          distribution: 'adopt'
       - name: Check for package tangles
         run: |
           export GRADLE_ENTERPRISE_CACHE_USERNAME="$GRADLE_ENTERPRISE_CACHE_USER"
@@ -127,14 +129,11 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v2
-      - name: Set up JDK
-        uses: actions/setup-java@v1
+      - name: Set up gradle
+        uses: spring-io/spring-gradle-build-action@v1
         with:
           java-version: '11'
-      - name: Setup gradle user name
-        run: |
-          mkdir -p ~/.gradle
-          echo 'systemProp.user.name=spring-builds+github' >> ~/.gradle/gradle.properties
+          distribution: 'adopt'
       - name: Deploy artifacts
         run: |
           export GRADLE_ENTERPRISE_CACHE_USERNAME="$GRADLE_ENTERPRISE_CACHE_USER"
@@ -154,14 +153,11 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v2
-      - name: Set up JDK
-        uses: actions/setup-java@v1
+      - name: Set up gradle
+        uses: spring-io/spring-gradle-build-action@v1
         with:
           java-version: '11'
-      - name: Setup gradle user name
-        run: |
-          mkdir -p ~/.gradle
-          echo 'systemProp.user.name=spring-builds+github' >> ~/.gradle/gradle.properties
+          distribution: 'adopt'
       - name: Deploy Docs
         run: |
           export GRADLE_ENTERPRISE_CACHE_USERNAME="$GRADLE_ENTERPRISE_CACHE_USER"
@@ -178,14 +174,11 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v2
-      - name: Set up JDK
-        uses: actions/setup-java@v1
+      - name: Set up gradle
+        uses: spring-io/spring-gradle-build-action@v1
         with:
           java-version: '11'
-      - name: Setup gradle user name
-        run: |
-          mkdir -p ~/.gradle
-          echo 'systemProp.user.name=spring-builds+github' >> ~/.gradle/gradle.properties
+          distribution: 'adopt'
       - name: Deploy Schema
         run: |
           export GRADLE_ENTERPRISE_CACHE_USERNAME="$GRADLE_ENTERPRISE_CACHE_USER"
@@ -196,14 +189,122 @@ jobs:
           DOCS_USERNAME: ${{ secrets.DOCS_USERNAME }}
           DOCS_SSH_KEY: ${{ secrets.DOCS_SSH_KEY }}
           DOCS_HOST: ${{ secrets.DOCS_HOST }}
+  perform_release:
+    name: Perform release
+    needs: [prerequisites, deploy_artifacts, deploy_docs, deploy_schema]
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+    timeout-minutes: 90
+    if: ${{ !endsWith(needs.prerequisites.outputs.project_version, '-SNAPSHOT') }}
+    env:
+      REPO: ${{ github.repository }}
+      BRANCH: ${{ github.ref_name }}
+      TOKEN: ${{ github.token }}
+      VERSION: ${{ needs.prerequisites.outputs.project_version }}
+    steps:
+      - uses: actions/checkout@v2
+        with:
+          token: ${{ secrets.GH_ACTIONS_REPO_TOKEN }}
+      - name: Set up gradle
+        uses: spring-io/spring-gradle-build-action@v1
+        with:
+          java-version: '11'
+          distribution: 'adopt'
+      - name: Wait for Artifactory Artifacts
+        if: ${{ contains(needs.prerequisites.outputs.project_version, '-RC') || contains(needs.prerequisites.outputs.project_version, '-M') }}
+        run: |
+          echo "Wait for artifacts of $REPO@$VERSION to appear on Artifactory."
+          until curl -f -s https://repo.spring.io/artifactory/milestone/org/springframework/security/spring-security-core/$VERSION/ > /dev/null
+          do
+            sleep 30
+            echo "."
+          done
+          echo "Artifacts for $REPO@$VERSION have been released to Artifactory."
+      - name: Wait for Maven Central Artifacts
+        if: ${{ !contains(needs.prerequisites.outputs.project_version, '-RC') && !contains(needs.prerequisites.outputs.project_version, '-M') }}
+        run: |
+          echo "Wait for artifacts of $REPO@$VERSION to appear on Maven Central."
+          until curl -f -s https://repo1.maven.org/maven2/org/springframework/security/spring-security-core/$VERSION/ > /dev/null
+          do
+            sleep 30
+            echo "."
+          done
+          echo "Artifacts for $REPO@$VERSION have been released to Maven Central."
+      - name: Create GitHub Release
+        run: |
+          export GRADLE_ENTERPRISE_CACHE_USERNAME="$GRADLE_ENTERPRISE_CACHE_USER"
+          export GRADLE_ENTERPRISE_CACHE_PASSWORD="$GRADLE_ENTERPRISE_CACHE_PASSWORD"
+          export GRADLE_ENTERPRISE_ACCESS_KEY="$GRADLE_ENTERPRISE_SECRET_ACCESS_KEY"
+          echo "Tagging and publishing $REPO@$VERSION release on GitHub."
+          ./gradlew createGitHubRelease -PnextVersion=$VERSION -Pbranch=$BRANCH -PcreateRelease=true -PgitHubAccessToken=$TOKEN
+      - name: Announce Release on Slack
+        id: spring-security-announcing
+        uses: slackapi/slack-github-action@v1.19.0
+        with:
+          payload: |
+            {
+              "text": "spring-security-announcing `${{ env.VERSION }}` is available now",
+              "blocks": [
+                {
+                  "type": "section",
+                  "text": {
+                    "type": "mrkdwn",
+                    "text": "spring-security-announcing `${{ env.VERSION }}` is available now"
+                  }
+                }
+              ]
+            }
+        env:
+          SLACK_WEBHOOK_URL: ${{ secrets.SPRING_RELEASE_SLACK_WEBHOOK_URL }}
+          SLACK_WEBHOOK_TYPE: INCOMING_WEBHOOK
+      - name: Setup git config
+        run: |
+          git config user.name 'github-actions[bot]'
+          git config user.email 'github-actions[bot]@users.noreply.github.com'
+      - name: Update to next Snapshot Version
+        run: |
+          export GRADLE_ENTERPRISE_CACHE_USERNAME="$GRADLE_ENTERPRISE_CACHE_USER"
+          export GRADLE_ENTERPRISE_CACHE_PASSWORD="$GRADLE_ENTERPRISE_CACHE_PASSWORD"
+          export GRADLE_ENTERPRISE_ACCESS_KEY="$GRADLE_ENTERPRISE_SECRET_ACCESS_KEY"
+          echo "Updating $REPO@$VERSION to next snapshot version."
+          ./gradlew :updateToSnapshotVersion
+          ./gradlew :spring-security-docs:antoraUpdateVersion
+          git commit -am "Next development version"
+          git push
+  perform_post_release:
+    name: Perform post-release
+    needs: [prerequisites, deploy_artifacts, deploy_docs, deploy_schema]
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      issues: write
+    timeout-minutes: 90
+    if: ${{ endsWith(needs.prerequisites.outputs.project_version, '-SNAPSHOT') }}
+    env:
+      TOKEN: ${{ github.token }}
+      VERSION: ${{ needs.prerequisites.outputs.project_version }}
+    steps:
+      - uses: actions/checkout@v2
+      - name: Set up gradle
+        uses: spring-io/spring-gradle-build-action@v1
+        with:
+          java-version: '11'
+          distribution: 'adopt'
+      - name: Schedule next release (if not already scheduled)
+        run: ./gradlew scheduleNextRelease -PnextVersion=$VERSION -PgitHubAccessToken=$TOKEN
   notify_result:
     name: Check for failures
-    needs: [build_jdk_11, snapshot_tests, check_samples, check_tangles, deploy_artifacts, deploy_docs, deploy_schema]
+    needs: [perform_release, perform_post_release]
     if: failure()
     runs-on: ubuntu-latest
+    permissions:
+      actions: read
     steps:
       - name: Send Slack message
-        uses: Gamesight/slack-workflow-status@v1.0.1
+        # Workaround while waiting for Gamesight/slack-workflow-status#38 to be fixed
+        # See https://github.com/Gamesight/slack-workflow-status/issues/38
+        uses: sjohnr/slack-workflow-status@v1-beta
         with:
           repo_token: ${{ secrets.GITHUB_TOKEN }}
           slack_webhook_url: ${{ secrets.SLACK_WEBHOOK_URL }}

.github/workflows/deploy-reference.yml

@@ -7,27 +7,28 @@ on:
     - cron: '0 10 * * *' # Once per day at 10am UTC
   workflow_dispatch: # Manual trigger
 
+permissions:
+  contents: read
+
 jobs:
   deploy:
     name: deploy
     runs-on: ubuntu-latest
+    if: ${{ github.repository == 'spring-projects/spring-security' }}
     steps:
       - uses: actions/checkout@v2
-      - name: Set up JDK 11
-        uses: actions/setup-java@v2
+      - name: Set up gradle
+        uses: spring-io/spring-gradle-build-action@v1
         with:
           java-version: '11'
           distribution: 'adopt'
-          cache: gradle
-      - name: Validate Gradle wrapper
-        uses: gradle/wrapper-validation-action@e6e38bacfdf1a337459f332974bb2327a31aaf4b
-      - name: Build with Gradle
-        run: ./gradlew :spring-security-docs:antora --stacktrace
       - name: Cleanup Gradle Cache
         # Remove some files from the Gradle cache, so they aren't cached by GitHub Actions.
         # Restoring these files from a GitHub Actions cache might cause problems for future builds.
         run: |
-          rm -f ~/.gradle/caches/modules-2/modules-2.lock
-          rm -f ~/.gradle/caches/modules-2/gc.properties
+          rm -f /home/runner/.gradle/caches/modules-2/modules-2.lock
+          rm -f /home/runner/.gradle/caches/modules-2/gc.properties
+      - name: Build with Gradle
+        run: ./gradlew :spring-security-docs:antora --stacktrace
       - name: Deploy
         run: ${GITHUB_WORKSPACE}/.github/actions/algolia-deploy.sh "${{ secrets.DOCS_USERNAME }}@${{ secrets.DOCS_HOST }}" "/opt/www/domains/spring.io/docs/htdocs/spring-security/reference/" "${{ secrets.DOCS_SSH_KEY }}" "${{ secrets.DOCS_SSH_HOST_KEY }}"

.github/workflows/milestone-spring-releasetrain.yml

@@ -5,10 +5,15 @@ on:
 env:
   DUE_ON: ${{ github.event.milestone.due_on }}
   TITLE: ${{ github.event.milestone.title }}
+permissions:
+  contents: read
 jobs:
   spring-releasetrain-checks:    
     name: Check DueOn is on a Release Date
     runs-on: ubuntu-latest
+    if: ${{ github.repository == 'spring-projects/spring-security' }}
+    permissions:
+      contents: none
     steps:
     - name: Print Milestone Being Checked
       run: echo "Validating DueOn '$DUE_ON' for milestone '$TITLE'"
@@ -23,6 +28,8 @@ jobs:
     needs: [spring-releasetrain-checks]
     if: failure()
     runs-on: ubuntu-latest
+    permissions:
+      actions: read
     steps:
       - name: Send Slack message
         uses: Gamesight/slack-workflow-status@v1.0.1

.github/workflows/pr-build-workflow.yml

@@ -2,27 +2,20 @@ name: PR Build
 
 on: pull_request
 
-env:
-  RUN_JOBS: ${{ github.repository == 'spring-projects/spring-security' }}
+permissions:
+  contents: read
 
 jobs:
   build:
     name: Build
     runs-on: ubuntu-latest
+    if: ${{ github.repository == 'spring-projects/spring-security' }}
     steps:
-      - if: env.RUN_JOBS == 'true'
-        uses: actions/checkout@v2
-      - name: Set up JDK
-        if: env.RUN_JOBS == 'true'
-        uses: actions/setup-java@v1
+      - uses: actions/checkout@v2
+      - name: Set up gradle
+        uses: spring-io/spring-gradle-build-action@v1
         with:
           java-version: '11'
-      - name: Cache Gradle packages
-        if: env.RUN_JOBS == 'true'
-        uses: actions/cache@v2
-        with:
-          path: ~/.gradle/caches
-          key: ${{ runner.os }}-gradle-${{ hashFiles('**/*.gradle') }}
+          distribution: 'adopt'
       - name: Build with Gradle
-        if: env.RUN_JOBS == 'true'
         run: ./gradlew clean build --continue --scan

.github/workflows/update-scheduled-release-version.yml

@@ -0,0 +1,81 @@
+name: Update Scheduled Release Version
+
+on:
+  workflow_dispatch: # Manual trigger only. Triggered by release-scheduler.yml on main.
+
+env:
+  SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}
+  GRADLE_ENTERPRISE_CACHE_USER: ${{ secrets.GRADLE_ENTERPRISE_CACHE_USER }}
+  GRADLE_ENTERPRISE_CACHE_PASSWORD: ${{ secrets.GRADLE_ENTERPRISE_CACHE_PASSWORD }}
+  GRADLE_ENTERPRISE_SECRET_ACCESS_KEY: ${{ secrets.GRADLE_ENTERPRISE_SECRET_ACCESS_KEY }}
+
+permissions:
+  contents: read
+
+jobs:
+  update_scheduled_release_version:
+    name: Initiate Release If Scheduled
+    if: ${{ github.repository == 'spring-projects/spring-security' }}
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      actions: read
+    steps:
+      - id: checkout-source
+        name: Checkout Source Code
+        uses: actions/checkout@v2
+        with:
+          token: ${{ secrets.GH_ACTIONS_REPO_TOKEN }}
+      - name: Set up gradle
+        uses: spring-io/spring-gradle-build-action@v1
+        with:
+          java-version: '11'
+          distribution: 'adopt'
+      - id: check-release-due
+        name: Check Release Due
+        run: |
+          export GRADLE_ENTERPRISE_CACHE_USERNAME="$GRADLE_ENTERPRISE_CACHE_USER"
+          export GRADLE_ENTERPRISE_CACHE_PASSWORD="$GRADLE_ENTERPRISE_CACHE_PASSWORD"
+          export GRADLE_ENTERPRISE_ACCESS_KEY="$GRADLE_ENTERPRISE_SECRET_ACCESS_KEY"
+          ./gradlew gitHubCheckNextVersionDueToday
+          echo "::set-output name=is_due_today::$(cat build/github/milestones/is-due-today)"
+      - id: check-open-issues
+        name: Check for open issues
+        if: steps.check-release-due.outputs.is_due_today == 'true'
+        run: |
+          export GRADLE_ENTERPRISE_CACHE_USERNAME="$GRADLE_ENTERPRISE_CACHE_USER"
+          export GRADLE_ENTERPRISE_CACHE_PASSWORD="$GRADLE_ENTERPRISE_CACHE_PASSWORD"
+          export GRADLE_ENTERPRISE_ACCESS_KEY="$GRADLE_ENTERPRISE_SECRET_ACCESS_KEY"
+          ./gradlew gitHubCheckMilestoneHasNoOpenIssues
+          echo "::set-output name=is_open_issues::$(cat build/github/milestones/is-open-issues)"
+      - id: validate-release-state
+        name: Validate State of Release
+        if: steps.check-release-due.outputs.is_due_today == 'true' && steps.check-open-issues.outputs.is_open_issues == 'true'
+        run: |
+          echo "The release is due today but there are open issues"
+          exit 1
+      - id: update-version-and-push
+        name: Update version and push
+        if: steps.check-release-due.outputs.is_due_today == 'true' && steps.check-open-issues.outputs.is_open_issues == 'false'
+        run: |
+          export GRADLE_ENTERPRISE_CACHE_USERNAME="$GRADLE_ENTERPRISE_CACHE_USER"
+          export GRADLE_ENTERPRISE_CACHE_PASSWORD="$GRADLE_ENTERPRISE_CACHE_PASSWORD"
+          export GRADLE_ENTERPRISE_ACCESS_KEY="$GRADLE_ENTERPRISE_SECRET_ACCESS_KEY"
+          git config user.name 'github-actions[bot]'
+          git config user.email 'github-actions[bot]@users.noreply.github.com'
+          ./gradlew :updateProjectVersion
+          ./gradlew :spring-security-docs:antoraUpdateVersion
+          updatedVersion=$(cat gradle.properties | grep "version=" | awk -F'=' '{print $2}')
+          git commit -am "Release $updatedVersion"
+          git tag $updatedVersion
+          git push
+          git push origin $updatedVersion
+      - id: send-slack-notification
+        name: Send Slack message
+        if: failure()
+        uses: Gamesight/slack-workflow-status@v1.0.1
+        with:
+          repo_token: ${{ secrets.GITHUB_TOKEN }}
+          slack_webhook_url: ${{ secrets.SLACK_WEBHOOK_URL }}
+          channel: '#spring-security-ci'
+          name: 'CI Notifier'

RELEASE.adoc

@@ -135,7 +135,7 @@ git push origin 5.4.0-RC1
 
 The following command will update https://spring.io/projects/spring-security#learn with the new release version using the following parameters
 
-<github-personal-access-token> - Replace with a https://github.com/settings/tokens[GitHub personal access token] that has a scope of `public_repo`
+<github-personal-access-token> - Replace with a https://github.com/settings/tokens[GitHub personal access token] that has a scope of `read:org` as https://spring.io/restdocs/index.html#authentication[documented for spring.io api]
 <next-version> - Replace with the milestone you are releasing now (i.e. 5.5.0-RC1)
 <previous-version> - Replace with the previous release which will be removed from the listed versions (i.e. 5.5.0-M3)
 

acl/src/main/java/org/springframework/security/acls/jdbc/BasicLookupStrategy.java

@@ -73,8 +73,8 @@ import org.springframework.util.Assert;
  * one in <tt>lookupObjectIdentities</tt>. These are built from the same select and "order
  * by" clause, using a different where clause in each case. In order to use custom schema
  * or column names, each of these SQL clauses can be customized, but they must be
- * consistent with each other and with the expected result set generated by the the
- * default values.
+ * consistent with each other and with the expected result set generated by the default
+ * values.
  *
  * @author Ben Alex
  */

build.gradle

@@ -19,9 +19,11 @@ apply plugin: 'io.spring.convention.root'
 apply plugin: 'io.spring.convention.include-check-remote'
 apply plugin: 'org.jetbrains.kotlin.jvm'
 apply plugin: 'org.springframework.security.update-dependencies'
+apply plugin: 'org.springframework.security.update-version'
 apply plugin: 'org.springframework.security.sagan'
 apply plugin: 'org.springframework.github.milestone'
 apply plugin: 'org.springframework.github.changelog'
+apply plugin: 'org.springframework.github.release'
 
 group = 'org.springframework.security'
 description = 'Spring Security'
@@ -35,7 +37,7 @@ repositories {
 }
 
 tasks.named("saganCreateRelease") {
-	referenceDocUrl = "https://docs.spring.io/spring-security/site/docs/{version}/reference/html5/"
+	referenceDocUrl = "https://docs.spring.io/spring-security/reference/{version}/index.html"
 	apiDocUrl = "https://docs.spring.io/spring-security/site/docs/{version}/api/"
 }
 
@@ -46,6 +48,43 @@ tasks.named("gitHubCheckMilestoneHasNoOpenIssues") {
 	}
 }
 
+tasks.named("gitHubNextReleaseMilestone") {
+	repository {
+		owner = "spring-projects"
+		name = "spring-security"
+	}
+}
+
+tasks.named("gitHubCheckNextVersionDueToday") {
+	repository {
+		owner = "spring-projects"
+		name = "spring-security"
+	}
+}
+
+tasks.named("scheduleNextRelease") {
+	repository {
+		owner = "spring-projects"
+		name = "spring-security"
+	}
+	weekOfMonth = 3
+	dayOfWeek = 1
+}
+
+tasks.named("createGitHubRelease") {
+	repository {
+		owner = "spring-projects"
+		name = "spring-security"
+	}
+}
+
+tasks.named("dispatchGitHubWorkflow") {
+	repository {
+		owner = "spring-projects"
+		name = "spring-security"
+	}
+}
+
 tasks.named("updateDependencies") {
 	// we aren't Gradle 7 compatible yet
 	checkForGradleUpdate = false
@@ -95,6 +134,18 @@ updateDependenciesSettings {
 					selection.reject("org.opensaml maintains two different versions, so it must be updated manually");
 				}
 			}
+			components.withModule("io.spring.javaformat:spring-javaformat-gradle-plugin") { selection ->
+				ModuleComponentIdentifier candidate = selection.getCandidate();
+				if (!candidate.getVersion().equals(selection.getCurrentVersion())) {
+					selection.reject("spring-javaformat-gradle-plugin updates break checkstyle");
+				}
+			}
+			components.withModule("io.spring.javaformat:spring-javaformat-checkstyle") { selection ->
+				ModuleComponentIdentifier candidate = selection.getCandidate();
+				if (!candidate.getVersion().equals(selection.getCurrentVersion())) {
+					selection.reject("spring-javaformat-checkstyle updates break checkstyle");
+				}
+			}
 		}
 	}
 }
@@ -154,6 +205,10 @@ tasks.register('checkSamples') {
 	includeCheckRemote {
 		repository = 'spring-projects/spring-security-samples'
 		ref = samplesBranch
+		if (project.hasProperty("samplesInitScript")) {
+			initScripts = [samplesInitScript]
+			projectProperties = ["localRepositoryPath": localRepositoryPath, "springSecurityVersion": project.version]
+		}
 	}
 	dependsOn checkRemote
 }

buildSrc/build.gradle

@@ -5,7 +5,6 @@ plugins {
 	id 'com.apollographql.apollo' version '2.4.5'
 }
 
-
 sourceCompatibility = 1.8
 
 repositories {
@@ -29,7 +28,7 @@ gradlePlugin {
 	plugins {
 		checkAntoraVersion {
 			id = "org.springframework.antora.check-version"
-			implementationClass = "org.springframework.gradle.antora.CheckAntoraVersionPlugin"
+			implementationClass = "org.springframework.gradle.antora.AntoraVersionPlugin"
 		}
 		trang {
 			id = "trang"
@@ -47,6 +46,10 @@ gradlePlugin {
 			id = "org.springframework.security.update-dependencies"
 			implementationClass = "org.springframework.security.convention.versions.UpdateDependenciesPlugin"
 		}
+		updateProjectVersion {
+			id = "org.springframework.security.update-version"
+			implementationClass = "org.springframework.security.convention.versions.UpdateProjectVersionPlugin"
+		}
 		sagan {
 			id = "org.springframework.security.sagan"
 			implementationClass = "org.springframework.gradle.sagan.SaganPlugin"
@@ -59,6 +62,10 @@ gradlePlugin {
 			id = "org.springframework.github.changelog"
 			implementationClass = "org.springframework.gradle.github.changelog.GitHubChangelogPlugin"
 		}
+		githubRelease {
+			id = "org.springframework.github.release"
+			implementationClass = "org.springframework.gradle.github.release.GitHubReleasePlugin"
+		}
 		s101 {
 			id = "s101"
 			implementationClass = "s101.S101Plugin"
@@ -80,7 +87,7 @@ dependencies {
 	implementation localGroovy()
 
 	implementation 'io.github.gradle-nexus:publish-plugin:1.1.0'
-	implementation 'io.projectreactor:reactor-core:3.4.15'
+	implementation 'io.projectreactor:reactor-core:3.4.22'
 	implementation 'gradle.plugin.org.gretty:gretty:3.0.1'
 	implementation 'com.apollographql.apollo:apollo-runtime:2.4.5'
 	implementation 'com.github.ben-manes:gradle-versions-plugin:0.38.0'
@@ -89,7 +96,7 @@ dependencies {
 	implementation 'io.spring.nohttp:nohttp-gradle:0.0.10'
 	implementation 'net.sourceforge.htmlunit:htmlunit:2.37.0'
 	implementation 'org.hidetake:gradle-ssh-plugin:2.10.1'
-	implementation 'org.jfrog.buildinfo:build-info-extractor-gradle:4.24.20'
+	implementation 'org.jfrog.buildinfo:build-info-extractor-gradle:4.29.0'
 	implementation 'org.sonarsource.scanner.gradle:sonarqube-gradle-plugin:2.7.1'
 
 	testImplementation platform('org.junit:junit-bom:5.8.2')

buildSrc/src/main/groovy/io/spring/gradle/convention/ArtifactoryPlugin.groovy

@@ -17,6 +17,7 @@ package io.spring.gradle.convention
 
 import org.gradle.api.Plugin
 import org.gradle.api.Project
+import org.gradle.api.publish.maven.plugins.MavenPublishPlugin
 
 class ArtifactoryPlugin implements Plugin<Project> {
 
@@ -36,8 +37,14 @@ class ArtifactoryPlugin implements Plugin<Project> {
 						password = artifactoryPassword
 					}
 				}
-				defaults {
-					publications('mavenJava')
+			}
+		}
+		project.plugins.withType(MavenPublishPlugin) {
+			project.artifactory {
+				publish {
+					defaults {
+						publications('mavenJava')
+					}
 				}
 			}
 		}

buildSrc/src/main/groovy/io/spring/gradle/convention/IncludeCheckRemotePlugin.groovy

@@ -1,5 +1,5 @@
 /*
- * Copyright 2002-2021 the original author or authors.
+ * Copyright 2002-2022 the original author or authors.
  *
  * Licensed under the Apache License, Version 2.0 (the "License"); you may not
  * use this file except in compliance with the License. You may obtain a copy of
@@ -19,7 +19,6 @@ package io.spring.gradle.convention
 import io.spring.gradle.IncludeRepoTask
 import org.gradle.api.Plugin
 import org.gradle.api.Project
-import org.gradle.api.provider.Property
 import org.gradle.api.tasks.GradleBuild
 import org.gradle.api.tasks.TaskProvider
 
@@ -40,6 +39,12 @@ class IncludeCheckRemotePlugin implements Plugin<Project> {
 			it.dependsOn 'includeRepo'
 			it.dir = includeRepoTask.get().outputDirectory
 			it.tasks = extension.getTasks()
+			extension.getInitScripts().forEach {script ->
+				it.startParameter.addInitScript(new File(script))
+			}
+			extension.getProjectProperties().entrySet().forEach { entry ->
+				it.startParameter.projectProperties.put(entry.getKey(), entry.getValue())
+			}
 		}
 	}
 
@@ -60,6 +65,16 @@ class IncludeCheckRemotePlugin implements Plugin<Project> {
 		 */
 		List<String> tasks = ['check']
 
+		/**
+		 * Init scripts for the build
+		 */
+		List<String> initScripts = []
+
+		/**
+		 * Map of properties for the build
+		 */
+		Map<String, String> projectProperties = [:]
+
 	}
 
 }

buildSrc/src/main/groovy/io/spring/gradle/convention/RootProjectPlugin.groovy

@@ -34,6 +34,7 @@ class RootProjectPlugin implements Plugin<Project> {
 		pluginManager.apply(NoHttpPlugin)
 		pluginManager.apply(SpringNexusPublishPlugin)
 		pluginManager.apply(CheckProhibitedDependenciesLifecyclePlugin)
+		pluginManager.apply(ArtifactoryPlugin)
 		pluginManager.apply("org.sonarqube")
 
 		project.repositories.mavenCentral()

buildSrc/src/main/java/org/springframework/gradle/antora/AntoraVersionPlugin.java

@@ -8,7 +8,7 @@ import org.gradle.api.Task;
 import org.gradle.api.tasks.TaskProvider;
 import org.gradle.language.base.plugins.LifecycleBasePlugin;
 
-public class CheckAntoraVersionPlugin implements Plugin<Project> {
+public class AntoraVersionPlugin implements Plugin<Project> {
 	public static final String ANTORA_CHECK_VERSION_TASK_NAME = "antoraCheckVersion";
 
 	@Override
@@ -35,32 +35,29 @@ public class CheckAntoraVersionPlugin implements Plugin<Project> {
 				});
 			}
 		});
+		 project.getTasks().register("antoraUpdateVersion", UpdateAntoraVersionTask.class, new Action<UpdateAntoraVersionTask>() {
+			@Override
+			public void execute(UpdateAntoraVersionTask antoraUpdateVersion) {
+				antoraUpdateVersion.setGroup("Release");
+				antoraUpdateVersion.setDescription("Updates the antora.yml version properties to match the Gradle version");
+				antoraUpdateVersion.getAntoraYmlFile().fileProvider(project.provider(() -> project.file("antora.yml")));
+			}
+		});
 	}
 
 	private static String getDefaultAntoraVersion(Project project) {
 		String projectVersion = getProjectVersion(project);
-		int preReleaseIndex = getSnapshotIndex(projectVersion);
-		return isSnapshot(projectVersion) ? projectVersion.substring(0, preReleaseIndex) : projectVersion;
+		return AntoraVersionUtils.getDefaultAntoraVersion(projectVersion);
 	}
 
 	private static String getDefaultAntoraPrerelease(Project project) {
 		String projectVersion = getProjectVersion(project);
-		if (isSnapshot(projectVersion)) {
-			int preReleaseIndex = getSnapshotIndex(projectVersion);
-			return projectVersion.substring(preReleaseIndex);
-		}
-		if (isPreRelease(projectVersion)) {
-			return Boolean.TRUE.toString();
-		}
-		return null;
+		return AntoraVersionUtils.getDefaultAntoraPrerelease(projectVersion);
 	}
 
 	private static String getDefaultAntoraDisplayVersion(Project project) {
 		String projectVersion = getProjectVersion(project);
-		if (!isSnapshot(projectVersion) && isPreRelease(projectVersion)) {
-			return getDefaultAntoraVersion(project);
-		}
-		return null;
+		return AntoraVersionUtils.getDefaultAntoraDisplayVersion(projectVersion);
 	}
 
 	private static String getProjectVersion(Project project) {
@@ -71,15 +68,4 @@ public class CheckAntoraVersionPlugin implements Plugin<Project> {
 		return String.valueOf(projectVersion);
 	}
 
-	private static boolean isSnapshot(String projectVersion) {
-		return getSnapshotIndex(projectVersion) >= 0;
-	}
-
-	private static int getSnapshotIndex(String projectVersion) {
-		return projectVersion.lastIndexOf("-SNAPSHOT");
-	}
-
-	private static boolean isPreRelease(String projectVersion) {
-		return projectVersion.lastIndexOf("-") >= 0;
-	}
 }

buildSrc/src/main/java/org/springframework/gradle/antora/AntoraVersionUtils.java

@@ -0,0 +1,55 @@
+/*
+ * Copyright 2019-2022 the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.springframework.gradle.antora;
+
+public class AntoraVersionUtils {
+
+	public static String getDefaultAntoraVersion(String projectVersion) {
+		int preReleaseIndex = getSnapshotIndex(projectVersion);
+		return isSnapshot(projectVersion) ? projectVersion.substring(0, preReleaseIndex) : projectVersion;
+	}
+
+	public static String getDefaultAntoraPrerelease(String projectVersion) {
+		if (isSnapshot(projectVersion)) {
+			int preReleaseIndex = getSnapshotIndex(projectVersion);
+			return projectVersion.substring(preReleaseIndex);
+		}
+		if (isPreRelease(projectVersion)) {
+			return Boolean.TRUE.toString();
+		}
+		return null;
+	}
+
+	public static String getDefaultAntoraDisplayVersion(String projectVersion) {
+		if (!isSnapshot(projectVersion) && isPreRelease(projectVersion)) {
+			return getDefaultAntoraVersion(projectVersion);
+		}
+		return null;
+	}
+
+	private static boolean isSnapshot(String projectVersion) {
+		return getSnapshotIndex(projectVersion) >= 0;
+	}
+
+	private static int getSnapshotIndex(String projectVersion) {
+		return projectVersion.lastIndexOf("-SNAPSHOT");
+	}
+
+	private static boolean isPreRelease(String projectVersion) {
+		return projectVersion.lastIndexOf("-") >= 0;
+	}
+}

buildSrc/src/main/java/org/springframework/gradle/antora/UpdateAntoraVersionTask.java

@@ -0,0 +1,138 @@
+/*
+ * Copyright 2019-2022 the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.springframework.gradle.antora;
+
+import org.gradle.api.DefaultTask;
+import org.gradle.api.GradleException;
+import org.gradle.api.Project;
+import org.gradle.api.file.RegularFileProperty;
+import org.gradle.api.provider.Property;
+import org.gradle.api.tasks.Input;
+import org.gradle.api.tasks.InputFile;
+import org.gradle.api.tasks.Optional;
+import org.gradle.api.tasks.OutputFile;
+import org.gradle.api.tasks.TaskAction;
+import org.yaml.snakeyaml.DumperOptions;
+import org.yaml.snakeyaml.Yaml;
+import org.yaml.snakeyaml.constructor.Constructor;
+import org.yaml.snakeyaml.nodes.NodeTuple;
+import org.yaml.snakeyaml.nodes.Tag;
+import org.yaml.snakeyaml.representer.Representer;
+
+import java.io.File;
+import java.io.FileInputStream;
+import java.io.FileWriter;
+import java.io.IOException;
+
+import org.springframework.gradle.github.milestones.NextVersionYml;
+
+public abstract class UpdateAntoraVersionTask extends DefaultTask {
+
+	@TaskAction
+	public void update() throws IOException {
+		String projectVersion = getProject().getVersion().toString();
+		File antoraYmlFile = getAntoraYmlFile().getAsFile().get();
+		String updatedAntoraVersion = AntoraVersionUtils.getDefaultAntoraVersion(projectVersion);
+		String updatedAntoraPrerelease = AntoraVersionUtils.getDefaultAntoraPrerelease(projectVersion);
+		String updatedAntoraDisplayVersion = AntoraVersionUtils.getDefaultAntoraDisplayVersion(projectVersion);
+
+		Representer representer = new Representer();
+		representer.getPropertyUtils().setSkipMissingProperties(true);
+
+		Yaml yaml = new Yaml(new Constructor(AntoraYml.class), representer);
+		AntoraYml antoraYml = yaml.load(new FileInputStream(antoraYmlFile));
+
+		System.out.println("Updating the version parameters in " + antoraYmlFile.getName() + " to version: "
+				+ updatedAntoraVersion + ", prerelease: " + updatedAntoraPrerelease + ", display_version: "
+				+ updatedAntoraDisplayVersion);
+		antoraYml.setVersion(updatedAntoraVersion);
+		antoraYml.setPrerelease(updatedAntoraPrerelease);
+		antoraYml.setDisplay_version(updatedAntoraDisplayVersion);
+
+		FileWriter outputWriter = new FileWriter(antoraYmlFile);
+		getYaml().dump(antoraYml, outputWriter);
+	}
+
+	@InputFile
+	public abstract RegularFileProperty getAntoraYmlFile();
+
+	public static class AntoraYml {
+
+		private String name;
+
+		private String version;
+
+		private String prerelease;
+
+		private String display_version;
+
+		public String getName() {
+			return name;
+		}
+
+		public void setName(String name) {
+			this.name = name;
+		}
+
+		public String getVersion() {
+			return version;
+		}
+
+		public void setVersion(String version) {
+			this.version = version;
+		}
+
+		public String getPrerelease() {
+			return prerelease;
+		}
+
+		public void setPrerelease(String prerelease) {
+			this.prerelease = prerelease;
+		}
+
+		public String getDisplay_version() {
+			return display_version;
+		}
+
+		public void setDisplay_version(String display_version) {
+			this.display_version = display_version;
+		}
+
+	}
+
+	private Yaml getYaml() {
+		Representer representer = new Representer() {
+			@Override
+			protected NodeTuple representJavaBeanProperty(Object javaBean,
+					org.yaml.snakeyaml.introspector.Property property, Object propertyValue, Tag customTag) {
+				// Don't write out null values
+				if (propertyValue == null) {
+					return null;
+				}
+				else {
+					return super.representJavaBeanProperty(javaBean, property, propertyValue, customTag);
+				}
+			}
+		};
+		representer.addClassTag(AntoraYml.class, Tag.MAP);
+		DumperOptions ymlOptions = new DumperOptions();
+		ymlOptions.setDefaultFlowStyle(DumperOptions.FlowStyle.BLOCK);
+		ymlOptions.setDefaultScalarStyle(DumperOptions.ScalarStyle.SINGLE_QUOTED);
+		return new Yaml(representer, ymlOptions);
+	}
+
+}

buildSrc/src/main/java/org/springframework/gradle/github/RepositoryRef.java

@@ -1,10 +1,16 @@
-package org.springframework.gradle.github.milestones;
-public class RepositoryRef {
+package org.springframework.gradle.github;
+
+import java.io.Serializable;
+
+public class RepositoryRef implements Serializable {
+
+	private static final long serialVersionUID = 7151218536746822797L;
+
 	private String owner;
 
 	private String name;
 
-	RepositoryRef() {
+	public RepositoryRef() {
 	}
 
 	public RepositoryRef(String owner, String name) {
@@ -62,4 +68,3 @@ public class RepositoryRef {
 		}
 	}
 }
-

buildSrc/src/main/java/org/springframework/gradle/github/changelog/GitHubChangelogPlugin.java

@@ -16,6 +16,9 @@
 
 package org.springframework.gradle.github.changelog;
 
+import java.io.File;
+import java.nio.file.Paths;
+
 import org.gradle.api.Action;
 import org.gradle.api.Plugin;
 import org.gradle.api.Project;
@@ -28,12 +31,10 @@ import org.gradle.api.artifacts.repositories.IvyArtifactRepository;
 import org.gradle.api.artifacts.repositories.IvyPatternRepositoryLayout;
 import org.gradle.api.tasks.JavaExec;
 
-import java.io.File;
-import java.nio.file.Paths;
-
 public class GitHubChangelogPlugin implements Plugin<Project> {
 
 	public static final String CHANGELOG_GENERATOR_CONFIGURATION_NAME = "changelogGenerator";
+	public static final String RELEASE_NOTES_PATH = "changelog/release-notes.md";
 
 	@Override
 	public void apply(Project project) {
@@ -42,7 +43,7 @@ public class GitHubChangelogPlugin implements Plugin<Project> {
 		project.getTasks().register("generateChangelog", JavaExec.class, new Action<JavaExec>() {
 			@Override
 			public void execute(JavaExec generateChangelog) {
-				File outputFile = project.file(Paths.get(project.getBuildDir().getPath(), "changelog/release-notes.md"));
+				File outputFile = project.file(Paths.get(project.getBuildDir().getPath(), RELEASE_NOTES_PATH));
 				outputFile.getParentFile().mkdirs();
 				generateChangelog.setGroup("Release");
 				generateChangelog.setDescription("Generates the changelog");

buildSrc/src/main/java/org/springframework/gradle/github/milestones/GitHubMilestoneApi.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2019-2020 the original author or authors.
+ * Copyright 2019-2022 the original author or authors.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -16,22 +16,35 @@
 
 package org.springframework.gradle.github.milestones;
 
+import java.io.IOException;
+import java.time.LocalDate;
+import java.time.LocalDateTime;
+import java.util.List;
+import java.util.Optional;
+import java.util.regex.Matcher;
+import java.util.regex.Pattern;
+
 import com.google.common.reflect.TypeToken;
 import com.google.gson.Gson;
+import com.google.gson.GsonBuilder;
 import okhttp3.Interceptor;
+import okhttp3.MediaType;
 import okhttp3.OkHttpClient;
 import okhttp3.Request;
+import okhttp3.RequestBody;
 import okhttp3.Response;
 
-import java.io.IOException;
-import java.util.List;
+import org.springframework.gradle.github.RepositoryRef;
 
 public class GitHubMilestoneApi {
 	private String baseUrl = "https://api.github.com";
 
 	private OkHttpClient client;
 
-	private Gson gson = new Gson();
+	private final Gson gson = new GsonBuilder()
+			.registerTypeAdapter(LocalDate.class, new LocalDateAdapter().nullSafe())
+			.registerTypeAdapter(LocalDateTime.class, new LocalDateTimeAdapter().nullSafe())
+			.create();
 
 	public GitHubMilestoneApi() {
 		this.client = new OkHttpClient.Builder().build();
@@ -48,26 +61,30 @@ public class GitHubMilestoneApi {
 	}
 
 	public long findMilestoneNumberByTitle(RepositoryRef repositoryRef, String milestoneTitle) {
+		List<Milestone> milestones = this.getMilestones(repositoryRef);
+		for (Milestone milestone : milestones) {
+			if (milestoneTitle.equals(milestone.getTitle())) {
+				return milestone.getNumber();
+			}
+		}
+		if (milestones.size() <= 100) {
+			throw new RuntimeException("Could not find open milestone with title " + milestoneTitle + " for repository " + repositoryRef + " Got " + milestones);
+		}
+		throw new RuntimeException("It is possible there are too many open milestones (only 100 are supported). Could not find open milestone with title " + milestoneTitle + " for repository " + repositoryRef + " Got " + milestones);
+	}
+
+	public List<Milestone> getMilestones(RepositoryRef repositoryRef) {
 		String url = this.baseUrl + "/repos/" + repositoryRef.getOwner() + "/" + repositoryRef.getName() + "/milestones?per_page=100";
 		Request request = new Request.Builder().get().url(url)
 				.build();
 		try {
 			Response response = this.client.newCall(request).execute();
 			if (!response.isSuccessful()) {
-				throw new RuntimeException("Could not find milestone with title " + milestoneTitle + " for repository " + repositoryRef + ". Response " + response);
+				throw new RuntimeException("Could not retrieve milestones for repository " + repositoryRef + ". Response " + response);
 			}
-			List<Milestone> milestones = this.gson.fromJson(response.body().charStream(), new TypeToken<List<Milestone>>(){}.getType());
-			for (Milestone milestone : milestones) {
-				if (milestoneTitle.equals(milestone.getTitle())) {
-					return milestone.getNumber();
-				}
-			}
-			if (milestones.size() <= 100) {
-				throw new RuntimeException("Could not find open milestone with title " + milestoneTitle + " for repository " + repositoryRef + " Got " + milestones);
-			}
-			throw new RuntimeException("It is possible there are too many open milestones open (only 100 are supported). Could not find open milestone with title " + milestoneTitle + " for repository " + repositoryRef + " Got " + milestones);
+			return this.gson.fromJson(response.body().charStream(), new TypeToken<List<Milestone>>(){}.getType());
 		} catch (IOException e) {
-			throw new RuntimeException("Could not find open milestone with title " + milestoneTitle + " for repository " + repositoryRef, e);
+			throw new RuntimeException("Could not retrieve milestones for repository " + repositoryRef, e);
 		}
 	}
 
