Release 7.1.0-M1

Bump ch.qos.logback:logback-classic from 1.5.24 to 1.5.25
Bumps [ch.qos.logback:logback-classic](https://github.com/qos-ch/logback) from 1.5.24 to 1.5.25. - [Release notes](https://github.com/qos-ch/logback/releases) - [Commits](https://github.com/qos-ch/logback/compare/v_1.5.24...v_1.5.25) --- updated-dependencies: - dependency-name: ch.qos.logback:logback-classic dependency-version: 1.5.25 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>
2026-09-06 01:09:48 +00:00 · 2026-01-19 15:23:49 +00:00 · 2026-01-19 10:06:16 -05:00 · 2026-01-19 10:03:41 -05:00 · 2026-01-16 21:55:49 -06:00 · 2026-01-16 16:54:00 -06:00
603 changed files with 7614 additions and 9735 deletions
@@ -1,7 +0,0 @@
-name: Build Release
-runs:
-  using: composite
-  steps:
-    - name: Build Release
-      shell: bash
-      run:  ./gradlew -PdeploymentRepository=$(pwd)/deployment-repository publishAllPublicationsToDeploymentRepository
@@ -1,7 +0,0 @@
-name: Test Release
-runs:
-  using: composite
-  steps:
-    - name: Test Release
-      shell: bash
-      run:  ./gradlew build
@@ -0,0 +1,2 @@
+require:
+  members: false
@@ -0,0 +1,129 @@
+version: 2
+registries:
+  shibboleth:
+    type: maven-repository
+    url: https://build.shibboleth.net/maven/releases
+updates:
+  - package-ecosystem: gradle
+    target-branch: 6.5.x
+    directory: /
+    schedule:
+      interval: daily
+      time: '03:00'
+      timezone: Etc/UTC
+    labels:
+      - 'type: dependency-upgrade'
+    registries:
+      - shibboleth
+    ignore:
+      - dependency-name: com.nimbusds:nimbus-jose-jwt
+      - dependency-name: org.python:jython
+      - dependency-name: org.apache.directory.server:*
+      - dependency-name: org.apache.directory.shared:*
+      - dependency-name: org.junit:junit-bom
+        update-types:
+          - version-update:semver-major
+      - dependency-name: org.mockito:mockito-bom
+        update-types:
+          - version-update:semver-major
+      - dependency-name: '*'
+        update-types:
+          - version-update:semver-major
+          - version-update:semver-minor
+
+  - package-ecosystem: gradle
+    target-branch: 7.0.x
+    directory: /
+    schedule:
+      interval: daily
+      time: '03:00'
+      timezone: Etc/UTC
+    labels:
+      - 'type: dependency-upgrade'
+    registries:
+      - shibboleth
+    ignore:
+      - dependency-name: com.nimbusds:nimbus-jose-jwt
+      - dependency-name: org.python:jython
+      - dependency-name: org.apache.directory.server:*
+      - dependency-name: org.apache.directory.shared:*
+      - dependency-name: org.junit:junit-bom
+        update-types:
+          - version-update:semver-major
+      - dependency-name: org.mockito:mockito-bom
+        update-types:
+          - version-update:semver-major
+      - dependency-name: com.gradle.enterprise
+        update-types:
+          - version-update:semver-major
+          - version-update:semver-minor
+      - dependency-name: '*'
+        update-types:
+          - version-update:semver-major
+          - version-update:semver-minor
+
+  - package-ecosystem: gradle
+    target-branch: main
+    directory: /
+    schedule:
+      interval: daily
+      time: '03:00'
+      timezone: Etc/UTC
+    labels:
+      - 'type: dependency-upgrade'
+    registries:
+      - shibboleth
+    ignore:
+      - dependency-name: com.nimbusds:nimbus-jose-jwt
+      - dependency-name: org.python:jython
+      - dependency-name: org.apache.directory.server:*
+      - dependency-name: org.apache.directory.shared:*
+      - dependency-name: org.junit:junit-bom
+        update-types:
+          - version-update:semver-major
+      - dependency-name: org.mockito:mockito-bom
+        update-types:
+          - version-update:semver-major
+      - dependency-name: com.gradle.enterprise
+        update-types:
+          - version-update:semver-major
+          - version-update:semver-minor
+      - dependency-name: '*'
+        update-types:
+          - version-update:semver-major
+
+  - package-ecosystem: npm
+    target-branch: docs-build
+    directory: /
+    schedule:
+      interval: weekly
+    labels:
+      - 'type: task'
+      - 'in: build'
+
+  - package-ecosystem: npm
+    target-branch: main
+    directory: /docs
+    schedule:
+      interval: weekly
+    labels:
+      - 'type: task'
+      - 'in: build'
+
+  - package-ecosystem: 7.0.x
+    target-branch: main
+    directory: /docs
+    schedule:
+      interval: weekly
+    labels:
+      - 'type: task'
+      - 'in: build'
+
+  - package-ecosystem: 6.5.x
+    target-branch: main
+    directory: /docs
+    schedule:
+      interval: weekly
+    labels:
+      - 'type: task'
+      - 'in: build'
@@ -1,17 +0,0 @@
-workflow:
-  generator:
-    project:
-      java:
-        versions:
-          primary: 17
-    workflows:
-      release-train:
-        build:
-          env:
-            COMMERCIAL_REPO_USERNAME: secrets.COMMERCIAL_ARTIFACTORY_USERNAME
-            COMMERCIAL_REPO_PASSWORD: secrets.COMMERCIAL_ARTIFACTORY_PASSWORD
-        test:
-          env:
-            COMMERCIAL_REPO_USERNAME: secrets.COMMERCIAL_ARTIFACTORY_USERNAME
-            COMMERCIAL_REPO_PASSWORD: secrets.COMMERCIAL_ARTIFACTORY_PASSWORD
-
@@ -0,0 +1,36 @@
+name: CI
+
+on:
+  schedule:
+    - cron: '0 10 * * *' # Once per day at 10am UTC
+  workflow_dispatch: # Manual trigger
+
+env:
+  DEVELOCITY_ACCESS_KEY: ${{ secrets.DEVELOCITY_ACCESS_KEY }}
+
+permissions:
+  contents: read
+
+jobs:
+  snapshot-test:
+    name: Test Against Snapshots
+    uses: spring-io/spring-security-release-tools/.github/workflows/test.yml@v1
+    strategy:
+      matrix:
+        include:
+          - java-version: 25
+            toolchain: 25
+    with:
+      java-version: ${{ matrix.java-version }}
+      test-args: --refresh-dependencies -PforceMavenRepositories=snapshot,https://oss.sonatype.org/content/repositories/snapshots -PisOverrideVersionCatalog -PtestToolchain=${{ matrix.toolchain }} -PspringFrameworkVersion=7.+ -PreactorVersion=2025.+ -PspringDataVersion=2025.+ --stacktrace
+    secrets: inherit
+  send-notification:
+    name: Send Notification
+    needs: [ snapshot-test ]
+    if: ${{ !success() }}
+    runs-on: ubuntu-latest
+    steps:
+      - name: Send Notification
+        uses: spring-io/spring-security-release-tools/.github/actions/send-notification@v1
+        with:
+          webhook-url: ${{ secrets.SPRING_SECURITY_CI_GCHAT_WEBHOOK_URL }}
@@ -0,0 +1,23 @@
+name: Clean build artifacts
+on:
+  schedule:
+    - cron: '0 10 * * *' # Once per day at 10am UTC
+
+permissions:
+  contents: read
+
+jobs:
+  main:
+    runs-on: ubuntu-latest
+    if: ${{ github.repository == 'spring-projects/spring-security' }}
+    permissions:
+      contents: none
+    steps:
+      - name: Delete artifacts in cron job
+        env:
+          GH_ACTIONS_REPO_TOKEN: ${{ secrets.GH_ACTIONS_REPO_TOKEN }}
+        run: |
+          echo "Running clean build artifacts logic"
+          output=$(curl -X GET -H "Authorization: token $GH_ACTIONS_REPO_TOKEN" https://api.github.com/repos/spring-projects/spring-security/actions/artifacts | grep '"id"' | cut -d : -f2 | sed 's/,*$//g')
+          echo Output is $output
+          for id in $output; do curl -X DELETE -H "Authorization: token $GH_ACTIONS_REPO_TOKEN" https://api.github.com/repos/spring-projects/spring-security/actions/artifacts/$id; done;
@@ -0,0 +1,17 @@
+name: "CodeQL Advanced"
+
+on:
+  push:
+  pull_request:
+  workflow_dispatch:
+  schedule:
+    # https://docs.github.com/en/actions/writing-workflows/choosing-when-your-workflow-runs/events-that-trigger-workflows#schedule
+    - cron: '0 5 * * *'
+permissions: read-all
+jobs:
+  codeql-analysis-call:
+    permissions:
+      actions: read
+      contents: read
+      security-events: write
+    uses: spring-io/github-actions/.github/workflows/codeql-analysis.yml@1
@@ -8,44 +8,59 @@ on:
    - cron: '0 10 * * *' # Once per day at 10am UTC
  workflow_dispatch: # Manual trigger

+env:
+  DEVELOCITY_ACCESS_KEY: ${{ secrets.DEVELOCITY_ACCESS_KEY }}
+
 permissions:
  contents: read