@@ -87,10 +104,150 @@ public class GitHubMilestoneApi {
 		}
 	}
 
-//	public boolean isOpenIssuesForMilestoneName(String owner, String repository, String milestoneName) {
-//
-//	}
+	/**
+	 * Check if the given milestone is due today or past due.
+	 *
+	 * @param repositoryRef The repository owner/name
+	 * @param milestoneTitle The title of the milestone whose due date should be checked
+	 * @return true if the given milestone is due today or past due, false otherwise
+	 */
+	public boolean isMilestoneDueToday(RepositoryRef repositoryRef, String milestoneTitle) {
+		String url = this.baseUrl + "/repos/" + repositoryRef.getOwner() + "/" + repositoryRef.getName()
+				+ "/milestones?per_page=100";
+		Request request = new Request.Builder().get().url(url).build();
+		try {
+			Response response = this.client.newCall(request).execute();
+			if (!response.isSuccessful()) {
+				throw new RuntimeException("Could not find milestone with title " + milestoneTitle + " for repository "
+						+ repositoryRef + ". Response " + response);
+			}
+			List<Milestone> milestones = this.gson.fromJson(response.body().charStream(),
+					new TypeToken<List<Milestone>>() {
+					}.getType());
+			for (Milestone milestone : milestones) {
+				if (milestoneTitle.equals(milestone.getTitle())) {
+					LocalDate today = LocalDate.now();
+					return milestone.getDueOn() != null && today.compareTo(milestone.getDueOn().toLocalDate()) >= 0;
+				}
+			}
+			if (milestones.size() <= 100) {
+				throw new RuntimeException("Could not find open milestone with title " + milestoneTitle
+						+ " for repository " + repositoryRef + " Got " + milestones);
+			}
+			throw new RuntimeException(
+					"It is possible there are too many open milestones open (only 100 are supported). Could not find open milestone with title "
+							+ milestoneTitle + " for repository " + repositoryRef + " Got " + milestones);
+		}
+		catch (IOException e) {
+			throw new RuntimeException(
+					"Could not find open milestone with title " + milestoneTitle + " for repository " + repositoryRef,
+					e);
+		}
+	}
 
+	/**
+	 * Calculate the next release version based on the current version.
+	 *
+	 * The current version must conform to the pattern MAJOR.MINOR.PATCH-SNAPSHOT. If the
+	 * current version is a snapshot of a patch release, then the patch release will be
+	 * returned. For example, if the current version is 5.6.1-SNAPSHOT, then 5.6.1 will be
+	 * returned. If the current version is a snapshot of a version that is not GA (i.e the
+	 * PATCH segment is 0), then GitHub will be queried to find the next milestone or
+	 * release candidate. If no pre-release versions are found, then the next version will
+	 * be assumed to be the GA.
+	 * @param repositoryRef The repository owner/name
+	 * @param currentVersion The current project version
+	 * @return the next matching milestone/release candidate or null if none exist
+	 */
+	public String getNextReleaseMilestone(RepositoryRef repositoryRef, String currentVersion) {
+		Pattern snapshotPattern = Pattern.compile("^([0-9]+)\\.([0-9]+)\\.([0-9]+)-SNAPSHOT$");
+		Matcher snapshotVersion = snapshotPattern.matcher(currentVersion);
+
+		if (snapshotVersion.find()) {
+			String patchSegment = snapshotVersion.group(3);
+			String currentVersionNoIdentifier = currentVersion.replace("-SNAPSHOT", "");
+			if (patchSegment.equals("0")) {
+				String nextPreRelease = getNextPreRelease(repositoryRef, currentVersionNoIdentifier);
+				return nextPreRelease != null ? nextPreRelease : currentVersionNoIdentifier;
+			}
+			else {
+				return currentVersionNoIdentifier;
+			}
+		}
+		else {
+			throw new IllegalStateException(
+					"Cannot calculate next release version because the current project version does not conform to the expected format");
+		}
+	}
+
+	/**
+	 * Calculate the next pre-release version (milestone or release candidate) based on
+	 * the current version.
+	 *
+	 * The current version must conform to the pattern MAJOR.MINOR.PATCH. If no matching
+	 * milestone or release candidate is found in GitHub then it will return null.
+	 * @param repositoryRef The repository owner/name
+	 * @param currentVersionNoIdentifier The current project version without any
+	 * identifier
+	 * @return the next matching milestone/release candidate or null if none exist
+	 */
+	private String getNextPreRelease(RepositoryRef repositoryRef, String currentVersionNoIdentifier) {
+		String url = this.baseUrl + "/repos/" + repositoryRef.getOwner() + "/" + repositoryRef.getName()
+				+ "/milestones?per_page=100";
+		Request request = new Request.Builder().get().url(url).build();
+		try {
+			Response response = this.client.newCall(request).execute();
+			if (!response.isSuccessful()) {
+				throw new RuntimeException(
+						"Could not get milestones for repository " + repositoryRef + ". Response " + response);
+			}
+			List<Milestone> milestones = this.gson.fromJson(response.body().charStream(),
+					new TypeToken<List<Milestone>>() {
+					}.getType());
+			Optional<String> nextPreRelease = milestones.stream().map(Milestone::getTitle)
+					.filter(m -> m.startsWith(currentVersionNoIdentifier + "-"))
+					.min((m1, m2) -> {
+						Pattern preReleasePattern = Pattern.compile("^.*-([A-Z]+)([0-9]+)$");
+						Matcher matcher1 = preReleasePattern.matcher(m1);
+						Matcher matcher2 = preReleasePattern.matcher(m2);
+						matcher1.find();
+						matcher2.find();
+						if (!matcher1.group(1).equals(matcher2.group(1))) {
+							return m1.compareTo(m2);
+						}
+						else {
+							return Integer.valueOf(matcher1.group(2)).compareTo(Integer.valueOf(matcher2.group(2)));
+						}
+					});
+			return nextPreRelease.orElse(null);
+		}
+		catch (IOException e) {
+			throw new RuntimeException("Could not find open milestones with for repository " + repositoryRef, e);
+		}
+	}
+
+	/**
+	 * Create a milestone.
+	 *
+	 * @param repository The repository owner/name
+	 * @param milestone The milestone containing a title and due date
+	 */
+	public void createMilestone(RepositoryRef repository, Milestone milestone) {
+		String url = this.baseUrl + "/repos/" + repository.getOwner() + "/" + repository.getName() + "/milestones";
+		String json = this.gson.toJson(milestone);
+		RequestBody body = RequestBody.create(MediaType.parse("application/json"), json);
+		Request request = new Request.Builder().url(url).post(body).build();
+		try {
+			Response response = this.client.newCall(request).execute();
+			if (!response.isSuccessful()) {
+				throw new RuntimeException(String.format("Could not create milestone %s for repository %s/%s. Got response %s",
+						milestone.getTitle(), repository.getOwner(), repository.getName(), response));
+			}
+		} catch (IOException ex) {
+			throw new RuntimeException(String.format("Could not create release %s for repository %s/%s",
+					milestone.getTitle(), repository.getOwner(), repository.getName()), ex);
+		}
+	}
 
 	private static class AuthorizationInterceptor implements Interceptor {
 

buildSrc/src/main/java/org/springframework/gradle/github/milestones/GitHubMilestoneHasNoOpenIssuesTask.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2019-2020 the original author or authors.
+ * Copyright 2019-2022 the original author or authors.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -17,30 +17,66 @@ package org.springframework.gradle.github.milestones;
 
 import org.gradle.api.Action;
 import org.gradle.api.DefaultTask;
+import org.gradle.api.file.RegularFileProperty;
 import org.gradle.api.tasks.Input;
+import org.gradle.api.tasks.InputFile;
 import org.gradle.api.tasks.Optional;
+import org.gradle.api.tasks.OutputFile;
 import org.gradle.api.tasks.TaskAction;
+import org.gradle.work.DisableCachingByDefault;
+import org.yaml.snakeyaml.Yaml;
+import org.yaml.snakeyaml.constructor.Constructor;
 
-public class GitHubMilestoneHasNoOpenIssuesTask extends DefaultTask {
+import java.io.File;
+import java.io.FileInputStream;
+import java.io.IOException;
+import java.nio.file.Files;
+import java.nio.file.Path;
+
+import org.springframework.gradle.github.RepositoryRef;
+
+@DisableCachingByDefault(because = "the due date needs to be checked every time in case it changes")
+public abstract class GitHubMilestoneHasNoOpenIssuesTask extends DefaultTask {
 	@Input
 	private RepositoryRef repository = new RepositoryRef();
 
-	@Input
+	@Input @Optional
 	private String milestoneTitle;
 
+	@InputFile @Optional
+	public abstract RegularFileProperty getNextVersionFile();
+
 	@Input @Optional
 	private String gitHubAccessToken;
 
+	@OutputFile
+	public abstract RegularFileProperty getIsOpenIssuesFile();
+
 	private GitHubMilestoneApi milestones = new GitHubMilestoneApi();
 
 	@TaskAction
-	public void checkHasNoOpenIssues() {
+	public void checkHasNoOpenIssues() throws IOException {
+		if (this.milestoneTitle == null) {
+			File nextVersionFile = getNextVersionFile().getAsFile().get();
+			Yaml yaml = new Yaml(new Constructor(NextVersionYml.class));
+			NextVersionYml nextVersionYml = yaml.load(new FileInputStream(nextVersionFile));
+			String nextVersion = nextVersionYml.getVersion();
+			if (nextVersion == null) {
+				throw new IllegalArgumentException(
+						"Could not find version property in provided file " + nextVersionFile.getName());
+			}
+			this.milestoneTitle = nextVersion;
+		}
 		long milestoneNumber = this.milestones.findMilestoneNumberByTitle(this.repository, this.milestoneTitle);
 		boolean isOpenIssues = this.milestones.isOpenIssuesForMilestoneNumber(this.repository, milestoneNumber);
+		Path isOpenIssuesPath = getIsOpenIssuesFile().getAsFile().get().toPath();
+		Files.write(isOpenIssuesPath, String.valueOf(isOpenIssues).getBytes());
 		if (isOpenIssues) {
-			throw new IllegalStateException("The repository " + this.repository + " has open issues for milestone with the title " + this.milestoneTitle + " and number " + milestoneNumber);
+			System.out.println("The repository " + this.repository + " has open issues for milestone with the title " + this.milestoneTitle + " and number " + milestoneNumber);
+		}
+		else {
+			System.out.println("The repository " + this.repository + " has no open issues for milestone with the title " + this.milestoneTitle + " and number " + milestoneNumber);
 		}
-		System.out.println("The repository " + this.repository + " has no open issues for milestone with the title " + this.milestoneTitle + " and number " + milestoneNumber);
 	}
 
 	public RepositoryRef getRepository() {

buildSrc/src/main/java/org/springframework/gradle/github/milestones/GitHubMilestoneNextReleaseTask.java

@@ -0,0 +1,93 @@
+/*
+ * Copyright 2019-2022 the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.springframework.gradle.github.milestones;
+
+import org.gradle.api.Action;
+import org.gradle.api.DefaultTask;
+import org.gradle.api.file.RegularFileProperty;
+import org.gradle.api.tasks.Input;
+import org.gradle.api.tasks.Optional;
+import org.gradle.api.tasks.OutputFile;
+import org.gradle.api.tasks.TaskAction;
+import org.yaml.snakeyaml.DumperOptions;
+import org.yaml.snakeyaml.Yaml;
+import org.yaml.snakeyaml.nodes.Tag;
+import org.yaml.snakeyaml.representer.Representer;
+
+import java.io.File;
+import java.io.FileWriter;
+import java.io.IOException;
+
+import org.springframework.gradle.github.RepositoryRef;
+
+public abstract class GitHubMilestoneNextReleaseTask extends DefaultTask {
+
+	@Input
+	private RepositoryRef repository = new RepositoryRef();
+
+	@Input
+	@Optional
+	private String gitHubAccessToken;
+
+	private GitHubMilestoneApi milestones = new GitHubMilestoneApi();
+
+	@TaskAction
+	public void calculateNextReleaseMilestone() throws IOException {
+		String currentVersion = getProject().getVersion().toString();
+		String nextPreRelease = this.milestones.getNextReleaseMilestone(this.repository, currentVersion);
+		System.out.println("The next release milestone is: " + nextPreRelease);
+		NextVersionYml nextVersionYml = new NextVersionYml();
+		nextVersionYml.setVersion(nextPreRelease);
+		File outputFile = getNextReleaseFile().get().getAsFile();
+		FileWriter outputWriter = new FileWriter(outputFile);
+		Yaml yaml = getYaml();
+		yaml.dump(nextVersionYml, outputWriter);
+	}
+
+	@OutputFile
+	public abstract RegularFileProperty getNextReleaseFile();
+
+	public RepositoryRef getRepository() {
+		return repository;
+	}
+
+	public void repository(Action<RepositoryRef> repository) {
+		repository.execute(this.repository);
+	}
+
+	public void setRepository(RepositoryRef repository) {
+		this.repository = repository;
+	}
+
+	public String getGitHubAccessToken() {
+		return gitHubAccessToken;
+	}
+
+	public void setGitHubAccessToken(String gitHubAccessToken) {
+		this.gitHubAccessToken = gitHubAccessToken;
+		this.milestones = new GitHubMilestoneApi(gitHubAccessToken);
+	}
+
+	private Yaml getYaml() {
+		Representer representer = new Representer();
+		representer.addClassTag(NextVersionYml.class, Tag.MAP);
+		DumperOptions ymlOptions = new DumperOptions();
+		ymlOptions.setDefaultFlowStyle(DumperOptions.FlowStyle.BLOCK);
+		return new Yaml(representer, ymlOptions);
+	}
+
+}

buildSrc/src/main/java/org/springframework/gradle/github/milestones/GitHubMilestoneNextVersionDueTodayTask.java

@@ -0,0 +1,102 @@
+/*
+ * Copyright 2019-2022 the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.springframework.gradle.github.milestones;
+
+import org.gradle.api.Action;
+import org.gradle.api.DefaultTask;
+import org.gradle.api.file.RegularFileProperty;
+import org.gradle.api.tasks.Input;
+import org.gradle.api.tasks.InputFile;
+import org.gradle.api.tasks.Optional;
+import org.gradle.api.tasks.OutputFile;
+import org.gradle.api.tasks.TaskAction;
+import org.gradle.work.DisableCachingByDefault;
+import org.yaml.snakeyaml.Yaml;
+import org.yaml.snakeyaml.constructor.Constructor;
+
+import java.io.File;
+import java.io.FileInputStream;
+import java.io.IOException;
+import java.nio.file.Files;
+import java.nio.file.Path;
+
+import org.springframework.gradle.github.RepositoryRef;
+
+@DisableCachingByDefault(because = "the due date needs to be checked every time in case it changes")
+public abstract class GitHubMilestoneNextVersionDueTodayTask extends DefaultTask {
+
+	@Input
+	private RepositoryRef repository = new RepositoryRef();
+
+	@Input
+	@Optional
+	private String gitHubAccessToken;
+
+	@InputFile
+	public abstract RegularFileProperty getNextVersionFile();
+
+	@OutputFile
+	public abstract RegularFileProperty getIsDueTodayFile();
+
+	private GitHubMilestoneApi milestones = new GitHubMilestoneApi();
+
+	@TaskAction
+	public void checkReleaseDueToday() throws IOException {
+		File nextVersionFile = getNextVersionFile().getAsFile().get();
+		Yaml yaml = new Yaml(new Constructor(NextVersionYml.class));
+		NextVersionYml nextVersionYml = yaml.load(new FileInputStream(nextVersionFile));
+		String nextVersion = nextVersionYml.getVersion();
+		if (nextVersion == null) {
+			throw new IllegalArgumentException(
+					"Could not find version property in provided file " + nextVersionFile.getName());
+		}
+		boolean milestoneDueToday = this.milestones.isMilestoneDueToday(this.repository, nextVersion);
+		Path isDueTodayPath = getIsDueTodayFile().getAsFile().get().toPath();
+		Files.writeString(isDueTodayPath, String.valueOf(milestoneDueToday));
+		if (milestoneDueToday) {
+			System.out.println("The milestone with the title " + nextVersion + " in the repository " + this.repository
+					+ " is due today");
+		}
+		else {
+			System.out.println("The milestone with the title " + nextVersion + " in the repository "
+					+ this.repository + " is not due yet");
+		}
+
+	}
+
+	public RepositoryRef getRepository() {
+		return repository;
+	}
+
+	public void repository(Action<RepositoryRef> repository) {
+		repository.execute(this.repository);
+	}
+
+	public void setRepository(RepositoryRef repository) {
+		this.repository = repository;
+	}
+
+	public String getGitHubAccessToken() {
+		return gitHubAccessToken;
+	}
+
+	public void setGitHubAccessToken(String gitHubAccessToken) {
+		this.gitHubAccessToken = gitHubAccessToken;
+		this.milestones = new GitHubMilestoneApi(gitHubAccessToken);
+	}
+
+}

buildSrc/src/main/java/org/springframework/gradle/github/milestones/GitHubMilestonePlugin.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2019-2020 the original author or authors.
+ * Copyright 2019-2022 the original author or authors.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -16,23 +16,55 @@
 
 package org.springframework.gradle.github.milestones;
 
-import org.gradle.api.Action;
 import org.gradle.api.Plugin;
 import org.gradle.api.Project;
+import org.gradle.api.tasks.TaskProvider;
 
 public class GitHubMilestonePlugin implements Plugin<Project> {
 	@Override
 	public void apply(Project project) {
-		project.getTasks().register("gitHubCheckMilestoneHasNoOpenIssues", GitHubMilestoneHasNoOpenIssuesTask.class, new Action<GitHubMilestoneHasNoOpenIssuesTask>() {
-			@Override
-			public void execute(GitHubMilestoneHasNoOpenIssuesTask githubCheckMilestoneHasNoOpenIssues) {
-				githubCheckMilestoneHasNoOpenIssues.setGroup("Release");
-				githubCheckMilestoneHasNoOpenIssues.setDescription("Checks if there are any open issues for the specified repository and milestone");
-				githubCheckMilestoneHasNoOpenIssues.setMilestoneTitle((String) project.findProperty("nextVersion"));
-				if (project.hasProperty("githubAccessToken")) {
-					githubCheckMilestoneHasNoOpenIssues.setGitHubAccessToken((String) project.findProperty("gitHubAccessToken"));
-				}
+		TaskProvider<GitHubMilestoneNextReleaseTask> nextReleaseMilestoneTask = project.getTasks().register("gitHubNextReleaseMilestone", GitHubMilestoneNextReleaseTask.class, (gitHubMilestoneNextReleaseTask) -> {
+			gitHubMilestoneNextReleaseTask.doNotTrackState("API call to GitHub needs to check for new milestones every time");
+			gitHubMilestoneNextReleaseTask.setGroup("Release");
+			gitHubMilestoneNextReleaseTask.setDescription("Calculates the next release version based on the current version and outputs it to a yaml file");
+			gitHubMilestoneNextReleaseTask.getNextReleaseFile()
+					.fileProvider(project.provider(() -> project.file("next-release.yml")));
+			if (project.hasProperty("gitHubAccessToken")) {
+				gitHubMilestoneNextReleaseTask
+						.setGitHubAccessToken((String) project.findProperty("gitHubAccessToken"));
 			}
 		});
+		project.getTasks().register("gitHubCheckMilestoneHasNoOpenIssues", GitHubMilestoneHasNoOpenIssuesTask.class, (githubCheckMilestoneHasNoOpenIssues) -> {
+			githubCheckMilestoneHasNoOpenIssues.setGroup("Release");
+			githubCheckMilestoneHasNoOpenIssues.setDescription("Checks if there are any open issues for the specified repository and milestone");
+			githubCheckMilestoneHasNoOpenIssues.getIsOpenIssuesFile().value(project.getLayout().getBuildDirectory().file("github/milestones/is-open-issues"));
+			githubCheckMilestoneHasNoOpenIssues.setMilestoneTitle((String) project.findProperty("nextVersion"));
+			if (!project.hasProperty("nextVersion")) {
+				githubCheckMilestoneHasNoOpenIssues.getNextVersionFile().convention(
+						nextReleaseMilestoneTask.flatMap(GitHubMilestoneNextReleaseTask::getNextReleaseFile));
+			}
+			if (project.hasProperty("gitHubAccessToken")) {
+				githubCheckMilestoneHasNoOpenIssues.setGitHubAccessToken((String) project.findProperty("gitHubAccessToken"));
+			}
+		});
+		project.getTasks().register("gitHubCheckNextVersionDueToday", GitHubMilestoneNextVersionDueTodayTask.class, (gitHubMilestoneNextVersionDueTodayTask) -> {
+			gitHubMilestoneNextVersionDueTodayTask.setGroup("Release");
+			gitHubMilestoneNextVersionDueTodayTask.setDescription("Checks if the next release version is due today or past due, will fail if the next version is not due yet");
+			gitHubMilestoneNextVersionDueTodayTask.getIsDueTodayFile().value(project.getLayout().getBuildDirectory().file("github/milestones/is-due-today"));
+			gitHubMilestoneNextVersionDueTodayTask.getNextVersionFile().convention(
+					nextReleaseMilestoneTask.flatMap(GitHubMilestoneNextReleaseTask::getNextReleaseFile));
+			if (project.hasProperty("gitHubAccessToken")) {
+				gitHubMilestoneNextVersionDueTodayTask
+						.setGitHubAccessToken((String) project.findProperty("gitHubAccessToken"));
+			}
+		});
+		project.getTasks().register("scheduleNextRelease", ScheduleNextReleaseTask.class, (scheduleNextRelease) -> {
+			scheduleNextRelease.doNotTrackState("API call to GitHub needs to check for new milestones every time");
+			scheduleNextRelease.setGroup("Release");
+			scheduleNextRelease.setDescription("Schedule the next release (even months only) or release train (series of milestones starting in January or July) based on the current version");
+
+			scheduleNextRelease.setVersion((String) project.findProperty("nextVersion"));
+			scheduleNextRelease.setGitHubAccessToken((String) project.findProperty("gitHubAccessToken"));
+		});
 	}
 }

buildSrc/src/main/java/org/springframework/gradle/github/milestones/LocalDateAdapter.java

@@ -0,0 +1,23 @@
+package org.springframework.gradle.github.milestones;
+
+import java.io.IOException;
+import java.time.LocalDate;
+
+import com.google.gson.TypeAdapter;
+import com.google.gson.stream.JsonReader;
+import com.google.gson.stream.JsonWriter;
+
+/**
+ * @author Steve Riesenberg
+ */
+class LocalDateAdapter extends TypeAdapter<LocalDate> {
+	@Override
+	public void write(JsonWriter jsonWriter, LocalDate localDate) throws IOException {
+		jsonWriter.value(localDate.toString());
+	}
+
+	@Override
+	public LocalDate read(JsonReader jsonReader) throws IOException {
+		return LocalDate.parse(jsonReader.nextString());
+	}
+}

buildSrc/src/main/java/org/springframework/gradle/github/milestones/LocalDateTimeAdapter.java

@@ -0,0 +1,25 @@
+package org.springframework.gradle.github.milestones;
+
+import java.io.IOException;
+import java.time.LocalDateTime;
+import java.time.ZoneOffset;
+import java.time.format.DateTimeFormatter;
+
+import com.google.gson.TypeAdapter;
+import com.google.gson.stream.JsonReader;
+import com.google.gson.stream.JsonWriter;
+
+/**
+ * @author Steve Riesenberg
+ */
+class LocalDateTimeAdapter extends TypeAdapter<LocalDateTime> {
+	@Override
+	public void write(JsonWriter jsonWriter, LocalDateTime localDateTime) throws IOException {
+		jsonWriter.value(localDateTime.atOffset(ZoneOffset.UTC).format(DateTimeFormatter.ISO_ZONED_DATE_TIME));
+	}
+
+	@Override
+	public LocalDateTime read(JsonReader jsonReader) throws IOException {
+		return LocalDateTime.parse(jsonReader.nextString(), DateTimeFormatter.ISO_ZONED_DATE_TIME);
+	}
+}

buildSrc/src/main/java/org/springframework/gradle/github/milestones/Milestone.java

@@ -1,9 +1,35 @@
+/*
+ * Copyright 2019-2022 the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
 package org.springframework.gradle.github.milestones;
 
+import com.google.gson.annotations.SerializedName;
+
+import java.time.LocalDateTime;
+
+/**
+ * @author Steve Riesenberg
+ */
 public class Milestone {
 	private String title;
 
-	private long number;
+	private Long number;
+
+	@SerializedName("due_on")
+	private LocalDateTime dueOn;
 
 	public String getTitle() {
 		return title;
@@ -13,19 +39,28 @@ public class Milestone {
 		this.title = title;
 	}
 
-	public long getNumber() {
+	public Long getNumber() {
 		return number;
 	}
 
-	public void setNumber(long number) {
+	public void setNumber(Long number) {
 		this.number = number;
 	}
 
+	public LocalDateTime getDueOn() {
+		return dueOn;
+	}
+
+	public void setDueOn(LocalDateTime dueOn) {
+		this.dueOn = dueOn;
+	}
+
 	@Override
 	public String toString() {
 		return "Milestone{" +
 				"title='" + title + '\'' +
-				", number=" + number +
+				", number='" + number + '\'' +
+				", dueOn='" + dueOn + '\'' +
 				'}';
 	}
 }

buildSrc/src/main/java/org/springframework/gradle/github/milestones/NextVersionYml.java

@@ -0,0 +1,29 @@
+/*
+ * Copyright 2019-2022 the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.springframework.gradle.github.milestones;
+
+public class NextVersionYml {
+	private String version;
+
+	public String getVersion() {
+		return version;
+	}
+
+	public void setVersion(String version) {
+		this.version = version;
+	}
+}

buildSrc/src/main/java/org/springframework/gradle/github/milestones/ScheduleNextReleaseTask.java

@@ -0,0 +1,147 @@
+/*
+ * Copyright 2002-2022 the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.springframework.gradle.github.milestones;
+
+import java.time.LocalDate;
+import java.time.LocalTime;
+
+import org.gradle.api.Action;
+import org.gradle.api.DefaultTask;
+import org.gradle.api.tasks.Input;
+import org.gradle.api.tasks.TaskAction;
+
+import org.springframework.gradle.github.RepositoryRef;
+
+/**
+ * @author Steve Riesenberg
+ */
+public class ScheduleNextReleaseTask extends DefaultTask {
+	@Input
+	private RepositoryRef repository = new RepositoryRef();
+
+	@Input
+	private String gitHubAccessToken;
+
+	@Input
+	private String version;
+
+	@Input
+	private Integer weekOfMonth;
+
+	@Input
+	private Integer dayOfWeek;
+
+	@TaskAction
+	public void scheduleNextRelease() {
+		GitHubMilestoneApi gitHubMilestoneApi = new GitHubMilestoneApi(this.gitHubAccessToken);
+		String nextReleaseMilestone = gitHubMilestoneApi.getNextReleaseMilestone(this.repository, this.version);
+
+		// If the next release contains a dash (e.g. 5.6.0-RC1), it is already scheduled
+		if (nextReleaseMilestone.contains("-")) {
+			return;
+		}
+
+		// Check to see if a scheduled GA version already exists
+		boolean hasExistingMilestone = gitHubMilestoneApi.getMilestones(this.repository).stream()
+				.anyMatch(milestone -> nextReleaseMilestone.equals(milestone.getTitle()));
+		if (hasExistingMilestone) {
+			return;
+		}
+
+		// Next milestone is either a patch version or minor version
+		// Note: Major versions will be handled like minor and get a release
+		// train which can be manually updated to match the desired schedule.
+		if (nextReleaseMilestone.endsWith(".0")) {
+			// Create M1, M2, M3, RC1 and GA milestones for release train
+			getReleaseTrain(nextReleaseMilestone).getTrainDates().forEach((milestoneTitle, dueOn) -> {
+				Milestone milestone = new Milestone();
+				milestone.setTitle(milestoneTitle);
+				// Note: GitHub seems to store full date/time as UTC then displays
+				// as a date (no time) in your timezone, which means the date will
+				// not always be the same date as we intend.
+				// Using 12pm/noon UTC allows GitHub to schedule and display the
+				// correct date.
+				milestone.setDueOn(dueOn.atTime(LocalTime.NOON));
+				gitHubMilestoneApi.createMilestone(this.repository, milestone);
+			});
+		} else {
+			// Create GA milestone for patch release on the next even month
+			LocalDate startDate = LocalDate.now();
+			LocalDate dueOn = getReleaseTrain(nextReleaseMilestone).getNextReleaseDate(startDate);
+			Milestone milestone = new Milestone();
+			milestone.setTitle(nextReleaseMilestone);
+			milestone.setDueOn(dueOn.atTime(LocalTime.NOON));
+			gitHubMilestoneApi.createMilestone(this.repository, milestone);
+		}
+	}
+
+	private SpringReleaseTrain getReleaseTrain(String nextReleaseMilestone) {
+		SpringReleaseTrainSpec releaseTrainSpec =
+				SpringReleaseTrainSpec.builder()
+						.nextTrain()
+						.version(nextReleaseMilestone)
+						.weekOfMonth(this.weekOfMonth)
+						.dayOfWeek(this.dayOfWeek)
+						.build();
+
+		return new SpringReleaseTrain(releaseTrainSpec);
+	}
+
+	public RepositoryRef getRepository() {
+		return this.repository;
+	}
+
+	public void repository(Action<RepositoryRef> repository) {
+		repository.execute(this.repository);
+	}
+
+	public void setRepository(RepositoryRef repository) {
+		this.repository = repository;
+	}
+
+	public String getGitHubAccessToken() {
+		return this.gitHubAccessToken;
+	}
+
+	public void setGitHubAccessToken(String gitHubAccessToken) {
+		this.gitHubAccessToken = gitHubAccessToken;
+	}
+
+	public String getVersion() {
+		return this.version;
+	}
+
+	public void setVersion(String version) {
+		this.version = version;
+	}
+
+	public Integer getWeekOfMonth() {
+		return weekOfMonth;
+	}
+
+	public void setWeekOfMonth(Integer weekOfMonth) {
+		this.weekOfMonth = weekOfMonth;
+	}
+
+	public Integer getDayOfWeek() {
+		return dayOfWeek;
+	}
+
+	public void setDayOfWeek(Integer dayOfWeek) {
+		this.dayOfWeek = dayOfWeek;
+	}
+}

buildSrc/src/main/java/org/springframework/gradle/github/milestones/SpringReleaseTrain.java

@@ -0,0 +1,136 @@
+/*
+ * Copyright 2002-2022 the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.springframework.gradle.github.milestones;
+
+import java.time.DayOfWeek;
+import java.time.LocalDate;
+import java.time.Month;
+import java.time.Year;
+import java.time.temporal.TemporalAdjuster;
+import java.time.temporal.TemporalAdjusters;
+import java.util.LinkedHashMap;
+import java.util.Map;
+
+/**
+ * Spring release train generator based on rules contained in a specification.
+ * <p>
+ * The rules are:
+ * <ol>
+ *     <li>Train 1 (January-May) or 2 (July-November)</li>
+ *     <li>Version number (e.g. 0.1.2, 1.0.0, etc.)</li>
+ *     <li>Week of month (1st, 2nd, 3rd, 4th)</li>
+ *     <li>Day of week (Monday-Friday)</li>
+ *     <li>Year (e.g. 2020, 2021, etc.)</li>
+ * </ol>
+ *
+ * The release train generated will contain M1, M2, M3, RC1 and GA versions
+ * mapped to their respective dates in the train.
+ *
+ * @author Steve Riesenberg
+ */
+public final class SpringReleaseTrain {
+	private final SpringReleaseTrainSpec releaseTrainSpec;
+
+	public SpringReleaseTrain(SpringReleaseTrainSpec releaseTrainSpec) {
+		this.releaseTrainSpec = releaseTrainSpec;
+	}
+
+	/**
+	 * Calculate release train dates based on the release train specification.
+	 *
+	 * @return A mapping of release milestones to scheduled release dates
+	 */
+	public Map<String, LocalDate> getTrainDates() {
+		Map<String, LocalDate> releaseDates = new LinkedHashMap<>();
+		switch (this.releaseTrainSpec.getTrain()) {
+			case ONE:
+				addTrainDate(releaseDates, "M1", Month.JANUARY);
+				addTrainDate(releaseDates, "M2", Month.FEBRUARY);
+				addTrainDate(releaseDates, "M3", Month.MARCH);
+				addTrainDate(releaseDates, "RC1", Month.APRIL);
+				addTrainDate(releaseDates, null, Month.MAY);
+				break;
+			case TWO:
+				addTrainDate(releaseDates, "M1", Month.JULY);
+				addTrainDate(releaseDates, "M2", Month.AUGUST);
+				addTrainDate(releaseDates, "M3", Month.SEPTEMBER);
+				addTrainDate(releaseDates, "RC1", Month.OCTOBER);
+				addTrainDate(releaseDates, null, Month.NOVEMBER);
+				break;
+		}
+
+		return releaseDates;
+	}
+
+	/**
+	 * Determine if a given date matches the due date of given version.
+	 *
+	 * @param version The version number (e.g. 5.6.0-M1, 5.6.0, etc.)
+	 * @param expectedDate The expected date
+	 * @return true if the given date matches the due date of the given version, false otherwise
+	 */
+	public boolean isTrainDate(String version, LocalDate expectedDate) {
+		return expectedDate.isEqual(getTrainDates().get(version));
+	}
+
+	/**
+	 * Calculate the next release date following the given date.
+	 * <p>
+	 * The next release date is always on an even month so that a patch release
+	 * is the month after the GA version of a release train. This method does
+	 * not consider the year of the release train, only the given start date.
+	 *
+	 * @param startDate The start date
+	 * @return The next release date following the given date
+	 */
+	public LocalDate getNextReleaseDate(LocalDate startDate) {
+		LocalDate trainDate;
+		LocalDate currentDate = startDate;
+		do {
+			trainDate = calculateReleaseDate(
+					Year.of(currentDate.getYear()),
+					currentDate.getMonth(),
+					this.releaseTrainSpec.getDayOfWeek().getDayOfWeek(),
+					this.releaseTrainSpec.getWeekOfMonth().getDayOffset()
+			);
+			currentDate = currentDate.plusMonths(1);
+		} while (!trainDate.isAfter(startDate) || trainDate.getMonthValue() % 2 != 0);
+
+		return trainDate;
+	}
+
+	private void addTrainDate(Map<String, LocalDate> releaseDates, String milestone, Month month) {
+		LocalDate releaseDate = calculateReleaseDate(
+				this.releaseTrainSpec.getYear(),
+				month,
+				this.releaseTrainSpec.getDayOfWeek().getDayOfWeek(),
+				this.releaseTrainSpec.getWeekOfMonth().getDayOffset()
+		);
+		String suffix = (milestone == null) ? "" : "-" + milestone;
+		releaseDates.put(this.releaseTrainSpec.getVersion() + suffix, releaseDate);
+	}
+
+	private static LocalDate calculateReleaseDate(Year year, Month month, DayOfWeek dayOfWeek, int dayOffset) {
+		TemporalAdjuster nextMonday = TemporalAdjusters.nextOrSame(DayOfWeek.MONDAY);
+		TemporalAdjuster nextDayOfWeek = TemporalAdjusters.nextOrSame(dayOfWeek);
+
+		LocalDate firstDayOfMonth = year.atMonth(month).atDay(1);
+		LocalDate firstMondayOfMonth = firstDayOfMonth.with(nextMonday);
+
+		return firstMondayOfMonth.with(nextDayOfWeek).plusDays(dayOffset);
+	}
+}

buildSrc/src/main/java/org/springframework/gradle/github/milestones/SpringReleaseTrainSpec.java

@@ -0,0 +1,205 @@
+/*
+ * Copyright 2002-2022 the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.springframework.gradle.github.milestones;
+
+import java.time.LocalDate;
+import java.time.Month;
+import java.time.Year;
+
+import org.springframework.util.Assert;
+
+/**
+ * A specification for a release train.
+ *
+ * @author Steve Riesenberg
+ * @see SpringReleaseTrain
+ */
+public final class SpringReleaseTrainSpec {
+	private final Train train;
+	private final String version;
+	private final WeekOfMonth weekOfMonth;
+	private final DayOfWeek dayOfWeek;
+	private final Year year;
+
+	public SpringReleaseTrainSpec(Train train, String version, WeekOfMonth weekOfMonth, DayOfWeek dayOfWeek, Year year) {
+		this.train = train;
+		this.version = version;
+		this.weekOfMonth = weekOfMonth;
+		this.dayOfWeek = dayOfWeek;
+		this.year = year;
+	}
+
+	public Train getTrain() {
+		return train;
+	}
+
+	public String getVersion() {
+		return version;
+	}
+
+	public WeekOfMonth getWeekOfMonth() {
+		return weekOfMonth;
+	}
+
+	public DayOfWeek getDayOfWeek() {
+		return dayOfWeek;
+	}
+
+	public Year getYear() {
+		return year;
+	}
+
+	public static Builder builder() {
+		return new Builder();
+	}
+
+	public enum WeekOfMonth {
+		FIRST(0), SECOND(7), THIRD(14), FOURTH(21);
+
+		private final int dayOffset;
+
+		WeekOfMonth(int dayOffset) {
+			this.dayOffset = dayOffset;
+		}
+
+		public int getDayOffset() {
+			return dayOffset;
+		}
+	}
+
+	public enum DayOfWeek {
+		MONDAY(java.time.DayOfWeek.MONDAY),
+		TUESDAY(java.time.DayOfWeek.TUESDAY),
+		WEDNESDAY(java.time.DayOfWeek.WEDNESDAY),
+		THURSDAY(java.time.DayOfWeek.THURSDAY),
+		FRIDAY(java.time.DayOfWeek.FRIDAY);
+
+		private final java.time.DayOfWeek dayOfWeek;
+
+		DayOfWeek(java.time.DayOfWeek dayOfWeek) {
+			this.dayOfWeek = dayOfWeek;
+		}
+
+		public java.time.DayOfWeek getDayOfWeek() {
+			return dayOfWeek;
+		}
+	}
+
+	public enum Train {
+		ONE, TWO
+	}
+
+	public static class Builder {
+		private Train train;
+		private String version;
+		private WeekOfMonth weekOfMonth;
+		private DayOfWeek dayOfWeek;
+		private Year year;
+
+		private Builder() {
+		}
+
+		public Builder train(int train) {
+			switch (train) {
+				case 1: this.train = Train.ONE; break;
+				case 2: this.train = Train.TWO; break;
+				default: throw new IllegalArgumentException("Invalid train: " + train);
+			}
+			return this;
+		}
+
+		public Builder train(Train train) {
+			this.train = train;
+			return this;
+		}
+
+		public Builder nextTrain() {
+			// Search for next train starting with this month
+			return nextTrain(LocalDate.now().withDayOfMonth(1));
+		}
+
+		public Builder nextTrain(LocalDate startDate) {
+			Train nextTrain = null;
+
+			// Search for next train from a given start date
+			LocalDate currentDate = startDate;
+			while (nextTrain == null) {
+				if (currentDate.getMonth() == Month.JANUARY) {
+					nextTrain = Train.ONE;
+				} else if (currentDate.getMonth() == Month.JULY) {
+					nextTrain = Train.TWO;
+				}
+
+				currentDate = currentDate.plusMonths(1);
+			}
+
+			return train(nextTrain).year(currentDate.getYear());
+		}
+
+		public Builder version(String version) {
+			this.version = version;
+			return this;
+		}
+
+		public Builder weekOfMonth(int weekOfMonth) {
+			switch (weekOfMonth) {
+				case 1: this.weekOfMonth = WeekOfMonth.FIRST; break;
+				case 2: this.weekOfMonth = WeekOfMonth.SECOND; break;
+				case 3: this.weekOfMonth = WeekOfMonth.THIRD; break;
+				case 4: this.weekOfMonth = WeekOfMonth.FOURTH; break;
+				default: throw new IllegalArgumentException("Invalid weekOfMonth: " + weekOfMonth);
+			}
+			return this;
+		}
+
+		public Builder weekOfMonth(WeekOfMonth weekOfMonth) {
+			this.weekOfMonth = weekOfMonth;
+			return this;
+		}
+
+		public Builder dayOfWeek(int dayOfWeek) {
+			switch (dayOfWeek) {
+				case 1: this.dayOfWeek = DayOfWeek.MONDAY; break;
+				case 2: this.dayOfWeek = DayOfWeek.TUESDAY; break;
+				case 3: this.dayOfWeek = DayOfWeek.WEDNESDAY; break;
+				case 4: this.dayOfWeek = DayOfWeek.THURSDAY; break;
+				case 5: this.dayOfWeek = DayOfWeek.FRIDAY; break;
+				default: throw new IllegalArgumentException("Invalid dayOfWeek: " + dayOfWeek);
+			}
+			return this;
+		}
+
+		public Builder dayOfWeek(DayOfWeek dayOfWeek) {
+			this.dayOfWeek = dayOfWeek;
+			return this;
+		}
+
+		public Builder year(int year) {
+			this.year = Year.of(year);
+			return this;
+		}
+
+		public SpringReleaseTrainSpec build() {
+			Assert.notNull(train, "train cannot be null");
+			Assert.notNull(version, "version cannot be null");
+			Assert.notNull(weekOfMonth, "weekOfMonth cannot be null");
+			Assert.notNull(dayOfWeek, "dayOfWeek cannot be null");
+			Assert.notNull(year, "year cannot be null");
+			return new SpringReleaseTrainSpec(train, version, weekOfMonth, dayOfWeek, year);
+		}
+	}
+}

buildSrc/src/main/java/org/springframework/gradle/github/release/CreateGitHubReleaseTask.java