 jobs:
  build:
    name: Build
-    uses: spring-projects/spring-security-commercial/.github/workflows/build.yml@workflows/v1
-    secrets: inherit
-  test:
-    name: Test Against Snapshots
-    uses: spring-projects/spring-security-commercial/.github/workflows/test.yml@workflows/v1
+    uses: spring-io/spring-security-release-tools/.github/workflows/build.yml@v1
+    strategy:
+      matrix:
+        os: [ ubuntu-latest, windows-latest ]
+        jdk: [ 25 ]
    with:
-      java-version: '17'
-      test-args: --refresh-dependencies -PforceMavenRepositories=snapshot -PisOverrideVersionCatalog -PtestToolchain=17 -PspringFrameworkVersion=7.0.+ -PreactorVersion=2025.0.+ -PspringDataVersion=2025.1.+ -PmicrometerVersion=1.16.+ --stacktrace
+      runs-on: ${{ matrix.os }}
+      java-version: ${{ matrix.jdk }}
+      distribution: temurin
    secrets: inherit
-  compute-version:
-    name: Compute Version
-    runs-on: ubuntu-latest
-    outputs:
-      snapshot: ${{ steps.project-version.outputs.snapshot }}
-    steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # 7.0.0
-      - id: project-version
-        name: Extract Project Version
-        uses: spring-io/spring-release-actions/compute-version@a1f321783a0769dd2aea4fad6c2ae2f95a52b885 # 0.0.5
  deploy-artifacts:
    name: Deploy Artifacts
-    needs: [ build, test, compute-version ]
-    if: needs.compute-version.outputs.snapshot == 'true'
-    uses: spring-projects/spring-security-commercial/.github/workflows/deploy-artifacts.yml@workflows/v1
+    needs: [ build]
+    uses: spring-io/spring-security-release-tools/.github/workflows/deploy-artifacts.yml@v1
+    with:
+      should-deploy-artifacts: ${{ needs.build.outputs.should-deploy-artifacts }}
+      default-publish-milestones-central: true
+    secrets: inherit
+  deploy-schema:
+    name: Deploy Schema
+    needs: [ build ]
+    uses: spring-io/spring-security-release-tools/.github/workflows/deploy-schema.yml@v1
+    with:
+      should-deploy-schema: ${{ needs.build.outputs.should-deploy-artifacts }}
+    secrets: inherit
+  perform-release:
+    name: Perform Release
+    needs: [ deploy-artifacts, deploy-schema ]
+    uses: spring-io/spring-security-release-tools/.github/workflows/perform-release.yml@v1
+    with:
+      should-perform-release: ${{ needs.deploy-artifacts.outputs.artifacts-deployed }}
+      project-version: ${{ needs.deploy-artifacts.outputs.project-version }}
+      milestone-repo-url: https://repo1.maven.org/maven2
+      release-repo-url: https://repo1.maven.org/maven2
+      artifact-path: org/springframework/security/spring-security-core
+      slack-announcing-id: spring-security-announcing
    secrets: inherit
  send-notification:
    name: Send Notification
-    needs: [ deploy-artifacts ]
+    needs: [ perform-release ]
    if: ${{ !success() }}
    runs-on: ubuntu-latest
    steps:
      - name: Send Notification
-        uses: spring-io/spring-security-release-tools/.github/actions/send-notification@b92832ecbc7cbe969201e6beafbde0ee400cf095 # v1.0.15
+        uses: spring-io/spring-security-release-tools/.github/actions/send-notification@v1
        with:
          webhook-url: ${{ secrets.SPRING_SECURITY_CI_GCHAT_WEBHOOK_URL }}
@@ -1,10 +0,0 @@
-name: Dependabot PR Build
-
-on: pull_request_target
-
-jobs:
-  build:
-    name: Build
-    uses: spring-projects/spring-security-commercial/.github/workflows/build-pull-request.yml@workflows/v1
-    if: ${{ github.actor == 'dependabot[bot]' }}
-    secrets: inherit
@@ -0,0 +1,33 @@
+name: Deploy Docs
+on:
+  push:
+    branches-ignore:
+      - "gh-pages"
+      - "dependabot/**"
+    tags: '**'
+  repository_dispatch:
+    types: request-build-reference # legacy
+  #schedule:
+  #- cron: '0 10 * * *' # Once per day at 10am UTC
+  workflow_dispatch:
+permissions: read-all
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    if: github.repository_owner == 'spring-projects'
+    steps:
+    - name: Checkout
+      uses: actions/checkout@v4
+      with:
+        ref: docs-build
+        fetch-depth: 1
+    - name: Dispatch (partial build)
+      if: github.ref_type == 'branch'
+      env:
+        GH_TOKEN: ${{ secrets.GH_ACTIONS_REPO_TOKEN }}
+      run: gh workflow run deploy-docs.yml -r $(git rev-parse --abbrev-ref HEAD) -f build-refname=${{ github.ref_name }}
+    - name: Dispatch (full build)
+      if: github.ref_type == 'tag'
+      env:
+        GH_TOKEN: ${{ secrets.GH_ACTIONS_REPO_TOKEN }}
+      run: gh workflow run deploy-docs.yml -r $(git rev-parse --abbrev-ref HEAD)
@@ -0,0 +1,27 @@
+name: Finalize Release
+
+on:
+  workflow_dispatch: # Manual trigger
+    inputs:
+      version:
+        description: The Spring Security release to finalize (e.g. 7.0.0-RC2)
+        required: true
+
+env:
+  DEVELOCITY_ACCESS_KEY: ${{ secrets.DEVELOCITY_ACCESS_KEY }}
+
+permissions:
+  contents: read
+
+jobs:
+  perform-release:
+    name: Perform Release
+    uses: spring-io/spring-security-release-tools/.github/workflows/perform-release.yml@v1
+    with:
+      should-perform-release: true
+      project-version: ${{ inputs.version }}
+      milestone-repo-url: https://repo1.maven.org/maven2
+      release-repo-url: https://repo1.maven.org/maven2
+      artifact-path: org/springframework/security/spring-security-core
+      slack-announcing-id: spring-security-announcing
+    secrets: inherit
@@ -0,0 +1,33 @@
+name: Execute Gradle Wrapper Upgrade
+
+on:
+  schedule:
+    - cron:  '0 2 * * *' # 2am UTC
+  workflow_dispatch:
+permissions:
+  pull-requests: write
+jobs:
+  upgrade_wrapper:
+    name: Execution
+    runs-on: ubuntu-latest
+    steps:
+      - name: Set up Git configuration
+        env:
+          TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          git config --global url."https://unused-username:${TOKEN}@github.com/".insteadOf "https://github.com/"
+          git config --global user.name 'github-actions[bot]'
+          git config --global user.email 'github-actions[bot]@users.noreply.github.com'
+      - name: Checkout
+        uses: actions/checkout@v4
+      - name: Set up JDK 25
+        uses: actions/setup-java@v4
+        with:
+          java-version: '25'
+          distribution: 'temurin'
+      - name: Set up Gradle
+        uses: gradle/gradle-build-action@v2
+      - name: Upgrade Wrappers
+        run: ./gradlew clean upgradeGradleWrapperAll --continue -Porg.gradle.java.installations.auto-download=false
+        env:
+          WRAPPER_UPGRADE_GIT_TOKEN: ${{ secrets.GITHUB_TOKEN }}
@@ -1,63 +0,0 @@
-name: Merge Dependabot PR
-
-on: pull_request_target
-
-run-name: Merge Dependabot PR ${{ github.ref_name }}
-
-permissions: write-all
-
-jobs:
-  merge-dependabot-pr:
-    name: Merge Dependabot PR
-    runs-on: ubuntu-latest
-    if: ${{ github.event.pull_request.user.login == 'dependabot[bot]' && github.repository == 'spring-projects/spring-security-commercial' }}
-    steps:
-
-      - uses: actions/checkout@v5
-        with:
-          show-progress: false
-          ref: ${{ github.event.pull_request.head.sha }}
-
-      - uses: actions/setup-java@v4
-        with:
-          distribution: temurin
-          java-version: 17
-
-      - name: Set Milestone to Dependabot Pull Request
-        id: set-milestone
-        run: |
-          if test -f pom.xml
-          then
-            CURRENT_VERSION=$(mvn help:evaluate -Dexpression="project.version" -q -DforceStdout)
-          else
-            CURRENT_VERSION=$(cat gradle.properties | sed -n '/^version=/ { s/^version=//;p }')
-          fi
-          export CANDIDATE_VERSION=${CURRENT_VERSION/-SNAPSHOT}
-          MILESTONE=$(gh api repos/$GITHUB_REPOSITORY/milestones --jq 'map(select(.due_on != null and (.title | startswith(env.CANDIDATE_VERSION)))) | .[0] | .title')
-
-          if [ -z $MILESTONE ]
-          then
-            gh run cancel ${{ github.run_id }}
-            echo "::warning title=Cannot merge::No scheduled milestone for $CURRENT_VERSION version"
-          else
-            gh pr edit ${{ github.event.pull_request.number }} --milestone $MILESTONE
-            echo mergeEnabled=true >> $GITHUB_OUTPUT
-          fi
-        env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: Merge Dependabot pull request
-        if: steps.set-milestone.outputs.mergeEnabled
-        run: gh pr merge ${{ github.event.pull_request.number }} --auto --rebase
-        env:
-          GH_TOKEN: ${{ secrets.GH_ACTIONS_REPO_TOKEN }}
-  send-notification:
-    name: Send Notification
-    needs: [ merge-dependabot-pr ]
-    if: ${{ failure() || cancelled() }}
-    runs-on: ubuntu-latest
-    steps:
-      - name: Send Notification
-        uses: spring-io/spring-security-release-tools/.github/actions/send-notification@v1
-        with:
-          webhook-url: ${{ secrets.SPRING_SECURITY_CI_GCHAT_WEBHOOK_URL }}
@@ -0,0 +1,35 @@
+name: Check Milestone
+on:
+  milestone:
+    types: [created, opened, edited]
+env:
+  DUE_ON: ${{ github.event.milestone.due_on }}
+  TITLE: ${{ github.event.milestone.title }}
+permissions:
+  contents: read
+jobs:
+  spring-releasetrain-checks:    
+    name: Check DueOn is on a Release Date
+    runs-on: ubuntu-latest
+    if: ${{ github.repository == 'spring-projects/spring-security' }}
+    permissions:
+      contents: none
+    steps:
+    - name: Print Milestone Being Checked
+      run: echo "Validating DueOn '$DUE_ON' for milestone '$TITLE'"
+    - name: Validate DueOn
+      if: env.DUE_ON != ''
+      run: |
+        export TOOL_VERSION=0.1.1
+        wget "https://repo.maven.apache.org/maven2/io/spring/releasetrain/spring-release-train-tools/$TOOL_VERSION/spring-release-train-tools-$TOOL_VERSION.jar"
+        java -cp "spring-release-train-tools-$TOOL_VERSION.jar" io.spring.releasetrain.CheckMilestoneDueOnMain --dueOn "$DUE_ON" --expectedDayOfWeek MONDAY --expectedMondayCount 3
+  send-notification:
+    name: Send Notification
+    needs: [ spring-releasetrain-checks ]
+    if: ${{ failure() || cancelled() }}
+    runs-on: ubuntu-latest
+    steps:
+      - name: Send Notification
+        uses: spring-io/spring-security-release-tools/.github/actions/send-notification@v1
+        with:
+          webhook-url: ${{ secrets.SPRING_SECURITY_CI_GCHAT_WEBHOOK_URL }}
@@ -8,6 +8,44 @@ permissions:
 jobs:
  build:
    name: Build
-    uses: spring-projects/spring-security-commercial/.github/workflows/build-pull-request.yml@workflows/v1
-    if: ${{ github.actor != 'dependabot[bot]' }}
-    secrets: inherit
+    runs-on: ubuntu-latest
+    if: ${{ github.repository == 'spring-projects/spring-security' }}
+    steps:
+      - uses: actions/checkout@v4
+      - name: Set up gradle
+        uses: spring-io/spring-gradle-build-action@v2
+        with:
+          java-version: '25'
+          distribution: 'temurin'
+      - name: Build with Gradle
+        run: ./gradlew clean build -PskipCheckExpectedBranchVersion --continue --scan
+  generate-docs:
+    name: Generate Docs
+    runs-on: ubuntu-latest
+    if: ${{ github.repository == 'spring-projects/spring-security' }}
+    steps:
+      - uses: actions/checkout@v4
+      - name: Set up gradle
+        uses: spring-io/spring-gradle-build-action@v2
+        with:
+          java-version: '25'
+          distribution: 'temurin'
+      - name: Run Antora
+        run: ./gradlew -PbuildSrc.skipTests=true :spring-security-docs:antora
+      - name: Upload Docs
+        id: upload
+        uses: actions/upload-artifact@v4
+        with:
+          name: docs
+          path: docs/build/site
+          overwrite: true
+  send-notification:
+    name: Send Notification
+    needs: [ build, generate-docs ]
+    if: ${{ failure() && github.event.pull_request.user.login == 'dependabot[bot]' && github.repository == 'spring-projects/spring-security' }}
+    runs-on: ubuntu-latest
+    steps:
+      - name: Send Notification
+        uses: spring-io/spring-security-release-tools/.github/actions/send-notification@v1
+        with:
+          webhook-url: ${{ secrets.SPRING_SECURITY_CI_GCHAT_WEBHOOK_URL }}
@@ -1,24 +0,0 @@
-name: Release Announcements - Stage
-
-on:
-  push:
-    tags:
-      - '[0-9]+.[0-9]+.[0-9]+'
-      - '[0-9]+.[0-9]+.[0-9]+.[0-9]+'
-  workflow_dispatch:
-    inputs:
-      version:
-        description: The version to stage
-        required: true
-        type: string
-
-permissions:
-  contents: read
-
-jobs:
-  stage-release-announcements:
-    name: Stage Release Announcements
-    uses: spring-projects/spring-security-commercial/.github/workflows/release-announcements-stage.yml@workflows/v1
-    with:
-      version: ${{ inputs.version || github.ref_name }}
-    secrets: inherit
@@ -0,0 +1,24 @@
+name: Release Scheduler
+on:
+  schedule:
+  - cron: '15 15 * * MON' # Every Monday at 3:15pm UTC
+  workflow_dispatch:
+permissions: read-all
+jobs:
+  dispatch_scheduled_releases:
+    name: Dispatch scheduled releases
+    if: github.repository_owner == 'spring-projects'
+    strategy:
+      matrix:
+        # List of active maintenance branches.
+        branch: [ main, 7.0.x, 6.5.x, 6.4.x, 6.3.x ]
+    runs-on: ubuntu-latest
+    steps:
+    - name: Checkout
+      uses: actions/checkout@v4
+      with:
+        fetch-depth: 1
+    - name: Dispatch
+      env:
+        GH_TOKEN: ${{ secrets.GH_ACTIONS_REPO_TOKEN }}
+      run: gh workflow run update-scheduled-release-version.yml -r ${{ matrix.branch }}
@@ -1,92 +0,0 @@
-# This file was auto-generated by github-actions-workflow-generator 0.0.6. Do not edit.
-# To update it, modify .github/workflow-generator.yml as needed and re-run the generator.
-
-name: "Release Train – Build"
-run-name: "${{ inputs.callback-ref }} – Build"
-"on":
-  workflow_dispatch:
-    inputs:
-      callback:
-        description: "Repository to which a callback should be made upon completion"
-        required: true
-        type: "string"
-      callback-ref:
-        description: "Ref in the callback repository to which a callback should be made upon completion"
-        required: true
-        type: "string"
-      release-train-maven-repository-url:
-        description: "URL of a Maven repository to be used to resolve artifacts of projects earlier in the train"
-        required: true
-        type: "string"
-permissions:
-  contents: "read"
-concurrency:
-  group: "${{ github.workflow }}-${{ github.ref }}"
-jobs:
-  build-release:
-    name: "Build Release"
-    runs-on: "ubuntu22-2-8"
-    steps:
-    - name: "Prevent Re-runs"
-      id: "prevent-re-runs"
-      run: |-
-        if [ "$GITHUB_RUN_ATTEMPT" -gt 1 ]; then
-          echo "Re-runs are prohibited. Use the 'Release Train – Retry' workflow to retry build failures"
-          exit 1
-        fi
-    - name: "Set up Java"
-      id: "set-up-java"
-      uses: "actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95" # v5.6.0
-      with:
-        distribution: "liberica"