@@ -0,0 +1,130 @@
+/*
+ * Copyright 2002-2021 the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.springframework.gradle.github.release;
+
+import java.io.File;
+import java.io.IOException;
+import java.nio.file.Files;
+import java.nio.file.Paths;
+
+import org.gradle.api.Action;
+import org.gradle.api.DefaultTask;
+import org.gradle.api.Project;
+import org.gradle.api.tasks.Input;
+import org.gradle.api.tasks.Optional;
+import org.gradle.api.tasks.TaskAction;
+
+import org.springframework.gradle.github.RepositoryRef;
+import org.springframework.gradle.github.changelog.GitHubChangelogPlugin;
+
+/**
+ * @author Steve Riesenberg
+ */
+public class CreateGitHubReleaseTask extends DefaultTask {
+	@Input
+	private RepositoryRef repository = new RepositoryRef();
+
+	@Input @Optional
+	private String gitHubAccessToken;
+
+	@Input
+	private String version;
+
+	@Input @Optional
+	private String branch = "main";
+
+	@Input
+	private boolean createRelease = false;
+
+	@TaskAction
+	public void createGitHubRelease() {
+		String body = readReleaseNotes();
+		Release release = Release.tag(this.version)
+				.commit(this.branch)
+				.name(this.version)
+				.body(body)
+				.preRelease(this.version.contains("-"))
+				.build();
+
+		System.out.printf("%sCreating GitHub release for %s/%s@%s\n",
+				this.createRelease ? "" : "[DRY RUN] ",
+				this.repository.getOwner(),
+				this.repository.getName(),
+				this.version
+		);
+		System.out.printf("  Release Notes:\n\n----\n%s\n----\n\n", body.trim());
+
+		if (this.createRelease) {
+			GitHubReleaseApi github = new GitHubReleaseApi(this.gitHubAccessToken);
+			github.publishRelease(this.repository, release);
+		}
+	}
+
+	private String readReleaseNotes() {
+		Project project = getProject();
+		File inputFile = project.file(Paths.get(project.getBuildDir().getPath(), GitHubChangelogPlugin.RELEASE_NOTES_PATH));
+		try {
+			return Files.readString(inputFile.toPath());
+		} catch (IOException ex) {
+			throw new RuntimeException("Unable to read release notes from " + inputFile, ex);
+		}
+	}
+
+	public RepositoryRef getRepository() {
+		return repository;
+	}
+
+	public void repository(Action<RepositoryRef> repository) {
+		repository.execute(this.repository);
+	}
+
+	public void setRepository(RepositoryRef repository) {
+		this.repository = repository;
+	}
+
+	public String getGitHubAccessToken() {
+		return gitHubAccessToken;
+	}
+
+	public void setGitHubAccessToken(String gitHubAccessToken) {
+		this.gitHubAccessToken = gitHubAccessToken;
+	}
+
+	public String getVersion() {
+		return version;
+	}
+
+	public void setVersion(String version) {
+		this.version = version;
+	}
+
+	public String getBranch() {
+		return branch;
+	}
+
+	public void setBranch(String branch) {
+		this.branch = branch;
+	}
+
+	public boolean isCreateRelease() {
+		return createRelease;
+	}
+
+	public void setCreateRelease(boolean createRelease) {
+		this.createRelease = createRelease;
+	}
+}

buildSrc/src/main/java/org/springframework/gradle/github/release/DispatchGitHubWorkflowTask.java

@@ -0,0 +1,84 @@
+/*
+ * Copyright 2002-2022 the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.springframework.gradle.github.release;
+
+import org.gradle.api.Action;
+import org.gradle.api.DefaultTask;
+import org.gradle.api.tasks.Input;
+import org.gradle.api.tasks.TaskAction;
+
+import org.springframework.gradle.github.RepositoryRef;
+
+/**
+ * @author Steve Riesenberg
+ */
+public class DispatchGitHubWorkflowTask extends DefaultTask {
+	@Input
+	private RepositoryRef repository = new RepositoryRef();
+
+	@Input
+	private String gitHubAccessToken;
+
+	@Input
+	private String branch;
+
+	@Input
+	private String workflowId;
+
+	@TaskAction
+	public void dispatchGitHubWorkflow() {
+		GitHubActionsApi gitHubActionsApi = new GitHubActionsApi(this.gitHubAccessToken);
+		WorkflowDispatch workflowDispatch = new WorkflowDispatch(this.branch, null);
+		gitHubActionsApi.dispatchWorkflow(this.repository, this.workflowId, workflowDispatch);
+	}
+
+	public RepositoryRef getRepository() {
+		return repository;
+	}
+
+	public void repository(Action<RepositoryRef> repository) {
+		repository.execute(this.repository);
+	}
+
+	public void setRepository(RepositoryRef repository) {
+		this.repository = repository;
+	}
+
+	public String getGitHubAccessToken() {
+		return gitHubAccessToken;
+	}
+
+	public void setGitHubAccessToken(String gitHubAccessToken) {
+		this.gitHubAccessToken = gitHubAccessToken;
+	}
+
+	public String getBranch() {
+		return branch;
+	}
+
+	public void setBranch(String branch) {
+		this.branch = branch;
+	}
+
+	public String getWorkflowId() {
+		return workflowId;
+	}
+
+	public void setWorkflowId(String workflowId) {
+		this.workflowId = workflowId;
+	}
+}

buildSrc/src/main/java/org/springframework/gradle/github/release/GitHubActionsApi.java

@@ -0,0 +1,98 @@
+/*
+ * Copyright 2002-2022 the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.springframework.gradle.github.release;
+
+import java.io.IOException;
+
+import com.google.gson.Gson;
+import com.google.gson.GsonBuilder;
+import okhttp3.Interceptor;
+import okhttp3.MediaType;
+import okhttp3.OkHttpClient;
+import okhttp3.Request;
+import okhttp3.RequestBody;
+import okhttp3.Response;
+
+import org.springframework.gradle.github.RepositoryRef;
+
+/**
+ * Manage GitHub Actions.
+ *
+ * @author Steve Riesenberg
+ */
+public class GitHubActionsApi {
+	private String baseUrl = "https://api.github.com";
+
+	private final OkHttpClient client;
+
+	private final Gson gson = new GsonBuilder().create();
+
+	public GitHubActionsApi() {
+		this.client = new OkHttpClient.Builder().build();
+	}
+
+	public GitHubActionsApi(String gitHubToken) {
+		this.client = new OkHttpClient.Builder()
+				.addInterceptor(new AuthorizationInterceptor(gitHubToken))
+				.build();
+	}
+
+	public void setBaseUrl(String baseUrl) {
+		this.baseUrl = baseUrl;
+	}
+
+	/**
+	 * Create a workflow dispatch event.
+	 *
+	 * @param repository The repository owner/name
+	 * @param workflowId The ID of the workflow or the name of the workflow file name
+	 * @param workflowDispatch The workflow dispatch containing a ref (branch) and optional inputs
+	 */
+	public void dispatchWorkflow(RepositoryRef repository, String workflowId, WorkflowDispatch workflowDispatch) {
+		String url = this.baseUrl + "/repos/" + repository.getOwner() + "/" + repository.getName() + "/actions/workflows/" + workflowId + "/dispatches";
+		String json = this.gson.toJson(workflowDispatch);
+		RequestBody body = RequestBody.create(MediaType.parse("application/json"), json);
+		Request request = new Request.Builder().url(url).post(body).build();
+		try {
+			Response response = this.client.newCall(request).execute();
+			if (!response.isSuccessful()) {
+				throw new RuntimeException(String.format("Could not create workflow dispatch %s for repository %s/%s. Got response %s",
+						workflowId, repository.getOwner(), repository.getName(), response));
+			}
+		} catch (IOException ex) {
+			throw new RuntimeException(String.format("Could not create workflow dispatch %s for repository %s/%s",
+					workflowId, repository.getOwner(), repository.getName()), ex);
+		}
+	}
+
+	private static class AuthorizationInterceptor implements Interceptor {
+		private final String token;
+
+		public AuthorizationInterceptor(String token) {
+			this.token = token;
+		}
+
+		@Override
+		public Response intercept(Chain chain) throws IOException {
+			Request request = chain.request().newBuilder()
+					.addHeader("Authorization", "Bearer " + this.token)
+					.build();
+
+			return chain.proceed(request);
+		}
+	}
+}

buildSrc/src/main/java/org/springframework/gradle/github/release/GitHubReleaseApi.java

@@ -0,0 +1,91 @@
+/*
+ * Copyright 2002-2021 the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.springframework.gradle.github.release;
+
+import java.io.IOException;
+
+import com.google.gson.Gson;
+import okhttp3.Interceptor;
+import okhttp3.MediaType;
+import okhttp3.OkHttpClient;
+import okhttp3.Request;
+import okhttp3.RequestBody;
+import okhttp3.Response;
+
+import org.springframework.gradle.github.RepositoryRef;
+
+/**
+ * Manage GitHub releases.
+ *
+ * @author Steve Riesenberg
+ */
+public class GitHubReleaseApi {
+	private String baseUrl = "https://api.github.com";
+
+	private final OkHttpClient httpClient;
+	private Gson gson = new Gson();
+
+	public GitHubReleaseApi(String gitHubAccessToken) {
+		this.httpClient = new OkHttpClient.Builder()
+				.addInterceptor(new AuthorizationInterceptor(gitHubAccessToken))
+				.build();
+	}
+
+	public void setBaseUrl(String baseUrl) {
+		this.baseUrl = baseUrl;
+	}
+
+	/**
+	 * Publish a release with no binary attachments.
+	 *
+	 * @param repository The repository owner/name
+	 * @param release The contents of the release
+	 */
+	public void publishRelease(RepositoryRef repository, Release release) {
+		String url = this.baseUrl + "/repos/" + repository.getOwner() + "/" + repository.getName() + "/releases";
+		String json = this.gson.toJson(release);
+		RequestBody body = RequestBody.create(MediaType.parse("application/json"), json);
+		Request request = new Request.Builder().url(url).post(body).build();
+		try {
+			Response response = this.httpClient.newCall(request).execute();
+			if (!response.isSuccessful()) {
+				throw new RuntimeException(String.format("Could not create release %s for repository %s/%s. Got response %s",
+						release.getName(), repository.getOwner(), repository.getName(), response));
+			}
+		} catch (IOException ex) {
+			throw new RuntimeException(String.format("Could not create release %s for repository %s/%s",
+					release.getName(), repository.getOwner(), repository.getName()), ex);
+		}
+	}
+
+	private static class AuthorizationInterceptor implements Interceptor {
+		private final String token;
+
+		public AuthorizationInterceptor(String token) {
+			this.token = token;
+		}
+
+		@Override
+		public Response intercept(Chain chain) throws IOException {
+			Request request = chain.request().newBuilder()
+					.addHeader("Authorization", "Bearer " + this.token)
+					.build();
+
+			return chain.proceed(request);
+		}
+	}
+}

buildSrc/src/main/java/org/springframework/gradle/github/release/GitHubReleasePlugin.java

@@ -0,0 +1,54 @@
+/*
+ * Copyright 2002-2021 the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.springframework.gradle.github.release;
+
+import groovy.lang.MissingPropertyException;
+import org.gradle.api.Plugin;
+import org.gradle.api.Project;
+
+/**
+ * @author Steve Riesenberg
+ */
+public class GitHubReleasePlugin implements Plugin<Project> {
+	@Override
+	public void apply(Project project) {
+		project.getTasks().register("createGitHubRelease", CreateGitHubReleaseTask.class, (createGitHubRelease) -> {
+			createGitHubRelease.setGroup("Release");
+			createGitHubRelease.setDescription("Create a github release");
+			createGitHubRelease.dependsOn("generateChangelog");
+
+			createGitHubRelease.setCreateRelease("true".equals(project.findProperty("createRelease")));
+			createGitHubRelease.setVersion((String) project.findProperty("nextVersion"));
+			if (project.hasProperty("branch")) {
+				createGitHubRelease.setBranch((String) project.findProperty("branch"));
+			}
+			createGitHubRelease.setGitHubAccessToken((String) project.findProperty("gitHubAccessToken"));
+			if (createGitHubRelease.isCreateRelease() && createGitHubRelease.getGitHubAccessToken() == null) {
+				throw new MissingPropertyException("Please provide an access token with -PgitHubAccessToken=...");
+			}
+		});
+
+		project.getTasks().register("dispatchGitHubWorkflow", DispatchGitHubWorkflowTask.class, (dispatchGitHubWorkflow) -> {
+			dispatchGitHubWorkflow.setGroup("Release");
+			dispatchGitHubWorkflow.setDescription("Create a workflow_dispatch event on a given branch");
+
+			dispatchGitHubWorkflow.setBranch((String) project.findProperty("branch"));
+			dispatchGitHubWorkflow.setWorkflowId((String) project.findProperty("workflowId"));
+			dispatchGitHubWorkflow.setGitHubAccessToken((String) project.findProperty("gitHubAccessToken"));
+		});
+	}
+}

buildSrc/src/main/java/org/springframework/gradle/github/release/Release.java

@@ -0,0 +1,156 @@
+/*
+ * Copyright 2002-2021 the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.springframework.gradle.github.release;
+
+import com.google.gson.annotations.SerializedName;
+
+/**
+ * @author Steve Riesenberg
+ */
+public class Release {
+	@SerializedName("tag_name")
+	private final String tag;
+
+	@SerializedName("target_commitish")
+	private final String commit;
+
+	@SerializedName("name")
+	private final String name;
+
+	@SerializedName("body")
+	private final String body;
+
+	@SerializedName("draft")
+	private final boolean draft;
+
+	@SerializedName("prerelease")
+	private final boolean preRelease;
+
+	@SerializedName("generate_release_notes")
+	private final boolean generateReleaseNotes;
+
+	private Release(String tag, String commit, String name, String body, boolean draft, boolean preRelease, boolean generateReleaseNotes) {
+		this.tag = tag;
+		this.commit = commit;
+		this.name = name;
+		this.body = body;
+		this.draft = draft;
+		this.preRelease = preRelease;
+		this.generateReleaseNotes = generateReleaseNotes;
+	}
+
+	public String getTag() {
+		return tag;
+	}
+
+	public String getCommit() {
+		return commit;
+	}
+
+	public String getName() {
+		return name;
+	}
+
+	public String getBody() {
+		return body;
+	}
+
+	public boolean isDraft() {
+		return draft;
+	}
+
+	public boolean isPreRelease() {
+		return preRelease;
+	}
+
+	public boolean isGenerateReleaseNotes() {
+		return generateReleaseNotes;
+	}
+
+	@Override
+	public String toString() {
+		return "Release{" +
+				"tag='" + tag + '\'' +
+				", commit='" + commit + '\'' +
+				", name='" + name + '\'' +
+				", body='" + body + '\'' +
+				", draft=" + draft +
+				", preRelease=" + preRelease +
+				", generateReleaseNotes=" + generateReleaseNotes +
+				'}';
+	}
+
+	public static Builder tag(String tag) {
+		return new Builder().tag(tag);
+	}
+
+	public static Builder commit(String commit) {
+		return new Builder().commit(commit);
+	}
+
+	public static final class Builder {
+		private String tag;
+		private String commit;
+		private String name;
+		private String body;
+		private boolean draft;
+		private boolean preRelease;
+		private boolean generateReleaseNotes;
+
+		private Builder() {
+		}
+
+		public Builder tag(String tag) {
+			this.tag = tag;
+			return this;
+		}
+
+		public Builder commit(String commit) {
+			this.commit = commit;
+			return this;
+		}
+
+		public Builder name(String name) {
+			this.name = name;
+			return this;
+		}
+
+		public Builder body(String body) {
+			this.body = body;
+			return this;
+		}
+
+		public Builder draft(boolean draft) {
+			this.draft = draft;
+			return this;
+		}
+
+		public Builder preRelease(boolean preRelease) {
+			this.preRelease = preRelease;
+			return this;
+		}
+
+		public Builder generateReleaseNotes(boolean generateReleaseNotes) {
+			this.generateReleaseNotes = generateReleaseNotes;
+			return this;
+		}
+
+		public Release build() {
+			return new Release(tag, commit, name, body, draft, preRelease, generateReleaseNotes);
+		}
+	}
+}

buildSrc/src/main/java/org/springframework/gradle/github/release/WorkflowDispatch.java

@@ -0,0 +1,51 @@
+/*
+ * Copyright 2002-2022 the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.springframework.gradle.github.release;
+
+import java.util.Map;
+
+/**
+ * @author Steve Riesenberg
+ */
+public class WorkflowDispatch {
+	private String ref;
+	private Map<String, Object> inputs;
+
+	public WorkflowDispatch() {
+	}
+
+	public WorkflowDispatch(String ref, Map<String, Object> inputs) {
+		this.ref = ref;
+		this.inputs = inputs;
+	}
+
+	public String getRef() {
+		return ref;
+	}
+
+	public void setRef(String ref) {
+		this.ref = ref;
+	}
+
+	public Map<String, Object> getInputs() {
+		return inputs;
+	}
+
+	public void setInputs(Map<String, Object> inputs) {
+		this.inputs = inputs;
+	}
+}

buildSrc/src/main/java/org/springframework/security/convention/versions/CommandLineUtils.java

@@ -0,0 +1,49 @@
+/*
+ * Copyright 2019-2022 the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.springframework.security.convention.versions;
+
+import java.io.File;
+import java.io.IOException;
+import java.io.InputStream;
+import java.io.PrintStream;
+import java.util.Arrays;
+import java.util.Scanner;
+
+class CommandLineUtils {
+	static void runCommand(File dir, String... args) {
+		try {
+			Process process = new ProcessBuilder()
+					.directory(dir)
+					.command(args)
+					.start();
+			writeLinesTo(process.getInputStream(), System.out);
+			writeLinesTo(process.getErrorStream(), System.out);
+			if (process.waitFor() != 0) {
+				new RuntimeException("Failed to run " + Arrays.toString(args));
+			}
+		} catch (IOException | InterruptedException e) {
+			throw new RuntimeException("Failed to run " + Arrays.toString(args), e);
+		}
+	}
+
+	private static void writeLinesTo(InputStream input, PrintStream out) {
+		Scanner scanner = new Scanner(input);
+		while(scanner.hasNextLine()) {
+			out.println(scanner.nextLine());
+		}
+	}
+}

buildSrc/src/main/java/org/springframework/security/convention/versions/FileUtils.java

@@ -0,0 +1,49 @@
+/*
+ * Copyright 2019-2022 the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.springframework.security.convention.versions;
+
+import java.io.File;
+import java.io.IOException;
+import java.nio.file.Files;
+import java.util.function.Function;
+
+class FileUtils {
+	static void replaceFileText(File file, Function<String, String> replaceText) {
+		String buildFileText = readString(file);
+		String updatedBuildFileText = replaceText.apply(buildFileText);
+		writeString(file, updatedBuildFileText);
+	}
+
+	static String readString(File file) {
+		try {
+			byte[] bytes = Files.readAllBytes(file.toPath());
+			return new String(bytes);
+		}
+		catch (IOException e) {
+			throw new RuntimeException(e);
+		}
+	}
+
+	private static void writeString(File file, String text) {
+		try {
+			Files.write(file.toPath(), text.getBytes());
+		}
+		catch (IOException e) {
+			throw new RuntimeException(e);
+		}
+	}
+}

buildSrc/src/main/java/org/springframework/security/convention/versions/UpdateDependenciesPlugin.java

@@ -33,13 +33,8 @@ import org.gradle.api.artifacts.component.ModuleComponentIdentifier;
 import reactor.core.publisher.Mono;
 
 import java.io.File;
-import java.io.IOException;
-import java.io.InputStream;
-import java.io.PrintStream;
-import java.nio.file.Files;
 import java.time.Duration;
 import java.util.*;
-import java.util.function.Function;
 import java.util.function.Supplier;
 import java.util.regex.Matcher;
 import java.util.regex.Pattern;
@@ -168,7 +163,7 @@ public class UpdateDependenciesPlugin implements Plugin<Project> {
 			Integer issueNumber = gitHubApi.createIssue(createIssueResult.getRepositoryId(), title, createIssueResult.getLabelIds(), createIssueResult.getMilestoneId(), createIssueResult.getAssigneeId()).delayElement(Duration.ofSeconds(1)).block();
 			commitMessage += "\n\nCloses gh-" + issueNumber;
 		}
-		runCommand(rootDir, "git", "commit", "-am", commitMessage);
+		CommandLineUtils.runCommand(rootDir, "git", "commit", "-am", commitMessage);
 	}
 
 	private Mono<GitHubApi.FindCreateIssueResult> createIssueResultMono(UpdateDependenciesExtension updateDependenciesExtension) {
@@ -187,7 +182,7 @@ public class UpdateDependenciesPlugin implements Plugin<Project> {
 		if (current.compareTo(running) > 0) {
 			String title = "Update Gradle to " + current.getVersion();
 			System.out.println(title);
-			runCommand(project.getRootDir(), "./gradlew", "wrapper", "--gradle-version", current.getVersion(), "--no-daemon");
+			CommandLineUtils.runCommand(project.getRootDir(), "./gradlew", "wrapper", "--gradle-version", current.getVersion(), "--no-daemon");
 			afterGroup(updateDependenciesSettings, project.getRootDir(), title, createIssueResultMono(updateDependenciesSettings));
 		}
 	}
@@ -204,30 +199,6 @@ public class UpdateDependenciesPlugin implements Plugin<Project> {
 		};
 	}
 
-	static void runCommand(File dir, String... args) {
-		try {
-			Process process = new ProcessBuilder()
-					.directory(dir)
-					.command(args)
-					.start();
-			writeLinesTo(process.getInputStream(), System.out);
-			writeLinesTo(process.getErrorStream(), System.out);
-			if (process.waitFor() != 0) {
-				new RuntimeException("Failed to run " + Arrays.toString(args));
-			}
-		} catch (IOException | InterruptedException e) {
-			throw new RuntimeException("Failed to run " + Arrays.toString(args), e);
-		}
-	}
-
-	static void writeLinesTo(InputStream input, PrintStream out) {
-		Scanner scanner = new Scanner(input);
-		while(scanner.hasNextLine()) {
-			out.println(scanner.nextLine());
-		}
-	}
-
-
 	static Action<ComponentSelectionWithCurrent> excludeWithRegex(String regex, String reason) {
 		Pattern pattern = Pattern.compile(regex);
 		return (selection) -> {
@@ -242,40 +213,17 @@ public class UpdateDependenciesPlugin implements Plugin<Project> {
 		String ga = dependency.getGroup() + ":" + dependency.getName() + ":";
 		String originalDependency = ga + dependency.getVersion();
 		String replacementDependency = ga + updatedVersion(dependency);
-		replaceFileText(buildFile, buildFileText -> buildFileText.replace(originalDependency, replacementDependency));
-	}
-
-	static void replaceFileText(File file, Function<String, String> replaceText) {
-		String buildFileText = readString(file);
-		String updatedBuildFileText = replaceText.apply(buildFileText);
-		writeString(file, updatedBuildFileText);
-	}
-
-	private static String readString(File file) {
-		try {
-			byte[] bytes = Files.readAllBytes(file.toPath());
-			return new String(bytes);
-		} catch (IOException e) {
-			throw new RuntimeException(e);
-		}
-	}
-
-	private static void writeString(File file, String text) {
-		try {
-			Files.write(file.toPath(), text.getBytes());
-		} catch (IOException e) {
-			throw new RuntimeException(e);
-		}
+		FileUtils.replaceFileText(buildFile, buildFileText -> buildFileText.replace(originalDependency, replacementDependency));
 	}
 
 	static void updateDependencyWithVersionVariable(File scanFile, File gradlePropertiesFile, DependencyOutdated dependency) {
 		if (!gradlePropertiesFile.exists()) {
 			return;
 		}
-		replaceFileText(gradlePropertiesFile, (gradlePropertiesText) -> {
+		FileUtils.replaceFileText(gradlePropertiesFile, (gradlePropertiesText) -> {
 			String ga = dependency.getGroup() + ":" + dependency.getName() + ":";
 			Pattern pattern = Pattern.compile("\"" + ga + "\\$\\{?([^'\"]+?)\\}?\"");
-			String buildFileText = readString(scanFile);
+			String buildFileText = FileUtils.readString(scanFile);
 			Matcher matcher = pattern.matcher(buildFileText);
 			while (matcher.find()) {
 				String versionVariable = matcher.group(1);

buildSrc/src/main/java/org/springframework/security/convention/versions/UpdateProjectVersionPlugin.java

@@ -0,0 +1,44 @@
+/*
+ * Copyright 2019-2022 the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.springframework.security.convention.versions;
+
+import org.gradle.api.Action;
+import org.gradle.api.Plugin;
+import org.gradle.api.Project;
+
+public class UpdateProjectVersionPlugin implements Plugin<Project> {
+	@Override
+	public void apply(Project project) {
+		project.getTasks().register("updateProjectVersion", UpdateProjectVersionTask.class, new Action<UpdateProjectVersionTask>() {
+			@Override
+			public void execute(UpdateProjectVersionTask updateProjectVersionTask) {
+				updateProjectVersionTask.setGroup("Release");
+				updateProjectVersionTask.setDescription("Updates the project version to the next release in gradle.properties");
+				updateProjectVersionTask.dependsOn("gitHubNextReleaseMilestone");
+				updateProjectVersionTask.getNextVersionFile().fileProvider(project.provider(() -> project.file("next-release.yml")));
+			}
+		});
+		project.getTasks().register("updateToSnapshotVersion", UpdateToSnapshotVersionTask.class, new Action<UpdateToSnapshotVersionTask>() {
+			@Override
+			public void execute(UpdateToSnapshotVersionTask updateToSnapshotVersionTask) {
+				updateToSnapshotVersionTask.setGroup("Release");
+				updateToSnapshotVersionTask.setDescription(
+						"Updates the project version to the next snapshot in gradle.properties");
+			}
+		});
+	}
+}

buildSrc/src/main/java/org/springframework/security/convention/versions/UpdateProjectVersionTask.java

@@ -0,0 +1,63 @@
+/*
+ * Copyright 2019-2022 the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.springframework.security.convention.versions;
+
+import org.gradle.api.DefaultTask;
+import org.gradle.api.Project;
+import org.gradle.api.file.RegularFileProperty;
+import org.gradle.api.tasks.Input;
+import org.gradle.api.tasks.InputFile;
+import org.gradle.api.tasks.Optional;
+import org.gradle.api.tasks.TaskAction;
+import org.yaml.snakeyaml.Yaml;
+import org.yaml.snakeyaml.constructor.Constructor;
+
+import java.io.File;
+import java.io.FileInputStream;
+import java.io.FileNotFoundException;
+
+import org.springframework.gradle.github.milestones.NextVersionYml;
+
+public abstract class UpdateProjectVersionTask extends DefaultTask {
+
+	@InputFile
+	public abstract RegularFileProperty getNextVersionFile();
+
+	@TaskAction
+	public void checkReleaseDueToday() throws FileNotFoundException {
+		File nextVersionFile = getNextVersionFile().getAsFile().get();
+		Yaml yaml = new Yaml(new Constructor(NextVersionYml.class));
+		NextVersionYml nextVersionYml = yaml.load(new FileInputStream(nextVersionFile));
+		String nextVersion = nextVersionYml.getVersion();
+		if (nextVersion == null) {
+			throw new IllegalArgumentException(
+					"Could not find version property in provided file " + nextVersionFile.getName());
+		}
+		String currentVersion = getProject().getVersion().toString();
+		File gradlePropertiesFile = getProject().getRootProject().file(Project.GRADLE_PROPERTIES);
+		if (!gradlePropertiesFile.exists()) {
+			return;
+		}
+		System.out.println("Updating the project version in " + Project.GRADLE_PROPERTIES + " from " + currentVersion
+				+ " to " + nextVersion);
+		FileUtils.replaceFileText(gradlePropertiesFile, (gradlePropertiesText) -> {
+			gradlePropertiesText = gradlePropertiesText.replace("version=" + currentVersion, "version=" + nextVersion);
+			return gradlePropertiesText;
+		});
+	}
+
+}

buildSrc/src/main/java/org/springframework/security/convention/versions/UpdateToSnapshotVersionTask.java

@@ -0,0 +1,68 @@
+/*
+ * Copyright 2019-2022 the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.springframework.security.convention.versions;
+
+import org.gradle.api.DefaultTask;
+import org.gradle.api.Project;
+import org.gradle.api.tasks.TaskAction;
+
+import java.io.File;
+import java.util.regex.Matcher;
+import java.util.regex.Pattern;
+
+public abstract class UpdateToSnapshotVersionTask extends DefaultTask {
+
+	private static final String RELEASE_VERSION_PATTERN = "^([0-9]+)\\.([0-9]+)\\.([0-9]+)(-M\\d+|-RC\\d+)?$";
+
+	@TaskAction
+	public void updateToSnapshotVersion() {
+		String currentVersion = getProject().getVersion().toString();
+		File gradlePropertiesFile = getProject().getRootProject().file(Project.GRADLE_PROPERTIES);
+		if (!gradlePropertiesFile.exists()) {
+			return;
+		}
+		String nextVersion = calculateNextSnapshotVersion(currentVersion);
+		System.out.println("Updating the project version in " + Project.GRADLE_PROPERTIES + " from " + currentVersion
+				+ " to " + nextVersion);
+		FileUtils.replaceFileText(gradlePropertiesFile, (gradlePropertiesText) -> {
+			gradlePropertiesText = gradlePropertiesText.replace("version=" + currentVersion, "version=" + nextVersion);
+			return gradlePropertiesText;
+		});
+	}
+
+	private String calculateNextSnapshotVersion(String currentVersion) {
+		Pattern releaseVersionPattern = Pattern.compile(RELEASE_VERSION_PATTERN);
+		Matcher releaseVersion = releaseVersionPattern.matcher(currentVersion);
+
+		if (releaseVersion.find()) {
+			String majorSegment = releaseVersion.group(1);
+			String minorSegment = releaseVersion.group(2);
+			String patchSegment = releaseVersion.group(3);
+			String modifier = releaseVersion.group(4);
+			if (modifier == null) {
+				patchSegment = String.valueOf(Integer.parseInt(patchSegment) + 1);
+			}
+			System.out.println("modifier = " + modifier);
+			return String.format("%s.%s.%s-SNAPSHOT", majorSegment, minorSegment, patchSegment);
+		}
+		else {
+			throw new IllegalStateException(
+					"Cannot calculate next snapshot version because the current project version does not conform to the expected format");
+		}
+	}
+
+}

buildSrc/src/test/java/io/spring/gradle/convention/IncludeCheckRemotePluginTest.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2002-2021 the original author or authors.
+ * Copyright 2002-2022 the original author or authors.
  *
  * Licensed under the Apache License, Version 2.0 (the "License"); you may not
  * use this file except in compliance with the License. You may obtain a copy of
@@ -16,6 +16,11 @@
 
 package io.spring.gradle.convention;
 
+import java.io.File;
+import java.util.Arrays;
+import java.util.HashMap;
+import java.util.Map;
+
 import io.spring.gradle.IncludeRepoTask;
 import org.apache.commons.io.FileUtils;
 import org.gradle.api.Project;
@@ -24,8 +29,6 @@ import org.gradle.testfixtures.ProjectBuilder;
 import org.junit.jupiter.api.AfterEach;
 import org.junit.jupiter.api.Test;
 
-import java.util.Arrays;
-
 import static org.assertj.core.api.Assertions.assertThat;
 
 class IncludeCheckRemotePluginTest {
@@ -68,6 +71,40 @@ class IncludeCheckRemotePluginTest {
 		assertThat(checkRemote.getTasks()).containsExactly("clean", "build", "test");
 	}
 
+	@Test
+	void applyWhenExtensionPropertiesInitScriptsThenCreateCheckRemoteWithProvidedTasks() {
+		this.rootProject = ProjectBuilder.builder().build();
+		this.rootProject.getPluginManager().apply(IncludeCheckRemotePlugin.class);
+		this.rootProject.getExtensions().configure(IncludeCheckRemotePlugin.IncludeCheckRemoteExtension.class,
+				(includeCheckRemoteExtension) -> {
+					includeCheckRemoteExtension.setProperty("repository", "my-project/my-repository");
+					includeCheckRemoteExtension.setProperty("ref", "main");
+					includeCheckRemoteExtension.setProperty("initScripts", Arrays.asList("spring-security-ci.gradle"));
+				});
+
+		GradleBuild checkRemote = (GradleBuild) this.rootProject.getTasks().named("checkRemote").get();
+		assertThat(checkRemote.getStartParameter().getAllInitScripts()).extracting(File::getName).containsExactly("spring-security-ci.gradle");
+	}
+
+	@Test
+	void applyWhenExtensionPropertiesBuildPropertiesThenCreateCheckRemoteWithProvidedTasks() {
+		Map<String, String> projectProperties = new HashMap<>();
+		projectProperties.put("localRepositoryPath", "~/local/repository");
+		projectProperties.put("anotherProperty", "some_value");
+		this.rootProject = ProjectBuilder.builder().build();
+		this.rootProject.getPluginManager().apply(IncludeCheckRemotePlugin.class);
+		this.rootProject.getExtensions().configure(IncludeCheckRemotePlugin.IncludeCheckRemoteExtension.class,
+				(includeCheckRemoteExtension) -> {
+					includeCheckRemoteExtension.setProperty("repository", "my-project/my-repository");
+					includeCheckRemoteExtension.setProperty("ref", "main");
+					includeCheckRemoteExtension.setProperty("projectProperties", projectProperties);
+				});
+
+		GradleBuild checkRemote = (GradleBuild) this.rootProject.getTasks().named("checkRemote").get();
+		assertThat(checkRemote.getStartParameter().getProjectProperties()).containsEntry("localRepositoryPath", "~/local/repository")
+				.containsEntry("anotherProperty", "some_value");
+	}
+
 	@Test
 	void applyWhenExtensionPropertiesThenRegisterIncludeRepoTaskWithExtensionProperties() {
 		this.rootProject = ProjectBuilder.builder().build();

buildSrc/src/test/java/io/spring/gradle/convention/sagan/SaganApiTests.java

@@ -58,7 +58,7 @@ public class SaganApiTests {
 		Release release = new Release();
 		release.setVersion("5.6.0-SNAPSHOT");
 		release.setApiDocUrl("https://docs.spring.io/spring-security/site/docs/{version}/api/");
-		release.setReferenceDocUrl("https://docs.spring.io/spring-security/site/docs/{version}/reference/html5/");
+		release.setReferenceDocUrl("https://docs.spring.io/spring-security/reference/{version}/index.html");
 		this.sagan.createReleaseForProject(release, "spring-security");
 		RecordedRequest request = this.server.takeRequest(1, TimeUnit.SECONDS);
 		assertThat(request.getRequestUrl().toString()).isEqualTo(this.baseUrl + "/projects/spring-security/releases");
@@ -67,7 +67,7 @@ public class SaganApiTests {
 		assertThat(request.getBody().readString(Charset.defaultCharset())).isEqualToIgnoringWhitespace("{\n" +
 				"   \"version\":\"5.6.0-SNAPSHOT\",\n" +
 				"   \"current\":false,\n" +
-				"   \"referenceDocUrl\":\"https://docs.spring.io/spring-security/site/docs/{version}/reference/html5/\",\n" +
+				"   \"referenceDocUrl\":\"https://docs.spring.io/spring-security/reference/{version}/index.html\",\n" +
 				"   \"apiDocUrl\":\"https://docs.spring.io/spring-security/site/docs/{version}/api/\"\n" +
 				"}");
 	}

buildSrc/src/test/java/io/spring/gradle/github/milestones/GitHubMilestoneApiTests.java