-        java-version: "17"
-    - name: "Check Out Code"
-      id: "check-out-code"
-      uses: "actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0" # v7.0.0
-    - name: "Build Release"
-      id: "build-release"
-      uses: "./.github/actions/release-train-build"
-      env:
-        COMMERCIAL_REPO_PASSWORD: "${{ secrets.COMMERCIAL_ARTIFACTORY_PASSWORD }}"
-        COMMERCIAL_REPO_USERNAME: "${{ secrets.COMMERCIAL_ARTIFACTORY_USERNAME }}"
-        RELEASE_TRAIN_MAVEN_REPOSITORY_PASSWORD: "${{ secrets.RELEASE_TRAIN_PARTICIPANT_MAVEN_REPOSITORY_PASSWORD }}"
-        RELEASE_TRAIN_MAVEN_REPOSITORY_URL: "${{ inputs.release-train-maven-repository-url }}"
-        RELEASE_TRAIN_MAVEN_REPOSITORY_USERNAME: "${{ secrets.RELEASE_TRAIN_PARTICIPANT_MAVEN_REPOSITORY_USERNAME }}"
-    - name: "Upload Deployment Repository"
-      id: "upload-deployment-repository"
-      uses: "actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a" # v7.0.1
-      with:
-        name: "deployment-repository"
-        path: "deployment-repository/**"
-    - name: "Upload Deployment Spec"
-      id: "upload-deployment-spec"
-      uses: "actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a" # v7.0.1
-      with:
-        archive: "false"
-        if-no-files-found: "ignore"
-        name: "deployment-spec"
-        path: ".github/actions/release-train-build/deployment-spec.yml"
-    - name: "Save Build System Caches"
-      id: "save-build-system-caches"
-      uses: "actions/cache/save@55cc8345863c7cc4c66a329aec7e433d2d1c52a9" # v6.1.0
-      with:
-        key: "release-train-${{ inputs.callback-ref }}-${{ github.ref_name }}"
-        path: |-
-          ~/.gradle/caches
-          ~/.gradle/wrapper
-    - name: "Send Callback"
-      id: "send-callback"
-      if: "${{ !cancelled() }}"
-      env:
-        GH_TOKEN: "${{ secrets.RELEASE_TRAIN_PARTICIPANT_GITHUB_TOKEN }}"
-      run: |-
-        gh workflow run callback \
-        --repo ${{ inputs.callback }} \
-        --ref ${{ inputs.callback-ref }} \
-        --field commit-hash=${{ steps.check-out-code.outputs.commit }} \
-        --field deployment-repository-artifact-identifier=${{ steps.upload-deployment-repository.outputs.artifact-id }} \
-        --field deployment-spec-artifact-identifier=${{ steps.upload-deployment-spec.outputs.artifact-id }} \
-        --field release-branch=${{ github.ref_name }} \
-        --field release-repository=${{ github.repository }} \
-        --field result=${{ job.status == 'success' && 'built' || 'build-failed' }} \
-        --field workflow-run-url=${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
@@ -1,55 +0,0 @@
-# This file was auto-generated by github-actions-workflow-generator 0.0.6. Do not edit.
-# To update it, modify .github/workflow-generator.yml as needed and re-run the generator.
-
-name: "Release Train – Join"
-run-name: "${{ inputs.release-train }} – Join"
-"on":
-  workflow_dispatch:
-    inputs:
-      deployment-destination:
-        description: "Destination to which the release should be deployed"
-        options:
-        - "Maven Central"
-        - "Spring Enterprise"
-        required: true
-        type: "choice"
-      release-train:
-        description: "Release train"
-        required: true
-        type: "string"
-      release-train-repository:
-        default: "spring-io/release-train"
-        description: "Release train repository"
-        required: true
-        type: "string"
-permissions:
-  contents: "none"
-jobs:
-  join-release-train:
-    name: "Join Release Train"
-    runs-on: "ubuntu-latest"
-    steps:
-    - name: "Join Release Train"
-      id: "join-release-train"
-      env:
-        GH_TOKEN: "${{ secrets.RELEASE_TRAIN_PARTICIPANT_GITHUB_TOKEN }}"
-      run: |-
-        run_url=$(
-          gh workflow run join \
-          --repo ${{ inputs.release-train-repository }} \
-          --ref ${{ inputs.release-train }} \
-          --field commit-hash=${{ github.sha }} \
-          --field deployment-destination=${{ inputs.deployment-destination == 'Maven Central' && 'maven-central' || 'spring-enterprise' }} \
-          --field release-branch=${{ github.ref_name }} \
-          --field release-repository=${{ github.repository }}
-        )
-        echo "Dispatched workflow run. Waiting for $run_url to complete."
-        run_id=${run_url##*/}
-        watch_exit_code=0
-        gh run watch $run_id --repo ${{ inputs.release-train-repository }} --exit-status --interval=3 > /dev/null 2>&1 || watch_exit_code=$?
-        if [[ $watch_exit_code -eq 0 ]]; then
-          echo "Workflow run succeeded."
-        else
-          echo "Workflow run failed."
-        fi
-        exit $watch_exit_code
@@ -1,46 +0,0 @@
-# This file was auto-generated by github-actions-workflow-generator 0.0.6. Do not edit.
-# To update it, modify .github/workflow-generator.yml as needed and re-run the generator.
-
-name: "Release Train – Leave"
-run-name: "${{ inputs.release-train }} – Leave"
-"on":
-  workflow_dispatch:
-    inputs:
-      release-train:
-        description: "Release train"
-        required: true
-        type: "string"
-      release-train-repository:
-        default: "spring-io/release-train"
-        description: "Release train repository"
-        required: true
-        type: "string"
-permissions:
-  contents: "none"
-jobs:
-  leave:
-    name: "Leave"
-    runs-on: "ubuntu-latest"
-    steps:
-    - name: "Leave"
-      id: "leave"
-      env:
-        GH_TOKEN: "${{ secrets.RELEASE_TRAIN_PARTICIPANT_GITHUB_TOKEN }}"
-      run: |-
-        run_url=$(
-          gh workflow run leave \
-          --repo ${{ inputs.release-train-repository }} \
-          --ref ${{ inputs.release-train }} \
-          --field release-branch=${{ github.ref_name }} \
-          --field release-repository=${{ github.repository }}
-        )
-        echo "Dispatched workflow run. Waiting for $run_url to complete."
-        run_id=${run_url##*/}
-        watch_exit_code=0
-        gh run watch $run_id --repo ${{ inputs.release-train-repository }} --exit-status --interval=3 > /dev/null 2>&1 || watch_exit_code=$?
-        if [[ $watch_exit_code -eq 0 ]]; then
-          echo "Workflow run succeeded."
-        else
-          echo "Workflow run failed."
-        fi
-        exit $watch_exit_code
@@ -1,47 +0,0 @@
-# This file was auto-generated by github-actions-workflow-generator 0.0.6. Do not edit.
-# To update it, modify .github/workflow-generator.yml as needed and re-run the generator.
-
-name: "Release Train – Ready"
-run-name: "${{ inputs.release-train }} – Ready"
-"on":
-  workflow_dispatch:
-    inputs:
-      release-train:
-        description: "Release train"
-        required: true
-        type: "string"
-      release-train-repository:
-        default: "spring-io/release-train"
-        description: "Release train repository"
-        required: true
-        type: "string"
-permissions:
-  contents: "none"
-jobs:
-  ready:
-    name: "Ready"
-    runs-on: "ubuntu-latest"
-    steps:
-    - name: "Ready"
-      id: "ready"
-      env:
-        GH_TOKEN: "${{ secrets.RELEASE_TRAIN_PARTICIPANT_GITHUB_TOKEN }}"
-      run: |-
-        run_url=$(
-          gh workflow run ready \
-          --repo ${{ inputs.release-train-repository }} \
-          --ref ${{ inputs.release-train }} \
-          --field commit-hash=${{ github.sha }} \
-          --field release-branch=${{ github.ref_name }} \
-          --field release-repository=${{ github.repository }}
-        )
-        echo "Dispatched workflow run. Waiting for $run_url to complete."
-        run_id=${run_url##*/}
-        watch_exit_code=0
-        gh run watch $run_id --repo ${{ inputs.release-train-repository }} --exit-status --interval=3 > /dev/null 2>&1 || watch_exit_code=$?
-        if [[ $watch_exit_code -eq 0 ]]; then
-          echo "Workflow run succeeded."
-        else
-          echo "Workflow run failed."
-        fi
-        exit $watch_exit_code
@@ -1,34 +0,0 @@
-# This file was auto-generated by github-actions-workflow-generator 0.0.6. Do not edit.
-# To update it, modify .github/workflow-generator.yml as needed and re-run the generator.
-
-name: "Release Train – Retry"
-run-name: "${{ inputs.release-train }} – Retry"
-"on":
-  workflow_dispatch:
-    inputs:
-      release-train:
-        description: "Release train"
-        required: true
-        type: "string"
-      release-train-repository:
-        default: "spring-io/release-train"
-        description: "Release train repository"
-        required: true
-        type: "string"
-permissions:
-  contents: "none"
-jobs:
-  trigger-retry:
-    name: "Trigger Retry"
-    runs-on: "ubuntu-latest"
-    steps:
-    - name: "Trigger Retry"
-      id: "trigger-retry"
-      env:
-        GH_TOKEN: "${{ secrets.RELEASE_TRAIN_PARTICIPANT_GITHUB_TOKEN }}"
-      run: |-
-        gh workflow run retry \
-        --repo ${{ inputs.release-train-repository }} \
-        --ref ${{ inputs.release-train }} \
-        --field release-branch=${{ github.ref_name }} \
-        --field release-repository=${{ github.repository }}
@@ -1,83 +0,0 @@
-# This file was auto-generated by github-actions-workflow-generator 0.0.6. Do not edit.
-# To update it, modify .github/workflow-generator.yml as needed and re-run the generator.
-
-name: "Release Train – Test"
-run-name: "${{ inputs.callback-ref }} – Test"
-"on":
-  workflow_dispatch:
-    inputs:
-      callback:
-        description: "Repository to which a callback should be made upon completion"
-        required: true
-        type: "string"
-      callback-ref:
-        description: "Ref in the callback repository to which a callback should be made upon completion"
-        required: true
-        type: "string"
-      release-train-maven-repository-url:
-        description: "URL of a Maven repository to be used to resolve artifacts of projects earlier in the train"
-        required: true
-        type: "string"
-permissions:
-  contents: "read"
-concurrency:
-  group: "${{ github.workflow }}-${{ github.ref }}"
-jobs:
-  test-release:
-    name: "Test Release"
-    runs-on: "ubuntu22-2-8"
-    steps:
-    - name: "Prevent Re-runs"
-      id: "prevent-re-runs"
-      run: |-
-        if [ "$GITHUB_RUN_ATTEMPT" -gt 1 ]; then
-          echo "Re-runs are prohibited. Use the 'Release Train – Retry' workflow to retry test failures"
-          exit 1
-        fi
-    - name: "Set up Java"
-      id: "set-up-java"
-      uses: "actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95" # v5.6.0
-      with:
-        distribution: "liberica"
-        java-version: "17"
-    - name: "Check Out Code"
-      id: "check-out-code"
-      uses: "actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0" # v7.0.0
-    - name: "Restore Build System Caches"
-      id: "restore-build-system-caches"
-      uses: "actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9" # v6.1.0
-      with:
-        key: "release-train-${{ inputs.callback-ref }}-${{ github.ref_name }}"
-        path: |-
-          ~/.gradle/caches
-          ~/.gradle/wrapper
-    - name: "Test Release"
-      id: "test-release"
-      uses: "./.github/actions/release-train-test"
-      env:
-        COMMERCIAL_REPO_PASSWORD: "${{ secrets.COMMERCIAL_ARTIFACTORY_PASSWORD }}"
-        COMMERCIAL_REPO_USERNAME: "${{ secrets.COMMERCIAL_ARTIFACTORY_USERNAME }}"
-        RELEASE_TRAIN_MAVEN_REPOSITORY_PASSWORD: "${{ secrets.RELEASE_TRAIN_PARTICIPANT_MAVEN_REPOSITORY_PASSWORD }}"
-        RELEASE_TRAIN_MAVEN_REPOSITORY_URL: "${{ inputs.release-train-maven-repository-url }}"
-        RELEASE_TRAIN_MAVEN_REPOSITORY_USERNAME: "${{ secrets.RELEASE_TRAIN_PARTICIPANT_MAVEN_REPOSITORY_USERNAME }}"
-    - name: "Send Callback"
-      id: "send-callback"
-      if: "${{ !cancelled() }}"
-      env:
-        GH_TOKEN: "${{ secrets.RELEASE_TRAIN_PARTICIPANT_GITHUB_TOKEN }}"
-      run: |-
-        gh workflow run callback \
-        --repo ${{ inputs.callback }} \
-        --ref ${{ inputs.callback-ref }} \
-        --field commit-hash=${{ steps.check-out-code.outputs.commit }} \
-        --field release-branch=${{ github.ref_name }} \
-        --field release-repository=${{ github.repository }} \
-        --field result=${{ job.status == 'success' && 'tested' || 'test-failed' }} \
-        --field workflow-run-url=${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
-    - name: "Upload Build System Reports"
-      id: "upload-build-system-reports"
-      if: "${{ failure() }}"
-      uses: "actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a" # v7.0.1
-      with:
-        name: "build-system-reports"
-        path: "**/build/reports"
@@ -0,0 +1,35 @@
+name: Update Antora UI Spring
+
+on:
+  schedule:
+    - cron: '0 10 * * *' # Once per day at 10am UTC
+  workflow_dispatch:
+
+permissions:
+  pull-requests: write
+  issues: write
+  contents: write
+
+jobs:
+  update-antora-ui-spring:
+    runs-on: ubuntu-latest
+    name: Update on Supported Branches
+    strategy:
+      matrix:
+        branch: [ '6.5.x', '7.0.x', 'main' ]
+    steps:
+      - uses: spring-io/spring-doc-actions/update-antora-spring-ui@e28269199d1d27975cf7f65e16d6095c555b3cd0
+        name: Update
+        with:
+          docs-branch: ${{ matrix.branch }}
+          token: ${{ secrets.GITHUB_TOKEN }}
+          antora-file-path: 'docs/antora-playbook.yml'
+  update-antora-ui-spring-docs-build:
+    runs-on: ubuntu-latest
+    name: Update on docs-build
+    steps:
+      - uses: spring-io/spring-doc-actions/update-antora-spring-ui@e28269199d1d27975cf7f65e16d6095c555b3cd0
+        name: Update
+        with:
+          docs-branch: 'docs-build'
+          token: ${{ secrets.GITHUB_TOKEN }}
@@ -0,0 +1,23 @@
+name: Update Scheduled Release Version
+
+on:
+  workflow_dispatch: # Manual trigger only. Triggered by release-scheduler.yml on main.
+
+permissions:
+  contents: read
+
+jobs:
+  update-scheduled-release-version:
+    name: Update Scheduled Release Version
+    uses: spring-io/spring-security-release-tools/.github/workflows/update-scheduled-release-version.yml@v1
+    secrets: inherit
+  send-notification:
+    name: Send Notification
+    needs: [ update-scheduled-release-version ]
+    if: ${{ failure() || cancelled() }}
+    runs-on: ubuntu-latest
+    steps:
+      - name: Send Notification
+        uses: spring-io/spring-security-release-tools/.github/actions/send-notification@v1
+        with:
+          webhook-url: ${{ secrets.SPRING_SECURITY_CI_GCHAT_WEBHOOK_URL }}
@@ -3,4 +3,4 @@
 # See https://sdkman.io/usage#config
 # A summary is to add the following to ~/.sdkman/etc/config
 # sdkman_auto_env=true
-java=17.0.3-tem
+java=25-librca
@@ -1,3 +1,3 @@
 {
-	"java.import.gradle.enabled": false
+  "java.gradle.buildServer.enabled": "off"
 }
@@ -68,27 +68,6 @@ The https://github.com/spring-projects/spring-security/tree/docs-build[playbook