@@ -1,388 +0,0 @@
-package io.spring.gradle.github.milestones;
-
-import okhttp3.mockwebserver.MockResponse;
-import okhttp3.mockwebserver.MockWebServer;
-import okhttp3.mockwebserver.RecordedRequest;
-import org.junit.jupiter.api.AfterEach;
-import org.junit.jupiter.api.BeforeEach;
-import org.junit.jupiter.api.Test;
-import org.springframework.gradle.github.milestones.GitHubMilestoneApi;
-import org.springframework.gradle.github.milestones.RepositoryRef;
-
-import java.util.concurrent.TimeUnit;
-
-import static org.assertj.core.api.Assertions.assertThat;
-import static org.assertj.core.api.Assertions.assertThatExceptionOfType;
-
-
-public class GitHubMilestoneApiTests {
-	private GitHubMilestoneApi github;
-
-	private RepositoryRef repositoryRef = RepositoryRef.owner("spring-projects").repository("spring-security").build();
-
-	private MockWebServer server;
-
-	private String baseUrl;
-
-	@BeforeEach
-	public void setup() throws Exception {
-		this.server = new MockWebServer();
-		this.server.start();
-		this.github = new GitHubMilestoneApi("mock-oauth-token");
-		this.baseUrl = this.server.url("/api").toString();
-		this.github.setBaseUrl(this.baseUrl);
-	}
-
-	@AfterEach
-	public void cleanup() throws Exception {
-		this.server.shutdown();
-	}
-
-	@Test
-	public void findMilestoneNumberByTitleWhenFoundThenSuccess() throws Exception {
-		String responseJson = "[\n" +
-				"   {\n" +
-				"      \"url\":\"https://api.github.com/repos/spring-projects/spring-security/milestones/207\",\n" +
-				"      \"html_url\":\"https://github.com/spring-projects/spring-security/milestone/207\",\n" +
-				"      \"labels_url\":\"https://api.github.com/repos/spring-projects/spring-security/milestones/207/labels\",\n" +
-				"      \"id\":6611880,\n" +
-				"      \"node_id\":\"MDk6TWlsZXN0b25lNjYxMTg4MA==\",\n" +
-				"      \"number\":207,\n" +
-				"      \"title\":\"5.6.x\",\n" +
-				"      \"description\":\"\",\n" +
-				"      \"creator\":{\n" +
-				"         \"login\":\"jgrandja\",\n" +
-				"         \"id\":10884212,\n" +
-				"         \"node_id\":\"MDQ6VXNlcjEwODg0MjEy\",\n" +
-				"         \"avatar_url\":\"https://avatars.githubusercontent.com/u/10884212?v=4\",\n" +
-				"         \"gravatar_id\":\"\",\n" +
-				"         \"url\":\"https://api.github.com/users/jgrandja\",\n" +
-				"         \"html_url\":\"https://github.com/jgrandja\",\n" +
-				"         \"followers_url\":\"https://api.github.com/users/jgrandja/followers\",\n" +
-				"         \"following_url\":\"https://api.github.com/users/jgrandja/following{/other_user}\",\n" +
-				"         \"gists_url\":\"https://api.github.com/users/jgrandja/gists{/gist_id}\",\n" +
-				"         \"starred_url\":\"https://api.github.com/users/jgrandja/starred{/owner}{/repo}\",\n" +
-				"         \"subscriptions_url\":\"https://api.github.com/users/jgrandja/subscriptions\",\n" +
-				"         \"organizations_url\":\"https://api.github.com/users/jgrandja/orgs\",\n" +
-				"         \"repos_url\":\"https://api.github.com/users/jgrandja/repos\",\n" +
-				"         \"events_url\":\"https://api.github.com/users/jgrandja/events{/privacy}\",\n" +
-				"         \"received_events_url\":\"https://api.github.com/users/jgrandja/received_events\",\n" +
-				"         \"type\":\"User\",\n" +
-				"         \"site_admin\":false\n" +
-				"      },\n" +
-				"      \"open_issues\":1,\n" +
-				"      \"closed_issues\":0,\n" +
-				"      \"state\":\"open\",\n" +
-				"      \"created_at\":\"2021-03-31T11:29:17Z\",\n" +
-				"      \"updated_at\":\"2021-03-31T11:30:47Z\",\n" +
-				"      \"due_on\":null,\n" +
-				"      \"closed_at\":null\n" +
-				"   },\n" +
-				"   {\n" +
-				"      \"url\":\"https://api.github.com/repos/spring-projects/spring-security/milestones/191\",\n" +
-				"      \"html_url\":\"https://github.com/spring-projects/spring-security/milestone/191\",\n" +
-				"      \"labels_url\":\"https://api.github.com/repos/spring-projects/spring-security/milestones/191/labels\",\n" +
-				"      \"id\":5884208,\n" +
-				"      \"node_id\":\"MDk6TWlsZXN0b25lNTg4NDIwOA==\",\n" +
-				"      \"number\":191,\n" +
-				"      \"title\":\"5.5.0-RC1\",\n" +
-				"      \"description\":\"\",\n" +
-				"      \"creator\":{\n" +
-				"         \"login\":\"jzheaux\",\n" +
-				"         \"id\":3627351,\n" +
-				"         \"node_id\":\"MDQ6VXNlcjM2MjczNTE=\",\n" +
-				"         \"avatar_url\":\"https://avatars.githubusercontent.com/u/3627351?v=4\",\n" +
-				"         \"gravatar_id\":\"\",\n" +
-				"         \"url\":\"https://api.github.com/users/jzheaux\",\n" +
-				"         \"html_url\":\"https://github.com/jzheaux\",\n" +
-				"         \"followers_url\":\"https://api.github.com/users/jzheaux/followers\",\n" +
-				"         \"following_url\":\"https://api.github.com/users/jzheaux/following{/other_user}\",\n" +
-				"         \"gists_url\":\"https://api.github.com/users/jzheaux/gists{/gist_id}\",\n" +
-				"         \"starred_url\":\"https://api.github.com/users/jzheaux/starred{/owner}{/repo}\",\n" +
-				"         \"subscriptions_url\":\"https://api.github.com/users/jzheaux/subscriptions\",\n" +
-				"         \"organizations_url\":\"https://api.github.com/users/jzheaux/orgs\",\n" +
-				"         \"repos_url\":\"https://api.github.com/users/jzheaux/repos\",\n" +
-				"         \"events_url\":\"https://api.github.com/users/jzheaux/events{/privacy}\",\n" +
-				"         \"received_events_url\":\"https://api.github.com/users/jzheaux/received_events\",\n" +
-				"         \"type\":\"User\",\n" +
-				"         \"site_admin\":false\n" +
-				"      },\n" +
-				"      \"open_issues\":21,\n" +
-				"      \"closed_issues\":23,\n" +
-				"      \"state\":\"open\",\n" +
-				"      \"created_at\":\"2020-09-16T13:28:03Z\",\n" +
-				"      \"updated_at\":\"2021-04-06T23:47:10Z\",\n" +
-				"      \"due_on\":\"2021-04-12T07:00:00Z\",\n" +
-				"      \"closed_at\":null\n" +
-				"   }\n" +
-				"]";
-		this.server.enqueue(new MockResponse().setBody(responseJson));
-
-		long milestoneNumberByTitle = this.github.findMilestoneNumberByTitle(this.repositoryRef, "5.5.0-RC1");
-
-		RecordedRequest recordedRequest = this.server.takeRequest(1, TimeUnit.SECONDS);
-		assertThat(recordedRequest.getMethod()).isEqualToIgnoringCase("get");
-		assertThat(recordedRequest.getRequestUrl().toString()).isEqualTo(this.baseUrl + "/repos/spring-projects/spring-security/milestones?per_page=100");
-
-		assertThat(milestoneNumberByTitle).isEqualTo(191);
-	}
-
-	@Test
-	public void findMilestoneNumberByTitleWhenNotFoundThenException() throws Exception {
-		String responseJson = "[\n" +
-				"   {\n" +
-				"      \"url\":\"https://api.github.com/repos/spring-projects/spring-security/milestones/207\",\n" +
-				"      \"html_url\":\"https://github.com/spring-projects/spring-security/milestone/207\",\n" +
-				"      \"labels_url\":\"https://api.github.com/repos/spring-projects/spring-security/milestones/207/labels\",\n" +
-				"      \"id\":6611880,\n" +
-				"      \"node_id\":\"MDk6TWlsZXN0b25lNjYxMTg4MA==\",\n" +
-				"      \"number\":207,\n" +
-				"      \"title\":\"5.6.x\",\n" +
-				"      \"description\":\"\",\n" +
-				"      \"creator\":{\n" +
-				"         \"login\":\"jgrandja\",\n" +
-				"         \"id\":10884212,\n" +
-				"         \"node_id\":\"MDQ6VXNlcjEwODg0MjEy\",\n" +
-				"         \"avatar_url\":\"https://avatars.githubusercontent.com/u/10884212?v=4\",\n" +
-				"         \"gravatar_id\":\"\",\n" +
-				"         \"url\":\"https://api.github.com/users/jgrandja\",\n" +
-				"         \"html_url\":\"https://github.com/jgrandja\",\n" +
-				"         \"followers_url\":\"https://api.github.com/users/jgrandja/followers\",\n" +
-				"         \"following_url\":\"https://api.github.com/users/jgrandja/following{/other_user}\",\n" +
-				"         \"gists_url\":\"https://api.github.com/users/jgrandja/gists{/gist_id}\",\n" +
-				"         \"starred_url\":\"https://api.github.com/users/jgrandja/starred{/owner}{/repo}\",\n" +
-				"         \"subscriptions_url\":\"https://api.github.com/users/jgrandja/subscriptions\",\n" +
-				"         \"organizations_url\":\"https://api.github.com/users/jgrandja/orgs\",\n" +
-				"         \"repos_url\":\"https://api.github.com/users/jgrandja/repos\",\n" +
-				"         \"events_url\":\"https://api.github.com/users/jgrandja/events{/privacy}\",\n" +
-				"         \"received_events_url\":\"https://api.github.com/users/jgrandja/received_events\",\n" +
-				"         \"type\":\"User\",\n" +
-				"         \"site_admin\":false\n" +
-				"      },\n" +
-				"      \"open_issues\":1,\n" +
-				"      \"closed_issues\":0,\n" +
-				"      \"state\":\"open\",\n" +
-				"      \"created_at\":\"2021-03-31T11:29:17Z\",\n" +
-				"      \"updated_at\":\"2021-03-31T11:30:47Z\",\n" +
-				"      \"due_on\":null,\n" +
-				"      \"closed_at\":null\n" +
-				"   },\n" +
-				"   {\n" +
-				"      \"url\":\"https://api.github.com/repos/spring-projects/spring-security/milestones/191\",\n" +
-				"      \"html_url\":\"https://github.com/spring-projects/spring-security/milestone/191\",\n" +
-				"      \"labels_url\":\"https://api.github.com/repos/spring-projects/spring-security/milestones/191/labels\",\n" +
-				"      \"id\":5884208,\n" +
-				"      \"node_id\":\"MDk6TWlsZXN0b25lNTg4NDIwOA==\",\n" +
-				"      \"number\":191,\n" +
-				"      \"title\":\"5.5.0-RC1\",\n" +
-				"      \"description\":\"\",\n" +
-				"      \"creator\":{\n" +
-				"         \"login\":\"jzheaux\",\n" +
-				"         \"id\":3627351,\n" +
-				"         \"node_id\":\"MDQ6VXNlcjM2MjczNTE=\",\n" +
-				"         \"avatar_url\":\"https://avatars.githubusercontent.com/u/3627351?v=4\",\n" +
-				"         \"gravatar_id\":\"\",\n" +
-				"         \"url\":\"https://api.github.com/users/jzheaux\",\n" +
-				"         \"html_url\":\"https://github.com/jzheaux\",\n" +
-				"         \"followers_url\":\"https://api.github.com/users/jzheaux/followers\",\n" +
-				"         \"following_url\":\"https://api.github.com/users/jzheaux/following{/other_user}\",\n" +
-				"         \"gists_url\":\"https://api.github.com/users/jzheaux/gists{/gist_id}\",\n" +
-				"         \"starred_url\":\"https://api.github.com/users/jzheaux/starred{/owner}{/repo}\",\n" +
-				"         \"subscriptions_url\":\"https://api.github.com/users/jzheaux/subscriptions\",\n" +
-				"         \"organizations_url\":\"https://api.github.com/users/jzheaux/orgs\",\n" +
-				"         \"repos_url\":\"https://api.github.com/users/jzheaux/repos\",\n" +
-				"         \"events_url\":\"https://api.github.com/users/jzheaux/events{/privacy}\",\n" +
-				"         \"received_events_url\":\"https://api.github.com/users/jzheaux/received_events\",\n" +
-				"         \"type\":\"User\",\n" +
-				"         \"site_admin\":false\n" +
-				"      },\n" +
-				"      \"open_issues\":21,\n" +
-				"      \"closed_issues\":23,\n" +
-				"      \"state\":\"open\",\n" +
-				"      \"created_at\":\"2020-09-16T13:28:03Z\",\n" +
-				"      \"updated_at\":\"2021-04-06T23:47:10Z\",\n" +
-				"      \"due_on\":\"2021-04-12T07:00:00Z\",\n" +
-				"      \"closed_at\":null\n" +
-				"   }\n" +
-				"]";
-		this.server.enqueue(new MockResponse().setBody(responseJson));
-
-		assertThatExceptionOfType(RuntimeException.class)
-				.isThrownBy(() -> this.github.findMilestoneNumberByTitle(this.repositoryRef, "missing"));
-	}
-
-	@Test
-	public void isOpenIssuesForMilestoneNumberWhenAllClosedThenFalse() throws Exception {
-		String responseJson = "[]";
-		long milestoneNumber = 202;
-		this.server.enqueue(new MockResponse().setBody(responseJson));
-
-		assertThat(this.github.isOpenIssuesForMilestoneNumber(this.repositoryRef, milestoneNumber)).isFalse();
-
-		RecordedRequest recordedRequest = this.server.takeRequest(1, TimeUnit.SECONDS);
-		assertThat(recordedRequest.getMethod()).isEqualToIgnoringCase("get");
-		assertThat(recordedRequest.getRequestUrl().toString()).isEqualTo(this.baseUrl + "/repos/spring-projects/spring-security/issues?per_page=1&milestone=" + milestoneNumber);
-	}
-
-	@Test
-	public void isOpenIssuesForMilestoneNumberWhenOpenIssuesThenTrue() throws Exception {
-		String responseJson = "[\n" +
-				"   {\n" +
-				"      \"url\":\"https://api.github.com/repos/spring-projects/spring-security/issues/9562\",\n" +
-				"      \"repository_url\":\"https://api.github.com/repos/spring-projects/spring-security\",\n" +
-				"      \"labels_url\":\"https://api.github.com/repos/spring-projects/spring-security/issues/9562/labels{/name}\",\n" +
-				"      \"comments_url\":\"https://api.github.com/repos/spring-projects/spring-security/issues/9562/comments\",\n" +
-				"      \"events_url\":\"https://api.github.com/repos/spring-projects/spring-security/issues/9562/events\",\n" +
-				"      \"html_url\":\"https://github.com/spring-projects/spring-security/pull/9562\",\n" +
-				"      \"id\":851886504,\n" +
-				"      \"node_id\":\"MDExOlB1bGxSZXF1ZXN0NjEwMjMzMDcw\",\n" +
-				"      \"number\":9562,\n" +
-				"      \"title\":\"Add package-list\",\n" +
-				"      \"user\":{\n" +
-				"         \"login\":\"jzheaux\",\n" +
-				"         \"id\":3627351,\n" +
-				"         \"node_id\":\"MDQ6VXNlcjM2MjczNTE=\",\n" +
-				"         \"avatar_url\":\"https://avatars.githubusercontent.com/u/3627351?v=4\",\n" +
-				"         \"gravatar_id\":\"\",\n" +
-				"         \"url\":\"https://api.github.com/users/jzheaux\",\n" +
-				"         \"html_url\":\"https://github.com/jzheaux\",\n" +
-				"         \"followers_url\":\"https://api.github.com/users/jzheaux/followers\",\n" +
-				"         \"following_url\":\"https://api.github.com/users/jzheaux/following{/other_user}\",\n" +
-				"         \"gists_url\":\"https://api.github.com/users/jzheaux/gists{/gist_id}\",\n" +
-				"         \"starred_url\":\"https://api.github.com/users/jzheaux/starred{/owner}{/repo}\",\n" +
-				"         \"subscriptions_url\":\"https://api.github.com/users/jzheaux/subscriptions\",\n" +
-				"         \"organizations_url\":\"https://api.github.com/users/jzheaux/orgs\",\n" +
-				"         \"repos_url\":\"https://api.github.com/users/jzheaux/repos\",\n" +
-				"         \"events_url\":\"https://api.github.com/users/jzheaux/events{/privacy}\",\n" +
-				"         \"received_events_url\":\"https://api.github.com/users/jzheaux/received_events\",\n" +
-				"         \"type\":\"User\",\n" +
-				"         \"site_admin\":false\n" +
-				"      },\n" +
-				"      \"labels\":[\n" +
-				"         {\n" +
-				"            \"id\":322225043,\n" +
-				"            \"node_id\":\"MDU6TGFiZWwzMjIyMjUwNDM=\",\n" +
-				"            \"url\":\"https://api.github.com/repos/spring-projects/spring-security/labels/in:%20build\",\n" +
-				"            \"name\":\"in: build\",\n" +
-				"            \"color\":\"e8f9de\",\n" +
-				"            \"default\":false,\n" +
-				"            \"description\":\"An issue in the build\"\n" +
-				"         },\n" +
-				"         {\n" +
-				"            \"id\":322225079,\n" +
-				"            \"node_id\":\"MDU6TGFiZWwzMjIyMjUwNzk=\",\n" +
-				"            \"url\":\"https://api.github.com/repos/spring-projects/spring-security/labels/type:%20bug\",\n" +
-				"            \"name\":\"type: bug\",\n" +
-				"            \"color\":\"e3d9fc\",\n" +
-				"            \"default\":false,\n" +
-				"            \"description\":\"A general bug\"\n" +
-				"         }\n" +
-				"      ],\n" +
-				"      \"state\":\"open\",\n" +
-				"      \"locked\":false,\n" +
-				"      \"assignee\":{\n" +
-				"         \"login\":\"rwinch\",\n" +
-				"         \"id\":362503,\n" +
-				"         \"node_id\":\"MDQ6VXNlcjM2MjUwMw==\",\n" +
-				"         \"avatar_url\":\"https://avatars.githubusercontent.com/u/362503?v=4\",\n" +
-				"         \"gravatar_id\":\"\",\n" +
-				"         \"url\":\"https://api.github.com/users/rwinch\",\n" +
-				"         \"html_url\":\"https://github.com/rwinch\",\n" +
-				"         \"followers_url\":\"https://api.github.com/users/rwinch/followers\",\n" +
-				"         \"following_url\":\"https://api.github.com/users/rwinch/following{/other_user}\",\n" +
-				"         \"gists_url\":\"https://api.github.com/users/rwinch/gists{/gist_id}\",\n" +
-				"         \"starred_url\":\"https://api.github.com/users/rwinch/starred{/owner}{/repo}\",\n" +
-				"         \"subscriptions_url\":\"https://api.github.com/users/rwinch/subscriptions\",\n" +
-				"         \"organizations_url\":\"https://api.github.com/users/rwinch/orgs\",\n" +
-				"         \"repos_url\":\"https://api.github.com/users/rwinch/repos\",\n" +
-				"         \"events_url\":\"https://api.github.com/users/rwinch/events{/privacy}\",\n" +
-				"         \"received_events_url\":\"https://api.github.com/users/rwinch/received_events\",\n" +
-				"         \"type\":\"User\",\n" +
-				"         \"site_admin\":false\n" +
-				"      },\n" +
-				"      \"assignees\":[\n" +
-				"         {\n" +
-				"            \"login\":\"rwinch\",\n" +
-				"            \"id\":362503,\n" +
-				"            \"node_id\":\"MDQ6VXNlcjM2MjUwMw==\",\n" +
-				"            \"avatar_url\":\"https://avatars.githubusercontent.com/u/362503?v=4\",\n" +
-				"            \"gravatar_id\":\"\",\n" +
-				"            \"url\":\"https://api.github.com/users/rwinch\",\n" +
-				"            \"html_url\":\"https://github.com/rwinch\",\n" +
-				"            \"followers_url\":\"https://api.github.com/users/rwinch/followers\",\n" +
-				"            \"following_url\":\"https://api.github.com/users/rwinch/following{/other_user}\",\n" +
-				"            \"gists_url\":\"https://api.github.com/users/rwinch/gists{/gist_id}\",\n" +
-				"            \"starred_url\":\"https://api.github.com/users/rwinch/starred{/owner}{/repo}\",\n" +
-				"            \"subscriptions_url\":\"https://api.github.com/users/rwinch/subscriptions\",\n" +
-				"            \"organizations_url\":\"https://api.github.com/users/rwinch/orgs\",\n" +
-				"            \"repos_url\":\"https://api.github.com/users/rwinch/repos\",\n" +
-				"            \"events_url\":\"https://api.github.com/users/rwinch/events{/privacy}\",\n" +
-				"            \"received_events_url\":\"https://api.github.com/users/rwinch/received_events\",\n" +
-				"            \"type\":\"User\",\n" +
-				"            \"site_admin\":false\n" +
-				"         }\n" +
-				"      ],\n" +
-				"      \"milestone\":{\n" +
-				"         \"url\":\"https://api.github.com/repos/spring-projects/spring-security/milestones/191\",\n" +
-				"         \"html_url\":\"https://github.com/spring-projects/spring-security/milestone/191\",\n" +
-				"         \"labels_url\":\"https://api.github.com/repos/spring-projects/spring-security/milestones/191/labels\",\n" +
-				"         \"id\":5884208,\n" +
-				"         \"node_id\":\"MDk6TWlsZXN0b25lNTg4NDIwOA==\",\n" +
-				"         \"number\":191,\n" +
-				"         \"title\":\"5.5.0-RC1\",\n" +
-				"         \"description\":\"\",\n" +
-				"         \"creator\":{\n" +
-				"            \"login\":\"jzheaux\",\n" +
-				"            \"id\":3627351,\n" +
-				"            \"node_id\":\"MDQ6VXNlcjM2MjczNTE=\",\n" +
-				"            \"avatar_url\":\"https://avatars.githubusercontent.com/u/3627351?v=4\",\n" +
-				"            \"gravatar_id\":\"\",\n" +
-				"            \"url\":\"https://api.github.com/users/jzheaux\",\n" +
-				"            \"html_url\":\"https://github.com/jzheaux\",\n" +
-				"            \"followers_url\":\"https://api.github.com/users/jzheaux/followers\",\n" +
-				"            \"following_url\":\"https://api.github.com/users/jzheaux/following{/other_user}\",\n" +
-				"            \"gists_url\":\"https://api.github.com/users/jzheaux/gists{/gist_id}\",\n" +
-				"            \"starred_url\":\"https://api.github.com/users/jzheaux/starred{/owner}{/repo}\",\n" +
-				"            \"subscriptions_url\":\"https://api.github.com/users/jzheaux/subscriptions\",\n" +
-				"            \"organizations_url\":\"https://api.github.com/users/jzheaux/orgs\",\n" +
-				"            \"repos_url\":\"https://api.github.com/users/jzheaux/repos\",\n" +
-				"            \"events_url\":\"https://api.github.com/users/jzheaux/events{/privacy}\",\n" +
-				"            \"received_events_url\":\"https://api.github.com/users/jzheaux/received_events\",\n" +
-				"            \"type\":\"User\",\n" +
-				"            \"site_admin\":false\n" +
-				"         },\n" +
-				"         \"open_issues\":21,\n" +
-				"         \"closed_issues\":23,\n" +
-				"         \"state\":\"open\",\n" +
-				"         \"created_at\":\"2020-09-16T13:28:03Z\",\n" +
-				"         \"updated_at\":\"2021-04-06T23:47:10Z\",\n" +
-				"         \"due_on\":\"2021-04-12T07:00:00Z\",\n" +
-				"         \"closed_at\":null\n" +
-				"      },\n" +
-				"      \"comments\":0,\n" +
-				"      \"created_at\":\"2021-04-06T23:47:10Z\",\n" +
-				"      \"updated_at\":\"2021-04-07T17:00:00Z\",\n" +
-				"      \"closed_at\":null,\n" +
-				"      \"author_association\":\"MEMBER\",\n" +
-				"      \"active_lock_reason\":null,\n" +
-				"      \"pull_request\":{\n" +
-				"         \"url\":\"https://api.github.com/repos/spring-projects/spring-security/pulls/9562\",\n" +
-				"         \"html_url\":\"https://github.com/spring-projects/spring-security/pull/9562\",\n" +
-				"         \"diff_url\":\"https://github.com/spring-projects/spring-security/pull/9562.diff\",\n" +
-				"         \"patch_url\":\"https://github.com/spring-projects/spring-security/pull/9562.patch\"\n" +
-				"      },\n" +
-				"      \"body\":\"Closes gh-9528\\r\\n\\r\\n<!--\\r\\nFor Security Vulnerabilities, please use https://pivotal.io/security#reporting\\r\\n-->\\r\\n\\r\\n<!--\\r\\nBefore creating new features, we recommend creating an issue to discuss the feature. This ensures that everyone is on the same page before extensive work is done.\\r\\n\\r\\nThanks for contributing to Spring Security. Please provide a brief description of your pull-request and reference any related issue numbers (prefix references with gh-).\\r\\n-->\\r\\n\",\n" +
-				"      \"performed_via_github_app\":null\n" +
-				"   }\n" +
-				"]";
-		long milestoneNumber = 191;
-		this.server.enqueue(new MockResponse().setBody(responseJson));
-
-		assertThat(this.github.isOpenIssuesForMilestoneNumber(this.repositoryRef, milestoneNumber)).isTrue();
-
-		RecordedRequest recordedRequest = this.server.takeRequest(1, TimeUnit.SECONDS);
-		assertThat(recordedRequest.getMethod()).isEqualToIgnoringCase("get");
-		assertThat(recordedRequest.getRequestUrl().toString()).isEqualTo(this.baseUrl + "/repos/spring-projects/spring-security/issues?per_page=1&milestone=" + milestoneNumber);
-	}
-
-}

buildSrc/src/test/java/org/springframework/gradle/antora/AntoraVersionPluginTests.java

@@ -15,16 +15,16 @@ import static org.assertj.core.api.Assertions.assertThat;
 import static org.assertj.core.api.Assertions.assertThatExceptionOfType;
 import static org.assertj.core.api.Assertions.assertThatIOException;
 
-class CheckAntoraVersionPluginTests {
+class AntoraVersionPluginTests {
 
 	@Test
 	void defaultsPropertiesWhenSnapshot() {
 		String expectedVersion = "1.0.0-SNAPSHOT";
 		Project project = ProjectBuilder.builder().build();
 		project.setVersion(expectedVersion);
-		project.getPluginManager().apply(CheckAntoraVersionPlugin.class);
+		project.getPluginManager().apply(AntoraVersionPlugin.class);
 
-		Task task = project.getTasks().findByName(CheckAntoraVersionPlugin.ANTORA_CHECK_VERSION_TASK_NAME);
+		Task task = project.getTasks().findByName(AntoraVersionPlugin.ANTORA_CHECK_VERSION_TASK_NAME);
 
 		assertThat(task).isInstanceOf(CheckAntoraVersionTask.class);
 
@@ -40,9 +40,9 @@ class CheckAntoraVersionPluginTests {
 		String expectedVersion = "1.0.0-M1";
 		Project project = ProjectBuilder.builder().build();
 		project.setVersion(expectedVersion);
-		project.getPluginManager().apply(CheckAntoraVersionPlugin.class);
+		project.getPluginManager().apply(AntoraVersionPlugin.class);
 
-		Task task = project.getTasks().findByName(CheckAntoraVersionPlugin.ANTORA_CHECK_VERSION_TASK_NAME);
+		Task task = project.getTasks().findByName(AntoraVersionPlugin.ANTORA_CHECK_VERSION_TASK_NAME);
 
 		assertThat(task).isInstanceOf(CheckAntoraVersionTask.class);
 
@@ -58,9 +58,9 @@ class CheckAntoraVersionPluginTests {
 		String expectedVersion = "1.0.0-RC1";
 		Project project = ProjectBuilder.builder().build();
 		project.setVersion(expectedVersion);
-		project.getPluginManager().apply(CheckAntoraVersionPlugin.class);
+		project.getPluginManager().apply(AntoraVersionPlugin.class);
 
-		Task task = project.getTasks().findByName(CheckAntoraVersionPlugin.ANTORA_CHECK_VERSION_TASK_NAME);
+		Task task = project.getTasks().findByName(AntoraVersionPlugin.ANTORA_CHECK_VERSION_TASK_NAME);
 
 		assertThat(task).isInstanceOf(CheckAntoraVersionTask.class);
 
@@ -76,9 +76,9 @@ class CheckAntoraVersionPluginTests {
 		String expectedVersion = "1.0.0";
 		Project project = ProjectBuilder.builder().build();
 		project.setVersion(expectedVersion);
-		project.getPluginManager().apply(CheckAntoraVersionPlugin.class);
+		project.getPluginManager().apply(AntoraVersionPlugin.class);
 
-		Task task = project.getTasks().findByName(CheckAntoraVersionPlugin.ANTORA_CHECK_VERSION_TASK_NAME);
+		Task task = project.getTasks().findByName(AntoraVersionPlugin.ANTORA_CHECK_VERSION_TASK_NAME);
 
 		assertThat(task).isInstanceOf(CheckAntoraVersionTask.class);
 
@@ -92,9 +92,9 @@ class CheckAntoraVersionPluginTests {
 	@Test
 	void explicitProperties() {
 		Project project = ProjectBuilder.builder().build();
-		project.getPluginManager().apply(CheckAntoraVersionPlugin.class);
+		project.getPluginManager().apply(AntoraVersionPlugin.class);
 
-		Task task = project.getTasks().findByName(CheckAntoraVersionPlugin.ANTORA_CHECK_VERSION_TASK_NAME);
+		Task task = project.getTasks().findByName(AntoraVersionPlugin.ANTORA_CHECK_VERSION_TASK_NAME);
 
 		CheckAntoraVersionTask checkAntoraVersionTask = (CheckAntoraVersionTask) task;
 		checkAntoraVersionTask.getAntoraVersion().set("1.0.0");
@@ -110,9 +110,9 @@ class CheckAntoraVersionPluginTests {
 		Project project = ProjectBuilder.builder().build();
 		File rootDir = project.getRootDir();
 		IOUtils.write("version: '1.0.0'", new FileOutputStream(new File(rootDir, "antora.yml")), StandardCharsets.UTF_8);
-		project.getPluginManager().apply(CheckAntoraVersionPlugin.class);
+		project.getPluginManager().apply(AntoraVersionPlugin.class);
 
-		Task task = project.getTasks().findByName(CheckAntoraVersionPlugin.ANTORA_CHECK_VERSION_TASK_NAME);
+		Task task = project.getTasks().findByName(AntoraVersionPlugin.ANTORA_CHECK_VERSION_TASK_NAME);
 
 		assertThat(task).isInstanceOf(CheckAntoraVersionTask.class);
 
@@ -125,9 +125,9 @@ class CheckAntoraVersionPluginTests {
 		String expectedVersion = "1.0.0-SNAPSHOT";
 		Project project = ProjectBuilder.builder().build();
 		project.setVersion(expectedVersion);
-		project.getPluginManager().apply(CheckAntoraVersionPlugin.class);
+		project.getPluginManager().apply(AntoraVersionPlugin.class);
 
-		Task task = project.getTasks().findByName(CheckAntoraVersionPlugin.ANTORA_CHECK_VERSION_TASK_NAME);
+		Task task = project.getTasks().findByName(AntoraVersionPlugin.ANTORA_CHECK_VERSION_TASK_NAME);
 
 		assertThat(task).isInstanceOf(CheckAntoraVersionTask.class);
 
@@ -142,9 +142,9 @@ class CheckAntoraVersionPluginTests {
 		File rootDir = project.getRootDir();
 		IOUtils.write("version: '1.0.0'", new FileOutputStream(new File(rootDir, "antora.yml")), StandardCharsets.UTF_8);
 		project.setVersion(expectedVersion);
-		project.getPluginManager().apply(CheckAntoraVersionPlugin.class);
+		project.getPluginManager().apply(AntoraVersionPlugin.class);
 
-		Task task = project.getTasks().findByName(CheckAntoraVersionPlugin.ANTORA_CHECK_VERSION_TASK_NAME);
+		Task task = project.getTasks().findByName(AntoraVersionPlugin.ANTORA_CHECK_VERSION_TASK_NAME);
 
 		assertThat(task).isInstanceOf(CheckAntoraVersionTask.class);
 
@@ -160,9 +160,9 @@ class CheckAntoraVersionPluginTests {
 		File rootDir = project.getRootDir();
 		IOUtils.write("version: '1.0.0'\nprerelease: '-SNAPSHOT'", new FileOutputStream(new File(rootDir, "antora.yml")), StandardCharsets.UTF_8);
 		project.setVersion(expectedVersion);
-		project.getPluginManager().apply(CheckAntoraVersionPlugin.class);
+		project.getPluginManager().apply(AntoraVersionPlugin.class);
 
-		Task task = project.getTasks().findByName(CheckAntoraVersionPlugin.ANTORA_CHECK_VERSION_TASK_NAME);
+		Task task = project.getTasks().findByName(AntoraVersionPlugin.ANTORA_CHECK_VERSION_TASK_NAME);
 
 		assertThat(task).isInstanceOf(CheckAntoraVersionTask.class);
 
@@ -177,9 +177,9 @@ class CheckAntoraVersionPluginTests {
 		File rootDir = project.getRootDir();
 		IOUtils.write("version: '1.0.0-M1'\nprerelease: 'true'\ndisplay_version: '1.0.0-M1'", new FileOutputStream(new File(rootDir, "antora.yml")), StandardCharsets.UTF_8);
 		project.setVersion(expectedVersion);
-		project.getPluginManager().apply(CheckAntoraVersionPlugin.class);
+		project.getPluginManager().apply(AntoraVersionPlugin.class);
 
-		Task task = project.getTasks().findByName(CheckAntoraVersionPlugin.ANTORA_CHECK_VERSION_TASK_NAME);
+		Task task = project.getTasks().findByName(AntoraVersionPlugin.ANTORA_CHECK_VERSION_TASK_NAME);
 
 		assertThat(task).isInstanceOf(CheckAntoraVersionTask.class);
 
@@ -194,9 +194,9 @@ class CheckAntoraVersionPluginTests {
 		File rootDir = project.getRootDir();
 		IOUtils.write("version: '1.0.0-RC1'\nprerelease: 'true'\ndisplay_version: '1.0.0-RC1'", new FileOutputStream(new File(rootDir, "antora.yml")), StandardCharsets.UTF_8);
 		project.setVersion(expectedVersion);
-		project.getPluginManager().apply(CheckAntoraVersionPlugin.class);
+		project.getPluginManager().apply(AntoraVersionPlugin.class);
 
-		Task task = project.getTasks().findByName(CheckAntoraVersionPlugin.ANTORA_CHECK_VERSION_TASK_NAME);
+		Task task = project.getTasks().findByName(AntoraVersionPlugin.ANTORA_CHECK_VERSION_TASK_NAME);
 
 		assertThat(task).isInstanceOf(CheckAntoraVersionTask.class);
 
@@ -211,9 +211,9 @@ class CheckAntoraVersionPluginTests {
 		File rootDir = project.getRootDir();
 		IOUtils.write("version: '1.0.0'", new FileOutputStream(new File(rootDir, "antora.yml")), StandardCharsets.UTF_8);
 		project.setVersion(expectedVersion);
-		project.getPluginManager().apply(CheckAntoraVersionPlugin.class);
+		project.getPluginManager().apply(AntoraVersionPlugin.class);
 
-		Task task = project.getTasks().findByName(CheckAntoraVersionPlugin.ANTORA_CHECK_VERSION_TASK_NAME);
+		Task task = project.getTasks().findByName(AntoraVersionPlugin.ANTORA_CHECK_VERSION_TASK_NAME);
 
 		assertThat(task).isInstanceOf(CheckAntoraVersionTask.class);
 
@@ -226,9 +226,9 @@ class CheckAntoraVersionPluginTests {
 		Project project = ProjectBuilder.builder().build();
 		File rootDir = project.getRootDir();
 		IOUtils.write("version: '1.0.0'", new FileOutputStream(new File(rootDir, "antora.yml")), StandardCharsets.UTF_8);
-		project.getPluginManager().apply(CheckAntoraVersionPlugin.class);
+		project.getPluginManager().apply(AntoraVersionPlugin.class);
 
-		Task task = project.getTasks().findByName(CheckAntoraVersionPlugin.ANTORA_CHECK_VERSION_TASK_NAME);
+		Task task = project.getTasks().findByName(AntoraVersionPlugin.ANTORA_CHECK_VERSION_TASK_NAME);
 
 		assertThat(task).isInstanceOf(CheckAntoraVersionTask.class);
 		CheckAntoraVersionTask checkAntoraVersionTask = (CheckAntoraVersionTask) task;
@@ -241,9 +241,9 @@ class CheckAntoraVersionPluginTests {
 		Project project = ProjectBuilder.builder().build();
 		File rootDir = project.getRootDir();
 		IOUtils.write("version: '1.0.0'\nprerelease: '-SNAPSHOT'", new FileOutputStream(new File(rootDir, "antora.yml")), StandardCharsets.UTF_8);
-		project.getPluginManager().apply(CheckAntoraVersionPlugin.class);
+		project.getPluginManager().apply(AntoraVersionPlugin.class);
 
-		Task task = project.getTasks().findByName(CheckAntoraVersionPlugin.ANTORA_CHECK_VERSION_TASK_NAME);
+		Task task = project.getTasks().findByName(AntoraVersionPlugin.ANTORA_CHECK_VERSION_TASK_NAME);
 
 		assertThat(task).isInstanceOf(CheckAntoraVersionTask.class);
 		CheckAntoraVersionTask checkAntoraVersionTask = (CheckAntoraVersionTask) task;
@@ -257,9 +257,9 @@ class CheckAntoraVersionPluginTests {
 		Project project = ProjectBuilder.builder().build();
 		File rootDir = project.getRootDir();
 		IOUtils.write("name: 'ROOT'\nversion: '1.0.0'", new FileOutputStream(new File(rootDir, "antora.yml")), StandardCharsets.UTF_8);
-		project.getPluginManager().apply(CheckAntoraVersionPlugin.class);
+		project.getPluginManager().apply(AntoraVersionPlugin.class);
 
-		Task task = project.getTasks().findByName(CheckAntoraVersionPlugin.ANTORA_CHECK_VERSION_TASK_NAME);
+		Task task = project.getTasks().findByName(AntoraVersionPlugin.ANTORA_CHECK_VERSION_TASK_NAME);
 
 		assertThat(task).isInstanceOf(CheckAntoraVersionTask.class);
 		CheckAntoraVersionTask checkAntoraVersionTask = (CheckAntoraVersionTask) task;

buildSrc/src/test/java/org/springframework/gradle/github/milestones/GitHubMilestoneApiTests.java

@@ -1,5 +1,11 @@
 package org.springframework.gradle.github.milestones;
 
+import java.nio.charset.Charset;
+import java.time.Instant;
+import java.time.LocalDate;
+import java.time.LocalTime;
+import java.util.concurrent.TimeUnit;
+
 import okhttp3.mockwebserver.MockResponse;
 import okhttp3.mockwebserver.MockWebServer;
 import okhttp3.mockwebserver.RecordedRequest;
@@ -7,7 +13,7 @@ import org.junit.jupiter.api.AfterEach;
 import org.junit.jupiter.api.BeforeEach;
 import org.junit.jupiter.api.Test;
 
-import java.util.concurrent.TimeUnit;
+import org.springframework.gradle.github.RepositoryRef;
 
 import static org.assertj.core.api.Assertions.assertThat;
 import static org.assertj.core.api.Assertions.assertThatExceptionOfType;
@@ -383,4 +389,836 @@ public class GitHubMilestoneApiTests {
 		assertThat(recordedRequest.getRequestUrl().toString()).isEqualTo(this.baseUrl + "/repos/spring-projects/spring-security/issues?per_page=1&milestone=" + milestoneNumber);
 	}
 
+	@Test
+	public void isMilestoneDueTodayWhenNotFoundThenException() throws Exception {
+		String responseJson = "[\n" +
+				"   {\n" +
+				"      \"url\":\"https://api.github.com/repos/spring-projects/spring-security/milestones/207\",\n" +
+				"      \"html_url\":\"https://github.com/spring-projects/spring-security/milestone/207\",\n" +
+				"      \"labels_url\":\"https://api.github.com/repos/spring-projects/spring-security/milestones/207/labels\",\n" +
+				"      \"id\":6611880,\n" +
+				"      \"node_id\":\"MDk6TWlsZXN0b25lNjYxMTg4MA==\",\n" +
+				"      \"number\":207,\n" +
+				"      \"title\":\"5.6.x\",\n" +
+				"      \"description\":\"\",\n" +
+				"      \"creator\":{\n" +
+				"         \"login\":\"jgrandja\",\n" +
+				"         \"id\":10884212,\n" +
+				"         \"node_id\":\"MDQ6VXNlcjEwODg0MjEy\",\n" +
+				"         \"avatar_url\":\"https://avatars.githubusercontent.com/u/10884212?v=4\",\n" +
+				"         \"gravatar_id\":\"\",\n" +
+				"         \"url\":\"https://api.github.com/users/jgrandja\",\n" +
+				"         \"html_url\":\"https://github.com/jgrandja\",\n" +
+				"         \"followers_url\":\"https://api.github.com/users/jgrandja/followers\",\n" +
+				"         \"following_url\":\"https://api.github.com/users/jgrandja/following{/other_user}\",\n" +
+				"         \"gists_url\":\"https://api.github.com/users/jgrandja/gists{/gist_id}\",\n" +
+				"         \"starred_url\":\"https://api.github.com/users/jgrandja/starred{/owner}{/repo}\",\n" +
+				"         \"subscriptions_url\":\"https://api.github.com/users/jgrandja/subscriptions\",\n" +
+				"         \"organizations_url\":\"https://api.github.com/users/jgrandja/orgs\",\n" +
+				"         \"repos_url\":\"https://api.github.com/users/jgrandja/repos\",\n" +
+				"         \"events_url\":\"https://api.github.com/users/jgrandja/events{/privacy}\",\n" +
+				"         \"received_events_url\":\"https://api.github.com/users/jgrandja/received_events\",\n" +
+				"         \"type\":\"User\",\n" +
+				"         \"site_admin\":false\n" +
+				"      },\n" +
+				"      \"open_issues\":1,\n" +
+				"      \"closed_issues\":0,\n" +
+				"      \"state\":\"open\",\n" +
+				"      \"created_at\":\"2021-03-31T11:29:17Z\",\n" +
+				"      \"updated_at\":\"2021-03-31T11:30:47Z\",\n" +
+				"      \"due_on\":null,\n" +
+				"      \"closed_at\":null\n" +
+				"   },\n" +
+				"   {\n" +
+				"      \"url\":\"https://api.github.com/repos/spring-projects/spring-security/milestones/191\",\n" +
+				"      \"html_url\":\"https://github.com/spring-projects/spring-security/milestone/191\",\n" +
+				"      \"labels_url\":\"https://api.github.com/repos/spring-projects/spring-security/milestones/191/labels\",\n" +
+				"      \"id\":5884208,\n" +
+				"      \"node_id\":\"MDk6TWlsZXN0b25lNTg4NDIwOA==\",\n" +
+				"      \"number\":191,\n" +
+				"      \"title\":\"5.5.0-RC1\",\n" +
+				"      \"description\":\"\",\n" +
+				"      \"creator\":{\n" +
+				"         \"login\":\"jzheaux\",\n" +
+				"         \"id\":3627351,\n" +
+				"         \"node_id\":\"MDQ6VXNlcjM2MjczNTE=\",\n" +
+				"         \"avatar_url\":\"https://avatars.githubusercontent.com/u/3627351?v=4\",\n" +
+				"         \"gravatar_id\":\"\",\n" +
+				"         \"url\":\"https://api.github.com/users/jzheaux\",\n" +
+				"         \"html_url\":\"https://github.com/jzheaux\",\n" +
+				"         \"followers_url\":\"https://api.github.com/users/jzheaux/followers\",\n" +
+				"         \"following_url\":\"https://api.github.com/users/jzheaux/following{/other_user}\",\n" +
+				"         \"gists_url\":\"https://api.github.com/users/jzheaux/gists{/gist_id}\",\n" +
+				"         \"starred_url\":\"https://api.github.com/users/jzheaux/starred{/owner}{/repo}\",\n" +
+				"         \"subscriptions_url\":\"https://api.github.com/users/jzheaux/subscriptions\",\n" +
+				"         \"organizations_url\":\"https://api.github.com/users/jzheaux/orgs\",\n" +
+				"         \"repos_url\":\"https://api.github.com/users/jzheaux/repos\",\n" +
+				"         \"events_url\":\"https://api.github.com/users/jzheaux/events{/privacy}\",\n" +
+				"         \"received_events_url\":\"https://api.github.com/users/jzheaux/received_events\",\n" +
+				"         \"type\":\"User\",\n" +
+				"         \"site_admin\":false\n" +
+				"      },\n" +
+				"      \"open_issues\":21,\n" +
+				"      \"closed_issues\":23,\n" +
+				"      \"state\":\"open\",\n" +
+				"      \"created_at\":\"2020-09-16T13:28:03Z\",\n" +
+				"      \"updated_at\":\"2021-04-06T23:47:10Z\",\n" +
+				"      \"due_on\":\"2021-04-12T07:00:00Z\",\n" +
+				"      \"closed_at\":null\n" +
+				"   }\n" +
+				"]";
+		this.server.enqueue(new MockResponse().setBody(responseJson));
+
+		assertThatExceptionOfType(RuntimeException.class)
+				.isThrownBy(() -> this.github.isMilestoneDueToday(this.repositoryRef, "missing"));
+	}
+
+	@Test
+	public void isMilestoneDueTodayWhenPastDueThenTrue() throws Exception {
+		String responseJson = "[\n" +
+				"   {\n" +
+				"      \"url\":\"https://api.github.com/repos/spring-projects/spring-security/milestones/207\",\n" +
+				"      \"html_url\":\"https://github.com/spring-projects/spring-security/milestone/207\",\n" +
+				"      \"labels_url\":\"https://api.github.com/repos/spring-projects/spring-security/milestones/207/labels\",\n" +
+				"      \"id\":6611880,\n" +
+				"      \"node_id\":\"MDk6TWlsZXN0b25lNjYxMTg4MA==\",\n" +
+				"      \"number\":207,\n" +
+				"      \"title\":\"5.6.x\",\n" +
+				"      \"description\":\"\",\n" +
+				"      \"creator\":{\n" +
+				"         \"login\":\"jgrandja\",\n" +
+				"         \"id\":10884212,\n" +
+				"         \"node_id\":\"MDQ6VXNlcjEwODg0MjEy\",\n" +
+				"         \"avatar_url\":\"https://avatars.githubusercontent.com/u/10884212?v=4\",\n" +
+				"         \"gravatar_id\":\"\",\n" +
+				"         \"url\":\"https://api.github.com/users/jgrandja\",\n" +
+				"         \"html_url\":\"https://github.com/jgrandja\",\n" +
+				"         \"followers_url\":\"https://api.github.com/users/jgrandja/followers\",\n" +
+				"         \"following_url\":\"https://api.github.com/users/jgrandja/following{/other_user}\",\n" +
+				"         \"gists_url\":\"https://api.github.com/users/jgrandja/gists{/gist_id}\",\n" +
+				"         \"starred_url\":\"https://api.github.com/users/jgrandja/starred{/owner}{/repo}\",\n" +
+				"         \"subscriptions_url\":\"https://api.github.com/users/jgrandja/subscriptions\",\n" +
+				"         \"organizations_url\":\"https://api.github.com/users/jgrandja/orgs\",\n" +
+				"         \"repos_url\":\"https://api.github.com/users/jgrandja/repos\",\n" +
+				"         \"events_url\":\"https://api.github.com/users/jgrandja/events{/privacy}\",\n" +
+				"         \"received_events_url\":\"https://api.github.com/users/jgrandja/received_events\",\n" +
+				"         \"type\":\"User\",\n" +
+				"         \"site_admin\":false\n" +
+				"      },\n" +
+				"      \"open_issues\":1,\n" +
+				"      \"closed_issues\":0,\n" +
+				"      \"state\":\"open\",\n" +
+				"      \"created_at\":\"2021-03-31T11:29:17Z\",\n" +
+				"      \"updated_at\":\"2021-03-31T11:30:47Z\",\n" +
+				"      \"due_on\":null,\n" +
+				"      \"closed_at\":null\n" +
+				"   },\n" +
+				"   {\n" +
+				"      \"url\":\"https://api.github.com/repos/spring-projects/spring-security/milestones/191\",\n" +
+				"      \"html_url\":\"https://github.com/spring-projects/spring-security/milestone/191\",\n" +
+				"      \"labels_url\":\"https://api.github.com/repos/spring-projects/spring-security/milestones/191/labels\",\n" +
+				"      \"id\":5884208,\n" +
+				"      \"node_id\":\"MDk6TWlsZXN0b25lNTg4NDIwOA==\",\n" +
+				"      \"number\":191,\n" +
+				"      \"title\":\"5.5.0-RC1\",\n" +
+				"      \"description\":\"\",\n" +
+				"      \"creator\":{\n" +
+				"         \"login\":\"jzheaux\",\n" +
+				"         \"id\":3627351,\n" +
+				"         \"node_id\":\"MDQ6VXNlcjM2MjczNTE=\",\n" +
+				"         \"avatar_url\":\"https://avatars.githubusercontent.com/u/3627351?v=4\",\n" +
+				"         \"gravatar_id\":\"\",\n" +
+				"         \"url\":\"https://api.github.com/users/jzheaux\",\n" +
+				"         \"html_url\":\"https://github.com/jzheaux\",\n" +
+				"         \"followers_url\":\"https://api.github.com/users/jzheaux/followers\",\n" +
+				"         \"following_url\":\"https://api.github.com/users/jzheaux/following{/other_user}\",\n" +
+				"         \"gists_url\":\"https://api.github.com/users/jzheaux/gists{/gist_id}\",\n" +
+				"         \"starred_url\":\"https://api.github.com/users/jzheaux/starred{/owner}{/repo}\",\n" +
+				"         \"subscriptions_url\":\"https://api.github.com/users/jzheaux/subscriptions\",\n" +
+				"         \"organizations_url\":\"https://api.github.com/users/jzheaux/orgs\",\n" +
+				"         \"repos_url\":\"https://api.github.com/users/jzheaux/repos\",\n" +
+				"         \"events_url\":\"https://api.github.com/users/jzheaux/events{/privacy}\",\n" +
+				"         \"received_events_url\":\"https://api.github.com/users/jzheaux/received_events\",\n" +
+				"         \"type\":\"User\",\n" +
+				"         \"site_admin\":false\n" +
+				"      },\n" +
+				"      \"open_issues\":21,\n" +
+				"      \"closed_issues\":23,\n" +
+				"      \"state\":\"open\",\n" +
+				"      \"created_at\":\"2020-09-16T13:28:03Z\",\n" +
+				"      \"updated_at\":\"2021-04-06T23:47:10Z\",\n" +
+				"      \"due_on\":\"2021-04-12T07:00:00Z\",\n" +
+				"      \"closed_at\":null\n" +
+				"   }\n" +
+				"]";
+		this.server.enqueue(new MockResponse().setBody(responseJson));
+
+		boolean dueToday = this.github.isMilestoneDueToday(this.repositoryRef, "5.5.0-RC1");
+
+		RecordedRequest recordedRequest = this.server.takeRequest(1, TimeUnit.SECONDS);
+		assertThat(recordedRequest.getMethod()).isEqualToIgnoringCase("get");
+		assertThat(recordedRequest.getRequestUrl().toString()).isEqualTo(this.baseUrl + "/repos/spring-projects/spring-security/milestones?per_page=100");
+
+		assertThat(dueToday).isTrue();
+	}
+
+	@Test
+	public void isMilestoneDueTodayWhenDueTodayThenTrue() throws Exception {
+		String responseJson = "[\n" +
+				"   {\n" +
+				"      \"url\":\"https://api.github.com/repos/spring-projects/spring-security/milestones/207\",\n" +
+				"      \"html_url\":\"https://github.com/spring-projects/spring-security/milestone/207\",\n" +
+				"      \"labels_url\":\"https://api.github.com/repos/spring-projects/spring-security/milestones/207/labels\",\n" +
+				"      \"id\":6611880,\n" +
+				"      \"node_id\":\"MDk6TWlsZXN0b25lNjYxMTg4MA==\",\n" +
+				"      \"number\":207,\n" +
+				"      \"title\":\"5.6.x\",\n" +
+				"      \"description\":\"\",\n" +
+				"      \"creator\":{\n" +
+				"         \"login\":\"jgrandja\",\n" +
+				"         \"id\":10884212,\n" +
+				"         \"node_id\":\"MDQ6VXNlcjEwODg0MjEy\",\n" +
+				"         \"avatar_url\":\"https://avatars.githubusercontent.com/u/10884212?v=4\",\n" +
+				"         \"gravatar_id\":\"\",\n" +
+				"         \"url\":\"https://api.github.com/users/jgrandja\",\n" +
+				"         \"html_url\":\"https://github.com/jgrandja\",\n" +
+				"         \"followers_url\":\"https://api.github.com/users/jgrandja/followers\",\n" +
+				"         \"following_url\":\"https://api.github.com/users/jgrandja/following{/other_user}\",\n" +
+				"         \"gists_url\":\"https://api.github.com/users/jgrandja/gists{/gist_id}\",\n" +
+				"         \"starred_url\":\"https://api.github.com/users/jgrandja/starred{/owner}{/repo}\",\n" +
+				"         \"subscriptions_url\":\"https://api.github.com/users/jgrandja/subscriptions\",\n" +
+				"         \"organizations_url\":\"https://api.github.com/users/jgrandja/orgs\",\n" +
+				"         \"repos_url\":\"https://api.github.com/users/jgrandja/repos\",\n" +
+				"         \"events_url\":\"https://api.github.com/users/jgrandja/events{/privacy}\",\n" +
+				"         \"received_events_url\":\"https://api.github.com/users/jgrandja/received_events\",\n" +
+				"         \"type\":\"User\",\n" +
+				"         \"site_admin\":false\n" +
+				"      },\n" +
+				"      \"open_issues\":1,\n" +
+				"      \"closed_issues\":0,\n" +
+				"      \"state\":\"open\",\n" +
+				"      \"created_at\":\"2021-03-31T11:29:17Z\",\n" +
+				"      \"updated_at\":\"2021-03-31T11:30:47Z\",\n" +
+				"      \"due_on\":null,\n" +
+				"      \"closed_at\":null\n" +
+				"   },\n" +
+				"   {\n" +
+				"      \"url\":\"https://api.github.com/repos/spring-projects/spring-security/milestones/191\",\n" +
+				"      \"html_url\":\"https://github.com/spring-projects/spring-security/milestone/191\",\n" +
+				"      \"labels_url\":\"https://api.github.com/repos/spring-projects/spring-security/milestones/191/labels\",\n" +
+				"      \"id\":5884208,\n" +
+				"      \"node_id\":\"MDk6TWlsZXN0b25lNTg4NDIwOA==\",\n" +
+				"      \"number\":191,\n" +
+				"      \"title\":\"5.5.0-RC1\",\n" +
+				"      \"description\":\"\",\n" +
+				"      \"creator\":{\n" +
+				"         \"login\":\"jzheaux\",\n" +
+				"         \"id\":3627351,\n" +
+				"         \"node_id\":\"MDQ6VXNlcjM2MjczNTE=\",\n" +
+				"         \"avatar_url\":\"https://avatars.githubusercontent.com/u/3627351?v=4\",\n" +
+				"         \"gravatar_id\":\"\",\n" +
+				"         \"url\":\"https://api.github.com/users/jzheaux\",\n" +
+				"         \"html_url\":\"https://github.com/jzheaux\",\n" +
+				"         \"followers_url\":\"https://api.github.com/users/jzheaux/followers\",\n" +
+				"         \"following_url\":\"https://api.github.com/users/jzheaux/following{/other_user}\",\n" +
+				"         \"gists_url\":\"https://api.github.com/users/jzheaux/gists{/gist_id}\",\n" +
+				"         \"starred_url\":\"https://api.github.com/users/jzheaux/starred{/owner}{/repo}\",\n" +
+				"         \"subscriptions_url\":\"https://api.github.com/users/jzheaux/subscriptions\",\n" +
+				"         \"organizations_url\":\"https://api.github.com/users/jzheaux/orgs\",\n" +
+				"         \"repos_url\":\"https://api.github.com/users/jzheaux/repos\",\n" +
+				"         \"events_url\":\"https://api.github.com/users/jzheaux/events{/privacy}\",\n" +
+				"         \"received_events_url\":\"https://api.github.com/users/jzheaux/received_events\",\n" +
+				"         \"type\":\"User\",\n" +
+				"         \"site_admin\":false\n" +
+				"      },\n" +
+				"      \"open_issues\":21,\n" +
+				"      \"closed_issues\":23,\n" +
+				"      \"state\":\"open\",\n" +
+				"      \"created_at\":\"2020-09-16T13:28:03Z\",\n" +
+				"      \"updated_at\":\"2021-04-06T23:47:10Z\",\n" +
+				"      \"due_on\":\"" + Instant.now().toString() + "\",\n" +
+				"      \"closed_at\":null\n" +
+				"   }\n" +
+				"]";
+		this.server.enqueue(new MockResponse().setBody(responseJson));
+
+		boolean dueToday = this.github.isMilestoneDueToday(this.repositoryRef, "5.5.0-RC1");
+
+		RecordedRequest recordedRequest = this.server.takeRequest(1, TimeUnit.SECONDS);
+		assertThat(recordedRequest.getMethod()).isEqualToIgnoringCase("get");
+		assertThat(recordedRequest.getRequestUrl().toString()).isEqualTo(this.baseUrl + "/repos/spring-projects/spring-security/milestones?per_page=100");
+
+		assertThat(dueToday).isTrue();
+	}
+
+	@Test
+	public void isMilestoneDueTodayWhenNoDueDateThenFalse() throws Exception {
+		String responseJson = "[\n" +
+				"   {\n" +
+				"      \"url\":\"https://api.github.com/repos/spring-projects/spring-security/milestones/207\",\n" +
+				"      \"html_url\":\"https://github.com/spring-projects/spring-security/milestone/207\",\n" +
+				"      \"labels_url\":\"https://api.github.com/repos/spring-projects/spring-security/milestones/207/labels\",\n" +
+				"      \"id\":6611880,\n" +
+				"      \"node_id\":\"MDk6TWlsZXN0b25lNjYxMTg4MA==\",\n" +
+				"      \"number\":207,\n" +
+				"      \"title\":\"5.6.x\",\n" +
+				"      \"description\":\"\",\n" +
+				"      \"creator\":{\n" +
+				"         \"login\":\"jgrandja\",\n" +
+				"         \"id\":10884212,\n" +
+				"         \"node_id\":\"MDQ6VXNlcjEwODg0MjEy\",\n" +
+				"         \"avatar_url\":\"https://avatars.githubusercontent.com/u/10884212?v=4\",\n" +
+				"         \"gravatar_id\":\"\",\n" +
+				"         \"url\":\"https://api.github.com/users/jgrandja\",\n" +
+				"         \"html_url\":\"https://github.com/jgrandja\",\n" +
+				"         \"followers_url\":\"https://api.github.com/users/jgrandja/followers\",\n" +
+				"         \"following_url\":\"https://api.github.com/users/jgrandja/following{/other_user}\",\n" +
+				"         \"gists_url\":\"https://api.github.com/users/jgrandja/gists{/gist_id}\",\n" +
+				"         \"starred_url\":\"https://api.github.com/users/jgrandja/starred{/owner}{/repo}\",\n" +
+				"         \"subscriptions_url\":\"https://api.github.com/users/jgrandja/subscriptions\",\n" +
+				"         \"organizations_url\":\"https://api.github.com/users/jgrandja/orgs\",\n" +
+				"         \"repos_url\":\"https://api.github.com/users/jgrandja/repos\",\n" +
+				"         \"events_url\":\"https://api.github.com/users/jgrandja/events{/privacy}\",\n" +
+				"         \"received_events_url\":\"https://api.github.com/users/jgrandja/received_events\",\n" +
+				"         \"type\":\"User\",\n" +
+				"         \"site_admin\":false\n" +
+				"      },\n" +
+				"      \"open_issues\":1,\n" +
+				"      \"closed_issues\":0,\n" +
+				"      \"state\":\"open\",\n" +
+				"      \"created_at\":\"2021-03-31T11:29:17Z\",\n" +
+				"      \"updated_at\":\"2021-03-31T11:30:47Z\",\n" +
+				"      \"due_on\":null,\n" +
+				"      \"closed_at\":null\n" +
+				"   },\n" +
+				"   {\n" +
+				"      \"url\":\"https://api.github.com/repos/spring-projects/spring-security/milestones/191\",\n" +
+				"      \"html_url\":\"https://github.com/spring-projects/spring-security/milestone/191\",\n" +
+				"      \"labels_url\":\"https://api.github.com/repos/spring-projects/spring-security/milestones/191/labels\",\n" +
+				"      \"id\":5884208,\n" +
+				"      \"node_id\":\"MDk6TWlsZXN0b25lNTg4NDIwOA==\",\n" +
+				"      \"number\":191,\n" +
+				"      \"title\":\"5.5.0-RC1\",\n" +
+				"      \"description\":\"\",\n" +
+				"      \"creator\":{\n" +
+				"         \"login\":\"jzheaux\",\n" +
+				"         \"id\":3627351,\n" +
+				"         \"node_id\":\"MDQ6VXNlcjM2MjczNTE=\",\n" +
+				"         \"avatar_url\":\"https://avatars.githubusercontent.com/u/3627351?v=4\",\n" +
+				"         \"gravatar_id\":\"\",\n" +
+				"         \"url\":\"https://api.github.com/users/jzheaux\",\n" +
+				"         \"html_url\":\"https://github.com/jzheaux\",\n" +
+				"         \"followers_url\":\"https://api.github.com/users/jzheaux/followers\",\n" +
+				"         \"following_url\":\"https://api.github.com/users/jzheaux/following{/other_user}\",\n" +
+				"         \"gists_url\":\"https://api.github.com/users/jzheaux/gists{/gist_id}\",\n" +
+				"         \"starred_url\":\"https://api.github.com/users/jzheaux/starred{/owner}{/repo}\",\n" +
+				"         \"subscriptions_url\":\"https://api.github.com/users/jzheaux/subscriptions\",\n" +
+				"         \"organizations_url\":\"https://api.github.com/users/jzheaux/orgs\",\n" +
+				"         \"repos_url\":\"https://api.github.com/users/jzheaux/repos\",\n" +
+				"         \"events_url\":\"https://api.github.com/users/jzheaux/events{/privacy}\",\n" +
+				"         \"received_events_url\":\"https://api.github.com/users/jzheaux/received_events\",\n" +
+				"         \"type\":\"User\",\n" +
+				"         \"site_admin\":false\n" +
+				"      },\n" +
+				"      \"open_issues\":21,\n" +
+				"      \"closed_issues\":23,\n" +
+				"      \"state\":\"open\",\n" +
+				"      \"created_at\":\"2020-09-16T13:28:03Z\",\n" +
+				"      \"updated_at\":\"2021-04-06T23:47:10Z\",\n" +
+				"      \"due_on\":null,\n" +
+				"      \"closed_at\":null\n" +
+				"   }\n" +
+				"]";
+		this.server.enqueue(new MockResponse().setBody(responseJson));
+
+		boolean dueToday = this.github.isMilestoneDueToday(this.repositoryRef, "5.5.0-RC1");
+
+		RecordedRequest recordedRequest = this.server.takeRequest(1, TimeUnit.SECONDS);
+		assertThat(recordedRequest.getMethod()).isEqualToIgnoringCase("get");
+		assertThat(recordedRequest.getRequestUrl().toString()).isEqualTo(this.baseUrl + "/repos/spring-projects/spring-security/milestones?per_page=100");
+
+		assertThat(dueToday).isFalse();
+	}
+
+	@Test
+	public void isMilestoneDueTodayWhenDueDateInFutureThenFalse() throws Exception {
+		String responseJson = "[\n" +
+				"   {\n" +
+				"      \"url\":\"https://api.github.com/repos/spring-projects/spring-security/milestones/207\",\n" +
+				"      \"html_url\":\"https://github.com/spring-projects/spring-security/milestone/207\",\n" +
+				"      \"labels_url\":\"https://api.github.com/repos/spring-projects/spring-security/milestones/207/labels\",\n" +
+				"      \"id\":6611880,\n" +
+				"      \"node_id\":\"MDk6TWlsZXN0b25lNjYxMTg4MA==\",\n" +
+				"      \"number\":207,\n" +
+				"      \"title\":\"5.6.x\",\n" +
+				"      \"description\":\"\",\n" +
+				"      \"creator\":{\n" +
+				"         \"login\":\"jgrandja\",\n" +
+				"         \"id\":10884212,\n" +
+				"         \"node_id\":\"MDQ6VXNlcjEwODg0MjEy\",\n" +
+				"         \"avatar_url\":\"https://avatars.githubusercontent.com/u/10884212?v=4\",\n" +
+				"         \"gravatar_id\":\"\",\n" +
+				"         \"url\":\"https://api.github.com/users/jgrandja\",\n" +
+				"         \"html_url\":\"https://github.com/jgrandja\",\n" +
+				"         \"followers_url\":\"https://api.github.com/users/jgrandja/followers\",\n" +
+				"         \"following_url\":\"https://api.github.com/users/jgrandja/following{/other_user}\",\n" +
+				"         \"gists_url\":\"https://api.github.com/users/jgrandja/gists{/gist_id}\",\n" +
+				"         \"starred_url\":\"https://api.github.com/users/jgrandja/starred{/owner}{/repo}\",\n" +
+				"         \"subscriptions_url\":\"https://api.github.com/users/jgrandja/subscriptions\",\n" +
+				"         \"organizations_url\":\"https://api.github.com/users/jgrandja/orgs\",\n" +
+				"         \"repos_url\":\"https://api.github.com/users/jgrandja/repos\",\n" +
+				"         \"events_url\":\"https://api.github.com/users/jgrandja/events{/privacy}\",\n" +
+				"         \"received_events_url\":\"https://api.github.com/users/jgrandja/received_events\",\n" +
+				"         \"type\":\"User\",\n" +
+				"         \"site_admin\":false\n" +
+				"      },\n" +
+				"      \"open_issues\":1,\n" +
+				"      \"closed_issues\":0,\n" +
+				"      \"state\":\"open\",\n" +
+				"      \"created_at\":\"2021-03-31T11:29:17Z\",\n" +
+				"      \"updated_at\":\"2021-03-31T11:30:47Z\",\n" +
+				"      \"due_on\":null,\n" +
+				"      \"closed_at\":null\n" +
+				"   },\n" +
+				"   {\n" +
+				"      \"url\":\"https://api.github.com/repos/spring-projects/spring-security/milestones/191\",\n" +
+				"      \"html_url\":\"https://github.com/spring-projects/spring-security/milestone/191\",\n" +
+				"      \"labels_url\":\"https://api.github.com/repos/spring-projects/spring-security/milestones/191/labels\",\n" +
+				"      \"id\":5884208,\n" +
+				"      \"node_id\":\"MDk6TWlsZXN0b25lNTg4NDIwOA==\",\n" +
+				"      \"number\":191,\n" +
+				"      \"title\":\"5.5.0-RC1\",\n" +
+				"      \"description\":\"\",\n" +
+				"      \"creator\":{\n" +
+				"         \"login\":\"jzheaux\",\n" +
+				"         \"id\":3627351,\n" +
+				"         \"node_id\":\"MDQ6VXNlcjM2MjczNTE=\",\n" +
+				"         \"avatar_url\":\"https://avatars.githubusercontent.com/u/3627351?v=4\",\n" +
+				"         \"gravatar_id\":\"\",\n" +
+				"         \"url\":\"https://api.github.com/users/jzheaux\",\n" +
+				"         \"html_url\":\"https://github.com/jzheaux\",\n" +
+				"         \"followers_url\":\"https://api.github.com/users/jzheaux/followers\",\n" +
+				"         \"following_url\":\"https://api.github.com/users/jzheaux/following{/other_user}\",\n" +
+				"         \"gists_url\":\"https://api.github.com/users/jzheaux/gists{/gist_id}\",\n" +
+				"         \"starred_url\":\"https://api.github.com/users/jzheaux/starred{/owner}{/repo}\",\n" +
+				"         \"subscriptions_url\":\"https://api.github.com/users/jzheaux/subscriptions\",\n" +
+				"         \"organizations_url\":\"https://api.github.com/users/jzheaux/orgs\",\n" +
+				"         \"repos_url\":\"https://api.github.com/users/jzheaux/repos\",\n" +
+				"         \"events_url\":\"https://api.github.com/users/jzheaux/events{/privacy}\",\n" +
+				"         \"received_events_url\":\"https://api.github.com/users/jzheaux/received_events\",\n" +
+				"         \"type\":\"User\",\n" +
+				"         \"site_admin\":false\n" +
+				"      },\n" +
+				"      \"open_issues\":21,\n" +
+				"      \"closed_issues\":23,\n" +
+				"      \"state\":\"open\",\n" +
+				"      \"created_at\":\"2020-09-16T13:28:03Z\",\n" +
+				"      \"updated_at\":\"2021-04-06T23:47:10Z\",\n" +
+				"      \"due_on\":\"3000-04-12T07:00:00Z\",\n" +
+				"      \"closed_at\":null\n" +
+				"   }\n" +
+				"]";
+		this.server.enqueue(new MockResponse().setBody(responseJson));
+
+		boolean dueToday = this.github.isMilestoneDueToday(this.repositoryRef, "5.5.0-RC1");
+
+		RecordedRequest recordedRequest = this.server.takeRequest(1, TimeUnit.SECONDS);
+		assertThat(recordedRequest.getMethod()).isEqualToIgnoringCase("get");
+		assertThat(recordedRequest.getRequestUrl().toString()).isEqualTo(this.baseUrl + "/repos/spring-projects/spring-security/milestones?per_page=100");
+
+		assertThat(dueToday).isFalse();
+	}
+
+	@Test
+	public void calculateNextReleaseMilestoneWhenCurrentVersionIsNotSnapshotThenException() {
+		assertThatExceptionOfType(RuntimeException.class)
+				.isThrownBy(() -> this.github.getNextReleaseMilestone(this.repositoryRef, "5.5.0-RC1"));
+	}
+
+	@Test
+	public void calculateNextReleaseMilestoneWhenPatchSegmentGreaterThan0ThenReturnsVersionWithoutSnapshot() {
+		String nextVersion = this.github.getNextReleaseMilestone(this.repositoryRef, "5.5.1-SNAPSHOT");
+
+		assertThat(nextVersion).isEqualTo("5.5.1");
+	}
+
+	@Test
+	public void calculateNextReleaseMilestoneWhenMilestoneAndRcExistThenReturnsMilestone() throws Exception {
+		String responseJson = "[\n" +
+				"   {\n" +
+				"      \"url\":\"https://api.github.com/repos/spring-projects/spring-security/milestones/207\",\n" +
+				"      \"html_url\":\"https://github.com/spring-projects/spring-security/milestone/207\",\n" +
+				"      \"labels_url\":\"https://api.github.com/repos/spring-projects/spring-security/milestones/207/labels\",\n" +
+				"      \"id\":6611880,\n" +
+				"      \"node_id\":\"MDk6TWlsZXN0b25lNjYxMTg4MA==\",\n" +
+				"      \"number\":207,\n" +
+				"      \"title\":\"5.5.0-M1\",\n" +
+				"      \"description\":\"\",\n" +
+				"      \"creator\":{\n" +
+				"         \"login\":\"jgrandja\",\n" +
+				"         \"id\":10884212,\n" +
+				"         \"node_id\":\"MDQ6VXNlcjEwODg0MjEy\",\n" +
+				"         \"avatar_url\":\"https://avatars.githubusercontent.com/u/10884212?v=4\",\n" +
+				"         \"gravatar_id\":\"\",\n" +
+				"         \"url\":\"https://api.github.com/users/jgrandja\",\n" +
+				"         \"html_url\":\"https://github.com/jgrandja\",\n" +
+				"         \"followers_url\":\"https://api.github.com/users/jgrandja/followers\",\n" +
+				"         \"following_url\":\"https://api.github.com/users/jgrandja/following{/other_user}\",\n" +
+				"         \"gists_url\":\"https://api.github.com/users/jgrandja/gists{/gist_id}\",\n" +
+				"         \"starred_url\":\"https://api.github.com/users/jgrandja/starred{/owner}{/repo}\",\n" +
+				"         \"subscriptions_url\":\"https://api.github.com/users/jgrandja/subscriptions\",\n" +
+				"         \"organizations_url\":\"https://api.github.com/users/jgrandja/orgs\",\n" +
+				"         \"repos_url\":\"https://api.github.com/users/jgrandja/repos\",\n" +
+				"         \"events_url\":\"https://api.github.com/users/jgrandja/events{/privacy}\",\n" +
+				"         \"received_events_url\":\"https://api.github.com/users/jgrandja/received_events\",\n" +
+				"         \"type\":\"User\",\n" +
+				"         \"site_admin\":false\n" +
+				"      },\n" +
+				"      \"open_issues\":1,\n" +
+				"      \"closed_issues\":0,\n" +
+				"      \"state\":\"open\",\n" +
+				"      \"created_at\":\"2021-03-31T11:29:17Z\",\n" +
+				"      \"updated_at\":\"2021-03-31T11:30:47Z\",\n" +
+				"      \"due_on\":null,\n" +
+				"      \"closed_at\":null\n" +
+				"   },\n" +
+				"   {\n" +
+				"      \"url\":\"https://api.github.com/repos/spring-projects/spring-security/milestones/191\",\n" +
+				"      \"html_url\":\"https://github.com/spring-projects/spring-security/milestone/191\",\n" +
+				"      \"labels_url\":\"https://api.github.com/repos/spring-projects/spring-security/milestones/191/labels\",\n" +
+				"      \"id\":5884208,\n" +
+				"      \"node_id\":\"MDk6TWlsZXN0b25lNTg4NDIwOA==\",\n" +
+				"      \"number\":191,\n" +
+				"      \"title\":\"5.5.0-RC1\",\n" +
+				"      \"description\":\"\",\n" +
+				"      \"creator\":{\n" +
+				"         \"login\":\"jzheaux\",\n" +
+				"         \"id\":3627351,\n" +
+				"         \"node_id\":\"MDQ6VXNlcjM2MjczNTE=\",\n" +
+				"         \"avatar_url\":\"https://avatars.githubusercontent.com/u/3627351?v=4\",\n" +
+				"         \"gravatar_id\":\"\",\n" +
+				"         \"url\":\"https://api.github.com/users/jzheaux\",\n" +
+				"         \"html_url\":\"https://github.com/jzheaux\",\n" +
+				"         \"followers_url\":\"https://api.github.com/users/jzheaux/followers\",\n" +
+				"         \"following_url\":\"https://api.github.com/users/jzheaux/following{/other_user}\",\n" +
+				"         \"gists_url\":\"https://api.github.com/users/jzheaux/gists{/gist_id}\",\n" +
+				"         \"starred_url\":\"https://api.github.com/users/jzheaux/starred{/owner}{/repo}\",\n" +
+				"         \"subscriptions_url\":\"https://api.github.com/users/jzheaux/subscriptions\",\n" +
+				"         \"organizations_url\":\"https://api.github.com/users/jzheaux/orgs\",\n" +
+				"         \"repos_url\":\"https://api.github.com/users/jzheaux/repos\",\n" +
+				"         \"events_url\":\"https://api.github.com/users/jzheaux/events{/privacy}\",\n" +
+				"         \"received_events_url\":\"https://api.github.com/users/jzheaux/received_events\",\n" +
+				"         \"type\":\"User\",\n" +
+				"         \"site_admin\":false\n" +
+				"      },\n" +
+				"      \"open_issues\":21,\n" +
+				"      \"closed_issues\":23,\n" +
+				"      \"state\":\"open\",\n" +
+				"      \"created_at\":\"2020-09-16T13:28:03Z\",\n" +
+				"      \"updated_at\":\"2021-04-06T23:47:10Z\",\n" +
+				"      \"due_on\":\"3000-04-12T07:00:00Z\",\n" +
+				"      \"closed_at\":null\n" +
+				"   }\n" +
+				"]";
+		this.server.enqueue(new MockResponse().setBody(responseJson));
+
+		String nextVersion = this.github.getNextReleaseMilestone(this.repositoryRef, "5.5.0-SNAPSHOT");
+
+		RecordedRequest recordedRequest = this.server.takeRequest(1, TimeUnit.SECONDS);
+		assertThat(recordedRequest.getMethod()).isEqualToIgnoringCase("get");
+		assertThat(recordedRequest.getRequestUrl().toString()).isEqualTo(this.baseUrl + "/repos/spring-projects/spring-security/milestones?per_page=100");
+
+		assertThat(nextVersion).isEqualTo("5.5.0-M1");
+	}
+
+	@Test
+	public void calculateNextReleaseMilestoneWhenTwoMilestonesExistThenReturnsSmallerMilestone() throws Exception {
+		String responseJson = "[\n" +
+				"   {\n" +
+				"      \"url\":\"https://api.github.com/repos/spring-projects/spring-security/milestones/207\",\n" +
+				"      \"html_url\":\"https://github.com/spring-projects/spring-security/milestone/207\",\n" +
+				"      \"labels_url\":\"https://api.github.com/repos/spring-projects/spring-security/milestones/207/labels\",\n" +
+				"      \"id\":6611880,\n" +
+				"      \"node_id\":\"MDk6TWlsZXN0b25lNjYxMTg4MA==\",\n" +
+				"      \"number\":207,\n" +
+				"      \"title\":\"5.5.0-M9\",\n" +
+				"      \"description\":\"\",\n" +
+				"      \"creator\":{\n" +
+				"         \"login\":\"jgrandja\",\n" +
+				"         \"id\":10884212,\n" +
+				"         \"node_id\":\"MDQ6VXNlcjEwODg0MjEy\",\n" +
+				"         \"avatar_url\":\"https://avatars.githubusercontent.com/u/10884212?v=4\",\n" +
+				"         \"gravatar_id\":\"\",\n" +
+				"         \"url\":\"https://api.github.com/users/jgrandja\",\n" +
+				"         \"html_url\":\"https://github.com/jgrandja\",\n" +
+				"         \"followers_url\":\"https://api.github.com/users/jgrandja/followers\",\n" +
+				"         \"following_url\":\"https://api.github.com/users/jgrandja/following{/other_user}\",\n" +
+				"         \"gists_url\":\"https://api.github.com/users/jgrandja/gists{/gist_id}\",\n" +
+				"         \"starred_url\":\"https://api.github.com/users/jgrandja/starred{/owner}{/repo}\",\n" +
+				"         \"subscriptions_url\":\"https://api.github.com/users/jgrandja/subscriptions\",\n" +
+				"         \"organizations_url\":\"https://api.github.com/users/jgrandja/orgs\",\n" +
+				"         \"repos_url\":\"https://api.github.com/users/jgrandja/repos\",\n" +
+				"         \"events_url\":\"https://api.github.com/users/jgrandja/events{/privacy}\",\n" +
+				"         \"received_events_url\":\"https://api.github.com/users/jgrandja/received_events\",\n" +
+				"         \"type\":\"User\",\n" +
+				"         \"site_admin\":false\n" +
+				"      },\n" +
+				"      \"open_issues\":1,\n" +
+				"      \"closed_issues\":0,\n" +
+				"      \"state\":\"open\",\n" +
+				"      \"created_at\":\"2021-03-31T11:29:17Z\",\n" +
+				"      \"updated_at\":\"2021-03-31T11:30:47Z\",\n" +
+				"      \"due_on\":null,\n" +
+				"      \"closed_at\":null\n" +
+				"   },\n" +
+				"   {\n" +
+				"      \"url\":\"https://api.github.com/repos/spring-projects/spring-security/milestones/191\",\n" +
+				"      \"html_url\":\"https://github.com/spring-projects/spring-security/milestone/191\",\n" +
+				"      \"labels_url\":\"https://api.github.com/repos/spring-projects/spring-security/milestones/191/labels\",\n" +
+				"      \"id\":5884208,\n" +
+				"      \"node_id\":\"MDk6TWlsZXN0b25lNTg4NDIwOA==\",\n" +
+				"      \"number\":191,\n" +
+				"      \"title\":\"5.5.0-M10\",\n" +
+				"      \"description\":\"\",\n" +
+				"      \"creator\":{\n" +
+				"         \"login\":\"jzheaux\",\n" +
+				"         \"id\":3627351,\n" +
+				"         \"node_id\":\"MDQ6VXNlcjM2MjczNTE=\",\n" +
+				"         \"avatar_url\":\"https://avatars.githubusercontent.com/u/3627351?v=4\",\n" +
+				"         \"gravatar_id\":\"\",\n" +
+				"         \"url\":\"https://api.github.com/users/jzheaux\",\n" +
+				"         \"html_url\":\"https://github.com/jzheaux\",\n" +
+				"         \"followers_url\":\"https://api.github.com/users/jzheaux/followers\",\n" +
+				"         \"following_url\":\"https://api.github.com/users/jzheaux/following{/other_user}\",\n" +
+				"         \"gists_url\":\"https://api.github.com/users/jzheaux/gists{/gist_id}\",\n" +
+				"         \"starred_url\":\"https://api.github.com/users/jzheaux/starred{/owner}{/repo}\",\n" +
+				"         \"subscriptions_url\":\"https://api.github.com/users/jzheaux/subscriptions\",\n" +
+				"         \"organizations_url\":\"https://api.github.com/users/jzheaux/orgs\",\n" +
+				"         \"repos_url\":\"https://api.github.com/users/jzheaux/repos\",\n" +
+				"         \"events_url\":\"https://api.github.com/users/jzheaux/events{/privacy}\",\n" +
+				"         \"received_events_url\":\"https://api.github.com/users/jzheaux/received_events\",\n" +
+				"         \"type\":\"User\",\n" +
+				"         \"site_admin\":false\n" +
+				"      },\n" +
+				"      \"open_issues\":21,\n" +
+				"      \"closed_issues\":23,\n" +
+				"      \"state\":\"open\",\n" +
+				"      \"created_at\":\"2020-09-16T13:28:03Z\",\n" +
+				"      \"updated_at\":\"2021-04-06T23:47:10Z\",\n" +
+				"      \"due_on\":\"3000-04-12T07:00:00Z\",\n" +
+				"      \"closed_at\":null\n" +
+				"   }\n" +
+				"]";
+		this.server.enqueue(new MockResponse().setBody(responseJson));
+
+		String nextVersion = this.github.getNextReleaseMilestone(this.repositoryRef, "5.5.0-SNAPSHOT");
+
+		RecordedRequest recordedRequest = this.server.takeRequest(1, TimeUnit.SECONDS);
+		assertThat(recordedRequest.getMethod()).isEqualToIgnoringCase("get");
+		assertThat(recordedRequest.getRequestUrl().toString()).isEqualTo(this.baseUrl + "/repos/spring-projects/spring-security/milestones?per_page=100");
+
+		assertThat(nextVersion).isEqualTo("5.5.0-M9");
+	}
+
+	@Test
+	public void calculateNextReleaseMilestoneWhenTwoRcsExistThenReturnsSmallerRc() throws Exception {
+		String responseJson = "[\n" +
+				"   {\n" +
+				"      \"url\":\"https://api.github.com/repos/spring-projects/spring-security/milestones/207\",\n" +
+				"      \"html_url\":\"https://github.com/spring-projects/spring-security/milestone/207\",\n" +
+				"      \"labels_url\":\"https://api.github.com/repos/spring-projects/spring-security/milestones/207/labels\",\n" +
+				"      \"id\":6611880,\n" +
+				"      \"node_id\":\"MDk6TWlsZXN0b25lNjYxMTg4MA==\",\n" +
+				"      \"number\":207,\n" +
+				"      \"title\":\"5.5.0-RC9\",\n" +
+				"      \"description\":\"\",\n" +
+				"      \"creator\":{\n" +
+				"         \"login\":\"jgrandja\",\n" +
+				"         \"id\":10884212,\n" +
+				"         \"node_id\":\"MDQ6VXNlcjEwODg0MjEy\",\n" +
+				"         \"avatar_url\":\"https://avatars.githubusercontent.com/u/10884212?v=4\",\n" +
+				"         \"gravatar_id\":\"\",\n" +
+				"         \"url\":\"https://api.github.com/users/jgrandja\",\n" +
+				"         \"html_url\":\"https://github.com/jgrandja\",\n" +
+				"         \"followers_url\":\"https://api.github.com/users/jgrandja/followers\",\n" +
+				"         \"following_url\":\"https://api.github.com/users/jgrandja/following{/other_user}\",\n" +
+				"         \"gists_url\":\"https://api.github.com/users/jgrandja/gists{/gist_id}\",\n" +
+				"         \"starred_url\":\"https://api.github.com/users/jgrandja/starred{/owner}{/repo}\",\n" +
+				"         \"subscriptions_url\":\"https://api.github.com/users/jgrandja/subscriptions\",\n" +
+				"         \"organizations_url\":\"https://api.github.com/users/jgrandja/orgs\",\n" +
+				"         \"repos_url\":\"https://api.github.com/users/jgrandja/repos\",\n" +
+				"         \"events_url\":\"https://api.github.com/users/jgrandja/events{/privacy}\",\n" +
+				"         \"received_events_url\":\"https://api.github.com/users/jgrandja/received_events\",\n" +
+				"         \"type\":\"User\",\n" +
+				"         \"site_admin\":false\n" +
+				"      },\n" +
+				"      \"open_issues\":1,\n" +
+				"      \"closed_issues\":0,\n" +
+				"      \"state\":\"open\",\n" +
+				"      \"created_at\":\"2021-03-31T11:29:17Z\",\n" +
+				"      \"updated_at\":\"2021-03-31T11:30:47Z\",\n" +
+				"      \"due_on\":null,\n" +
+				"      \"closed_at\":null\n" +
+				"   },\n" +
+				"   {\n" +
+				"      \"url\":\"https://api.github.com/repos/spring-projects/spring-security/milestones/191\",\n" +
+				"      \"html_url\":\"https://github.com/spring-projects/spring-security/milestone/191\",\n" +
+				"      \"labels_url\":\"https://api.github.com/repos/spring-projects/spring-security/milestones/191/labels\",\n" +
+				"      \"id\":5884208,\n" +
+				"      \"node_id\":\"MDk6TWlsZXN0b25lNTg4NDIwOA==\",\n" +
+				"      \"number\":191,\n" +
+				"      \"title\":\"5.5.0-RC10\",\n" +
+				"      \"description\":\"\",\n" +
+				"      \"creator\":{\n" +
+				"         \"login\":\"jzheaux\",\n" +
+				"         \"id\":3627351,\n" +
+				"         \"node_id\":\"MDQ6VXNlcjM2MjczNTE=\",\n" +
+				"         \"avatar_url\":\"https://avatars.githubusercontent.com/u/3627351?v=4\",\n" +
+				"         \"gravatar_id\":\"\",\n" +
+				"         \"url\":\"https://api.github.com/users/jzheaux\",\n" +
+				"         \"html_url\":\"https://github.com/jzheaux\",\n" +
+				"         \"followers_url\":\"https://api.github.com/users/jzheaux/followers\",\n" +
+				"         \"following_url\":\"https://api.github.com/users/jzheaux/following{/other_user}\",\n" +
+				"         \"gists_url\":\"https://api.github.com/users/jzheaux/gists{/gist_id}\",\n" +
+				"         \"starred_url\":\"https://api.github.com/users/jzheaux/starred{/owner}{/repo}\",\n" +
+				"         \"subscriptions_url\":\"https://api.github.com/users/jzheaux/subscriptions\",\n" +
+				"         \"organizations_url\":\"https://api.github.com/users/jzheaux/orgs\",\n" +
+				"         \"repos_url\":\"https://api.github.com/users/jzheaux/repos\",\n" +
+				"         \"events_url\":\"https://api.github.com/users/jzheaux/events{/privacy}\",\n" +
+				"         \"received_events_url\":\"https://api.github.com/users/jzheaux/received_events\",\n" +
+				"         \"type\":\"User\",\n" +
+				"         \"site_admin\":false\n" +
+				"      },\n" +
+				"      \"open_issues\":21,\n" +
+				"      \"closed_issues\":23,\n" +
+				"      \"state\":\"open\",\n" +
+				"      \"created_at\":\"2020-09-16T13:28:03Z\",\n" +
+				"      \"updated_at\":\"2021-04-06T23:47:10Z\",\n" +
+				"      \"due_on\":\"3000-04-12T07:00:00Z\",\n" +
+				"      \"closed_at\":null\n" +
+				"   }\n" +
+				"]";
+		this.server.enqueue(new MockResponse().setBody(responseJson));
+
+		String nextVersion = this.github.getNextReleaseMilestone(this.repositoryRef, "5.5.0-SNAPSHOT");
+
+		RecordedRequest recordedRequest = this.server.takeRequest(1, TimeUnit.SECONDS);
+		assertThat(recordedRequest.getMethod()).isEqualToIgnoringCase("get");
+		assertThat(recordedRequest.getRequestUrl().toString()).isEqualTo(this.baseUrl + "/repos/spring-projects/spring-security/milestones?per_page=100");
+
+		assertThat(nextVersion).isEqualTo("5.5.0-RC9");
+	}
+
+	@Test
+	public void calculateNextReleaseMilestoneWhenNoPreReleaseThenReturnsVersionWithoutSnapshot() throws Exception {
+		String responseJson = "[\n" +
+				"   {\n" +
+				"      \"url\":\"https://api.github.com/repos/spring-projects/spring-security/milestones/207\",\n" +
+				"      \"html_url\":\"https://github.com/spring-projects/spring-security/milestone/207\",\n" +
+				"      \"labels_url\":\"https://api.github.com/repos/spring-projects/spring-security/milestones/207/labels\",\n" +
+				"      \"id\":6611880,\n" +
+				"      \"node_id\":\"MDk6TWlsZXN0b25lNjYxMTg4MA==\",\n" +
+				"      \"number\":207,\n" +
+				"      \"title\":\"5.6.x\",\n" +
+				"      \"description\":\"\",\n" +
+				"      \"creator\":{\n" +
+				"         \"login\":\"jgrandja\",\n" +
+				"         \"id\":10884212,\n" +
+				"         \"node_id\":\"MDQ6VXNlcjEwODg0MjEy\",\n" +
+				"         \"avatar_url\":\"https://avatars.githubusercontent.com/u/10884212?v=4\",\n" +
+				"         \"gravatar_id\":\"\",\n" +
+				"         \"url\":\"https://api.github.com/users/jgrandja\",\n" +
+				"         \"html_url\":\"https://github.com/jgrandja\",\n" +
+				"         \"followers_url\":\"https://api.github.com/users/jgrandja/followers\",\n" +
+				"         \"following_url\":\"https://api.github.com/users/jgrandja/following{/other_user}\",\n" +
+				"         \"gists_url\":\"https://api.github.com/users/jgrandja/gists{/gist_id}\",\n" +
+				"         \"starred_url\":\"https://api.github.com/users/jgrandja/starred{/owner}{/repo}\",\n" +
+				"         \"subscriptions_url\":\"https://api.github.com/users/jgrandja/subscriptions\",\n" +
+				"         \"organizations_url\":\"https://api.github.com/users/jgrandja/orgs\",\n" +
+				"         \"repos_url\":\"https://api.github.com/users/jgrandja/repos\",\n" +
+				"         \"events_url\":\"https://api.github.com/users/jgrandja/events{/privacy}\",\n" +
+				"         \"received_events_url\":\"https://api.github.com/users/jgrandja/received_events\",\n" +
+				"         \"type\":\"User\",\n" +
+				"         \"site_admin\":false\n" +
+				"      },\n" +
+				"      \"open_issues\":1,\n" +
+				"      \"closed_issues\":0,\n" +
+				"      \"state\":\"open\",\n" +
+				"      \"created_at\":\"2021-03-31T11:29:17Z\",\n" +
+				"      \"updated_at\":\"2021-03-31T11:30:47Z\",\n" +
+				"      \"due_on\":null,\n" +
+				"      \"closed_at\":null\n" +
+				"   },\n" +
+				"   {\n" +
+				"      \"url\":\"https://api.github.com/repos/spring-projects/spring-security/milestones/191\",\n" +
+				"      \"html_url\":\"https://github.com/spring-projects/spring-security/milestone/191\",\n" +
+				"      \"labels_url\":\"https://api.github.com/repos/spring-projects/spring-security/milestones/191/labels\",\n" +
+				"      \"id\":5884208,\n" +
+				"      \"node_id\":\"MDk6TWlsZXN0b25lNTg4NDIwOA==\",\n" +
+				"      \"number\":191,\n" +
+				"      \"title\":\"5.4.3\",\n" +
+				"      \"description\":\"\",\n" +
+				"      \"creator\":{\n" +
+				"         \"login\":\"jzheaux\",\n" +
+				"         \"id\":3627351,\n" +
+				"         \"node_id\":\"MDQ6VXNlcjM2MjczNTE=\",\n" +
+				"         \"avatar_url\":\"https://avatars.githubusercontent.com/u/3627351?v=4\",\n" +
+				"         \"gravatar_id\":\"\",\n" +
+				"         \"url\":\"https://api.github.com/users/jzheaux\",\n" +
+				"         \"html_url\":\"https://github.com/jzheaux\",\n" +
+				"         \"followers_url\":\"https://api.github.com/users/jzheaux/followers\",\n" +
+				"         \"following_url\":\"https://api.github.com/users/jzheaux/following{/other_user}\",\n" +
+				"         \"gists_url\":\"https://api.github.com/users/jzheaux/gists{/gist_id}\",\n" +
+				"         \"starred_url\":\"https://api.github.com/users/jzheaux/starred{/owner}{/repo}\",\n" +
+				"         \"subscriptions_url\":\"https://api.github.com/users/jzheaux/subscriptions\",\n" +
+				"         \"organizations_url\":\"https://api.github.com/users/jzheaux/orgs\",\n" +
+				"         \"repos_url\":\"https://api.github.com/users/jzheaux/repos\",\n" +
+				"         \"events_url\":\"https://api.github.com/users/jzheaux/events{/privacy}\",\n" +
+				"         \"received_events_url\":\"https://api.github.com/users/jzheaux/received_events\",\n" +
+				"         \"type\":\"User\",\n" +
+				"         \"site_admin\":false\n" +
+				"      },\n" +
+				"      \"open_issues\":21,\n" +
+				"      \"closed_issues\":23,\n" +
+				"      \"state\":\"open\",\n" +
+				"      \"created_at\":\"2020-09-16T13:28:03Z\",\n" +
+				"      \"updated_at\":\"2021-04-06T23:47:10Z\",\n" +
+				"      \"due_on\":\"2021-04-12T07:00:00Z\",\n" +
+				"      \"closed_at\":null\n" +
+				"   }\n" +
+				"]";
+		this.server.enqueue(new MockResponse().setBody(responseJson));
+
+		String nextVersion = this.github.getNextReleaseMilestone(this.repositoryRef, "5.5.0-SNAPSHOT");
+
+		RecordedRequest recordedRequest = this.server.takeRequest(1, TimeUnit.SECONDS);
+		assertThat(recordedRequest.getMethod()).isEqualToIgnoringCase("get");
+		assertThat(recordedRequest.getRequestUrl().toString()).isEqualTo(this.baseUrl + "/repos/spring-projects/spring-security/milestones?per_page=100");
+
+		assertThat(nextVersion).isEqualTo("5.5.0");
+	}
+
+	@Test
+	public void createMilestoneWhenValidParametersThenSuccess() throws Exception {
+		this.server.enqueue(new MockResponse().setResponseCode(204));
+		Milestone milestone = new Milestone();
+		milestone.setTitle("1.0.0");
+		milestone.setDueOn(LocalDate.of(2022, 5, 4).atTime(LocalTime.NOON));
+		this.github.createMilestone(this.repositoryRef, milestone);
+
+		RecordedRequest recordedRequest = this.server.takeRequest(1, TimeUnit.SECONDS);
+		assertThat(recordedRequest.getMethod()).isEqualToIgnoringCase("post");
+		assertThat(recordedRequest.getRequestUrl().toString())
+				.isEqualTo(this.baseUrl + "/repos/spring-projects/spring-security/milestones");
+		assertThat(recordedRequest.getBody().readString(Charset.defaultCharset()))
+				.isEqualTo("{\"title\":\"1.0.0\",\"due_on\":\"2022-05-04T12:00:00Z\"}");
+	}
+
+	@Test
+	public void createMilestoneWhenErrorResponseThenException() throws Exception {
+		this.server.enqueue(new MockResponse().setResponseCode(400));
+		assertThatExceptionOfType(RuntimeException.class)
+				.isThrownBy(() -> this.github.createMilestone(this.repositoryRef, new Milestone()));
+	}
+
 }