 Discover more commands with `./gradlew tasks`.

-=== IDE setup (IntelliJ)
-
-No special steps are needed to open Spring Security in IntelliJ.
-
-=== IDE setup (Eclipse and VS Code)
-
-To work in Eclipse or VS Code, first generate Eclipse metadata so you can import the project into Eclipse or VS Code:
-
-[indent=0]
----
-./gradlew cleanEclipse eclipse
----
-
-If you have not built the project yet, run `./gradlew publishToMavenLocal` first so dependencies are resolved.
-
-*VS Code:* Open the repository root as a folder. The repository includes `.vscode/settings.json` which disables automatic Gradle import so that the generated Eclipse metadata (`.classpath`, `.project`) is used. Do not use the Gradle for Java extension to import the project.
-
-*Eclipse:* File → Import → General → Existing Projects into Workspace, then select the repository root.
-
-The build uses a custom Eclipse plugin to work around Gradle dependency cycles that confuse IDE metadata generation. You may see Eclipse warnings about `xml-apis` from some test dependencies; those are excluded in the build and can be ignored.
-
 == Getting Support
 Check out the https://stackoverflow.com/questions/tagged/spring-security[Spring Security tags on Stack Overflow].
 https://spring.io/support[Commercial support] is available too.
@@ -35,7 +35,6 @@ import org.springframework.security.web.FilterInvocation;
 */
@Deprecated
@NullUnmarked
-@SuppressWarnings("serial")
 class WebExpressionConfigAttribute implements ConfigAttribute, EvaluationContextPostProcessor<FilterInvocation> {

 	private final Expression authorizeExpression;
@@ -1,5 +1,7 @@
 import io.spring.gradle.IncludeRepoTask
+import org.jetbrains.kotlin.gradle.dsl.JvmTarget
 import trang.RncToXsd
+import org.jetbrains.kotlin.gradle.tasks.KotlinCompile

 buildscript {
 	dependencies {
@@ -25,7 +27,6 @@ apply plugin: 'org.jetbrains.kotlin.jvm'
 apply plugin: 'org.springframework.security.versions.verify-dependencies-versions'
 apply plugin: 'org.springframework.security.check-expected-branch-version'
 apply plugin: 'io.spring.security.release'
-apply from: 'commercial-settings.gradle'

 group = 'org.springframework.security'
 description = 'Spring Security'
@@ -40,12 +41,10 @@ repositories {
 }

 springRelease {
-	repositoryOwner = "spring-projects"
-	repositoryName = "spring-security-commercial"
 	weekOfMonth = 3
 	dayOfWeek = 1
-	referenceDocUrl = "https://docs.spring.vmware.com/spring-security/reference/{version}/index.html"
-	apiDocUrl = "https://docs.spring.vmware.com/spring-security/reference/{version}/api/java/index.html"
+	referenceDocUrl = "https://docs.spring.io/spring-security/reference/{version}/index.html"
+	apiDocUrl = "https://docs.spring.io/spring-security/reference/{version}/api/java/index.html"
 	replaceSnapshotVersionInReferenceDocUrl = true
 }

@@ -73,6 +72,12 @@ allprojects {
 	}
 }

+develocity {
+	buildScan {
+		termsOfUseUrl = 'https://gradle.com/help/legal-terms-of-use'
+		termsOfUseAgree = 'yes'
+	}
+}

 nohttp {
 	source.exclude "buildSrc/build/**", "javascript/.gradle/**", "javascript/package-lock.json", "javascript/node_modules/**", "javascript/build/**", "javascript/dist/**"
@@ -12,26 +12,7 @@ java {
 repositories {
 	gradlePluginPortal()
 	mavenCentral()
-	if (project.hasProperty("artifactoryUsername") && project.hasProperty("artifactoryPassword")) {
-		maven {
-			name "spring-commercial-release"
-			url "https://usw1.packages.broadcom.com/spring-enterprise-maven-prod-local"
-			credentials {
-				username project.artifactoryUsername
-				password project.artifactoryPassword
-			}
-		}
-	}
-	if (System.getenv("RELEASE_TRAIN_MAVEN_REPOSITORY_URL") != null) {
-		maven {
-			name = "Release Train"
-			url = System.getenv("RELEASE_TRAIN_MAVEN_REPOSITORY_URL")
-			credentials {
-				username = System.getenv("RELEASE_TRAIN_MAVEN_REPOSITORY_USERNAME")
-				password = System.getenv("RELEASE_TRAIN_MAVEN_REPOSITORY_PASSWORD")
-			}
-		}
-	}
+	maven { url = 'https://repo.spring.io/snapshot' }
 }

 sourceSets {
@@ -0,0 +1,5 @@
+distributionBase=GRADLE_USER_HOME
+distributionPath=wrapper/dists
+distributionUrl=https\://services.gradle.org/distributions/gradle-7.5.1-bin.zip
+zipStoreBase=GRADLE_USER_HOME
+zipStorePath=wrapper/dists
@@ -0,0 +1,240 @@
+#!/bin/sh
+
+#
+# Copyright © 2015-2021 the original authors.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+##############################################################################
+#
+#   Gradle start up script for POSIX generated by Gradle.
+#
+#   Important for running:
+#
+#   (1) You need a POSIX-compliant shell to run this script. If your /bin/sh is
+#       noncompliant, but you have some other compliant shell such as ksh or
+#       bash, then to run this script, type that shell name before the whole
+#       command line, like:
+#
+#           ksh Gradle
+#
+#       Busybox and similar reduced shells will NOT work, because this script
+#       requires all of these POSIX shell features:
+#         * functions;
+#         * expansions «$var», «${var}», «${var:-default}», «${var+SET}»,
+#           «${var#prefix}», «${var%suffix}», and «$( cmd )»;
+#         * compound commands having a testable exit status, especially «case»;
+#         * various built-in commands including «command», «set», and «ulimit».
+#
+#   Important for patching:
+#
+#   (2) This script targets any POSIX shell, so it avoids extensions provided
+#       by Bash, Ksh, etc; in particular arrays are avoided.
+#
+#       The "traditional" practice of packing multiple parameters into a
+#       space-separated string is a well documented source of bugs and security
+#       problems, so this is (mostly) avoided, by progressively accumulating
+#       options in "$@", and eventually passing that to Java.
+#
+#       Where the inherited environment variables (DEFAULT_JVM_OPTS, JAVA_OPTS,
+#       and GRADLE_OPTS) rely on word-splitting, this is performed explicitly;
+#       see the in-line comments for details.
+#
+#       There are tweaks for specific operating systems such as AIX, CygWin,
+#       Darwin, MinGW, and NonStop.
+#
+#   (3) This script is generated from the Groovy template
+#       https://github.com/gradle/gradle/blob/master/subprojects/plugins/src/main/resources/org/gradle/api/internal/plugins/unixStartScript.txt
+#       within the Gradle project.
+#
+#       You can find Gradle at https://github.com/gradle/gradle/.
+#
+##############################################################################
+
+# Attempt to set APP_HOME
+
+# Resolve links: $0 may be a link
+app_path=$0
+
+# Need this for daisy-chained symlinks.
+while
+    APP_HOME=${app_path%"${app_path##*/}"}  # leaves a trailing /; empty if no leading path
+    [ -h "$app_path" ]
+do
+    ls=$( ls -ld "$app_path" )
+    link=${ls#*' -> '}
+    case $link in             #(
+      /*)   app_path=$link ;; #(
+      *)    app_path=$APP_HOME$link ;;
+    esac
+done
+
+APP_HOME=$( cd "${APP_HOME:-./}" && pwd -P ) || exit
+
+APP_NAME="Gradle"
+APP_BASE_NAME=${0##*/}
+
+# Add default JVM options here. You can also use JAVA_OPTS and GRADLE_OPTS to pass JVM options to this script.
+DEFAULT_JVM_OPTS='"-Xmx64m" "-Xms64m"'
+
+# Use the maximum available, or set MAX_FD != -1 to use that value.
+MAX_FD=maximum
+
+warn () {
+    echo "$*"
+} >&2
+
+die () {
+    echo
+    echo "$*"
+    echo
+    exit 1
+} >&2
+
+# OS specific support (must be 'true' or 'false').
+cygwin=false
+msys=false
+darwin=false
+nonstop=false
+case "$( uname )" in                #(
+  CYGWIN* )         cygwin=true  ;; #(
+  Darwin* )         darwin=true  ;; #(
+  MSYS* | MINGW* )  msys=true    ;; #(
+  NONSTOP* )        nonstop=true ;;
+esac
+
+CLASSPATH=$APP_HOME/gradle/wrapper/gradle-wrapper.jar
+
+
+# Determine the Java command to use to start the JVM.
+if [ -n "$JAVA_HOME" ] ; then
+    if [ -x "$JAVA_HOME/jre/sh/java" ] ; then
+        # IBM's JDK on AIX uses strange locations for the executables
+        JAVACMD=$JAVA_HOME/jre/sh/java
+    else
+        JAVACMD=$JAVA_HOME/bin/java
+    fi
+    if [ ! -x "$JAVACMD" ] ; then
+        die "ERROR: JAVA_HOME is set to an invalid directory: $JAVA_HOME
+
+Please set the JAVA_HOME variable in your environment to match the
+location of your Java installation."
+    fi
+else
+    JAVACMD=java
+    which java >/dev/null 2>&1 || die "ERROR: JAVA_HOME is not set and no 'java' command could be found in your PATH.
+
+Please set the JAVA_HOME variable in your environment to match the
+location of your Java installation."
+fi
+
+# Increase the maximum file descriptors if we can.
+if ! "$cygwin" && ! "$darwin" && ! "$nonstop" ; then
+    case $MAX_FD in #(
+      max*)
+        MAX_FD=$( ulimit -H -n ) ||
+            warn "Could not query maximum file descriptor limit"
+    esac
+    case $MAX_FD in  #(
+      '' | soft) :;; #(
+      *)
+        ulimit -n "$MAX_FD" ||
+            warn "Could not set maximum file descriptor limit to $MAX_FD"
+    esac
+fi
+
+# Collect all arguments for the java command, stacking in reverse order:
+#   * args from the command line
+#   * the main class name
+#   * -classpath
+#   * -D...appname settings
+#   * --module-path (only if needed)
+#   * DEFAULT_JVM_OPTS, JAVA_OPTS, and GRADLE_OPTS environment variables.
+
+# For Cygwin or MSYS, switch paths to Windows format before running java
+if "$cygwin" || "$msys" ; then
+    APP_HOME=$( cygpath --path --mixed "$APP_HOME" )
+    CLASSPATH=$( cygpath --path --mixed "$CLASSPATH" )
+
+    JAVACMD=$( cygpath --unix "$JAVACMD" )
+
+    # Now convert the arguments - kludge to limit ourselves to /bin/sh
+    for arg do
+        if
+            case $arg in                                #(
+              -*)   false ;;                            # don't mess with options #(
+              /?*)  t=${arg#/} t=/${t%%/*}              # looks like a POSIX filepath
+                    [ -e "$t" ] ;;                      #(
+              *)    false ;;
+            esac
+        then
+            arg=$( cygpath --path --ignore --mixed "$arg" )
+        fi
+        # Roll the args list around exactly as many times as the number of
+        # args, so each arg winds up back in the position where it started, but
+        # possibly modified.
+        #
+        # NB: a `for` loop captures its iteration list before it begins, so
+        # changing the positional parameters here affects neither the number of
+        # iterations, nor the values presented in `arg`.
+        shift                   # remove old arg
+        set -- "$@" "$arg"      # push replacement arg
+    done
+fi
+
+# Collect all arguments for the java command;
+#   * $DEFAULT_JVM_OPTS, $JAVA_OPTS, and $GRADLE_OPTS can contain fragments of
+#     shell script including quotes and variable substitutions, so put them in
+#     double quotes to make sure that they get re-expanded; and
+#   * put everything else in single quotes, so that it's not re-expanded.
+
+set -- \
+        "-Dorg.gradle.appname=$APP_BASE_NAME" \
+        -classpath "$CLASSPATH" \
+        org.gradle.wrapper.GradleWrapperMain \
+        "$@"
+
+# Stop when "xargs" is not available.
+if ! command -v xargs >/dev/null 2>&1
+then
+    die "xargs is not available"
+fi
+
+# Use "xargs" to parse quoted args.
+#
+# With -n1 it outputs one arg per line, with the quotes and backslashes removed.
+#
+# In Bash we could simply go:
+#
+#   readarray ARGS < <( xargs -n1 <<<"$var" ) &&
+#   set -- "${ARGS[@]}" "$@"
+#
+# but POSIX shell has neither arrays nor command substitution, so instead we
+# post-process each arg (as a line of input to sed) to backslash-escape any
+# character that might be a shell metacharacter, then use eval to reverse
+# that process (while maintaining the separation between arguments), and wrap
+# the whole thing up as a single "set" statement.
+#
+# This will of course break if any of these variables contains a newline or
+# an unmatched quote.
+#
+
+eval "set -- $(
+        printf '%s\n' "$DEFAULT_JVM_OPTS $JAVA_OPTS $GRADLE_OPTS" |
+        xargs -n1 |
+        sed ' s~[^-[:alnum:]+,./:=@_]~\\&~g; ' |
+        tr '\n' ' '
+    )" '"$@"'
+
+exec "$JAVACMD" "$@"
@@ -0,0 +1,91 @@
+@rem
+@rem Copyright 2004-present the original author or authors.
+@rem
+@rem Licensed under the Apache License, Version 2.0 (the "License");
+@rem you may not use this file except in compliance with the License.
+@rem You may obtain a copy of the License at
+@rem
+@rem      https://www.apache.org/licenses/LICENSE-2.0
+@rem
+@rem Unless required by applicable law or agreed to in writing, software
+@rem distributed under the License is distributed on an "AS IS" BASIS,
+@rem WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+@rem See the License for the specific language governing permissions and
+@rem limitations under the License.
+@rem
+
+@if "%DEBUG%"=="" @echo off
+@rem ##########################################################################
+@rem
+@rem  Gradle startup script for Windows
+@rem
+@rem ##########################################################################
+
+@rem Set local scope for the variables with windows NT shell
+if "%OS%"=="Windows_NT" setlocal
+
+set DIRNAME=%~dp0
+if "%DIRNAME%"=="" set DIRNAME=.
+set APP_BASE_NAME=%~n0
+set APP_HOME=%DIRNAME%
+
+@rem Resolve any "." and ".." in APP_HOME to make it shorter.
+for %%i in ("%APP_HOME%") do set APP_HOME=%%~fi
+
+@rem Add default JVM options here. You can also use JAVA_OPTS and GRADLE_OPTS to pass JVM options to this script.
+set DEFAULT_JVM_OPTS="-Xmx64m" "-Xms64m"
+
+@rem Find java.exe
+if defined JAVA_HOME goto findJavaFromJavaHome
+
+set JAVA_EXE=java.exe
+%JAVA_EXE% -version >NUL 2>&1
+if %ERRORLEVEL% equ 0 goto execute
+
+echo.
+echo ERROR: JAVA_HOME is not set and no 'java' command could be found in your PATH.
+echo.
+echo Please set the JAVA_HOME variable in your environment to match the
+echo location of your Java installation.
+
+goto fail
+
+:findJavaFromJavaHome
+set JAVA_HOME=%JAVA_HOME:"=%
+set JAVA_EXE=%JAVA_HOME%/bin/java.exe
+
+if exist "%JAVA_EXE%" goto execute
+
+echo.
+echo ERROR: JAVA_HOME is set to an invalid directory: %JAVA_HOME%
+echo.
+echo Please set the JAVA_HOME variable in your environment to match the
+echo location of your Java installation.
+
+goto fail
+
+:execute
+@rem Setup the command line
+
+set CLASSPATH=%APP_HOME%\gradle\wrapper\gradle-wrapper.jar
+
+
+@rem Execute Gradle
+"%JAVA_EXE%" %DEFAULT_JVM_OPTS% %JAVA_OPTS% %GRADLE_OPTS% "-Dorg.gradle.appname=%APP_BASE_NAME%" -classpath "%CLASSPATH%" org.gradle.wrapper.GradleWrapperMain %*
+
+:end
+@rem End local scope for the variables with windows NT shell
+if %ERRORLEVEL% equ 0 goto mainEnd
+
+:fail
+rem Set variable GRADLE_EXIT_CONSOLE if you need the _script_ return code instead of
+rem the _cmd.exe /c_ return code!
+set EXIT_CODE=%ERRORLEVEL%
+if %EXIT_CODE% equ 0 set EXIT_CODE=1
+if not ""=="%GRADLE_EXIT_CONSOLE%" exit %EXIT_CODE%
+exit /b %EXIT_CODE%
+
+:mainEnd
+if "%OS%"=="Windows_NT" endlocal
+
+:omega
@@ -0,0 +1,10 @@
+import org.gradle.api.tasks.compile.JavaCompile
+import org.jetbrains.kotlin.gradle.tasks.KotlinCompile
+
+tasks.withType(JavaCompile) {
+    options.compilerArgs += "-Werror"
+}
+
+tasks.withType(KotlinCompile) {
+    kotlinOptions.allWarningsAsErrors = true
+}
@@ -34,7 +34,7 @@ class JacocoPlugin implements Plugin<Project> {
 			project.tasks.check.dependsOn project.tasks.jacocoTestReport

 			project.jacoco {
-				toolVersion = '0.8.9'
+				toolVersion = '0.8.14'
 			}
 		}
 	}
@@ -43,16 +43,6 @@ class RepositoryConventionPlugin implements Plugin<Project> {
 				}
 			}
 			mavenCentral()
-			if (System.getenv("RELEASE_TRAIN_MAVEN_REPOSITORY_URL") != null) {
-				maven {
-					name = "Release Train"
-					url = System.getenv("RELEASE_TRAIN_MAVEN_REPOSITORY_URL")
-					credentials {
-						username = System.getenv("RELEASE_TRAIN_MAVEN_REPOSITORY_USERNAME")
-						password = System.getenv("RELEASE_TRAIN_MAVEN_REPOSITORY_PASSWORD")
-					}
-				}
-			}
 			if (isSnapshot) {
 				maven {
 					name = 'artifactory-snapshot'
@@ -5,7 +5,7 @@ def toolchainVersion() {
 	if (project.hasProperty('testToolchain')) {
 		return project.property('testToolchain').toString().toInteger()
 	}
-	return 17
+	return 25
 }

 java {
@@ -0,0 +1,7 @@
+import org.gradle.api.tasks.javadoc.Javadoc
+
+project.tasks.withType(Javadoc).configureEach {
+	options.addBooleanOption('Werror', true)
+	// temporarily disable missing to get build to pass with JDK 25
+	options.addStringOption('Xdoclint:all,-missing')
+}
@@ -0,0 +1,30 @@
+import org.gradle.api.tasks.compile.JavaCompile
+import org.jetbrains.kotlin.gradle.tasks.KotlinCompile
+
+/**
+ * We need to compile with JDK 25 for nullability support, but using JDK 25 means that our tests will fail due to the
+ * <a href="https://docs.oracle.com/en/java/javase/25/security/security-manager-is-permanently-disabled.html">removal
+ * of the Java Security Manager</a>. For example, in JDK 25 {@code Subject.getSubject(AccessControlContext)} throws an
+ * {@code UnsupportedOperationException}.
+ *
+ * To resolve this, we must migrate tests to use the new APIs (e.g. {@code Subject.current()}) but those APIs are not
+ * available in the JDK 17 source, so compiling with JDK 25 and release 17 fails. The plugin overrides the test
+ * compilation to use release 25.
+ *
+ * @see <a href="https://docs.oracle.com/en/java/javase/25/security/security-manager-is-permanently-disabled.html">The
+ * Security Manager Is Permanently Disabled</a>
+ * @see <a href="https://inside.java/2024/07/08/quality-heads-up/">Quality Outreach Heads-up - JDK 23: Re-Specified
+ * Subject.getSubject API</a>
+ */
+
+tasks.withType(JavaCompile).configureEach { task ->
+	if (task.name == 'compileTestJava' || task.name == 'compileIntegrationTestJava') {
+		task.options.release.set(25)
+	}
+}
+
+tasks.withType(KotlinCompile).configureEach { task ->
+	if (task.name == 'compileTestKotlin' || task.name == 'compileIntegrationTestKotlin') {
+		task.kotlinOptions.jvmTarget = '25'
+	}
+}
@@ -22,12 +22,6 @@ public class MavenPublishingConventionsPlugin implements Plugin<Project> {
 			@Override
 			public void execute(MavenPublishPlugin mavenPublish) {
 				PublishingExtension publishing = project.getExtensions().getByType(PublishingExtension.class);
-				if (project.hasProperty("deploymentRepository")) {
-					publishing.getRepositories().maven((mavenRepository) -> {
-						mavenRepository.setUrl(project.property("deploymentRepository"));
-						mavenRepository.setName("deployment");
-					});
-				}
 				publishing.getPublications().withType(MavenPublication.class)
 						.all((mavenPublication) -> MavenPublishingConventionsPlugin.this.customizePom(mavenPublication.getPom(), project));
 				MavenPublishingConventionsPlugin.this.customizeJavaPlugin(project);
@@ -108,7 +108,7 @@ public class CasAuthenticationToken extends AbstractAuthenticationToken implemen
 	protected CasAuthenticationToken(Builder<?> builder) {
 		super(builder);
 		Assert.isTrue(!"".equals(builder.principal), "principal cannot be null or empty");
-		Assert.isTrue(!"".equals(builder.credentials), "credentials cannot be null or empty");
+		Assert.notNull(!"".equals(builder.credentials), "credentials cannot be null or empty");
 		Assert.notNull(builder.userDetails, "userDetails cannot be null");
 		Assert.notNull(builder.assertion, "assertion cannot be null");
 		this.keyHash = builder.keyHash;
@@ -48,7 +48,6 @@ import org.springframework.security.jackson.SecurityJacksonModules;
 * @since 7.0
 * @see SecurityJacksonModules
 */
-@SuppressWarnings("serial")
 public class CasJacksonModule extends SecurityJacksonModule {

 	public CasJacksonModule() {
@@ -17,4 +17,7 @@
 /**
 * Jackson 3+ serialization support for CAS.
 */
+@NullMarked
 package org.springframework.security.cas.jackson;
+
+import org.jspecify.annotations.NullMarked;
@@ -34,7 +34,6 @@ import org.springframework.security.core.userdetails.UserDetails;
 import static org.assertj.core.api.Assertions.assertThat;
 import static org.assertj.core.api.Assertions.assertThatExceptionOfType;
 import static org.assertj.core.api.Assertions.assertThatIllegalArgumentException;
-import static org.assertj.core.api.Assertions.assertThatNoException;

 /**
 * Tests {@link CasAuthenticationToken}.
@@ -183,38 +182,4 @@ public class CasAuthenticationTokenTests {
 		assertThat(authorities).containsExactlyInAnyOrder("FACTOR_ONE", "FACTOR_TWO");
 	}

-	@Test
-	public void toBuilderWhenPrincipalIsEmpty() {
-		final Assertion assertion = new AssertionImpl("test");
-		CasAuthenticationToken token = new CasAuthenticationToken("key", makeUserDetails(), "Password", this.ROLES,
-				makeUserDetails(), assertion);
-		assertThatIllegalArgumentException().isThrownBy(() -> token.toBuilder().principal(null).build());
-		assertThatIllegalArgumentException().isThrownBy(() -> token.toBuilder().principal("").build());
-	}
-
-	@Test
-	public void toBuilderWhenPrincipalIsNotEmpty() {
-		final Assertion assertion = new AssertionImpl("test");
-		CasAuthenticationToken token = new CasAuthenticationToken("key", makeUserDetails(), "Password", this.ROLES,
-				makeUserDetails(), assertion);
-		assertThatNoException().isThrownBy(() -> token.toBuilder().principal("principal").build());
-	}
-
-	@Test
-	public void toBuilderWhenCredentialsIsEmpty() {
-		final Assertion assertion = new AssertionImpl("test");
-		CasAuthenticationToken token = new CasAuthenticationToken("key", makeUserDetails(), "Password", this.ROLES,
-				makeUserDetails(), assertion);
-		assertThatIllegalArgumentException().isThrownBy(() -> token.toBuilder().credentials(null).build());
-		assertThatIllegalArgumentException().isThrownBy(() -> token.toBuilder().credentials("").build());
-	}
-
-	@Test
-	public void toBuilderWhenCredentialsIsNotEmpty() {
-		final Assertion assertion = new AssertionImpl("test");
-		CasAuthenticationToken token = new CasAuthenticationToken("key", makeUserDetails(), "Password", this.ROLES,
-				makeUserDetails(), assertion);
-		assertThatNoException().isThrownBy(() -> token.toBuilder().credentials("credentials").build());
-	}
-
 }
@@ -1,27 +0,0 @@
-subprojects {
-	repositories {
-		mavenCentral()
-		def repoUsername = project.findProperty("artifactoryUsername") ?: System.getenv("COMMERCIAL_REPO_USERNAME")
-		def repoPassword = project.findProperty("artifactoryPassword") ?: System.getenv("COMMERCIAL_REPO_PASSWORD")
-		if (repoUsername && repoPassword) {
-			maven {
-				name "spring-commercial-release"
-				url "https://usw1.packages.broadcom.com/spring-enterprise-maven-prod-local"
-				credentials {
-					username repoUsername
-					password repoPassword
-				}
-			}
-			if ("$version".endsWith("-SNAPSHOT")) {
-				maven {
-					name "spring-commercial-snapshot"
-					url "https://usw1.packages.broadcom.com/spring-enterprise-maven-dev-local"
-					credentials {
-						username repoUsername
-						password repoPassword
-					}
-				}
-			}
-		}
-	}
-}
@@ -4,6 +4,7 @@ import trang.RncToXsd
 apply plugin: 'io.spring.convention.spring-module'
 apply plugin: 'trang'
 apply plugin: 'security-kotlin'
+apply plugin: 'test-compile-target-jdk25'

 configurations {
 	opensaml5 {
@@ -94,7 +94,7 @@ public final class SecurityNamespaceHandler implements NamespaceHandler {
 	public BeanDefinition parse(Element element, ParserContext pc) {
 		if (!namespaceMatchesVersion(element)) {
 			pc.getReaderContext()
-				.fatal("You cannot use any XSD older than spring-security-7.0.xsd. Either change to spring-security.xsd or spring-security-7.0.xsd",
+				.fatal("You cannot use any XSD older than spring-security-7.1.xsd. Either change to spring-security.xsd or spring-security-7.1.xsd",
 						element);
 		}
 		String name = pc.getDelegate().getLocalName(element);
@@ -219,7 +219,7 @@ public final class SecurityNamespaceHandler implements NamespaceHandler {

 	private boolean matchesVersionInternal(Element element) {
 		String schemaLocation = element.getAttributeNS("http://www.w3.org/2001/XMLSchema-instance", "schemaLocation");
-		return schemaLocation.matches("(?m).*spring-security-7\\.0.*.xsd.*")
+		return schemaLocation.matches("(?m).*spring-security-7\\.1.*.xsd.*")
 				|| schemaLocation.matches("(?m).*spring-security.xsd.*")
 				|| !schemaLocation.matches("(?m).*spring-security.*");
 	}
@@ -17,7 +17,6 @@
 package org.springframework.security.config.annotation.authentication.configurers.ldap;

 import java.io.IOException;
-import java.net.InetAddress;
 import java.net.ServerSocket;

 import org.springframework.ldap.core.support.BaseLdapPathContextSource;
@@ -591,7 +590,7 @@ public class LdapAuthenticationProviderConfigurer<B extends ProviderManagerBuild
 		}

 		private int getDefaultPort() {
-			try (ServerSocket serverSocket = new ServerSocket(DEFAULT_PORT, 50, InetAddress.getLoopbackAddress())) {
+			try (ServerSocket serverSocket = new ServerSocket(DEFAULT_PORT)) {
 				return serverSocket.getLocalPort();
 			}
 			catch (IOException ex) {
@@ -39,9 +39,6 @@ import org.springframework.util.ClassUtils;
@Deprecated
 final class GlobalMethodSecuritySelector implements ImportSelector {

-	private static final boolean isAccessPresent = ClassUtils.isPresent(
-			"org.springframework.security.access.intercept.aopalliance.MethodSecurityMetadataSourceAdvisor", null);
-
 	@Override
 	public String[] selectImports(AnnotationMetadata importingClassMetadata) {
 		Class<EnableGlobalMethodSecurity> annoType = EnableGlobalMethodSecurity.class;
@@ -62,26 +59,16 @@ final class GlobalMethodSecuritySelector implements ImportSelector {
 		boolean jsr250Enabled = attributes.getBoolean("jsr250Enabled");
 		List<String> classNames = new ArrayList<>(4);
 		if (isProxy) {
-			assertAccessModulePresent();
 			classNames.add(MethodSecurityMetadataSourceAdvisorRegistrar.class.getName());
 		}
 		classNames.add(autoProxyClassName);
 		if (!skipMethodSecurityConfiguration) {
-			assertAccessModulePresent();
 			classNames.add(GlobalMethodSecurityConfiguration.class.getName());
 		}
 		if (jsr250Enabled) {
-			assertAccessModulePresent();
 			classNames.add(Jsr250MetadataSourceConfiguration.class.getName());
 		}
 		return classNames.toArray(new String[0]);
 	}

-	private static void assertAccessModulePresent() {
-		Assert.state(isAccessPresent,
-				() -> "@EnableGlobalMethodSecurity requires the spring-security-access dependency on the "
-						+ "classpath. Please add spring-security-access, or migrate to @EnableMethodSecurity "
-						+ "which does not require it.");
-	}
-
 }
@@ -26,7 +26,6 @@ import org.springframework.context.annotation.AutoProxyRegistrar;
 import org.springframework.context.annotation.ImportSelector;
 import org.springframework.core.type.AnnotationMetadata;
 import org.springframework.lang.NonNull;
-import org.springframework.util.Assert;
 import org.springframework.util.ClassUtils;