buildSrc/src/test/java/org/springframework/gradle/github/milestones/SpringReleaseTrainTests.java

@@ -0,0 +1,245 @@
+/*
+ * Copyright 2002-2022 the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.springframework.gradle.github.milestones;
+
+import java.time.LocalDate;
+import java.time.Year;
+import java.util.Map;
+
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.params.ParameterizedTest;
+import org.junit.jupiter.params.provider.CsvSource;
+
+import org.springframework.gradle.github.milestones.SpringReleaseTrainSpec.Train;
+
+import static org.assertj.core.api.Assertions.assertThat;
+
+/**
+ * @author Steve Riesenberg
+ */
+public class SpringReleaseTrainTests {
+	@ParameterizedTest
+	@CsvSource({
+			"2019-12-31, ONE, 2020",
+			"2020-01-01, ONE, 2020",
+			"2020-01-31, ONE, 2020",
+			"2020-02-01, TWO, 2020",
+			"2020-07-31, TWO, 2020",
+			"2020-08-01, ONE, 2021"
+	})
+	public void nextTrainWhenBoundaryConditionsThenSuccess(LocalDate startDate, Train expectedTrain, Year expectedYear) {
+		SpringReleaseTrainSpec releaseTrainSpec =
+				SpringReleaseTrainSpec.builder()
+						.nextTrain(startDate)
+						.version("1.0.0")
+						.weekOfMonth(2)
+						.dayOfWeek(2)
+						.build();
+		assertThat(releaseTrainSpec.getTrain()).isEqualTo(expectedTrain);
+		assertThat(releaseTrainSpec.getYear()).isEqualTo(expectedYear);
+	}
+
+	@Test
+	public void getTrainDatesWhenTrainOneIsSecondTuesdayOf2020ThenSuccess() {
+		SpringReleaseTrainSpec releaseTrainSpec =
+				SpringReleaseTrainSpec.builder()
+						.train(1)
+						.version("1.0.0")
+						.weekOfMonth(2)
+						.dayOfWeek(2)
+						.year(2020)
+						.build();
+
+		SpringReleaseTrain releaseTrain = new SpringReleaseTrain(releaseTrainSpec);
+		Map<String, LocalDate> trainDates = releaseTrain.getTrainDates();
+		assertThat(trainDates).hasSize(5);
+		assertThat(trainDates.get("1.0.0-M1")).isEqualTo(LocalDate.of(2020, 1, 14));
+		assertThat(trainDates.get("1.0.0-M2")).isEqualTo(LocalDate.of(2020, 2, 11));
+		assertThat(trainDates.get("1.0.0-M3")).isEqualTo(LocalDate.of(2020, 3, 10));
+		assertThat(trainDates.get("1.0.0-RC1")).isEqualTo(LocalDate.of(2020, 4, 14));
+		assertThat(trainDates.get("1.0.0")).isEqualTo(LocalDate.of(2020, 5, 12));
+	}
+
+	@Test
+	public void getTrainDatesWhenTrainTwoIsSecondTuesdayOf2020ThenSuccess() {
+		SpringReleaseTrainSpec releaseTrainSpec =
+				SpringReleaseTrainSpec.builder()
+						.train(2)
+						.version("1.0.0")
+						.weekOfMonth(2)
+						.dayOfWeek(2)
+						.year(2020)
+						.build();
+
+		SpringReleaseTrain releaseTrain = new SpringReleaseTrain(releaseTrainSpec);
+		Map<String, LocalDate> trainDates = releaseTrain.getTrainDates();
+		assertThat(trainDates).hasSize(5);
+		assertThat(trainDates.get("1.0.0-M1")).isEqualTo(LocalDate.of(2020, 7, 14));
+		assertThat(trainDates.get("1.0.0-M2")).isEqualTo(LocalDate.of(2020, 8, 11));
+		assertThat(trainDates.get("1.0.0-M3")).isEqualTo(LocalDate.of(2020, 9, 15));
+		assertThat(trainDates.get("1.0.0-RC1")).isEqualTo(LocalDate.of(2020, 10, 13));
+		assertThat(trainDates.get("1.0.0")).isEqualTo(LocalDate.of(2020, 11, 10));
+	}
+
+	@Test
+	public void getTrainDatesWhenTrainOneIsSecondTuesdayOf2022ThenSuccess() {
+		SpringReleaseTrainSpec releaseTrainSpec =
+				SpringReleaseTrainSpec.builder()
+						.train(1)
+						.version("1.0.0")
+						.weekOfMonth(2)
+						.dayOfWeek(2)
+						.year(2022)
+						.build();
+
+		SpringReleaseTrain releaseTrain = new SpringReleaseTrain(releaseTrainSpec);
+		Map<String, LocalDate> trainDates = releaseTrain.getTrainDates();
+		assertThat(trainDates).hasSize(5);
+		assertThat(trainDates.get("1.0.0-M1")).isEqualTo(LocalDate.of(2022, 1, 11));
+		assertThat(trainDates.get("1.0.0-M2")).isEqualTo(LocalDate.of(2022, 2, 15));
+		assertThat(trainDates.get("1.0.0-M3")).isEqualTo(LocalDate.of(2022, 3, 15));
+		assertThat(trainDates.get("1.0.0-RC1")).isEqualTo(LocalDate.of(2022, 4, 12));
+		assertThat(trainDates.get("1.0.0")).isEqualTo(LocalDate.of(2022, 5, 10));
+	}
+
+	@Test
+	public void getTrainDatesWhenTrainTwoIsSecondTuesdayOf2022ThenSuccess() {
+		SpringReleaseTrainSpec releaseTrainSpec =
+				SpringReleaseTrainSpec.builder()
+						.train(2)
+						.version("1.0.0")
+						.weekOfMonth(2)
+						.dayOfWeek(2)
+						.year(2022)
+						.build();
+
+		SpringReleaseTrain releaseTrain = new SpringReleaseTrain(releaseTrainSpec);
+		Map<String, LocalDate> trainDates = releaseTrain.getTrainDates();
+		assertThat(trainDates).hasSize(5);
+		assertThat(trainDates.get("1.0.0-M1")).isEqualTo(LocalDate.of(2022, 7, 12));
+		assertThat(trainDates.get("1.0.0-M2")).isEqualTo(LocalDate.of(2022, 8, 9));
+		assertThat(trainDates.get("1.0.0-M3")).isEqualTo(LocalDate.of(2022, 9, 13));
+		assertThat(trainDates.get("1.0.0-RC1")).isEqualTo(LocalDate.of(2022, 10, 11));
+		assertThat(trainDates.get("1.0.0")).isEqualTo(LocalDate.of(2022, 11, 15));
+	}
+
+	@Test
+	public void getTrainDatesWhenTrainOneIsThirdMondayOf2022ThenSuccess() {
+		SpringReleaseTrainSpec releaseTrainSpec =
+				SpringReleaseTrainSpec.builder()
+						.train(1)
+						.version("1.0.0")
+						.weekOfMonth(3)
+						.dayOfWeek(1)
+						.year(2022)
+						.build();
+
+		SpringReleaseTrain releaseTrain = new SpringReleaseTrain(releaseTrainSpec);
+		Map<String, LocalDate> trainDates = releaseTrain.getTrainDates();
+		assertThat(trainDates).hasSize(5);
+		assertThat(trainDates.get("1.0.0-M1")).isEqualTo(LocalDate.of(2022, 1, 17));
+		assertThat(trainDates.get("1.0.0-M2")).isEqualTo(LocalDate.of(2022, 2, 21));
+		assertThat(trainDates.get("1.0.0-M3")).isEqualTo(LocalDate.of(2022, 3, 21));
+		assertThat(trainDates.get("1.0.0-RC1")).isEqualTo(LocalDate.of(2022, 4, 18));
+		assertThat(trainDates.get("1.0.0")).isEqualTo(LocalDate.of(2022, 5, 16));
+	}
+
+	@Test
+	public void getTrainDatesWhenTrainTwoIsThirdMondayOf2022ThenSuccess() {
+		SpringReleaseTrainSpec releaseTrainSpec =
+				SpringReleaseTrainSpec.builder()
+						.train(2)
+						.version("1.0.0")
+						.weekOfMonth(3)
+						.dayOfWeek(1)
+						.year(2022)
+						.build();
+
+		SpringReleaseTrain releaseTrain = new SpringReleaseTrain(releaseTrainSpec);
+		Map<String, LocalDate> trainDates = releaseTrain.getTrainDates();
+		assertThat(trainDates).hasSize(5);
+		assertThat(trainDates.get("1.0.0-M1")).isEqualTo(LocalDate.of(2022, 7, 18));
+		assertThat(trainDates.get("1.0.0-M2")).isEqualTo(LocalDate.of(2022, 8, 15));
+		assertThat(trainDates.get("1.0.0-M3")).isEqualTo(LocalDate.of(2022, 9, 19));
+		assertThat(trainDates.get("1.0.0-RC1")).isEqualTo(LocalDate.of(2022, 10, 17));
+		assertThat(trainDates.get("1.0.0")).isEqualTo(LocalDate.of(2022, 11, 21));
+	}
+
+	@Test
+	public void isTrainDateWhenTrainOneIsThirdMondayOf2022ThenSuccess() {
+		SpringReleaseTrainSpec releaseTrainSpec =
+				SpringReleaseTrainSpec.builder()
+						.train(1)
+						.version("1.0.0")
+						.weekOfMonth(3)
+						.dayOfWeek(1)
+						.year(2022)
+						.build();
+
+		SpringReleaseTrain releaseTrain = new SpringReleaseTrain(releaseTrainSpec);
+		for (int dayOfMonth = 1; dayOfMonth <= 31; dayOfMonth++) {
+			assertThat(releaseTrain.isTrainDate("1.0.0-M1", LocalDate.of(2022, 1, dayOfMonth))).isEqualTo(dayOfMonth == 17);
+		}
+		for (int dayOfMonth = 1; dayOfMonth <= 28; dayOfMonth++) {
+			assertThat(releaseTrain.isTrainDate("1.0.0-M2", LocalDate.of(2022, 2, dayOfMonth))).isEqualTo(dayOfMonth == 21);
+		}
+		for (int dayOfMonth = 1; dayOfMonth <= 31; dayOfMonth++) {
+			assertThat(releaseTrain.isTrainDate("1.0.0-M3", LocalDate.of(2022, 3, dayOfMonth))).isEqualTo(dayOfMonth == 21);
+		}
+		for (int dayOfMonth = 1; dayOfMonth <= 30; dayOfMonth++) {
+			assertThat(releaseTrain.isTrainDate("1.0.0-RC1", LocalDate.of(2022, 4, dayOfMonth))).isEqualTo(dayOfMonth == 18);
+		}
+		for (int dayOfMonth = 1; dayOfMonth <= 31; dayOfMonth++) {
+			assertThat(releaseTrain.isTrainDate("1.0.0", LocalDate.of(2022, 5, dayOfMonth))).isEqualTo(dayOfMonth == 16);
+		}
+	}
+
+	@ParameterizedTest
+	@CsvSource({
+			"2022-01-01, 2022-02-21",
+			"2022-02-01, 2022-02-21",
+			"2022-02-21, 2022-04-18",
+			"2022-03-01, 2022-04-18",
+			"2022-04-01, 2022-04-18",
+			"2022-04-18, 2022-06-20",
+			"2022-05-01, 2022-06-20",
+			"2022-06-01, 2022-06-20",
+			"2022-06-20, 2022-08-15",
+			"2022-07-01, 2022-08-15",
+			"2022-08-01, 2022-08-15",
+			"2022-08-15, 2022-10-17",
+			"2022-09-01, 2022-10-17",
+			"2022-10-01, 2022-10-17",
+			"2022-10-17, 2022-12-19",
+			"2022-11-01, 2022-12-19",
+			"2022-12-01, 2022-12-19",
+			"2022-12-19, 2023-02-20"
+	})
+	public void getNextReleaseDateWhenBoundaryConditionsThenSuccess(LocalDate startDate, LocalDate expectedDate) {
+		SpringReleaseTrainSpec releaseTrainSpec =
+				SpringReleaseTrainSpec.builder()
+						.train(1)
+						.version("1.0.0")
+						.weekOfMonth(3)
+						.dayOfWeek(1)
+						.year(2022)
+						.build();
+
+		SpringReleaseTrain releaseTrain = new SpringReleaseTrain(releaseTrainSpec);
+		assertThat(releaseTrain.getNextReleaseDate(startDate)).isEqualTo(expectedDate);
+	}
+}

buildSrc/src/test/java/org/springframework/gradle/github/release/GitHubActionsApiTests.java

@@ -0,0 +1,89 @@
+/*
+ * Copyright 2002-2022 the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.springframework.gradle.github.release;
+
+import java.nio.charset.Charset;
+import java.util.LinkedHashMap;
+import java.util.Map;
+import java.util.concurrent.TimeUnit;
+
+import okhttp3.mockwebserver.MockResponse;
+import okhttp3.mockwebserver.MockWebServer;
+import okhttp3.mockwebserver.RecordedRequest;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
+
+import org.springframework.gradle.github.RepositoryRef;
+
+import static org.assertj.core.api.Assertions.assertThat;
+import static org.assertj.core.api.Assertions.assertThatExceptionOfType;
+
+/**
+ * @author Steve Riesenberg
+ */
+public class GitHubActionsApiTests {
+	private GitHubActionsApi gitHubActionsApi;
+
+	private MockWebServer server;
+
+	private String baseUrl;
+
+	private RepositoryRef repository;
+
+	@BeforeEach
+	public void setup() throws Exception {
+		this.server = new MockWebServer();
+		this.server.start();
+		this.baseUrl = this.server.url("/api").toString();
+		this.gitHubActionsApi = new GitHubActionsApi("mock-oauth-token");
+		this.gitHubActionsApi.setBaseUrl(this.baseUrl);
+		this.repository = new RepositoryRef("spring-projects", "spring-security");
+	}
+
+	@AfterEach
+	public void cleanup() throws Exception {
+		this.server.shutdown();
+	}
+
+	@Test
+	public void dispatchWorkflowWhenValidParametersThenSuccess() throws Exception {
+		this.server.enqueue(new MockResponse().setResponseCode(204));
+
+		Map<String, Object> inputs = new LinkedHashMap<>();
+		inputs.put("input-1", "value");
+		inputs.put("input-2", false);
+		WorkflowDispatch workflowDispatch = new WorkflowDispatch("main", inputs);
+		this.gitHubActionsApi.dispatchWorkflow(this.repository, "test-workflow.yml", workflowDispatch);
+
+		RecordedRequest recordedRequest = this.server.takeRequest(1, TimeUnit.SECONDS);
+		assertThat(recordedRequest.getMethod()).isEqualToIgnoringCase("post");
+		assertThat(recordedRequest.getRequestUrl().toString())
+				.isEqualTo(this.baseUrl + "/repos/spring-projects/spring-security/actions/workflows/test-workflow.yml/dispatches");
+		assertThat(recordedRequest.getBody().readString(Charset.defaultCharset()))
+				.isEqualTo("{\"ref\":\"main\",\"inputs\":{\"input-1\":\"value\",\"input-2\":false}}");
+	}
+
+	@Test
+	public void dispatchWorkflowWhenErrorResponseThenException() throws Exception {
+		this.server.enqueue(new MockResponse().setResponseCode(400));
+
+		WorkflowDispatch workflowDispatch = new WorkflowDispatch("main", null);
+		assertThatExceptionOfType(RuntimeException.class)
+				.isThrownBy(() -> this.gitHubActionsApi.dispatchWorkflow(this.repository, "test-workflow.yml", workflowDispatch));
+	}
+}

buildSrc/src/test/java/org/springframework/gradle/github/release/GitHubReleaseApiTests.java

@@ -0,0 +1,155 @@
+/*
+ * Copyright 2002-2022 the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.springframework.gradle.github.release;
+
+import java.nio.charset.Charset;
+import java.util.concurrent.TimeUnit;
+
+import okhttp3.mockwebserver.MockResponse;
+import okhttp3.mockwebserver.MockWebServer;
+import okhttp3.mockwebserver.RecordedRequest;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
+
+import org.springframework.gradle.github.RepositoryRef;
+
+import static org.assertj.core.api.Assertions.assertThat;
+import static org.assertj.core.api.Assertions.assertThatExceptionOfType;
+
+/**
+ * @author Steve Riesenberg
+ */
+public class GitHubReleaseApiTests {
+	private GitHubReleaseApi gitHubReleaseApi;
+
+	private MockWebServer server;
+
+	private String baseUrl;
+
+	private RepositoryRef repository;
+
+	@BeforeEach
+	public void setup() throws Exception {
+		this.server = new MockWebServer();
+		this.server.start();
+		this.baseUrl = this.server.url("/api").toString();
+		this.gitHubReleaseApi = new GitHubReleaseApi("mock-oauth-token");
+		this.gitHubReleaseApi.setBaseUrl(this.baseUrl);
+		this.repository = new RepositoryRef("spring-projects", "spring-security");
+	}
+
+	@AfterEach
+	public void cleanup() throws Exception {
+		this.server.shutdown();
+	}
+
+	@Test
+	public void publishReleaseWhenValidParametersThenSuccess() throws Exception {
+		String responseJson = "{\n" +
+				"  \"url\": \"https://api.github.com/spring-projects/spring-security/releases/1\",\n" +
+				"  \"html_url\": \"https://github.com/spring-projects/spring-security/releases/tags/v1.0.0\",\n" +
+				"  \"assets_url\": \"https://api.github.com/spring-projects/spring-security/releases/1/assets\",\n" +
+				"  \"upload_url\": \"https://uploads.github.com/spring-projects/spring-security/releases/1/assets{?name,label}\",\n" +
+				"  \"tarball_url\": \"https://api.github.com/spring-projects/spring-security/tarball/v1.0.0\",\n" +
+				"  \"zipball_url\": \"https://api.github.com/spring-projects/spring-security/zipball/v1.0.0\",\n" +
+				"  \"discussion_url\": \"https://github.com/spring-projects/spring-security/discussions/90\",\n" +
+				"  \"id\": 1,\n" +
+				"  \"node_id\": \"MDc6UmVsZWFzZTE=\",\n" +
+				"  \"tag_name\": \"v1.0.0\",\n" +
+				"  \"target_commitish\": \"main\",\n" +
+				"  \"name\": \"v1.0.0\",\n" +
+				"  \"body\": \"Description of the release\",\n" +
+				"  \"draft\": false,\n" +
+				"  \"prerelease\": false,\n" +
+				"  \"created_at\": \"2013-02-27T19:35:32Z\",\n" +
+				"  \"published_at\": \"2013-02-27T19:35:32Z\",\n" +
+				"  \"author\": {\n" +
+				"    \"login\": \"sjohnr\",\n" +
+				"    \"id\": 1,\n" +
+				"    \"node_id\": \"MDQ6VXNlcjE=\",\n" +
+				"    \"avatar_url\": \"https://github.com/images/avatar.gif\",\n" +
+				"    \"gravatar_id\": \"\",\n" +
+				"    \"url\": \"https://api.github.com/users/sjohnr\",\n" +
+				"    \"html_url\": \"https://github.com/sjohnr\",\n" +
+				"    \"followers_url\": \"https://api.github.com/users/sjohnr/followers\",\n" +
+				"    \"following_url\": \"https://api.github.com/users/sjohnr/following{/other_user}\",\n" +
+				"    \"gists_url\": \"https://api.github.com/users/sjohnr/gists{/gist_id}\",\n" +
+				"    \"starred_url\": \"https://api.github.com/users/sjohnr/starred{/owner}{/repo}\",\n" +
+				"    \"subscriptions_url\": \"https://api.github.com/users/sjohnr/subscriptions\",\n" +
+				"    \"organizations_url\": \"https://api.github.com/users/sjohnr/orgs\",\n" +
+				"    \"repos_url\": \"https://api.github.com/users/sjohnr/repos\",\n" +
+				"    \"events_url\": \"https://api.github.com/users/sjohnr/events{/privacy}\",\n" +
+				"    \"received_events_url\": \"https://api.github.com/users/sjohnr/received_events\",\n" +
+				"    \"type\": \"User\",\n" +
+				"    \"site_admin\": false\n" +
+				"  },\n" +
+				"  \"assets\": [\n" +
+				"    {\n" +
+				"      \"url\": \"https://api.github.com/spring-projects/spring-security/releases/assets/1\",\n" +
+				"      \"browser_download_url\": \"https://github.com/spring-projects/spring-security/releases/download/v1.0.0/example.zip\",\n" +
+				"      \"id\": 1,\n" +
+				"      \"node_id\": \"MDEyOlJlbGVhc2VBc3NldDE=\",\n" +
+				"      \"name\": \"example.zip\",\n" +
+				"      \"label\": \"short description\",\n" +
+				"      \"state\": \"uploaded\",\n" +
+				"      \"content_type\": \"application/zip\",\n" +
+				"      \"size\": 1024,\n" +
+				"      \"download_count\": 42,\n" +
+				"      \"created_at\": \"2013-02-27T19:35:32Z\",\n" +
+				"      \"updated_at\": \"2013-02-27T19:35:32Z\",\n" +
+				"      \"uploader\": {\n" +
+				"        \"login\": \"sjohnr\",\n" +
+				"        \"id\": 1,\n" +
+				"        \"node_id\": \"MDQ6VXNlcjE=\",\n" +
+				"        \"avatar_url\": \"https://github.com/images/avatar.gif\",\n" +
+				"        \"gravatar_id\": \"\",\n" +
+				"        \"url\": \"https://api.github.com/users/sjohnr\",\n" +
+				"        \"html_url\": \"https://github.com/sjohnr\",\n" +
+				"        \"followers_url\": \"https://api.github.com/users/sjohnr/followers\",\n" +
+				"        \"following_url\": \"https://api.github.com/users/sjohnr/following{/other_user}\",\n" +
+				"        \"gists_url\": \"https://api.github.com/users/sjohnr/gists{/gist_id}\",\n" +
+				"        \"starred_url\": \"https://api.github.com/users/sjohnr/starred{/owner}{/repo}\",\n" +
+				"        \"subscriptions_url\": \"https://api.github.com/users/sjohnr/subscriptions\",\n" +
+				"        \"organizations_url\": \"https://api.github.com/users/sjohnr/orgs\",\n" +
+				"        \"repos_url\": \"https://api.github.com/users/sjohnr/repos\",\n" +
+				"        \"events_url\": \"https://api.github.com/users/sjohnr/events{/privacy}\",\n" +
+				"        \"received_events_url\": \"https://api.github.com/users/sjohnr/received_events\",\n" +
+				"        \"type\": \"User\",\n" +
+				"        \"site_admin\": false\n" +
+				"      }\n" +
+				"    }\n" +
+				"  ]\n" +
+				"}";
+		this.server.enqueue(new MockResponse().setBody(responseJson));
+		this.gitHubReleaseApi.publishRelease(this.repository, Release.tag("1.0.0").build());
+
+		RecordedRequest recordedRequest = this.server.takeRequest(1, TimeUnit.SECONDS);
+		assertThat(recordedRequest.getMethod()).isEqualToIgnoringCase("post");
+		assertThat(recordedRequest.getRequestUrl().toString())
+				.isEqualTo(this.baseUrl + "/repos/spring-projects/spring-security/releases");
+		assertThat(recordedRequest.getBody().readString(Charset.defaultCharset()))
+				.isEqualTo("{\"tag_name\":\"1.0.0\",\"draft\":false,\"prerelease\":false,\"generate_release_notes\":false}");
+	}
+
+	@Test
+	public void publishReleaseWhenErrorResponseThenException() throws Exception {
+		this.server.enqueue(new MockResponse().setResponseCode(400));
+		assertThatExceptionOfType(RuntimeException.class)
+				.isThrownBy(() -> this.gitHubReleaseApi.publishRelease(this.repository, Release.tag("1.0.0").build()));
+	}
+}

config/src/main/java/org/springframework/security/config/annotation/web/builders/HttpSecurity.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2002-2021 the original author or authors.
+ * Copyright 2002-2022 the original author or authors.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -3283,20 +3283,26 @@ public final class HttpSecurity extends AbstractConfiguredSecurityBuilder<Defaul
 	 */
 	public final class MvcMatchersRequestMatcherConfigurer extends RequestMatcherConfigurer {
 
+		private final List<MvcRequestMatcher> mvcMatchers;
+
 		/**
 		 * Creates a new instance
 		 * @param context the {@link ApplicationContext} to use
-		 * @param matchers the {@link MvcRequestMatcher} instances to set the servlet path
-		 * on if {@link #servletPath(String)} is set.
+		 * @param mvcMatchers the {@link MvcRequestMatcher} instances to set the servlet
+		 * path on if {@link #servletPath(String)} is set.
+		 * @param allMatchers the {@link RequestMatcher} instances to continue the
+		 * configuration
 		 */
-		private MvcMatchersRequestMatcherConfigurer(ApplicationContext context, List<MvcRequestMatcher> matchers) {
+		private MvcMatchersRequestMatcherConfigurer(ApplicationContext context, List<MvcRequestMatcher> mvcMatchers,
+				List<RequestMatcher> allMatchers) {
 			super(context);
-			this.matchers = new ArrayList<>(matchers);
+			this.mvcMatchers = new ArrayList<>(mvcMatchers);
+			this.matchers = allMatchers;
 		}
 
 		public RequestMatcherConfigurer servletPath(String servletPath) {
-			for (RequestMatcher matcher : this.matchers) {
-				((MvcRequestMatcher) matcher).setServletPath(servletPath);
+			for (MvcRequestMatcher matcher : this.mvcMatchers) {
+				matcher.setServletPath(servletPath);
 			}
 			return this;
 		}
@@ -3321,7 +3327,7 @@ public final class HttpSecurity extends AbstractConfiguredSecurityBuilder<Defaul
 		public MvcMatchersRequestMatcherConfigurer mvcMatchers(HttpMethod method, String... mvcPatterns) {
 			List<MvcRequestMatcher> mvcMatchers = createMvcMatchers(method, mvcPatterns);
 			setMatchers(mvcMatchers);
-			return new MvcMatchersRequestMatcherConfigurer(getContext(), mvcMatchers);
+			return new MvcMatchersRequestMatcherConfigurer(getContext(), mvcMatchers, this.matchers);
 		}
 
 		@Override

config/src/main/java/org/springframework/security/config/annotation/web/builders/WebSecurity.java

@@ -264,6 +264,7 @@ public final class WebSecurity extends AbstractConfiguredSecurityBuilder<Filter,
 	 * @deprecated Use {@link #privilegeEvaluator(WebInvocationPrivilegeEvaluator)}
 	 * instead
 	 */
+	@Deprecated
 	public WebSecurity securityInterceptor(FilterSecurityInterceptor securityInterceptor) {
 		this.filterSecurityInterceptor = securityInterceptor;
 		return this;
@@ -344,7 +345,10 @@ public final class WebSecurity extends AbstractConfiguredSecurityBuilder<Filter,
 			if (filter instanceof AuthorizationFilter) {
 				AuthorizationManager<HttpServletRequest> authorizationManager = ((AuthorizationFilter) filter)
 						.getAuthorizationManager();
-				privilegeEvaluators.add(new AuthorizationManagerWebInvocationPrivilegeEvaluator(authorizationManager));
+				AuthorizationManagerWebInvocationPrivilegeEvaluator evaluator = new AuthorizationManagerWebInvocationPrivilegeEvaluator(
+						authorizationManager);
+				evaluator.setServletContext(this.servletContext);
+				privilegeEvaluators.add(evaluator);
 			}
 		}
 		return new RequestMatcherEntry<>(securityFilterChain::matches, privilegeEvaluators);

config/src/test/java/org/springframework/security/config/annotation/web/configurers/ChannelSecurityConfigurerTests.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2002-2019 the original author or authors.
+ * Copyright 2002-2022 the original author or authors.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -21,17 +21,22 @@ import org.junit.jupiter.api.extension.ExtendWith;
 