 /**
@@ -36,8 +35,6 @@ import org.springframework.util.ClassUtils;
 */
 class ReactiveMethodSecuritySelector implements ImportSelector {

-	private static final String METHOD_SECURITY_METADATA_SOURCE_ADVISOR = "org.springframework.security.access.intercept.aopalliance.MethodSecurityMetadataSourceAdvisor";
-
 	private static final boolean isDataPresent = ClassUtils
 		.isPresent("org.springframework.security.data.aot.hint.AuthorizeReturnObjectDataHintsRegistrar", null);

@@ -59,11 +56,6 @@ class ReactiveMethodSecuritySelector implements ImportSelector {
 			imports.add(ReactiveAuthorizationManagerMethodSecurityConfiguration.class.getName());
 		}
 		else {
-			Assert.state(
-					ClassUtils.isPresent(METHOD_SECURITY_METADATA_SOURCE_ADVISOR, ClassUtils.getDefaultClassLoader()),
-					() -> "@EnableReactiveMethodSecurity(useAuthorizationManager = false) requires the "
-							+ "spring-security-access dependency on the classpath. Please add spring-security-access, "
-							+ "or use the default useAuthorizationManager = true which does not require it.");
 			imports.add(ReactiveMethodSecurityConfiguration.class.getName());
 		}
 		if (isDataPresent) {
@@ -2035,9 +2035,7 @@ public final class HttpSecurity extends AbstractConfiguredSecurityBuilder<Defaul
 	 */
 	public HttpSecurity securityMatcher(String... patterns) {
 		List<RequestMatcher> matchers = new ArrayList<>();
-		ApplicationContext context = getSharedObject(ApplicationContext.class);
-		PathPatternRequestMatcher.Builder builder = context.getBeanProvider(PathPatternRequestMatcher.Builder.class)
-			.getIfUnique(() -> getSharedObject(PathPatternRequestMatcher.Builder.class));
+		PathPatternRequestMatcher.Builder builder = getSharedObject(PathPatternRequestMatcher.Builder.class);
 		for (String pattern : patterns) {
 			matchers.add(builder.matcher(pattern));
 		}
@@ -379,8 +379,9 @@ public final class WebSecurity extends AbstractConfiguredSecurityBuilder<Filter,
 			}
 			if (filter instanceof AuthorizationFilter authorization) {
 				AuthorizationManager<HttpServletRequest> authorizationManager = authorization.getAuthorizationManager();
-				builder.add(securityFilterChain::matches, (authentication, context) -> authorizationManager
-					.authorize(authentication, context.getRequest()));
+				builder.add(securityFilterChain::matches,
+						(authentication, context) -> (AuthorizationDecision) authorizationManager
+							.authorize(authentication, context.getRequest()));
 				mappings = true;
 			}
 		}
@@ -39,7 +39,6 @@ import org.springframework.security.web.webauthn.api.PublicKeyCredentialRpEntity
 import org.springframework.security.web.webauthn.authentication.PublicKeyCredentialRequestOptionsFilter;
 import org.springframework.security.web.webauthn.authentication.WebAuthnAuthenticationFilter;
 import org.springframework.security.web.webauthn.authentication.WebAuthnAuthenticationProvider;
-import org.springframework.security.web.webauthn.management.CredentialRecordOwnerAuthorizationManager;
 import org.springframework.security.web.webauthn.management.MapPublicKeyCredentialUserEntityRepository;
 import org.springframework.security.web.webauthn.management.MapUserCredentialRepository;
 import org.springframework.security.web.webauthn.management.PublicKeyCredentialUserEntityRepository;
@@ -181,8 +180,6 @@ public class WebAuthnConfigurer<H extends HttpSecurityBuilder<H>>
 		webAuthnAuthnFilter = postProcess(webAuthnAuthnFilter);
 		WebAuthnRegistrationFilter webAuthnRegistrationFilter = new WebAuthnRegistrationFilter(userCredentials,
 				rpOperations);
-		webAuthnRegistrationFilter.setDeleteCredentialAuthorizationManager(
-				new CredentialRecordOwnerAuthorizationManager(userCredentials, userEntities));
 		PublicKeyCredentialCreationOptionsFilter creationOptionsFilter = new PublicKeyCredentialCreationOptionsFilter(
 				rpOperations);
 		if (creationOptionsRepository != null) {
@@ -16,9 +16,14 @@

 package org.springframework.security.config.annotation.web.configurers.oauth2.server.authorization;

+import java.util.Map;
+
 import com.nimbusds.jose.jwk.source.JWKSource;
 import com.nimbusds.jose.proc.SecurityContext;

+import org.springframework.beans.factory.BeanFactoryUtils;
+import org.springframework.beans.factory.NoSuchBeanDefinitionException;
+import org.springframework.beans.factory.NoUniqueBeanDefinitionException;
 import org.springframework.context.ApplicationContext;
 import org.springframework.core.ResolvableType;
 import org.springframework.security.config.annotation.web.builders.HttpSecurity;
@@ -40,6 +45,7 @@ import org.springframework.security.oauth2.server.authorization.token.OAuth2Toke
 import org.springframework.security.oauth2.server.authorization.token.OAuth2TokenCustomizer;
 import org.springframework.security.oauth2.server.authorization.token.OAuth2TokenGenerator;
 import org.springframework.util.Assert;
+import org.springframework.util.StringUtils;

 /**
 * Utility methods for the OAuth 2.0 Configurers.
@@ -201,16 +207,41 @@ final class OAuth2ConfigurerUtils {
 	}

 	static <T> T getBean(HttpSecurity httpSecurity, Class<T> type) {
-		return httpSecurity.getSharedObject(ApplicationContext.class).getBeanProvider(type).getObject();
+		return httpSecurity.getSharedObject(ApplicationContext.class).getBean(type);
+	}
+
+	@SuppressWarnings("unchecked")
+	static <T> T getBean(HttpSecurity httpSecurity, ResolvableType type) {
+		ApplicationContext context = httpSecurity.getSharedObject(ApplicationContext.class);
+		String[] names = context.getBeanNamesForType(type);
+		if (names.length == 1) {
+			return (T) context.getBean(names[0]);
+		}
+		if (names.length > 1) {
+			throw new NoUniqueBeanDefinitionException(type, names);
+		}
+		throw new NoSuchBeanDefinitionException(type);
 	}

 	static <T> T getOptionalBean(HttpSecurity httpSecurity, Class<T> type) {
-		return httpSecurity.getSharedObject(ApplicationContext.class).getBeanProvider(type).getIfUnique();
+		Map<String, T> beansMap = BeanFactoryUtils
+			.beansOfTypeIncludingAncestors(httpSecurity.getSharedObject(ApplicationContext.class), type);
+		if (beansMap.size() > 1) {
+			throw new NoUniqueBeanDefinitionException(type, beansMap.size(),
+					"Expected single matching bean of type '" + type.getName() + "' but found " + beansMap.size() + ": "
+							+ StringUtils.collectionToCommaDelimitedString(beansMap.keySet()));
+		}
+		return (!beansMap.isEmpty() ? beansMap.values().iterator().next() : null);
 	}

 	@SuppressWarnings("unchecked")
 	static <T> T getOptionalBean(HttpSecurity httpSecurity, ResolvableType type) {
-		return (T) httpSecurity.getSharedObject(ApplicationContext.class).getBeanProvider(type).getIfUnique();
+		ApplicationContext context = httpSecurity.getSharedObject(ApplicationContext.class);
+		String[] names = context.getBeanNamesForType(type);
+		if (names.length > 1) {
+			throw new NoUniqueBeanDefinitionException(type, names);
+		}
+		return (names.length == 1) ? (T) context.getBean(names[0]) : null;
 	}

 }
@@ -40,11 +40,11 @@ import org.springframework.security.oauth2.server.authorization.settings.Authori
 import org.springframework.security.oauth2.server.authorization.web.OAuth2DeviceVerificationEndpointFilter;
 import org.springframework.security.oauth2.server.authorization.web.authentication.OAuth2DeviceAuthorizationConsentAuthenticationConverter;
 import org.springframework.security.oauth2.server.authorization.web.authentication.OAuth2DeviceVerificationAuthenticationConverter;
-import org.springframework.security.web.access.intercept.AuthorizationFilter;
 import org.springframework.security.web.authentication.AuthenticationConverter;
 import org.springframework.security.web.authentication.AuthenticationFailureHandler;
 import org.springframework.security.web.authentication.AuthenticationSuccessHandler;
 import org.springframework.security.web.authentication.DelegatingAuthenticationConverter;
+import org.springframework.security.web.authentication.preauth.AbstractPreAuthenticatedProcessingFilter;
 import org.springframework.security.web.servlet.util.matcher.PathPatternRequestMatcher;
 import org.springframework.security.web.util.matcher.OrRequestMatcher;
 import org.springframework.security.web.util.matcher.RequestMatcher;
@@ -279,7 +279,8 @@ public final class OAuth2DeviceVerificationEndpointConfigurer extends AbstractOA
 		if (StringUtils.hasText(this.consentPage)) {
 			deviceVerificationEndpointFilter.setConsentPage(this.consentPage);
 		}
-		builder.addFilterAfter(postProcess(deviceVerificationEndpointFilter), AuthorizationFilter.class);
+		builder.addFilterBefore(postProcess(deviceVerificationEndpointFilter),
+				AbstractPreAuthenticatedProcessingFilter.class);
 	}

 	@Override
@@ -79,10 +79,8 @@ final class DPoPAuthenticationConfigurer<B extends HttpSecurityBuilder<B>>

 	@Override
 	public void configure(B http) {
-		DPoPAuthenticationProvider authenticationProvider = new DPoPAuthenticationProvider(
-				getTokenAuthenticationManager(http));
-		http.authenticationProvider(postProcess(authenticationProvider));
 		AuthenticationManager authenticationManager = http.getSharedObject(AuthenticationManager.class);
+		http.authenticationProvider(new DPoPAuthenticationProvider(getTokenAuthenticationManager(http)));
 		AuthenticationFilter authenticationFilter = new AuthenticationFilter(authenticationManager,
 				getAuthenticationConverter());
 		authenticationFilter.setRequestMatcher(getRequestMatcher());
@@ -33,7 +33,6 @@ import org.springframework.security.authentication.AuthenticationManager;
 import org.springframework.security.authentication.AuthenticationManagerResolver;
 import org.springframework.security.authentication.AuthenticationProvider;
 import org.springframework.security.config.Customizer;
-import org.springframework.security.config.ObjectPostProcessor;
 import org.springframework.security.config.annotation.web.HttpSecurityBuilder;
 import org.springframework.security.config.annotation.web.configurers.AbstractHttpConfigurer;
 import org.springframework.security.config.annotation.web.configurers.CsrfConfigurer;
@@ -299,8 +298,6 @@ public final class OAuth2ResourceServerConfigurer<H extends HttpSecurityBuilder<

 		if (dPoPAuthenticationAvailable) {
 			DPoPAuthenticationConfigurer<H> dPoPAuthenticationConfigurer = new DPoPAuthenticationConfigurer<>();
-			dPoPAuthenticationConfigurer.withObjectPostProcessor(
-					(ObjectPostProcessor<Object>) OAuth2ResourceServerConfigurer.this::postProcess);
 			dPoPAuthenticationConfigurer.configure(http);
 		}

@@ -255,9 +255,7 @@ class ServerHttpSecurityConfiguration {
 			if (this.passwordEncoder != null) {
 				manager.setPasswordEncoder(this.passwordEncoder);
 			}
-			if (this.userDetailsPasswordService != null) {
-				manager.setUserDetailsPasswordService(this.userDetailsPasswordService);
-			}
+			manager.setUserDetailsPasswordService(this.userDetailsPasswordService);
 			manager.setCompromisedPasswordChecker(this.compromisedPasswordChecker);
 			return this.postProcessor.postProcess(manager);
 		}
@@ -70,7 +70,7 @@ public final class PathPatternRequestMatcherFactoryBean
 	@Override
 	public void afterPropertiesSet() throws Exception {
 		if (this.basePath != null) {
-			this.builder = this.builder.basePath(this.basePath);
+			this.builder.basePath(this.basePath);
 		}
 	}

@@ -17,7 +17,6 @@
 package org.springframework.security.config.ldap;

 import java.io.IOException;
-import java.net.InetAddress;
 import java.net.ServerSocket;

 import org.w3c.dom.Element;
@@ -189,7 +188,7 @@ public class LdapServerBeanDefinitionParser implements BeanDefinitionParser {
 	}

 	private String getDefaultPort() {
-		try (ServerSocket serverSocket = new ServerSocket(DEFAULT_PORT, 50, InetAddress.getLoopbackAddress())) {
+		try (ServerSocket serverSocket = new ServerSocket(DEFAULT_PORT)) {
 			return String.valueOf(serverSocket.getLocalPort());
 		}
 		catch (IOException ex) {
@@ -14,6 +14,8 @@
 # limitations under the License.
 #

+http\://www.springframework.org/schema/security/spring-security.xsd=org/springframework/security/config/spring-security-7.1.xsd
+http\://www.springframework.org/schema/security/spring-security-7.0.xsd=org/springframework/security/config/spring-security-7.1.xsd
 http\://www.springframework.org/schema/security/spring-security.xsd=org/springframework/security/config/spring-security-7.0.xsd
 http\://www.springframework.org/schema/security/spring-security-7.0.xsd=org/springframework/security/config/spring-security-7.0.xsd
 http\://www.springframework.org/schema/security/spring-security-6.5.xsd=org/springframework/security/config/spring-security-6.5.xsd
@@ -42,7 +44,8 @@ http\://www.springframework.org/schema/security/spring-security-2.0.xsd=org/spri
 http\://www.springframework.org/schema/security/spring-security-2.0.1.xsd=org/springframework/security/config/spring-security-2.0.1.xsd
 http\://www.springframework.org/schema/security/spring-security-2.0.2.xsd=org/springframework/security/config/spring-security-2.0.2.xsd
 http\://www.springframework.org/schema/security/spring-security-2.0.4.xsd=org/springframework/security/config/spring-security-2.0.4.xsd
-https\://www.springframework.org/schema/security/spring-security.xsd=org/springframework/security/config/spring-security-7.0.xsd
+https\://www.springframework.org/schema/security/spring-security.xsd=org/springframework/security/config/spring-security-7.1.xsd
+https\://www.springframework.org/schema/security/spring-security-7.1.xsd=org/springframework/security/config/spring-security-7.1.xsd
 https\://www.springframework.org/schema/security/spring-security-7.0.xsd=org/springframework/security/config/spring-security-7.0.xsd
 https\://www.springframework.org/schema/security/spring-security-6.5.xsd=org/springframework/security/config/spring-security-6.5.xsd
 https\://www.springframework.org/schema/security/spring-security-6.4.xsd=org/springframework/security/config/spring-security-6.4.xsd
@@ -12,8 +12,8 @@ base64 =
 	## Whether a string should be base64 encoded
 	attribute base64 {xsd:boolean}
 request-matcher =
-	## Defines the strategy use for matching incoming requests. Currently the options are 'path' (for PathPatternRequestMatcher), 'regex' for regular expressions and 'ciRegex' for case-insensitive regular expressions.
-	attribute request-matcher {"path" | "regex" | "ciRegex"}
+	## Defines the strategy use for matching incoming requests. Currently the options are 'mvc' (for Spring MVC matcher), 'ant' (for ant path patterns), 'regex' for regular expressions and 'ciRegex' for case-insensitive regular expressions.
+	attribute request-matcher {"mvc" | "ant" | "regex" | "ciRegex"}
 port =
 	## Specifies an IP port number. Used to configure an embedded LDAP server, for example.
 	attribute port { xsd:nonNegativeInteger }
@@ -27,14 +27,15 @@
  <xs:attributeGroup name="request-matcher">
      <xs:attribute name="request-matcher" use="required">
         <xs:annotation>
-            <xs:documentation>Defines the strategy use for matching incoming requests. Currently the options are 'path'
-                (for PathPatternRequestMatcher), 'regex' for regular expressions and 'ciRegex' for
-                case-insensitive regular expressions.
+            <xs:documentation>Defines the strategy use for matching incoming requests. Currently the options are 'mvc'
+                (for Spring MVC matcher), 'ant' (for ant path patterns), 'regex' for regular expressions
+                and 'ciRegex' for case-insensitive regular expressions.
                </xs:documentation>
         </xs:annotation>
         <xs:simpleType>
            <xs:restriction base="xs:token">
-               <xs:enumeration value="path"/>
+               <xs:enumeration value="mvc"/>
+               <xs:enumeration value="ant"/>
               <xs:enumeration value="regex"/>
               <xs:enumeration value="ciRegex"/>
            </xs:restriction>
@@ -1305,14 +1306,15 @@
      </xs:attribute>
      <xs:attribute name="request-matcher">
         <xs:annotation>
-            <xs:documentation>Defines the strategy use for matching incoming requests. Currently the options are 'path'
-                (for PathPatternRequestMatcher), 'regex' for regular expressions and 'ciRegex' for
-                case-insensitive regular expressions.
+            <xs:documentation>Defines the strategy use for matching incoming requests. Currently the options are 'mvc'
+                (for Spring MVC matcher), 'ant' (for ant path patterns), 'regex' for regular expressions
+                and 'ciRegex' for case-insensitive regular expressions.
                </xs:documentation>
         </xs:annotation>
         <xs:simpleType>
            <xs:restriction base="xs:token">
-               <xs:enumeration value="path"/>
+               <xs:enumeration value="mvc"/>
+               <xs:enumeration value="ant"/>
               <xs:enumeration value="regex"/>
               <xs:enumeration value="ciRegex"/>
            </xs:restriction>
@@ -2472,14 +2474,15 @@
  <xs:attributeGroup name="filter-chain-map.attlist">
      <xs:attribute name="request-matcher">
         <xs:annotation>
-            <xs:documentation>Defines the strategy use for matching incoming requests. Currently the options are 'path'
-                (for PathPatternRequestMatcher), 'regex' for regular expressions and 'ciRegex' for
-                case-insensitive regular expressions.
+            <xs:documentation>Defines the strategy use for matching incoming requests. Currently the options are 'mvc'
+                (for Spring MVC matcher), 'ant' (for ant path patterns), 'regex' for regular expressions
+                and 'ciRegex' for case-insensitive regular expressions.
                </xs:documentation>
         </xs:annotation>
         <xs:simpleType>
            <xs:restriction base="xs:token">
-               <xs:enumeration value="path"/>
+               <xs:enumeration value="mvc"/>
+               <xs:enumeration value="ant"/>
               <xs:enumeration value="regex"/>
               <xs:enumeration value="ciRegex"/>
            </xs:restriction>
@@ -2577,14 +2580,15 @@
      </xs:attribute>
      <xs:attribute name="request-matcher">
         <xs:annotation>
-            <xs:documentation>Defines the strategy use for matching incoming requests. Currently the options are 'path'
-                (for PathPatternRequestMatcher), 'regex' for regular expressions and 'ciRegex' for
-                case-insensitive regular expressions.
+            <xs:documentation>Defines the strategy use for matching incoming requests. Currently the options are 'mvc'
+                (for Spring MVC matcher), 'ant' (for ant path patterns), 'regex' for regular expressions
+                and 'ciRegex' for case-insensitive regular expressions.
                </xs:documentation>
         </xs:annotation>
         <xs:simpleType>
            <xs:restriction base="xs:token">
-               <xs:enumeration value="path"/>
+               <xs:enumeration value="mvc"/>
+               <xs:enumeration value="ant"/>
               <xs:enumeration value="regex"/>
               <xs:enumeration value="ciRegex"/>
            </xs:restriction>
@@ -20,7 +20,6 @@ import java.io.IOException;
 import java.io.Serializable;
 import java.lang.reflect.Field;
 import java.security.Principal;
-import java.time.Duration;
 import java.time.Instant;
 import java.util.Collection;
 import java.util.Date;
@@ -86,9 +85,6 @@ import org.springframework.security.authentication.password.CompromisedPasswordE
 import org.springframework.security.authorization.AuthorityAuthorizationDecision;
 import org.springframework.security.authorization.AuthorizationDecision;
 import org.springframework.security.authorization.AuthorizationDeniedException;
-import org.springframework.security.authorization.FactorAuthorizationDecision;
-import org.springframework.security.authorization.RequiredFactor;
-import org.springframework.security.authorization.RequiredFactorError;
 import org.springframework.security.authorization.event.AuthorizationEvent;
 import org.springframework.security.authorization.event.AuthorizationGrantedEvent;
 import org.springframework.security.cas.authentication.CasAssertionAuthenticationToken;
@@ -165,7 +161,6 @@ import org.springframework.security.oauth2.jwt.JwtException;
 import org.springframework.security.oauth2.jwt.JwtValidationException;
 import org.springframework.security.oauth2.jwt.TestJwts;
 import org.springframework.security.oauth2.server.authorization.OAuth2Authorization;
-import org.springframework.security.oauth2.server.authorization.OAuth2AuthorizationCode;
 import org.springframework.security.oauth2.server.authorization.OAuth2AuthorizationConsent;
 import org.springframework.security.oauth2.server.authorization.OAuth2AuthorizationServerMetadata;
 import org.springframework.security.oauth2.server.authorization.OAuth2ClientRegistration;
@@ -173,22 +168,15 @@ import org.springframework.security.oauth2.server.authorization.OAuth2TokenIntro
 import org.springframework.security.oauth2.server.authorization.OAuth2TokenType;
 import org.springframework.security.oauth2.server.authorization.TestOAuth2Authorizations;
 import org.springframework.security.oauth2.server.authorization.authentication.OAuth2AccessTokenAuthenticationToken;
-import org.springframework.security.oauth2.server.authorization.authentication.OAuth2AuthorizationCodeRequestAuthenticationException;
 import org.springframework.security.oauth2.server.authorization.authentication.OAuth2AuthorizationCodeRequestAuthenticationToken;
 import org.springframework.security.oauth2.server.authorization.authentication.OAuth2AuthorizationConsentAuthenticationToken;
 import org.springframework.security.oauth2.server.authorization.authentication.OAuth2AuthorizationGrantAuthenticationToken;
 import org.springframework.security.oauth2.server.authorization.authentication.OAuth2ClientAuthenticationToken;
-import org.springframework.security.oauth2.server.authorization.authentication.OAuth2ClientCredentialsAuthenticationToken;
 import org.springframework.security.oauth2.server.authorization.authentication.OAuth2ClientRegistrationAuthenticationToken;
 import org.springframework.security.oauth2.server.authorization.authentication.OAuth2DeviceAuthorizationConsentAuthenticationToken;
 import org.springframework.security.oauth2.server.authorization.authentication.OAuth2DeviceAuthorizationRequestAuthenticationToken;
-import org.springframework.security.oauth2.server.authorization.authentication.OAuth2DeviceCodeAuthenticationToken;
 import org.springframework.security.oauth2.server.authorization.authentication.OAuth2DeviceVerificationAuthenticationToken;
 import org.springframework.security.oauth2.server.authorization.authentication.OAuth2PushedAuthorizationRequestAuthenticationToken;
-import org.springframework.security.oauth2.server.authorization.authentication.OAuth2RefreshTokenAuthenticationToken;
-import org.springframework.security.oauth2.server.authorization.authentication.OAuth2TokenExchangeActor;
-import org.springframework.security.oauth2.server.authorization.authentication.OAuth2TokenExchangeAuthenticationToken;
-import org.springframework.security.oauth2.server.authorization.authentication.OAuth2TokenExchangeCompositeAuthenticationToken;
 import org.springframework.security.oauth2.server.authorization.authentication.OAuth2TokenIntrospectionAuthenticationToken;
 import org.springframework.security.oauth2.server.authorization.authentication.OAuth2TokenRevocationAuthenticationToken;
 import org.springframework.security.oauth2.server.authorization.client.RegisteredClient;
@@ -202,7 +190,6 @@ import org.springframework.security.oauth2.server.authorization.settings.Authori
 import org.springframework.security.oauth2.server.authorization.settings.ClientSettings;
 import org.springframework.security.oauth2.server.authorization.settings.OAuth2TokenFormat;
 import org.springframework.security.oauth2.server.authorization.settings.TokenSettings;
-import org.springframework.security.oauth2.server.authorization.token.OAuth2TokenClaimNames;
 import org.springframework.security.oauth2.server.resource.BearerTokenError;
 import org.springframework.security.oauth2.server.resource.BearerTokenErrors;
 import org.springframework.security.oauth2.server.resource.InvalidBearerTokenException;
@@ -262,7 +249,6 @@ import org.springframework.security.web.webauthn.api.AuthenticationExtensionsCli
 import org.springframework.security.web.webauthn.api.AuthenticationExtensionsClientOutputs;
 import org.springframework.security.web.webauthn.api.AuthenticatorAssertionResponse;
 import org.springframework.security.web.webauthn.api.AuthenticatorAttachment;
-import org.springframework.security.web.webauthn.api.AuthenticatorAttestationResponse;
 import org.springframework.security.web.webauthn.api.AuthenticatorTransport;
 import org.springframework.security.web.webauthn.api.Bytes;
 import org.springframework.security.web.webauthn.api.CredProtectAuthenticationExtensionsClientInput;
@@ -277,7 +263,6 @@ import org.springframework.security.web.webauthn.api.PublicKeyCredentialRequestO
 import org.springframework.security.web.webauthn.api.PublicKeyCredentialType;
 import org.springframework.security.web.webauthn.api.PublicKeyCredentialUserEntity;
 import org.springframework.security.web.webauthn.api.TestAuthenticationAssertionResponses;
-import org.springframework.security.web.webauthn.api.TestAuthenticatorAttestationResponses;
 import org.springframework.security.web.webauthn.api.TestBytes;
 import org.springframework.security.web.webauthn.api.TestPublicKeyCredentialRequestOptions;
 import org.springframework.security.web.webauthn.api.TestPublicKeyCredentialUserEntities;
@@ -442,8 +427,6 @@ final class SerializationSamples {
 		generatorByClassName.put(RegisteredClient.class, (r) -> registeredClient);
 		generatorByClassName.put(OAuth2Authorization.class, (r) -> authorization);
 		generatorByClassName.put(OAuth2Authorization.Token.class, (r) -> authorization.getAccessToken());
-		generatorByClassName.put(OAuth2AuthorizationCode.class,
-				(r) -> new OAuth2AuthorizationCode("code", Instant.now(), Instant.now().plusSeconds(300)));
 		generatorByClassName.put(OAuth2AuthorizationConsent.class,
 				(r) -> OAuth2AuthorizationConsent.withId("registeredClientId", "principalName")
 					.scope("scope1")
@@ -469,58 +452,6 @@ final class SerializationSamples {
 			authenticationToken.setDetails(details);
 			return authenticationToken;
 		});
-		generatorByClassName.put(
-				org.springframework.security.oauth2.server.authorization.authentication.OAuth2AuthorizationCodeAuthenticationToken.class,
-				(r) -> {
-					org.springframework.security.oauth2.server.authorization.authentication.OAuth2AuthorizationCodeAuthenticationToken token = new org.springframework.security.oauth2.server.authorization.authentication.OAuth2AuthorizationCodeAuthenticationToken(
-							"code", principal, "https://localhost/callback", Map.of("custom_param", "custom_value"));
-					token.setDetails(details);
-					return token;
-				});
-		generatorByClassName.put(OAuth2AuthorizationCodeRequestAuthenticationException.class, (r) -> {
-			OAuth2AuthorizationCodeRequestAuthenticationToken authToken = new OAuth2AuthorizationCodeRequestAuthenticationToken(
-					"https://localhost/authorize", "clientId", principal, "https://localhost/callback", "state",
-					authorizationRequest.getScopes(), authorizationRequest.getAdditionalParameters());
-			return new OAuth2AuthorizationCodeRequestAuthenticationException(
-					new OAuth2Error("invalid_request", "Missing required parameter", "https://example.com/error"),
-					authToken);
-		});
-		generatorByClassName.put(OAuth2ClientCredentialsAuthenticationToken.class, (r) -> {
-			OAuth2ClientCredentialsAuthenticationToken token = new OAuth2ClientCredentialsAuthenticationToken(principal,
-					Set.of("scope1", "scope2"), Map.of("custom_param", "custom_value"));
-			token.setDetails(details);
-			return token;
-		});
-		generatorByClassName.put(OAuth2DeviceCodeAuthenticationToken.class, (r) -> {
-			OAuth2DeviceCodeAuthenticationToken token = new OAuth2DeviceCodeAuthenticationToken("device-code",
-					principal, Map.of("custom_param", "custom_value"));
-			token.setDetails(details);
-			return token;
-		});
-		generatorByClassName.put(OAuth2RefreshTokenAuthenticationToken.class, (r) -> {
-			OAuth2RefreshTokenAuthenticationToken token = new OAuth2RefreshTokenAuthenticationToken("refresh-token",
-					principal, Set.of("scope1", "scope2"), Map.of("custom_param", "custom_value"));
-			token.setDetails(details);
-			return token;
-		});
-		generatorByClassName.put(OAuth2TokenExchangeAuthenticationToken.class, (r) -> {
-			OAuth2TokenExchangeAuthenticationToken token = new OAuth2TokenExchangeAuthenticationToken(
-					"urn:ietf:params:oauth:token-type:access_token", "subject-token",
-					"urn:ietf:params:oauth:token-type:jwt", principal, "actor-token",
-					"urn:ietf:params:oauth:token-type:jwt", Set.of("https://resource.example.com"), Set.of("audience"),
-					Set.of("scope1"), Map.of("custom_param", "custom_value"));
-			token.setDetails(details);
-			return token;
-		});
-		OAuth2TokenExchangeActor actor = new OAuth2TokenExchangeActor(Map.of(OAuth2TokenClaimNames.ISS,
-				"https://issuer.example.com", OAuth2TokenClaimNames.SUB, "actor-subject"));
-		generatorByClassName.put(OAuth2TokenExchangeActor.class, (r) -> actor);
-		generatorByClassName.put(OAuth2TokenExchangeCompositeAuthenticationToken.class, (r) -> {
-			AbstractAuthenticationToken token = new OAuth2TokenExchangeCompositeAuthenticationToken(authentication,
-					List.of(actor));
-			token.setDetails(details);
-			return token;
-		});
 		generatorByClassName.put(OAuth2AuthorizationConsentAuthenticationToken.class, (r) -> {
 			OAuth2AuthorizationConsentAuthenticationToken authenticationToken = new OAuth2AuthorizationConsentAuthenticationToken(
 					"authorizationUri", "clientId", principal, "state", authorizationRequest.getScopes(),
@@ -737,12 +668,6 @@ final class SerializationSamples {
 		generatorByClassName.put(AuthorizationDecision.class, (r) -> new AuthorizationDecision(true));
 		generatorByClassName.put(AuthorityAuthorizationDecision.class,
 				(r) -> new AuthorityAuthorizationDecision(true, AuthorityUtils.createAuthorityList("ROLE_USER")));
-		RequiredFactor factor = RequiredFactor.withAuthority("authority").validDuration(Duration.ofSeconds(5)).build();
-		generatorByClassName.put(RequiredFactor.class, (r) -> factor);
-		RequiredFactorError error = RequiredFactorError.createMissing(factor);
-		generatorByClassName.put(RequiredFactorError.class, (r) -> error);
-		generatorByClassName.put(FactorAuthorizationDecision.class,
-				(r) -> new FactorAuthorizationDecision(List.of(error)));
 		generatorByClassName.put(CycleInRoleHierarchyException.class, (r) -> new CycleInRoleHierarchyException());
 		generatorByClassName.put(AuthorizationEvent.class,
 				(r) -> new AuthorizationEvent(new SerializableSupplier<>(authentication), "source",
@@ -933,8 +858,6 @@ final class SerializationSamples {
 		generatorByClassName.put(CredentialPropertiesOutput.class, (o) -> credentialOutput);
 		generatorByClassName.put(ImmutableAuthenticationExtensionsClientOutputs.class, (o) -> outputs);
 		generatorByClassName.put(AuthenticatorAssertionResponse.class, (r) -> response);
-		generatorByClassName.put(AuthenticatorAttestationResponse.class,
-				(r) -> TestAuthenticatorAttestationResponses.createAuthenticatorAttestationResponse().build());
 		generatorByClassName.put(RelyingPartyAuthenticationRequest.class, (r) -> authRequest);
 		generatorByClassName.put(PublicKeyCredential.class, (r) -> credential);
 		generatorByClassName.put(WebAuthnAuthenticationRequestToken.class, (r) -> requestToken);
@@ -33,10 +33,10 @@ import java.nio.file.Files;
 import java.nio.file.Path;
 import java.nio.file.Paths;
 import java.util.ArrayList;
+import java.util.Arrays;
 import java.util.HashSet;
 import java.util.List;
 import java.util.Set;
-import java.util.regex.Pattern;
 import java.util.stream.Stream;