 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.context.annotation.Bean;
+import org.springframework.core.Ordered;
+import org.springframework.core.annotation.Order;
 import org.springframework.security.config.annotation.ObjectPostProcessor;
 import org.springframework.security.config.annotation.web.builders.HttpSecurity;
 import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
 import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
 import org.springframework.security.config.test.SpringTestContext;
 import org.springframework.security.config.test.SpringTestContextExtension;
+import org.springframework.security.web.PortMapperImpl;
+import org.springframework.security.web.SecurityFilterChain;
 import org.springframework.security.web.access.channel.ChannelDecisionManagerImpl;
 import org.springframework.security.web.access.channel.ChannelProcessingFilter;
 import org.springframework.security.web.access.channel.InsecureChannelProcessor;
 import org.springframework.security.web.access.channel.SecureChannelProcessor;
 import org.springframework.test.web.servlet.MockMvc;
+import org.springframework.web.servlet.config.annotation.EnableWebMvc;
 
 import static org.mockito.ArgumentMatchers.any;
 import static org.mockito.Mockito.spy;
@@ -44,6 +49,7 @@ import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.
  *
  * @author Rob Winch
  * @author Eleftheria Stein
+ * @author Onur Kagan Ozcan
  */
 @ExtendWith(SpringTestContextExtension.class)
 public class ChannelSecurityConfigurerTests {
@@ -93,6 +99,24 @@ public class ChannelSecurityConfigurerTests {
 		this.mvc.perform(get("/")).andExpect(redirectedUrl("https://localhost/"));
 	}
 
+	// gh-10956
+	@Test
+	public void requestWhenRequiresChannelWithMultiMvcMatchersThenRedirectsToHttps() throws Exception {
+		this.spring.register(RequiresChannelMultiMvcMatchersConfig.class).autowire();
+		this.mvc.perform(get("/test-1")).andExpect(redirectedUrl("https://localhost/test-1"));
+		this.mvc.perform(get("/test-2")).andExpect(redirectedUrl("https://localhost/test-2"));
+		this.mvc.perform(get("/test-3")).andExpect(redirectedUrl("https://localhost/test-3"));
+	}
+
+	// gh-10956
+	@Test
+	public void requestWhenRequiresChannelWithMultiMvcMatchersInLambdaThenRedirectsToHttps() throws Exception {
+		this.spring.register(RequiresChannelMultiMvcMatchersInLambdaConfig.class).autowire();
+		this.mvc.perform(get("/test-1")).andExpect(redirectedUrl("https://localhost/test-1"));
+		this.mvc.perform(get("/test-2")).andExpect(redirectedUrl("https://localhost/test-2"));
+		this.mvc.perform(get("/test-3")).andExpect(redirectedUrl("https://localhost/test-3"));
+	}
+
 	@EnableWebSecurity
 	static class ObjectPostProcessorConfig extends WebSecurityConfigurerAdapter {
 
@@ -155,4 +179,59 @@ public class ChannelSecurityConfigurerTests {
 
 	}
 
+	@EnableWebSecurity
+	@EnableWebMvc
+	static class RequiresChannelMultiMvcMatchersConfig {
+
+		@Bean
+		@Order(Ordered.HIGHEST_PRECEDENCE)
+		SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
+			// @formatter:off
+			http
+				.portMapper()
+					.portMapper(new PortMapperImpl())
+					.and()
+				.requiresChannel()
+					.mvcMatchers("/test-1")
+						.requiresSecure()
+					.mvcMatchers("/test-2")
+						.requiresSecure()
+					.mvcMatchers("/test-3")
+						.requiresSecure()
+					.anyRequest()
+						.requiresInsecure();
+			// @formatter:on
+			return http.build();
+		}
+
+	}
+
+	@EnableWebSecurity
+	@EnableWebMvc
+	static class RequiresChannelMultiMvcMatchersInLambdaConfig {
+
+		@Bean
+		@Order(Ordered.HIGHEST_PRECEDENCE)
+		SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
+			// @formatter:off
+			http
+				.portMapper((port) -> port
+					.portMapper(new PortMapperImpl())
+				)
+				.requiresChannel((channel) -> channel
+					.mvcMatchers("/test-1")
+						.requiresSecure()
+					.mvcMatchers("/test-2")
+						.requiresSecure()
+					.mvcMatchers("/test-3")
+						.requiresSecure()
+					.anyRequest()
+						.requiresInsecure()
+				);
+			// @formatter:on
+			return http.build();
+		}
+
+	}
+
 }

config/src/test/java/org/springframework/security/config/annotation/web/configurers/HttpSecurityRequestMatchersTests.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2002-2019 the original author or authors.
+ * Copyright 2002-2022 the original author or authors.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -23,7 +23,10 @@ import org.junit.jupiter.api.BeforeEach;
 import org.junit.jupiter.api.Test;
 
 import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.context.annotation.Bean;
 import org.springframework.context.annotation.Configuration;
+import org.springframework.core.Ordered;
+import org.springframework.core.annotation.Order;
 import org.springframework.mock.web.MockFilterChain;
 import org.springframework.mock.web.MockHttpServletRequest;
 import org.springframework.mock.web.MockHttpServletResponse;
@@ -33,6 +36,7 @@ import org.springframework.security.config.annotation.web.builders.HttpSecurity;
 import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
 import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
 import org.springframework.security.web.FilterChainProxy;
+import org.springframework.security.web.SecurityFilterChain;
 import org.springframework.web.bind.annotation.RequestMapping;
 import org.springframework.web.bind.annotation.RestController;
 import org.springframework.web.context.support.AnnotationConfigWebApplicationContext;
@@ -167,6 +171,38 @@ public class HttpSecurityRequestMatchersTests {
 		assertThat(this.response.getStatus()).isEqualTo(HttpServletResponse.SC_OK);
 	}
 
+	@Test
+	public void requestMatcherWhenMultiMvcMatcherInLambdaThenAllPathsAreDenied() throws Exception {
+		loadConfig(MultiMvcMatcherInLambdaConfig.class);
+		this.request.setRequestURI("/test-1");
+		this.springSecurityFilterChain.doFilter(this.request, this.response, this.chain);
+		assertThat(this.response.getStatus()).isEqualTo(HttpServletResponse.SC_UNAUTHORIZED);
+		setup();
+		this.request.setRequestURI("/test-2");
+		this.springSecurityFilterChain.doFilter(this.request, this.response, this.chain);
+		assertThat(this.response.getStatus()).isEqualTo(HttpServletResponse.SC_UNAUTHORIZED);
+		setup();
+		this.request.setRequestURI("/test-3");
+		this.springSecurityFilterChain.doFilter(this.request, this.response, this.chain);
+		assertThat(this.response.getStatus()).isEqualTo(HttpServletResponse.SC_UNAUTHORIZED);
+	}
+
+	@Test
+	public void requestMatcherWhenMultiMvcMatcherThenAllPathsAreDenied() throws Exception {
+		loadConfig(MultiMvcMatcherConfig.class);
+		this.request.setRequestURI("/test-1");
+		this.springSecurityFilterChain.doFilter(this.request, this.response, this.chain);
+		assertThat(this.response.getStatus()).isEqualTo(HttpServletResponse.SC_UNAUTHORIZED);
+		setup();
+		this.request.setRequestURI("/test-2");
+		this.springSecurityFilterChain.doFilter(this.request, this.response, this.chain);
+		assertThat(this.response.getStatus()).isEqualTo(HttpServletResponse.SC_UNAUTHORIZED);
+		setup();
+		this.request.setRequestURI("/test-3");
+		this.springSecurityFilterChain.doFilter(this.request, this.response, this.chain);
+		assertThat(this.response.getStatus()).isEqualTo(HttpServletResponse.SC_UNAUTHORIZED);
+	}
+
 	public void loadConfig(Class<?>... configs) {
 		this.context = new AnnotationConfigWebApplicationContext();
 		this.context.register(configs);
@@ -175,6 +211,101 @@ public class HttpSecurityRequestMatchersTests {
 		this.context.getAutowireCapableBeanFactory().autowireBean(this);
 	}
 
+	@EnableWebSecurity
+	@Configuration
+	@EnableWebMvc
+	static class MultiMvcMatcherInLambdaConfig {
+
+		@Bean
+		@Order(Ordered.HIGHEST_PRECEDENCE)
+		SecurityFilterChain first(HttpSecurity http) throws Exception {
+			// @formatter:off
+			http
+				.requestMatchers((requests) -> requests
+					.mvcMatchers("/test-1")
+					.mvcMatchers("/test-2")
+					.mvcMatchers("/test-3")
+				)
+				.authorizeRequests((authorize) -> authorize.anyRequest().denyAll())
+				.httpBasic(withDefaults());
+			// @formatter:on
+			return http.build();
+		}
+
+		@Bean
+		SecurityFilterChain second(HttpSecurity http) throws Exception {
+			// @formatter:off
+			http
+				.requestMatchers((requests) -> requests
+					.mvcMatchers("/test-1")
+				)
+				.authorizeRequests((authorize) -> authorize
+					.anyRequest().permitAll()
+				);
+			// @formatter:on
+			return http.build();
+		}
+
+		@RestController
+		static class PathController {
+
+			@RequestMapping({ "/test-1", "/test-2", "/test-3" })
+			String path() {
+				return "path";
+			}
+
+		}
+
+	}
+
+	@EnableWebSecurity
+	@Configuration
+	@EnableWebMvc
+	static class MultiMvcMatcherConfig {
+
+		@Bean
+		@Order(Ordered.HIGHEST_PRECEDENCE)
+		SecurityFilterChain first(HttpSecurity http) throws Exception {
+			// @formatter:off
+			http
+				.requestMatchers()
+					.mvcMatchers("/test-1")
+					.mvcMatchers("/test-2")
+					.mvcMatchers("/test-3")
+					.and()
+				.authorizeRequests()
+					.anyRequest().denyAll()
+					.and()
+				.httpBasic(withDefaults());
+			// @formatter:on
+			return http.build();
+		}
+
+		@Bean
+		SecurityFilterChain second(HttpSecurity http) throws Exception {
+			// @formatter:off
+			http
+				.requestMatchers()
+					.mvcMatchers("/test-1")
+					.and()
+				.authorizeRequests()
+					.anyRequest().permitAll();
+			// @formatter:on
+			return http.build();
+		}
+
+		@RestController
+		static class PathController {
+
+			@RequestMapping({ "/test-1", "/test-2", "/test-3" })
+			String path() {
+				return "path";
+			}
+
+		}
+
+	}
+
 	@EnableWebSecurity
 	@Configuration
 	@EnableWebMvc

config/src/test/java/org/springframework/security/config/annotation/web/configurers/UrlAuthorizationConfigurerTests.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2002-2015 the original author or authors.
+ * Copyright 2002-2022 the original author or authors.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -16,6 +16,8 @@
 
 package org.springframework.security.config.annotation.web.configurers;
 
+import java.util.Base64;
+
 import javax.servlet.http.HttpServletResponse;
 
 import org.junit.jupiter.api.AfterEach;
@@ -23,16 +25,24 @@ import org.junit.jupiter.api.BeforeEach;
 import org.junit.jupiter.api.Test;
 
 import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.context.ApplicationContext;
+import org.springframework.context.annotation.Bean;
 import org.springframework.context.annotation.Configuration;
 import org.springframework.mock.web.MockFilterChain;
 import org.springframework.mock.web.MockHttpServletRequest;
 import org.springframework.mock.web.MockHttpServletResponse;
 import org.springframework.mock.web.MockServletContext;
+import org.springframework.security.config.Customizer;
 import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
 import org.springframework.security.config.annotation.web.builders.HttpSecurity;
 import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
 import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
+import org.springframework.security.core.userdetails.User;
+import org.springframework.security.core.userdetails.UserDetails;
+import org.springframework.security.core.userdetails.UserDetailsService;
+import org.springframework.security.provisioning.InMemoryUserDetailsManager;
 import org.springframework.security.web.FilterChainProxy;
+import org.springframework.security.web.SecurityFilterChain;
 import org.springframework.web.bind.annotation.RequestMapping;
 import org.springframework.web.bind.annotation.RestController;
 import org.springframework.web.context.support.AnnotationConfigWebApplicationContext;
@@ -125,6 +135,35 @@ public class UrlAuthorizationConfigurerTests {
 		loadConfig(AnonymousUrlAuthorizationConfig.class);
 	}
 
+	// gh-10956
+	@Test
+	public void multiMvcMatchersConfig() throws Exception {
+		loadConfig(MultiMvcMatcherConfig.class);
+		this.request.addHeader("Authorization",
+				"Basic " + new String(Base64.getEncoder().encode("user:password".getBytes())));
+		this.request.setRequestURI("/test-1");
+		this.springSecurityFilterChain.doFilter(this.request, this.response, this.chain);
+		assertThat(this.response.getStatus()).isEqualTo(HttpServletResponse.SC_FORBIDDEN);
+		setup();
+		this.request.addHeader("Authorization",
+				"Basic " + new String(Base64.getEncoder().encode("user:password".getBytes())));
+		this.request.setRequestURI("/test-2");
+		this.springSecurityFilterChain.doFilter(this.request, this.response, this.chain);
+		assertThat(this.response.getStatus()).isEqualTo(HttpServletResponse.SC_FORBIDDEN);
+		setup();
+		this.request.addHeader("Authorization",
+				"Basic " + new String(Base64.getEncoder().encode("user:password".getBytes())));
+		this.request.setRequestURI("/test-3");
+		this.springSecurityFilterChain.doFilter(this.request, this.response, this.chain);
+		assertThat(this.response.getStatus()).isEqualTo(HttpServletResponse.SC_FORBIDDEN);
+		setup();
+		this.request.addHeader("Authorization",
+				"Basic " + new String(Base64.getEncoder().encode("user:password".getBytes())));
+		this.request.setRequestURI("/test-x");
+		this.springSecurityFilterChain.doFilter(this.request, this.response, this.chain);
+		assertThat(this.response.getStatus()).isEqualTo(HttpServletResponse.SC_OK);
+	}
+
 	public void loadConfig(Class<?>... configs) {
 		this.context = new AnnotationConfigWebApplicationContext();
 		this.context.register(configs);
@@ -228,4 +267,41 @@ public class UrlAuthorizationConfigurerTests {
 
 	}
 
+	@EnableWebSecurity
+	@EnableWebMvc
+	static class MultiMvcMatcherConfig {
+
+		@Bean
+		SecurityFilterChain security(HttpSecurity http, ApplicationContext context) throws Exception {
+			// @formatter:off
+			http
+					.httpBasic(Customizer.withDefaults())
+					.apply(new UrlAuthorizationConfigurer<>(context)).getRegistry()
+						.mvcMatchers("/test-1").hasRole("ADMIN")
+						.mvcMatchers("/test-2").hasRole("ADMIN")
+						.mvcMatchers("/test-3").hasRole("ADMIN")
+						.anyRequest().hasRole("USER");
+			// @formatter:on
+			return http.build();
+		}
+
+		@Bean
+		UserDetailsService userDetailsService() {
+			UserDetails user = User.withDefaultPasswordEncoder().username("user").password("password").roles("USER")
+					.build();
+			return new InMemoryUserDetailsManager(user);
+		}
+
+		@RestController
+		static class PathController {
+
+			@RequestMapping({ "/test-1", "/test-2", "/test-3", "/test-x" })
+			String path() {
+				return "path";
+			}
+
+		}
+
+	}
+
 }

crypto/src/main/java/org/springframework/security/crypto/bcrypt/BCrypt.java

@@ -526,35 +526,47 @@ public class BCrypt {
 	 * @param safety bit 16 is set when the safety measure is requested
 	 * @return an array containing the binary hashed password
 	 */
-	private byte[] crypt_raw(byte password[], byte salt[], int log_rounds, boolean sign_ext_bug, int safety) {
-		int rounds, i, j;
+	private byte[] crypt_raw(byte password[], byte salt[], int log_rounds, boolean sign_ext_bug, int safety,
+			boolean for_check) {
 		int cdata[] = bf_crypt_ciphertext.clone();
 		int clen = cdata.length;
-		byte ret[];
 
+		long rounds;
 		if (log_rounds < 4 || log_rounds > 31) {
-			throw new IllegalArgumentException("Bad number of rounds");
+			if (!for_check) {
+				throw new IllegalArgumentException("Bad number of rounds");
+			}
+			if (log_rounds != 0) {
+				throw new IllegalArgumentException("Bad number of rounds");
+			}
+			rounds = 0;
 		}
-		rounds = 1 << log_rounds;
+		else {
+			rounds = roundsForLogRounds(log_rounds);
+			if (rounds < 16 || rounds > 2147483648L) {
+				throw new IllegalArgumentException("Bad number of rounds");
+			}
+		}
+
 		if (salt.length != BCRYPT_SALT_LEN) {
 			throw new IllegalArgumentException("Bad salt length");
 		}
 
 		init_key();
 		ekskey(salt, password, sign_ext_bug, safety);
-		for (i = 0; i < rounds; i++) {
+		for (int i = 0; i < rounds; i++) {
 			key(password, sign_ext_bug, safety);
 			key(salt, false, safety);
 		}
 
-		for (i = 0; i < 64; i++) {
-			for (j = 0; j < (clen >> 1); j++) {
+		for (int i = 0; i < 64; i++) {
+			for (int j = 0; j < (clen >> 1); j++) {
 				encipher(cdata, j << 1);
 			}
 		}
 
-		ret = new byte[clen * 4];
-		for (i = 0, j = 0; i < clen; i++) {
+		byte[] ret = new byte[clen * 4];
+		for (int i = 0, j = 0; i < clen; i++) {
 			ret[j++] = (byte) ((cdata[i] >> 24) & 0xff);
 			ret[j++] = (byte) ((cdata[i] >> 16) & 0xff);
 			ret[j++] = (byte) ((cdata[i] >> 8) & 0xff);
@@ -563,6 +575,10 @@ public class BCrypt {
 		return ret;
 	}
 
+	private static String hashpwforcheck(byte[] passwordb, String salt) {
+		return hashpw(passwordb, salt, true);
+	}
+
 	/**
 	 * Hash a password using the OpenBSD bcrypt scheme
 	 * @param password the password to hash
@@ -584,6 +600,10 @@ public class BCrypt {
 	 * @return the hashed password
 	 */
 	public static String hashpw(byte passwordb[], String salt) {
+		return hashpw(passwordb, salt, false);
+	}
+
+	private static String hashpw(byte passwordb[], String salt, boolean for_check) {
 		BCrypt B;
 		String real_salt;
 		byte saltb[], hashed[];
@@ -633,7 +653,7 @@ public class BCrypt {
 		}
 
 		B = new BCrypt();
-		hashed = B.crypt_raw(passwordb, saltb, rounds, minor == 'x', minor == 'a' ? 0x10000 : 0);
+		hashed = B.crypt_raw(passwordb, saltb, rounds, minor == 'x', minor == 'a' ? 0x10000 : 0, for_check);
 
 		rs.append("$2");
 		if (minor >= 'a') {
@@ -740,7 +760,8 @@ public class BCrypt {
 	 * @return true if the passwords match, false otherwise
 	 */
 	public static boolean checkpw(String plaintext, String hashed) {
-		return equalsNoEarlyReturn(hashed, hashpw(plaintext, hashed));
+		byte[] passwordb = plaintext.getBytes(StandardCharsets.UTF_8);
+		return equalsNoEarlyReturn(hashed, hashpwforcheck(passwordb, hashed));
 	}
 
 	/**
@@ -751,7 +772,7 @@ public class BCrypt {
 	 * @since 5.3
 	 */
 	public static boolean checkpw(byte[] passwordb, String hashed) {
-		return equalsNoEarlyReturn(hashed, hashpw(passwordb, hashed));
+		return equalsNoEarlyReturn(hashed, hashpwforcheck(passwordb, hashed));
 	}
 
 	static boolean equalsNoEarlyReturn(String a, String b) {

crypto/src/test/java/org/springframework/security/crypto/bcrypt/BCryptPasswordEncoderTests.java

@@ -208,4 +208,18 @@ public class BCryptPasswordEncoderTests {
 		assertThatIllegalArgumentException().isThrownBy(() -> encoder.matches(null, "does-not-matter"));
 	}
 
+	@Test
+	public void upgradeWhenNoRoundsThenTrue() {
+		BCryptPasswordEncoder encoder = new BCryptPasswordEncoder();
+		assertThat(encoder.upgradeEncoding("$2a$00$9N8N35BVs5TLqGL3pspAte5OWWA2a2aZIs.EGp7At7txYakFERMue")).isTrue();
+	}
+
+	@Test
+	public void checkWhenNoRoundsThenTrue() {
+		BCryptPasswordEncoder encoder = new BCryptPasswordEncoder();
+		assertThat(encoder.matches("password", "$2a$00$9N8N35BVs5TLqGL3pspAte5OWWA2a2aZIs.EGp7At7txYakFERMue"))
+				.isTrue();
+		assertThat(encoder.matches("wrong", "$2a$00$9N8N35BVs5TLqGL3pspAte5OWWA2a2aZIs.EGp7At7txYakFERMue")).isFalse();
+	}
+
 }

crypto/src/test/java/org/springframework/security/crypto/bcrypt/BCryptTests.java

@@ -456,4 +456,11 @@ public class BCryptTests {
 		assertThat(BCrypt.equalsNoEarlyReturn("test", "pass")).isFalse();
 	}
 
+	@Test
+	public void checkpwWhenZeroRoundsThenMatches() {
+		String password = "$2a$00$9N8N35BVs5TLqGL3pspAte5OWWA2a2aZIs.EGp7At7txYakFERMue";
+		assertThat(BCrypt.checkpw("password", password)).isTrue();
+		assertThat(BCrypt.checkpw("wrong", password)).isFalse();
+	}
+
 }

data/src/main/java/org/springframework/security/data/repository/query/SecurityEvaluationContextExtension.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2002-2019 the original author or authors.
+ * Copyright 2002-2022 the original author or authors.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -17,7 +17,13 @@
 package org.springframework.security.data.repository.query;
 
 import org.springframework.data.spel.spi.EvaluationContextExtension;
+import org.springframework.security.access.PermissionEvaluator;
+import org.springframework.security.access.expression.DenyAllPermissionEvaluator;
 import org.springframework.security.access.expression.SecurityExpressionRoot;
+import org.springframework.security.access.hierarchicalroles.NullRoleHierarchy;
+import org.springframework.security.access.hierarchicalroles.RoleHierarchy;
+import org.springframework.security.authentication.AuthenticationTrustResolver;
+import org.springframework.security.authentication.AuthenticationTrustResolverImpl;
 import org.springframework.security.core.Authentication;
 import org.springframework.security.core.context.SecurityContext;
 import org.springframework.security.core.context.SecurityContextHolder;
@@ -77,12 +83,21 @@ import org.springframework.security.core.context.SecurityContextHolder;
  * it.
  *
  * @author Rob Winch
+ * @author Evgeniy Cheban
  * @since 4.0
  */
 public class SecurityEvaluationContextExtension implements EvaluationContextExtension {
 
 	private Authentication authentication;
 
+	private AuthenticationTrustResolver trustResolver = new AuthenticationTrustResolverImpl();
+
+	private RoleHierarchy roleHierarchy = new NullRoleHierarchy();
+
+	private PermissionEvaluator permissionEvaluator = new DenyAllPermissionEvaluator();
+
+	private String defaultRolePrefix = "ROLE_";
+
 	/**
 	 * Creates a new instance that uses the current {@link Authentication} found on the
 	 * {@link org.springframework.security.core.context.SecurityContextHolder}.
@@ -106,8 +121,13 @@ public class SecurityEvaluationContextExtension implements EvaluationContextExte
 	@Override
 	public SecurityExpressionRoot getRootObject() {
 		Authentication authentication = getAuthentication();
-		return new SecurityExpressionRoot(authentication) {
+		SecurityExpressionRoot root = new SecurityExpressionRoot(authentication) {
 		};
+		root.setTrustResolver(this.trustResolver);
+		root.setRoleHierarchy(this.roleHierarchy);
+		root.setPermissionEvaluator(this.permissionEvaluator);
+		root.setDefaultRolePrefix(this.defaultRolePrefix);
+		return root;
 	}
 
 	private Authentication getAuthentication() {

data/src/test/java/org/springframework/security/data/repository/query/SecurityEvaluationContextExtensionTests.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2002-2016 the original author or authors.
+ * Copyright 2002-2022 the original author or authors.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -20,7 +20,10 @@ import org.junit.jupiter.api.AfterEach;
 import org.junit.jupiter.api.BeforeEach;
 import org.junit.jupiter.api.Test;
 
+import org.springframework.security.access.expression.DenyAllPermissionEvaluator;
 import org.springframework.security.access.expression.SecurityExpressionRoot;
+import org.springframework.security.access.hierarchicalroles.NullRoleHierarchy;
+import org.springframework.security.authentication.AuthenticationTrustResolverImpl;
 import org.springframework.security.authentication.TestingAuthenticationToken;
 import org.springframework.security.core.context.SecurityContextHolder;
 
@@ -69,6 +72,17 @@ public class SecurityEvaluationContextExtensionTests {
 		assertThat(getRoot().getAuthentication()).isSameAs(explicit);
 	}
 
+	@Test
+	public void getRootObjectWhenAdditionalFieldsNotSetThenVerifyDefaults() {
+		TestingAuthenticationToken explicit = new TestingAuthenticationToken("explicit", "password", "ROLE_EXPLICIT");
+		this.securityExtension = new SecurityEvaluationContextExtension(explicit);
+		SecurityExpressionRoot root = getRoot();
+		assertThat(root).extracting("trustResolver").isInstanceOf(AuthenticationTrustResolverImpl.class);
+		assertThat(root).extracting("roleHierarchy").isInstanceOf(NullRoleHierarchy.class);
+		assertThat(root).extracting("permissionEvaluator").isInstanceOf(DenyAllPermissionEvaluator.class);
+		assertThat(root).extracting("defaultRolePrefix").isEqualTo("ROLE_");
+	}
+
 	private SecurityExpressionRoot getRoot() {
 		return this.securityExtension.getRootObject();
 	}

dependencies/spring-security-dependencies.gradle

@@ -8,15 +8,15 @@ javaPlatform {
 
 dependencies {
 	api platform("org.springframework:spring-framework-bom:$springFrameworkVersion")
-	api platform("io.projectreactor:reactor-bom:2020.0.16")
-	api platform("io.rsocket:rsocket-bom:1.1.1")
+	api platform("io.projectreactor:reactor-bom:2020.0.22")
+	api platform("io.rsocket:rsocket-bom:1.1.2")
 	api platform("org.junit:junit-bom:5.8.2")
-	api platform("org.springframework.data:spring-data-bom:2021.1.2")
+	api platform("org.springframework.data:spring-data-bom:2021.1.6")
 	api platform("org.jetbrains.kotlin:kotlin-bom:$kotlinVersion")
 	api platform("org.jetbrains.kotlinx:kotlinx-coroutines-bom:1.5.2")
-	api platform("com.fasterxml.jackson:jackson-bom:2.13.1")
+	api platform("com.fasterxml.jackson:jackson-bom:2.13.3")
 	constraints {
-		api "ch.qos.logback:logback-classic:1.2.10"
+		api "ch.qos.logback:logback-classic:1.2.11"
 		api "com.google.inject:guice:3.0"
 		api "com.nimbusds:nimbus-jose-jwt:9.14"
 		api "com.nimbusds:oauth2-oidc-sdk:9.19"
@@ -25,7 +25,7 @@ dependencies {
 		api "com.unboundid:unboundid-ldapsdk:4.0.14"
 		api "commons-codec:commons-codec:1.15"
 		api "commons-collections:commons-collections:3.2.2"
-		api "io.mockk:mockk:1.12.2"
+		api "io.mockk:mockk:1.12.4"
 		api "io.projectreactor.tools:blockhound:1.0.6.RELEASE"
 		api "jakarta.inject:jakarta.inject-api:1.0.5"
 		api "jakarta.annotation:jakarta.annotation-api:1.3.5"
@@ -50,11 +50,11 @@ dependencies {
 		api "org.assertj:assertj-core:3.21.0"
 		api "org.bouncycastle:bcpkix-jdk15on:1.69"
 		api "org.bouncycastle:bcprov-jdk15on:1.69"
-		api "org.eclipse.jetty:jetty-server:9.4.45.v20220203"
-		api "org.eclipse.jetty:jetty-servlet:9.4.45.v20220203"
+		api "org.eclipse.jetty:jetty-server:9.4.48.v20220622"
+		api "org.eclipse.jetty:jetty-servlet:9.4.48.v20220622"
 		api "org.eclipse.persistence:javax.persistence:2.2.1"
 		api "org.hamcrest:hamcrest:2.2"
-		api "org.hibernate:hibernate-entitymanager:5.6.5.Final"
+		api "org.hibernate:hibernate-entitymanager:5.6.10.Final"
 		api "org.hsqldb:hsqldb:2.6.1"
 		api "org.jasig.cas.client:cas-client-core:3.6.4"
 		api "org.mockito:mockito-core:3.12.4"
@@ -68,10 +68,10 @@ dependencies {
 		api "org.seleniumhq.selenium:htmlunit-driver:2.54.0"
 		api "org.seleniumhq.selenium:selenium-java:3.141.59"
 		api "org.seleniumhq.selenium:selenium-support:3.141.59"
-		api "org.skyscreamer:jsonassert:1.5.0"
+		api "org.skyscreamer:jsonassert:1.5.1"
 		api "org.slf4j:log4j-over-slf4j:1.7.36"
 		api "org.slf4j:slf4j-api:1.7.36"
-		api "org.springframework.ldap:spring-ldap-core:2.3.6.RELEASE"
+		api "org.springframework.ldap:spring-ldap-core:2.3.8.RELEASE"
 		api "org.synchronoss.cloud:nio-multipart-parser:1.1.0"
 	}
 }

docs/antora.yml

@@ -1,2 +1,2 @@
-name: ROOT
-version: '5.6.2'
+'name': 'ROOT'
+'version': '5.6.7'

docs/modules/ROOT/pages/features/authentication/password-storage.adoc

@@ -495,7 +495,7 @@ XML Configuration requires the `NoOpPasswordEncoder` bean name to be `passwordEn
 
 Most applications that allow a user to specify a password also require a feature for updating that password.
 
-https://w3c.github.io/webappsec-change-password-url/[A Well-Know URL for Changing Passwords] indicates a mechanism by which password managers can discover the password update endpoint for a given application.
+https://w3c.github.io/webappsec-change-password-url/[A Well-Known URL for Changing Passwords] indicates a mechanism by which password managers can discover the password update endpoint for a given application.
 
 You can configure Spring Security to provide this discovery endpoint.
 For example, if the change password endpoint in your application is `/change-password`, then you can configure Spring Security like so:

docs/modules/ROOT/pages/features/integrations/cryptography.adoc

@@ -198,10 +198,13 @@ The password package of the spring-security-crypto module provides support for e
 [source,java]
 ----
 public interface PasswordEncoder {
+	String encode(CharSequence rawPassword);
 
-String encode(String rawPassword);
+	boolean matches(CharSequence rawPassword, String encodedPassword);
 
-boolean matches(String rawPassword, String encodedPassword);
+	default boolean upgradeEncoding(String encodedPassword) {
+		return false;
+	}
 }
 ----
 

docs/modules/ROOT/pages/reactive/oauth2/resource-server/opaque-token.adoc

@@ -23,13 +23,14 @@ To specify where the introspection endpoint is, simply do:
 
 [source,yaml]
 ----
-security:
-  oauth2:
-    resourceserver:
-      opaque-token:
-        introspection-uri: https://idp.example.com/introspect
-        client-id: client
-        client-secret: secret
+spring:
+  security:
+    oauth2:
+      resourceserver:
+        opaque-token:
+          introspection-uri: https://idp.example.com/introspect
+          client-id: client
+          client-secret: secret
 ----
 
 Where `https://idp.example.com/introspect` is the introspection endpoint hosted by your authorization server and `client-id` and `client-secret` are the credentials needed to hit that endpoint.

docs/modules/ROOT/pages/reactive/test/method.adoc

@@ -8,7 +8,7 @@ Here is a minimal sample of what we can do:
 .Java
 [source,java,role="primary"]
 ----
-@RunWith(SpringRunner.class)
+@ExtendWith(SpringExtension.class)
 @ContextConfiguration(classes = HelloWebfluxMethodApplication.class)
 public class HelloWorldMessageServiceTests {
 	@Autowired
@@ -42,7 +42,7 @@ public class HelloWorldMessageServiceTests {
 .Kotlin
 [source,kotlin,role="secondary"]
 ----
-@RunWith(SpringRunner::class)
+@ExtendWith(SpringExtension.class)
 @ContextConfiguration(classes = [HelloWebfluxMethodApplication::class])
 class HelloWorldMessageServiceTests {
     @Autowired

docs/modules/ROOT/pages/reactive/test/web/setup.adoc

@@ -2,9 +2,11 @@
 
 The basic setup looks like this:
 
-[source,java]
+====
+.Java
+[source,java,role="primary"]
 ----
-@RunWith(SpringRunner.class)
+@ExtendWith(SpringExtension.class)
 @ContextConfiguration(classes = HelloWebfluxMethodApplication.class)
 public class HelloWebfluxMethodApplicationTests {
 	@Autowired
@@ -12,16 +14,42 @@ public class HelloWebfluxMethodApplicationTests {
 
 	WebTestClient rest;
 
-	@Before
+	@BeforeEach
 	public void setup() {
 		this.rest = WebTestClient
 			.bindToApplicationContext(this.context)
 			// add Spring Security test Support
 			.apply(springSecurity())
 			.configureClient()
-			.filter(basicAuthentication())
+			.filter(basicAuthentication("user", "password"))
 			.build();
 	}
 	// ...
 }
 ----
+
+.Kotlin
+[source,kotlin,role="secondary"]
+----
+@ExtendWith(SpringExtension::class)
+@ContextConfiguration(classes = [HelloWebfluxMethodApplication::class])
+class HelloWebfluxMethodApplicationTests {
+    @Autowired
+    lateinit var context: ApplicationContext
+
+    lateinit var rest: WebTestClient
+
+    @BeforeEach
+    fun setup() {
+        this.rest = WebTestClient
+            .bindToApplicationContext(this.context)
+            // add Spring Security test Support
+            .apply(springSecurity())
+            .configureClient()
+            .filter(basicAuthentication("user", "password"))
+            .build()
+    }
+    // ...
+}
+----
+====

docs/modules/ROOT/pages/servlet/authentication/architecture.adoc

@@ -19,8 +19,6 @@ This also gives a good idea of the high level flow of authentication and how pie
 [[servlet-authentication-securitycontextholder]]
 == SecurityContextHolder
 
-Hi {figures} there
-
 At the heart of Spring Security's authentication model is the `SecurityContextHolder`.
 It contains the <<servlet-authentication-securitycontext>>.
 

docs/modules/ROOT/pages/servlet/authorization/authorize-http-requests.adoc

@@ -69,7 +69,11 @@ SecurityFilterChain web(HttpSecurity http) throws Exception {
 		.authorizeHttpRequests(authorize -> authorize                                  // <1>
 			.mvcMatchers("/resources/**", "/signup", "/about").permitAll()         // <2>
 			.mvcMatchers("/admin/**").hasRole("ADMIN")                             // <3>
-			.mvcMatchers("/db/**").access("hasRole('ADMIN') and hasRole('DBA')")   // <4>
+			.mvcMatchers("/db/**").access((authentication, request) ->
+			    Optional.of(hasRole("ADMIN").check(authentication, request))
+			        .filter((decision) -> !decision.isGranted())
+			        .orElseGet(() -> hasRole("DBA").check(authentication, request));
+			)   // <4>
 			.anyRequest().denyAll()                                                // <5>
 		);
 

docs/modules/ROOT/pages/servlet/oauth2/resource-server/opaque-token.adoc

@@ -24,13 +24,14 @@ To specify where the introspection endpoint is, simply do:
 
 [source,yaml]
 ----
-security:
-  oauth2:
-    resourceserver:
-      opaque-token:
-        introspection-uri: https://idp.example.com/introspect
-        client-id: client
-        client-secret: secret
+spring:
+  security:
+    oauth2:
+      resourceserver:
+        opaque-token:
+          introspection-uri: https://idp.example.com/introspect
+          client-id: client
+          client-secret: secret
 ----
 
 Where `https://idp.example.com/introspect` is the introspection endpoint hosted by your authorization server and `client-id` and `client-secret` are the credentials needed to hit that endpoint.

docs/modules/ROOT/pages/servlet/saml2/login/authentication-requests.adoc

@@ -8,7 +8,7 @@ This filter by default responds to endpoint `+/saml2/authenticate/{registrationI
 
 For example, if you were deployed to `https://rp.example.com` and you gave your registration an ID of `okta`, you could navigate to:
 
-`https://rp.example.org/saml2/authenticate/ping`
+`https://rp.example.org/saml2/authenticate/okta`
 
 and the result would be a redirect that included a `SAMLRequest` parameter containing the signed, deflated, and encoded `<saml2:AuthnRequest>`.
 

docs/modules/ROOT/pages/servlet/test/method.adoc

@@ -49,7 +49,7 @@ Before we can use Spring Security Test support, we must perform some setup. An e
 .Java
 [source,java,role="primary"]
 ----
-@RunWith(SpringJUnit4ClassRunner.class) // <1>
+@ExtendWith(SpringExtension.class) // <1>
 @ContextConfiguration // <2>
 public class WithMockUserTests {
 ----
@@ -57,16 +57,15 @@ public class WithMockUserTests {
 .Kotlin
 [source,kotlin,role="secondary"]
 ----
-@RunWith(SpringJUnit4ClassRunner::class)
+@ExtendWith(SpringExtension.class)
 @ContextConfiguration
 class WithMockUserTests {
 ----
-====
 
 This is a basic example of how to setup Spring Security Test. The highlights are:
 
-<1> `@RunWith` instructs the spring-test module that it should create an `ApplicationContext`. This is no different than using the existing Spring Test support. For additional information, refer to the https://docs.spring.io/spring-framework/docs/4.0.x/spring-framework-reference/htmlsingle/#integration-testing-annotations-standard[Spring Reference]
-<2> `@ContextConfiguration` instructs the spring-test the configuration to use to create the `ApplicationContext`. Since no configuration is specified, the default configuration locations will be tried. This is no different than using the existing Spring Test support. For additional information, refer to the https://docs.spring.io/spring-framework/docs/4.0.x/spring-framework-reference/htmlsingle/#testcontext-ctx-management[Spring Reference]
+<1> `@ExtendWith` instructs the spring-test module that it should create an `ApplicationContext`. For additional information, refer to the {spring-framework-reference-url}testing.html#testcontext-junit-jupiter-extension[Spring reference].
+<2> `@ContextConfiguration` instructs the spring-test the configuration to use to create the `ApplicationContext`. Since no configuration is specified, the default configuration locations will be tried. This is no different than using the existing Spring Test support. For additional information, refer to the {spring-framework-reference-url}testing.html#spring-testing-annotation-contextconfiguration[Spring Reference]
 
 NOTE: Spring Security hooks into Spring Test support using the `WithSecurityContextTestExecutionListener` which will ensure our tests are ran with the correct user.
 It does this by populating the `SecurityContextHolder` prior to running our tests.
@@ -225,7 +224,7 @@ For example, the following would run every test with a user with the username "a
 .Java
 [source,java,role="primary"]
 ----
-@RunWith(SpringJUnit4ClassRunner.class)
+@ExtendWith(SpringExtension.class)
 @ContextConfiguration
 @WithMockUser(username="admin",roles={"USER","ADMIN"})
 public class WithMockUserTests {
@@ -234,7 +233,7 @@ public class WithMockUserTests {
 .Kotlin
 [source,kotlin,role="secondary"]
 ----
-@RunWith(SpringJUnit4ClassRunner::class)
+@ExtendWith(SpringExtension.class)
 @ContextConfiguration
 @WithMockUser(username="admin",roles=["USER","ADMIN"])
 class WithMockUserTests {
@@ -304,7 +303,7 @@ For example, the following will run withMockUser1 and withMockUser2 using <<test
 .Java
 [source,java,role="primary"]
 ----
-@RunWith(SpringJUnit4ClassRunner.class)
+@ExtendWith(SpringExtension.class)
 @WithMockUser
 public class WithUserClassLevelAuthenticationTests {
 
@@ -327,7 +326,7 @@ public class WithUserClassLevelAuthenticationTests {
 .Kotlin
 [source,kotlin,role="secondary"]
 ----
-@RunWith(SpringJUnit4ClassRunner::class)
+@ExtendWith(SpringExtension.class)
 @WithMockUser
 class WithUserClassLevelAuthenticationTests {
     @Test

docs/modules/ROOT/pages/servlet/test/mockmvc/setup.adoc

@@ -15,7 +15,7 @@ NOTE: Spring Security's testing support requires spring-test-4.1.3.RELEASE or gr
 
 import static org.springframework.security.test.web.servlet.setup.SecurityMockMvcConfigurers.*;
 
-@RunWith(SpringJUnit4ClassRunner.class)
+@ExtendWith(SpringExtension.class)
 @ContextConfiguration(classes = SecurityConfig.class)
 @WebAppConfiguration
 public class CsrfShowcaseTests {
@@ -25,7 +25,7 @@ public class CsrfShowcaseTests {
 
 	private MockMvc mvc;
 
-	@Before
+	@BeforeEach
 	public void setup() {
 		mvc = MockMvcBuilders
 				.webAppContextSetup(context)
@@ -39,7 +39,7 @@ public class CsrfShowcaseTests {
 .Kotlin
 [source,kotlin,role="secondary"]
 ----
-@RunWith(SpringJUnit4ClassRunner::class)
+@ExtendWith(SpringExtension.class)
 @ContextConfiguration(classes = [SecurityConfig::class])
 @WebAppConfiguration
 class CsrfShowcaseTests {
@@ -49,7 +49,7 @@ class CsrfShowcaseTests {
 
     private var mvc: MockMvc? = null
 
-    @Before
+    @BeforeEach
     fun setup() {
         mvc = MockMvcBuilders
             .webAppContextSetup(context)

gradle.properties

@@ -1,9 +1,9 @@
-aspectjVersion=1.9.8
+aspectjVersion=1.9.9.1
 springJavaformatVersion=0.0.31
 springBootVersion=2.4.2
-springFrameworkVersion=5.3.16
+springFrameworkVersion=5.3.22
 openSamlVersion=3.4.6
-version=5.6.2
+version=5.6.7
 kotlinVersion=1.5.32
 samplesBranch=5.6.x
 org.gradle.jvmargs=-Xmx3g -XX:MaxPermSize=2048m -XX:+HeapDumpOnOutOfMemoryError

oauth2/oauth2-client/src/main/java/org/springframework/security/oauth2/client/oidc/web/server/logout/OidcClientInitiatedServerLogoutSuccessHandler.java

@@ -85,13 +85,13 @@ public class OidcClientInitiatedServerLogoutSuccessHandler implements ServerLogo
 						return Mono.empty();
 					}
 					String idToken = idToken(authentication);
-					URI postLogoutRedirectUri = postLogoutRedirectUri(exchange.getExchange().getRequest());
+					String postLogoutRedirectUri = postLogoutRedirectUri(exchange.getExchange().getRequest());
 					return Mono.just(endpointUri(endSessionEndpoint, idToken, postLogoutRedirectUri));
 				})
 				.switchIfEmpty(
 						this.serverLogoutSuccessHandler.onLogoutSuccess(exchange, authentication).then(Mono.empty())
 				)
-				.flatMap((endpointUri) -> this.redirectStrategy.sendRedirect(exchange.getExchange(), endpointUri));
+				.flatMap((endpointUri) -> this.redirectStrategy.sendRedirect(exchange.getExchange(), URI.create(endpointUri)));
 		// @formatter:on
 	}
 
@@ -106,20 +106,20 @@ public class OidcClientInitiatedServerLogoutSuccessHandler implements ServerLogo
 		return null;
 	}
 
-	private URI endpointUri(URI endSessionEndpoint, String idToken, URI postLogoutRedirectUri) {
+	private String endpointUri(URI endSessionEndpoint, String idToken, String postLogoutRedirectUri) {
 		UriComponentsBuilder builder = UriComponentsBuilder.fromUri(endSessionEndpoint);
 		builder.queryParam("id_token_hint", idToken);
 		if (postLogoutRedirectUri != null) {
 			builder.queryParam("post_logout_redirect_uri", postLogoutRedirectUri);
 		}
-		return builder.encode(StandardCharsets.UTF_8).build().toUri();
+		return builder.encode(StandardCharsets.UTF_8).build().toUriString();
 	}
 
 	private String idToken(Authentication authentication) {
 		return ((OidcUser) authentication.getPrincipal()).getIdToken().getTokenValue();
 	}
 
-	private URI postLogoutRedirectUri(ServerHttpRequest request) {
+	private String postLogoutRedirectUri(ServerHttpRequest request) {
 		if (this.postLogoutRedirectUri == null) {
 			return null;
 		}
@@ -131,7 +131,7 @@ public class OidcClientInitiatedServerLogoutSuccessHandler implements ServerLogo
 				.build();
 		return UriComponentsBuilder.fromUriString(this.postLogoutRedirectUri)
 				.buildAndExpand(Collections.singletonMap("baseUrl", uriComponents.toUriString()))
-				.toUri();
+				.toUriString();
 		// @formatter:on
 	}
 

oauth2/oauth2-client/src/test/java/org/springframework/security/oauth2/client/oidc/web/server/logout/OidcClientInitiatedServerLogoutSuccessHandlerTests.java

@@ -150,6 +150,19 @@ public class OidcClientInitiatedServerLogoutSuccessHandlerTests {
 				"https://endpoint?" + "id_token_hint=id-token&" + "post_logout_redirect_uri=https://rp.example.org");
 	}
 
+	// gh-11379
+	@Test
+	public void logoutWhenUsingPostLogoutRedirectUriWithQueryParametersThenBuildsItForRedirect() {
+		OAuth2AuthenticationToken token = new OAuth2AuthenticationToken(TestOidcUsers.create(),
+				AuthorityUtils.NO_AUTHORITIES, this.registration.getRegistrationId());
+		given(this.exchange.getPrincipal()).willReturn(Mono.just(token));
+		this.handler.setPostLogoutRedirectUri("https://rp.example.org/context?forwardUrl=secured%3Fparam%3Dtrue");
+		WebFilterExchange f = new WebFilterExchange(this.exchange, this.chain);
+		this.handler.onLogoutSuccess(f, token).block();
+		assertThat(redirectedUrl(this.exchange)).isEqualTo("https://endpoint?id_token_hint=id-token&"
+				+ "post_logout_redirect_uri=https://rp.example.org/context?forwardUrl%3Dsecured%253Fparam%253Dtrue");
+	}
+
 	@Test
 	public void setPostLogoutRedirectUriWhenGivenNullThenThrowsException() {
 		assertThatIllegalArgumentException().isThrownBy(() -> this.handler.setPostLogoutRedirectUri((URI) null));

saml2/saml2-service-provider/spring-security-saml2-service-provider.gradle

@@ -46,9 +46,9 @@ dependencies {
 	api "org.opensaml:opensaml-core"
 	api "org.opensaml:opensaml-saml-api"
 	api "org.opensaml:opensaml-saml-impl"
-	opensaml4MainImplementation "org.opensaml:opensaml-core:4.1.0"
-	opensaml4MainImplementation "org.opensaml:opensaml-saml-api:4.1.0"
-	opensaml4MainImplementation "org.opensaml:opensaml-saml-impl:4.1.0"
+	opensaml4MainImplementation "org.opensaml:opensaml-core:4.1.1"
+	opensaml4MainImplementation "org.opensaml:opensaml-saml-api:4.1.1"
+	opensaml4MainImplementation "org.opensaml:opensaml-saml-impl:4.1.1"
 
 	provided 'jakarta.servlet:jakarta.servlet-api'
 

saml2/saml2-service-provider/src/main/java/org/springframework/security/saml2/provider/service/authentication/Saml2Utils.java

@@ -19,13 +19,12 @@ package org.springframework.security.saml2.provider.service.authentication;
 import java.io.ByteArrayOutputStream;
 import java.io.IOException;
 import java.nio.charset.StandardCharsets;
+import java.util.Base64;
 import java.util.zip.Deflater;
 import java.util.zip.DeflaterOutputStream;
 import java.util.zip.Inflater;
 import java.util.zip.InflaterOutputStream;
 
-import org.apache.commons.codec.binary.Base64;
-
 import org.springframework.security.saml2.Saml2Exception;
 
 /**
@@ -33,17 +32,15 @@ import org.springframework.security.saml2.Saml2Exception;
  */
 final class Saml2Utils {
 
-	private static Base64 BASE64 = new Base64(0, new byte[] { '\n' });
-
 	private Saml2Utils() {
 	}
 
 	static String samlEncode(byte[] b) {
-		return BASE64.encodeAsString(b);
+		return Base64.getEncoder().encodeToString(b);
 	}
 
 	static byte[] samlDecode(String s) {
-		return BASE64.decode(s);
+		return Base64.getMimeDecoder().decode(s);
 	}
 
 	static byte[] samlDeflate(String s) {

saml2/saml2-service-provider/src/main/java/org/springframework/security/saml2/provider/service/authentication/logout/Saml2Utils.java

@@ -44,7 +44,7 @@ final class Saml2Utils {
 	}
 
 	static byte[] samlDecode(String s) {
-		return Base64.getDecoder().decode(s);
+		return Base64.getMimeDecoder().decode(s);
 	}
 
 	static byte[] samlDeflate(String s) {

saml2/saml2-service-provider/src/main/java/org/springframework/security/saml2/provider/service/metadata/OpenSamlMetadataResolver.java

@@ -70,7 +70,7 @@ public final class OpenSamlMetadataResolver implements Saml2MetadataResolver {
 
 	@Override
 	public String resolve(RelyingPartyRegistration relyingPartyRegistration) {
-		EntityDescriptor entityDescriptor = build(EntityDescriptor.ELEMENT_QNAME);
+		EntityDescriptor entityDescriptor = build(EntityDescriptor.DEFAULT_ELEMENT_NAME);
 		entityDescriptor.setEntityID(relyingPartyRegistration.getEntityId());
 		SPSSODescriptor spSsoDescriptor = buildSpSsoDescriptor(relyingPartyRegistration);
 		entityDescriptor.getRoleDescriptors(SPSSODescriptor.DEFAULT_ELEMENT_NAME).add(spSsoDescriptor);

saml2/saml2-service-provider/src/main/java/org/springframework/security/saml2/provider/service/registration/RelyingPartyRegistration.java

@@ -21,7 +21,7 @@ import java.security.cert.X509Certificate;
 import java.util.ArrayList;
 import java.util.Collection;
 import java.util.Collections;
-import java.util.HashSet;
+import java.util.LinkedHashSet;
 import java.util.LinkedList;
 import java.util.List;
 import java.util.Set;
@@ -451,7 +451,7 @@ public final class RelyingPartyRegistration {
 			org.springframework.security.saml2.credentials.Saml2X509Credential credential) {
 		PrivateKey privateKey = credential.getPrivateKey();
 		X509Certificate certificate = credential.getCertificate();
-		Set<Saml2X509Credential.Saml2X509CredentialType> credentialTypes = new HashSet<>();
+		Set<Saml2X509Credential.Saml2X509CredentialType> credentialTypes = new LinkedHashSet<>();
 		if (credential.isSigningCredential()) {
 			credentialTypes.add(Saml2X509Credential.Saml2X509CredentialType.SIGNING);
 		}
@@ -471,7 +471,7 @@ public final class RelyingPartyRegistration {
 			Saml2X509Credential credential) {
 		PrivateKey privateKey = credential.getPrivateKey();
 		X509Certificate certificate = credential.getCertificate();
-		Set<org.springframework.security.saml2.credentials.Saml2X509Credential.Saml2X509CredentialType> credentialTypes = new HashSet<>();
+		Set<org.springframework.security.saml2.credentials.Saml2X509Credential.Saml2X509CredentialType> credentialTypes = new LinkedHashSet<>();
 		if (credential.isSigningCredential()) {
 			credentialTypes.add(
 					org.springframework.security.saml2.credentials.Saml2X509Credential.Saml2X509CredentialType.SIGNING);
@@ -696,9 +696,9 @@ public final class RelyingPartyRegistration {
 
 			private List<String> signingAlgorithms = new ArrayList<>();
 
-			private Collection<Saml2X509Credential> verificationX509Credentials = new HashSet<>();
+			private Collection<Saml2X509Credential> verificationX509Credentials = new LinkedHashSet<>();
 
-			private Collection<Saml2X509Credential> encryptionX509Credentials = new HashSet<>();
+			private Collection<Saml2X509Credential> encryptionX509Credentials = new LinkedHashSet<>();
 
 			private String singleSignOnServiceLocation;
 
@@ -1006,9 +1006,9 @@ public final class RelyingPartyRegistration {
 
 		private String entityId = "{baseUrl}/saml2/service-provider-metadata/{registrationId}";
 
-		private Collection<Saml2X509Credential> signingX509Credentials = new HashSet<>();
+		private Collection<Saml2X509Credential> signingX509Credentials = new LinkedHashSet<>();
 
-		private Collection<Saml2X509Credential> decryptionX509Credentials = new HashSet<>();
+		private Collection<Saml2X509Credential> decryptionX509Credentials = new LinkedHashSet<>();
 
 		private String assertionConsumerServiceLocation = "{baseUrl}/login/saml2/sso/{registrationId}";
 
@@ -1022,7 +1022,7 @@ public final class RelyingPartyRegistration {
 
 		private ProviderDetails.Builder providerDetails = new ProviderDetails.Builder();
 
-		private Collection<org.springframework.security.saml2.credentials.Saml2X509Credential> credentials = new HashSet<>();
+		private Collection<org.springframework.security.saml2.credentials.Saml2X509Credential> credentials = new LinkedHashSet<>();
 
 		private Builder(String registrationId) {
 			this.registrationId = registrationId;

saml2/saml2-service-provider/src/main/java/org/springframework/security/saml2/provider/service/web/authentication/logout/Saml2Utils.java

@@ -44,7 +44,7 @@ final class Saml2Utils {
 	}
 
 	static byte[] samlDecode(String s) {
-		return Base64.getDecoder().decode(s);
+		return Base64.getMimeDecoder().decode(s);
 	}
 
 	static byte[] samlDeflate(String s) {

saml2/saml2-service-provider/src/opensaml3Test/java/org/springframework/security/saml2/provider/service/authentication/OpenSamlAuthenticationProviderTests.java

@@ -244,6 +244,7 @@ public class OpenSamlAuthenticationProviderTests {
 		expected.put("age", Collections.singletonList(21));
 		expected.put("website", Collections.singletonList("https://johndoe.com/"));
 		expected.put("registered", Collections.singletonList(true));
+		expected.put("role", Arrays.asList("RoleTwo"));
 		Instant registeredDate = Instant.ofEpochMilli(DateTime.parse("1970-01-01T00:00:00Z").getMillis());
 		expected.put("registeredDate", Collections.singletonList(registeredDate));
 		assertThat((String) principal.getFirstAttribute("name")).isEqualTo("John Doe");

saml2/saml2-service-provider/src/opensaml4Main/java/org/springframework/security/saml2/provider/service/authentication/OpenSaml4AuthenticationProvider.java

@@ -23,7 +23,6 @@ import java.util.ArrayList;
 import java.util.Collection;
 import java.util.Collections;
 import java.util.HashMap;
-import java.util.LinkedHashMap;
 import java.util.List;
 import java.util.Map;
 import java.util.function.Consumer;
@@ -86,6 +85,8 @@ import org.springframework.security.saml2.core.Saml2ResponseValidatorResult;
 import org.springframework.security.saml2.provider.service.registration.RelyingPartyRegistration;
 import org.springframework.util.Assert;
 import org.springframework.util.CollectionUtils;
+import org.springframework.util.LinkedMultiValueMap;
+import org.springframework.util.MultiValueMap;
 import org.springframework.util.StringUtils;
 
 /**
@@ -601,7 +602,7 @@ public final class OpenSaml4AuthenticationProvider implements AuthenticationProv
 	}
 
 	private static Map<String, List<Object>> getAssertionAttributes(Assertion assertion) {
-		Map<String, List<Object>> attributeMap = new LinkedHashMap<>();
+		MultiValueMap<String, Object> attributeMap = new LinkedMultiValueMap<>();
 		for (AttributeStatement attributeStatement : assertion.getAttributeStatements()) {
 			for (Attribute attribute : attributeStatement.getAttributes()) {
 				List<Object> attributeValues = new ArrayList<>();
@@ -611,7 +612,7 @@ public final class OpenSaml4AuthenticationProvider implements AuthenticationProv
 						attributeValues.add(attributeValue);
 					}
 				}
-				attributeMap.put(attribute.getName(), attributeValues);
+				attributeMap.addAll(attribute.getName(), attributeValues);
 			}
 		}
 		return attributeMap;

saml2/saml2-service-provider/src/opensaml4Test/java/org/springframework/security/saml2/provider/service/authentication/OpenSaml4AuthenticationProviderTests.java

@@ -245,6 +245,7 @@ public class OpenSaml4AuthenticationProviderTests {
 		expected.put("registered", Collections.singletonList(true));
 		Instant registeredDate = Instant.parse("1970-01-01T00:00:00Z");
 		expected.put("registeredDate", Collections.singletonList(registeredDate));
+		expected.put("role", Arrays.asList("RoleOne", "RoleTwo")); // gh-11042
 		assertThat((String) principal.getFirstAttribute("name")).isEqualTo("John Doe");
 		assertThat(principal.getAttributes()).isEqualTo(expected);
 	}

saml2/saml2-service-provider/src/test/java/org/springframework/security/saml2/core/Saml2Utils.java

@@ -19,28 +19,25 @@ package org.springframework.security.saml2.core;
 import java.io.ByteArrayOutputStream;
 import java.io.IOException;
 import java.nio.charset.StandardCharsets;
+import java.util.Base64;
 import java.util.zip.Deflater;
 import java.util.zip.DeflaterOutputStream;
 import java.util.zip.Inflater;
 import java.util.zip.InflaterOutputStream;
 
-import org.apache.commons.codec.binary.Base64;
-
 import org.springframework.security.saml2.Saml2Exception;
 
 public final class Saml2Utils {
 
-	private static Base64 BASE64 = new Base64(0, new byte[] { '\n' });
-
 	private Saml2Utils() {
 	}
 
 	public static String samlEncode(byte[] b) {
-		return BASE64.encodeAsString(b);
+		return Base64.getEncoder().encodeToString(b);
 	}
 
 	public static byte[] samlDecode(String s) {
-		return BASE64.decode(s);
+		return Base64.getMimeDecoder().decode(s);
 	}
 
 	public static byte[] samlDeflate(String s) {

saml2/saml2-service-provider/src/test/java/org/springframework/security/saml2/core/TestSaml2X509Credentials.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2002-2020 the original author or authors.
+ * Copyright 2002-2022 the original author or authors.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -51,6 +51,10 @@ public final class TestSaml2X509Credentials {
 		return new Saml2X509Credential(idpCertificate(), Saml2X509CredentialType.VERIFICATION);
 	}
 
+	public static Saml2X509Credential relyingPartyEncryptingCredential() {
+		return new Saml2X509Credential(idpCertificate(), Saml2X509CredentialType.ENCRYPTION);
+	}
+
 	public static Saml2X509Credential relyingPartySigningCredential() {
 		return new Saml2X509Credential(spPrivateKey(), spCertificate(), Saml2X509CredentialType.SIGNING);
 	}
@@ -59,6 +63,16 @@ public final class TestSaml2X509Credentials {
 		return new Saml2X509Credential(spPrivateKey(), spCertificate(), Saml2X509CredentialType.DECRYPTION);
 	}
 
+	public static Saml2X509Credential altPublicCredential() {
+		return new Saml2X509Credential(altCertificate(), Saml2X509CredentialType.VERIFICATION,
+				Saml2X509CredentialType.ENCRYPTION);
+	}
+
+	public static Saml2X509Credential altPrivateCredential() {
+		return new Saml2X509Credential(altPrivateKey(), altCertificate(), Saml2X509CredentialType.SIGNING,
+				Saml2X509CredentialType.DECRYPTION);
+	}
+
 	private static X509Certificate certificate(String cert) {
 		ByteArrayInputStream certBytes = new ByteArrayInputStream(cert.getBytes());
 		try {
@@ -170,4 +184,40 @@ public final class TestSaml2X509Credentials {
 						+ "-----END PRIVATE KEY-----");
 	}
 
+	private static X509Certificate altCertificate() {
+		return certificate(
+				"-----BEGIN CERTIFICATE-----\n" + "MIICkDCCAfkCFEstVfmWSFQp/j88GaMUwqVK72adMA0GCSqGSIb3DQEBCwUAMIGG\n"
+						+ "MQswCQYDVQQGEwJVUzETMBEGA1UECAwKV2FzaGluZ3RvbjESMBAGA1UEBwwJVmFu\n"
+						+ "Y291dmVyMR0wGwYDVQQKDBRTcHJpbmcgU2VjdXJpdHkgU0FNTDEMMAoGA1UECwwD\n"
+						+ "YWx0MSEwHwYDVQQDDBhhbHQuc3ByaW5nLnNlY3VyaXR5LnNhbWwwHhcNMjIwMjEw\n"
+						+ "MTY1ODA4WhcNMzIwMjEwMTY1ODA4WjCBhjELMAkGA1UEBhMCVVMxEzARBgNVBAgM\n"
+						+ "Cldhc2hpbmd0b24xEjAQBgNVBAcMCVZhbmNvdXZlcjEdMBsGA1UECgwUU3ByaW5n\n"
+						+ "IFNlY3VyaXR5IFNBTUwxDDAKBgNVBAsMA2FsdDEhMB8GA1UEAwwYYWx0LnNwcmlu\n"
+						+ "Zy5zZWN1cml0eS5zYW1sMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC9ZGWj\n"
+						+ "TPDsymQCJL044py4xLsBI/S9RvzNeR9oD/tHyoxCE+YZzjf0PyBtwqKzkKWqCPf4\n"
+						+ "XGUYHfEpkM5kJYwCW8TsOx5fnwLIQweiPqjYrBr/O0IjHMqYG9HlR/ros7iBt4ab\n"
+						+ "EGUu/B9yYg1YRYPxKQ6TNP3AD+9tBT8TsFFyjwIDAQABMA0GCSqGSIb3DQEBCwUA\n"
+						+ "A4GBAKJf2VHLjkCHRxlbWn63jGiquq3ENYgd1JS0DZ3ggFmuc6zQiqxzRGtArIDZ\n"
+						+ "0jH5nrG0jcvO0fqDqBQh0iT8thfUnkViAQvACZ9a+0x0NzUicJ+Ra51c8Z2enqbg\n"
+						+ "pXy+ga67HcAXrDekm1MCGCgiEb/Cgl41lsideqhC8Efl7PRN\n" + "-----END CERTIFICATE-----");
+	}
+
+	private static PrivateKey altPrivateKey() {
+		return privateKey(
+				"-----BEGIN PRIVATE KEY-----\n" + "MIICeAIBADANBgkqhkiG9w0BAQEFAASCAmIwggJeAgEAAoGBAL1kZaNM8OzKZAIk\n"
+						+ "vTjinLjEuwEj9L1G/M15H2gP+0fKjEIT5hnON/Q/IG3CorOQpaoI9/hcZRgd8SmQ\n"
+						+ "zmQljAJbxOw7Hl+fAshDB6I+qNisGv87QiMcypgb0eVH+uizuIG3hpsQZS78H3Ji\n"
+						+ "DVhFg/EpDpM0/cAP720FPxOwUXKPAgMBAAECgYEApYKslAZ0cer5dSoYNzNLFOnQ\n"
+						+ "J1H92r/Dw+k6+h0lUvr+keyD5T9jhM76DxHOUDBzpmIKGoDcVDQugk2rILfzXsQA\n"
+						+ "JtwvDRJk32Z02Vt0jb7t/WUOOQhjKCjQuv9/tOx90GCl0VxYG69UOjaMRWrlg/i9\n"
+						+ "6/zcTRIahIn5XxF0psECQQD7ivJCpDbOLJGsc8gNJR4cvjZ1q0mHIOrbKqJC0y1n\n"
+						+ "5DrzGEflPeyCUwnOKNp9HJQP8gmZzXfj0JM9KsjpiUChAkEAwL+FmhDoTiqStIrH\n"
+						+ "h9Kdnsev//imMmRHxjwDhntYvqavUsISRmY3imd8inoYq5dzWQMzBtoTyMRmqeLT\n"
+						+ "DHV1LwJAW4xaV37Eo4z9B7Kr4Hzd1MA1ueW5QQDt+Q4vN/r7z4/1FHyFzh0Xcucd\n"
+						+ "7nZX7qj0CkmgzOVG+Rb0P5LOxJA7gQJBAK1KQ2qNct375qPM9bEGSVGchH6k5X7+\n"
+						+ "q4ztHdpFgTb/EzdbZiTG935GpjC1rwJuinTnrHOnkwv4j7iDRm24GF8CQQDqPvrQ\n"
+						+ "GcItR6UUy0q/B8UxLzlE6t+HiznfiJKfyGgCHU56Y4/ZhzSQz2MZHz9SK4DsUL9s\n" + "bOYrWq8VY2fyjV1t\n"
+						+ "-----END PRIVATE KEY-----");
+	}
+
 }

saml2/saml2-service-provider/src/test/java/org/springframework/security/saml2/provider/service/authentication/TestOpenSamlObjects.java

@@ -312,6 +312,18 @@ public final class TestOpenSamlObjects {
 		name.setValue("John Doe");
 		nameAttr.getAttributeValues().add(name);
 		attrStmt1.getAttributes().add(nameAttr);
+		Attribute roleOneAttr = attributeBuilder.buildObject(); // gh-11042
+		roleOneAttr.setName("role");
+		XSString roleOne = new XSStringBuilder().buildObject(AttributeValue.DEFAULT_ELEMENT_NAME, XSString.TYPE_NAME);
+		roleOne.setValue("RoleOne");
+		roleOneAttr.getAttributeValues().add(roleOne);
+		attrStmt1.getAttributes().add(roleOneAttr);
+		Attribute roleTwoAttr = attributeBuilder.buildObject(); // gh-11042
+		roleTwoAttr.setName("role");
+		XSString roleTwo = new XSStringBuilder().buildObject(AttributeValue.DEFAULT_ELEMENT_NAME, XSString.TYPE_NAME);
+		roleTwo.setValue("RoleTwo");
+		roleTwoAttr.getAttributeValues().add(roleTwo);
+		attrStmt1.getAttributes().add(roleTwoAttr);
 		Attribute ageAttr = attributeBuilder.buildObject();
 		ageAttr.setName("age");
 		XSInteger age = new XSIntegerBuilder().buildObject(AttributeValue.DEFAULT_ELEMENT_NAME, XSInteger.TYPE_NAME);

saml2/saml2-service-provider/src/test/java/org/springframework/security/saml2/provider/service/authentication/logout/OpenSamlLogoutRequestValidatorTests.java

@@ -129,6 +129,23 @@ public class OpenSamlLogoutRequestValidatorTests {
 		assertThat(result.getErrors().iterator().next().getErrorCode()).isEqualTo(Saml2ErrorCodes.INVALID_DESTINATION);
 	}
 
+	// gh-10923
+	@Test
+	public void handleWhenLogoutResponseHasLineBreaksThenHandles() {
+		RelyingPartyRegistration registration = registration().build();
+		LogoutRequest logoutRequest = TestOpenSamlObjects.assertingPartyLogoutRequest(registration);
+		sign(logoutRequest, registration);
+		String encoded = new StringBuffer(
+				Saml2Utils.samlEncode(serialize(logoutRequest).getBytes(StandardCharsets.UTF_8))).insert(10, "\r\n")
+						.toString();
+		Saml2LogoutRequest request = Saml2LogoutRequest.withRelyingPartyRegistration(registration).samlRequest(encoded)
+				.build();
+		Saml2LogoutRequestValidatorParameters parameters = new Saml2LogoutRequestValidatorParameters(request,
+				registration, authentication(registration));
+		Saml2LogoutValidatorResult result = this.manager.validate(parameters);
+		assertThat(result.hasErrors()).isFalse();
+	}
+
 	private RelyingPartyRegistration.Builder registration() {
 		return signing(verifying(TestRelyingPartyRegistrations.noCredentials()))
 				.assertingPartyDetails((party) -> party.singleLogoutServiceBinding(Saml2MessageBinding.POST));

saml2/saml2-service-provider/src/test/java/org/springframework/security/saml2/provider/service/authentication/logout/OpenSamlLogoutResponseValidatorTests.java

@@ -119,6 +119,24 @@ public class OpenSamlLogoutResponseValidatorTests {
 		assertThat(result.getErrors().iterator().next().getErrorCode()).isEqualTo(Saml2ErrorCodes.INVALID_RESPONSE);
 	}
 
+	// gh-10923
+	@Test
+	public void handleWhenLogoutResponseHasLineBreaksThenHandles() {
+		RelyingPartyRegistration registration = signing(verifying(registration())).build();
+		Saml2LogoutRequest logoutRequest = Saml2LogoutRequest.withRelyingPartyRegistration(registration).id("id")
+				.build();
+		LogoutResponse logoutResponse = TestOpenSamlObjects.assertingPartyLogoutResponse(registration);
+		sign(logoutResponse, registration);
+		String encoded = new StringBuilder(
+				Saml2Utils.samlEncode(serialize(logoutResponse).getBytes(StandardCharsets.UTF_8))).insert(10, "\r\n")
+						.toString();
+		Saml2LogoutResponse response = Saml2LogoutResponse.withRelyingPartyRegistration(registration)
+				.samlResponse(encoded).build();
+		Saml2LogoutResponseValidatorParameters parameters = new Saml2LogoutResponseValidatorParameters(response,
+				logoutRequest, registration);
+		this.manager.validate(parameters);
+	}
+
 	private RelyingPartyRegistration.Builder registration() {
 		return signing(verifying(TestRelyingPartyRegistrations.noCredentials()))
 				.assertingPartyDetails((party) -> party.singleLogoutServiceBinding(Saml2MessageBinding.POST));

saml2/saml2-service-provider/src/test/java/org/springframework/security/saml2/provider/service/metadata/OpenSamlMetadataResolverTests.java

@@ -36,7 +36,7 @@ public class OpenSamlMetadataResolverTests {
 				.assertionConsumerServiceBinding(Saml2MessageBinding.REDIRECT).build();
 		OpenSamlMetadataResolver openSamlMetadataResolver = new OpenSamlMetadataResolver();
 		String metadata = openSamlMetadataResolver.resolve(relyingPartyRegistration);
-		assertThat(metadata).contains("<EntityDescriptor").contains("entityID=\"rp-entity-id\"")
+		assertThat(metadata).contains("<md:EntityDescriptor").contains("entityID=\"rp-entity-id\"")
 				.contains("WantAssertionsSigned=\"true\"").contains("<md:KeyDescriptor use=\"signing\">")
 				.contains("<md:KeyDescriptor use=\"encryption\">")
 				.contains("<ds:X509Certificate>MIICgTCCAeoCCQCuVzyqFgMSyDANBgkqhkiG9w0BAQsFADCBhDELMAkGA1UEBh")
@@ -53,7 +53,7 @@ public class OpenSamlMetadataResolverTests {
 				.build();
 		OpenSamlMetadataResolver openSamlMetadataResolver = new OpenSamlMetadataResolver();
 		String metadata = openSamlMetadataResolver.resolve(relyingPartyRegistration);
-		assertThat(metadata).contains("<EntityDescriptor").contains("entityID=\"rp-entity-id\"")
+		assertThat(metadata).contains("<md:EntityDescriptor").contains("entityID=\"rp-entity-id\"")
 				.contains("WantAssertionsSigned=\"true\"").doesNotContain("<md:KeyDescriptor use=\"signing\">")
 				.doesNotContain("<md:KeyDescriptor use=\"encryption\">")
 				.contains("Binding=\"urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST\"")

saml2/saml2-service-provider/src/test/java/org/springframework/security/saml2/provider/service/registration/RelyingPartyRegistrationTests.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2002-2020 the original author or authors.
+ * Copyright 2002-2022 the original author or authors.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -18,7 +18,8 @@ package org.springframework.security.saml2.provider.service.registration;
 
 import org.junit.jupiter.api.Test;
 
-import org.springframework.security.saml2.credentials.TestSaml2X509Credentials;
+import org.springframework.security.saml2.core.Saml2X509Credential;
+import org.springframework.security.saml2.core.TestSaml2X509Credentials;
 import org.springframework.security.saml2.provider.service.servlet.filter.Saml2WebSsoAuthenticationFilter;
 
 import static org.assertj.core.api.Assertions.assertThat;
@@ -81,9 +82,68 @@ public class RelyingPartyRegistrationTests {
 		RelyingPartyRegistration relyingPartyRegistration = RelyingPartyRegistration.withRegistrationId("id")
 				.entityId("entity-id").assertionConsumerServiceLocation("location")
 				.assertingPartyDetails((assertingParty) -> assertingParty.entityId("entity-id")
-						.singleSignOnServiceLocation("location"))
-				.credentials((c) -> c.add(TestSaml2X509Credentials.relyingPartyVerifyingCredential())).build();
+						.singleSignOnServiceLocation("location").verificationX509Credentials(
+								(c) -> c.add(TestSaml2X509Credentials.relyingPartyVerifyingCredential())))
+				.build();
 		assertThat(relyingPartyRegistration.getAssertionConsumerServiceBinding()).isEqualTo(Saml2MessageBinding.POST);
 	}
 
+	@Test
+	public void buildPreservesCredentialsOrder() {
+		Saml2X509Credential altRpCredential = TestSaml2X509Credentials.altPrivateCredential();
+		Saml2X509Credential altApCredential = TestSaml2X509Credentials.altPublicCredential();
+		Saml2X509Credential verifyingCredential = TestSaml2X509Credentials.relyingPartyVerifyingCredential();
+		Saml2X509Credential encryptingCredential = TestSaml2X509Credentials.relyingPartyEncryptingCredential();
+		Saml2X509Credential signingCredential = TestSaml2X509Credentials.relyingPartySigningCredential();
+		Saml2X509Credential decryptionCredential = TestSaml2X509Credentials.relyingPartyDecryptingCredential();
+
+		// Test with the alt credentials first
+		RelyingPartyRegistration relyingPartyRegistration = TestRelyingPartyRegistrations.noCredentials()
+				.assertingPartyDetails((assertingParty) -> assertingParty.verificationX509Credentials((c) -> {
+					c.add(altApCredential);
+					c.add(verifyingCredential);
+				}).encryptionX509Credentials((c) -> {
+					c.add(altApCredential);
+					c.add(encryptingCredential);
+				})).signingX509Credentials((c) -> {
+					c.add(altRpCredential);
+					c.add(signingCredential);
+				}).decryptionX509Credentials((c) -> {
+					c.add(altRpCredential);
+					c.add(decryptionCredential);
+				}).build();
+		assertThat(relyingPartyRegistration.getSigningX509Credentials()).containsExactly(altRpCredential,
+				signingCredential);
+		assertThat(relyingPartyRegistration.getDecryptionX509Credentials()).containsExactly(altRpCredential,
+				decryptionCredential);
+		assertThat(relyingPartyRegistration.getAssertingPartyDetails().getVerificationX509Credentials())
+				.containsExactly(altApCredential, verifyingCredential);
+		assertThat(relyingPartyRegistration.getAssertingPartyDetails().getEncryptionX509Credentials())
+				.containsExactly(altApCredential, encryptingCredential);
+
+		// Test with the alt credentials last
+		relyingPartyRegistration = TestRelyingPartyRegistrations.noCredentials()
+				.assertingPartyDetails((assertingParty) -> assertingParty.verificationX509Credentials((c) -> {
+					c.add(verifyingCredential);
+					c.add(altApCredential);
+				}).encryptionX509Credentials((c) -> {
+					c.add(encryptingCredential);
+					c.add(altApCredential);
+				})).signingX509Credentials((c) -> {
+					c.add(signingCredential);
+					c.add(altRpCredential);
+				}).decryptionX509Credentials((c) -> {
+					c.add(decryptionCredential);
+					c.add(altRpCredential);
+				}).build();
+		assertThat(relyingPartyRegistration.getSigningX509Credentials()).containsExactly(signingCredential,
+				altRpCredential);
+		assertThat(relyingPartyRegistration.getDecryptionX509Credentials()).containsExactly(decryptionCredential,
+				altRpCredential);
+		assertThat(relyingPartyRegistration.getAssertingPartyDetails().getVerificationX509Credentials())
+				.containsExactly(verifyingCredential, altApCredential);
+		assertThat(relyingPartyRegistration.getAssertingPartyDetails().getEncryptionX509Credentials())
+				.containsExactly(encryptingCredential, altApCredential);
+	}
+
 }

saml2/saml2-service-provider/src/test/java/org/springframework/security/saml2/provider/service/web/authentication/logout/OpenSamlLogoutResponseResolverTests.java

@@ -98,6 +98,29 @@ public class OpenSamlLogoutResponseResolverTests {
 		assertThat(logoutResponse.getStatus().getStatusCode().getValue()).isEqualTo(StatusCode.SUCCESS);
 	}
 
+	// gh-10923
+	@Test
+	public void resolvePostWithLineBreaksWhenAuthenticatedThenSuccess() {
+		RelyingPartyRegistration registration = TestRelyingPartyRegistrations.full()
+				.assertingPartyDetails((party) -> party.singleLogoutServiceBinding(Saml2MessageBinding.POST)).build();
+		MockHttpServletRequest request = new MockHttpServletRequest();
+		LogoutRequest logoutRequest = TestOpenSamlObjects.assertingPartyLogoutRequest(registration);
+		String encoded = new StringBuffer(
+				Saml2Utils.samlEncode(OpenSamlSigningUtils.serialize(logoutRequest).getBytes())).insert(10, "\r\n")
+						.toString();
+		request.setParameter(Saml2ParameterNames.SAML_REQUEST, encoded);
+		request.setParameter(Saml2ParameterNames.RELAY_STATE, "abcd");
+		Authentication authentication = authentication(registration);
+		given(this.relyingPartyRegistrationResolver.resolve(any(), any())).willReturn(registration);
+		Saml2LogoutResponse saml2LogoutResponse = this.logoutResponseResolver.resolve(request, authentication);
+		assertThat(saml2LogoutResponse.getParameter(Saml2ParameterNames.SIG_ALG)).isNull();
+		assertThat(saml2LogoutResponse.getParameter(Saml2ParameterNames.SIGNATURE)).isNull();
+		assertThat(saml2LogoutResponse.getParameter(Saml2ParameterNames.RELAY_STATE)).isSameAs("abcd");
+		Saml2MessageBinding binding = registration.getAssertingPartyDetails().getSingleLogoutServiceBinding();
+		LogoutResponse logoutResponse = getLogoutResponse(saml2LogoutResponse.getSamlResponse(), binding);
+		assertThat(logoutResponse.getStatus().getStatusCode().getValue()).isEqualTo(StatusCode.SUCCESS);
+	}
+
 	private Saml2Authentication authentication(RelyingPartyRegistration registration) {
 		DefaultSaml2AuthenticatedPrincipal principal = new DefaultSaml2AuthenticatedPrincipal("user", new HashMap<>());
 		principal.setRelyingPartyRegistrationId(registration.getRegistrationId());

scripts/release/release-notes-sections.yml

@@ -14,3 +14,6 @@ changelog:
       emoji: ":hammer:"
       labels: ["type: dependency-upgrade"]
       sort: "title"
+  issues:
+    exclude:
+      labels: ["status: duplicate"]

web/src/main/java/org/springframework/security/web/DefaultSecurityFilterChain.java

@@ -48,7 +48,7 @@ public final class DefaultSecurityFilterChain implements SecurityFilterChain {
 	}
 
 	public DefaultSecurityFilterChain(RequestMatcher requestMatcher, List<Filter> filters) {
-		if (!filters.isEmpty()) {
+		if (filters.isEmpty()) {
 			logger.info(LogMessage.format("Will not secure %s", requestMatcher));
 		}
 		else {

web/src/main/java/org/springframework/security/web/FilterChainProxy.java

@@ -40,6 +40,7 @@ import org.springframework.security.web.firewall.HttpFirewall;
 import org.springframework.security.web.firewall.RequestRejectedException;
 import org.springframework.security.web.firewall.RequestRejectedHandler;
 import org.springframework.security.web.firewall.StrictHttpFirewall;
+import org.springframework.security.web.util.ThrowableAnalyzer;
 import org.springframework.security.web.util.UrlUtils;
 import org.springframework.security.web.util.matcher.RequestMatcher;
 import org.springframework.util.Assert;
@@ -154,6 +155,8 @@ public class FilterChainProxy extends GenericFilterBean {
 
 	private RequestRejectedHandler requestRejectedHandler = new DefaultRequestRejectedHandler();
 
+	private ThrowableAnalyzer throwableAnalyzer = new ThrowableAnalyzer();
+
 	public FilterChainProxy() {
 	}
 
@@ -182,8 +185,15 @@ public class FilterChainProxy extends GenericFilterBean {
 			request.setAttribute(FILTER_APPLIED, Boolean.TRUE);
 			doFilterInternal(request, response, chain);
 		}
-		catch (RequestRejectedException ex) {
-			this.requestRejectedHandler.handle((HttpServletRequest) request, (HttpServletResponse) response, ex);
+		catch (Exception ex) {
+			Throwable[] causeChain = this.throwableAnalyzer.determineCauseChain(ex);
+			Throwable requestRejectedException = this.throwableAnalyzer
+					.getFirstThrowableOfType(RequestRejectedException.class, causeChain);
+			if (!(requestRejectedException instanceof RequestRejectedException)) {
+				throw ex;
+			}
+			this.requestRejectedHandler.handle((HttpServletRequest) request, (HttpServletResponse) response,
+					(RequestRejectedException) requestRejectedException);
 		}
 		finally {
 			SecurityContextHolder.clearContext();