 import org.apache.commons.lang3.ObjectUtils;
@@ -207,7 +207,10 @@ class SpringSecurityCoreVersionSerializableTests {
 			boolean hasSerialVersion = Stream.of(clazz.getDeclaredFields())
 				.map(Field::getName)
 				.anyMatch((n) -> n.equals("serialVersionUID"));
-			if (!hasSerialVersion && !hasSuppressSerialInSource(clazz)) {
+			SuppressWarnings suppressWarnings = clazz.getAnnotation(SuppressWarnings.class);
+			boolean hasSerialIgnore = suppressWarnings == null
+					|| Arrays.asList(suppressWarnings.value()).contains("Serial");
+			if (!hasSerialVersion && !hasSerialIgnore) {
 				classes.add(clazz);
 				continue;
 			}
@@ -246,62 +249,11 @@ class SpringSecurityCoreVersionSerializableTests {
 		return classes.stream();
 	}

-	private static boolean hasSuppressSerialInSource(Class<?> clazz) {
-		try {
-			Class<?> fileClass = clazz;
-			while (fileClass.getEnclosingClass() != null) {
-				fileClass = fileClass.getEnclosingClass();
-			}
-			var codeSource = fileClass.getProtectionDomain().getCodeSource();
-			if (codeSource == null) {
-				return false;
-			}
-			Path sourceFile = findSourceFile(Path.of(codeSource.getLocation().toURI()), fileClass);
-			if (sourceFile == null) {
-				return false;
-			}
-			return hasSuppressSerialAnnotation(Files.readAllLines(sourceFile), clazz.getSimpleName());
-		}
-		catch (Exception ex) {
-			return false;
-		}
-	}
-
-	private static Path findSourceFile(Path start, Class<?> clazz) {
-		String relativePath = clazz.getName().replace('.', '/') + ".java";
-		Path dir = start;
-		for (int i = 0; i < 10 && dir != null; i++) {
-			for (String sourceRoot : List.of("src/main/java", "src/test/java")) {
-				Path candidate = dir.resolve(sourceRoot).resolve(relativePath);
-				if (Files.exists(candidate)) {
-					return candidate;
-				}
-			}
-			dir = dir.getParent();
-		}
-		return null;
-	}
-
-	private static boolean hasSuppressSerialAnnotation(List<String> lines, String simpleClassName) {
-		Pattern classDeclaration = Pattern
-			.compile("\\b(?:class|interface|enum|record)\\s+" + Pattern.quote(simpleClassName) + "\\b");
-		for (int i = 0; i < lines.size(); i++) {
-			if (classDeclaration.matcher(lines.get(i)).find()) {
-				for (int j = Math.max(0, i - 5); j < i; j++) {
-					String line = lines.get(j);
-					if (line.contains("@SuppressWarnings") && line.contains("\"serial\"")) {
-						return true;
-					}
-				}
-			}
-		}
-		return false;
-	}
-
 	private static String getCurrentVersion() {
 		String version = System.getProperty("springSecurityVersion");
 		String[] parts = version.split("\\.");
-		return parts[0] + "." + parts[1] + ".x";
+		parts[2] = "x";
+		return String.join(".", parts);
 	}

 	private static String getPreviousVersion() {
@@ -314,7 +266,8 @@ class SpringSecurityCoreVersionSerializableTests {
 			parts[0] = String.valueOf(Integer.parseInt(parts[0]) - 1);
 			parts[1] = "5"; // FIXME: this should not be hard coded
 		}
-		return parts[0] + "." + parts[1] + ".x";
+		parts[2] = "x";
+		return String.join(".", parts);
 	}

 }
@@ -114,7 +114,7 @@ public class SecurityNamespaceHandlerTests {
 					"<user-service id='us'><user name='bob' password='bobspassword' authorities='ROLE_A' /></user-service>",
 					"3.0.3", null))
 			.withMessageContaining(
-					"You cannot use any XSD older than spring-security-7.0.xsd. Either change to spring-security.xsd or spring-security-7.0.xsd");
+					"You cannot use any XSD older than spring-security-7.1.xsd. Either change to spring-security.xsd or spring-security-7.1.xsd");
 	}

 	// SEC-1868
@@ -1,138 +0,0 @@
-/*
- * Copyright 2004-present the original author or authors.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *      https://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.springframework.security.config.annotation.method.configuration;
-
-import org.junit.jupiter.api.Test;
-
-import org.springframework.context.annotation.AdviceMode;
-import org.springframework.context.annotation.AnnotationConfigApplicationContext;
-import org.springframework.context.annotation.Configuration;
-import org.springframework.security.test.support.ClassPathExclusions;
-
-import static org.assertj.core.api.Assertions.assertThatExceptionOfType;
-
-/**
- * Tests for gh-19441: {@code spring-security-access} moved
- * {@link org.springframework.security.access.intercept.aopalliance.MethodSecurityMetadataSourceAdvisor}
- * out of {@code spring-security-core} and into the optional
- * {@code spring-security-access} module. {@link EnableMethodSecurity} and
- * {@link EnableReactiveMethodSecurity}'s default (AuthorizationManager-based) mode never
- * needed that class and continue to work without {@code spring-security-access} on the
- * classpath, but the deprecated legacy method security annotations do need it and
- * previously failed with a confusing {@link NoClassDefFoundError} instead of an
- * actionable message.
- */
-@ClassPathExclusions("spring-security-access-*.jar")
-public class Gh19441Tests {
-
-	@Test
-	public void enableMethodSecurityWhenAccessModuleAbsentThenContextStartsCleanly() {
-		try (AnnotationConfigApplicationContext context = new AnnotationConfigApplicationContext()) {
-			context.register(EnableMethodSecurityConfig.class);
-			context.refresh();
-		}
-	}
-
-	@Test
-	public void enableReactiveMethodSecurityWhenAccessModuleAbsentThenContextStartsCleanly() {
-		try (AnnotationConfigApplicationContext context = new AnnotationConfigApplicationContext()) {
-			context.register(EnableReactiveMethodSecurityConfig.class);
-			context.refresh();
-		}
-	}
-
-	@Test
-	public void enableGlobalMethodSecurityWhenProxyModeAndAccessModuleAbsentThenClearException() {
-		try (AnnotationConfigApplicationContext context = new AnnotationConfigApplicationContext()) {
-			context.register(EnableGlobalMethodSecurityProxyConfig.class);
-			assertThatExceptionOfType(Exception.class).isThrownBy(context::refresh)
-				.havingRootCause()
-				.isInstanceOf(IllegalStateException.class)
-				.withMessageContaining("spring-security-access");
-		}
-	}
-
-	@Test
-	public void enableGlobalMethodSecurityWhenAspectJModeAndAccessModuleAbsentThenClearException() {
-		try (AnnotationConfigApplicationContext context = new AnnotationConfigApplicationContext()) {
-			context.register(EnableGlobalMethodSecurityAspectJConfig.class);
-			assertThatExceptionOfType(Exception.class).isThrownBy(context::refresh)
-				.havingRootCause()
-				.isInstanceOf(IllegalStateException.class)
-				.withMessageContaining("spring-security-access");
-		}
-	}
-
-	@Test
-	public void enableReactiveMethodSecurityWhenUseAuthorizationManagerFalseAndAccessModuleAbsentThenClearException() {
-		try (AnnotationConfigApplicationContext context = new AnnotationConfigApplicationContext()) {
-			context.register(EnableReactiveMethodSecurityLegacyConfig.class);
-			assertThatExceptionOfType(Exception.class).isThrownBy(context::refresh)
-				.havingRootCause()
-				.isInstanceOf(IllegalStateException.class)
-				.withMessageContaining("spring-security-access");
-		}
-	}
-
-	@Test
-	public void enableGlobalMethodSecurityWhenAspectJModeAndJsr250EnabledAndConfigurationSubclassedAndAccessModuleAbsentThenClearException() {
-		try (AnnotationConfigApplicationContext context = new AnnotationConfigApplicationContext()) {
-			context.register(EnableGlobalMethodSecurityAspectJJsr250SubclassedConfig.class);
-			assertThatExceptionOfType(Exception.class).isThrownBy(context::refresh)
-				.havingRootCause()
-				.isInstanceOf(IllegalStateException.class)
-				.withMessageContaining("spring-security-access");
-		}
-	}
-
-	@Configuration
-	@EnableMethodSecurity
-	static class EnableMethodSecurityConfig {
-
-	}
-
-	@Configuration
-	@EnableReactiveMethodSecurity
-	static class EnableReactiveMethodSecurityConfig {
-
-	}
-
-	@Configuration
-	@EnableGlobalMethodSecurity(prePostEnabled = true)
-	static class EnableGlobalMethodSecurityProxyConfig {
-
-	}
-
-	@Configuration
-	@EnableGlobalMethodSecurity(prePostEnabled = true, mode = AdviceMode.ASPECTJ)
-	static class EnableGlobalMethodSecurityAspectJConfig {
-
-	}
-
-	@Configuration
-	@EnableReactiveMethodSecurity(useAuthorizationManager = false)
-	static class EnableReactiveMethodSecurityLegacyConfig {
-
-	}
-
-	@Configuration
-	@EnableGlobalMethodSecurity(jsr250Enabled = true, mode = AdviceMode.ASPECTJ)
-	static class EnableGlobalMethodSecurityAspectJJsr250SubclassedConfig extends GlobalMethodSecurityConfiguration {
-
-	}
-
-}
@@ -37,7 +37,6 @@ import org.springframework.mock.web.MockHttpServletResponse;
 import org.springframework.mock.web.MockServletContext;
 import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
 import org.springframework.security.config.annotation.web.configuration.WebSecurityCustomizer;
-import org.springframework.security.config.web.PathPatternRequestMatcherBuilderFactoryBean;
 import org.springframework.security.core.userdetails.PasswordEncodedUser;
 import org.springframework.security.core.userdetails.UserDetailsService;
 import org.springframework.security.provisioning.InMemoryUserDetailsManager;
@@ -111,21 +110,6 @@ public class WebSecurityTests {
 		assertThat(this.response.getStatus()).isEqualTo(HttpServletResponse.SC_BAD_REQUEST);
 	}

-	// gh-19128
-	@Test
-	public void ignoringWhenBuilderBeanWithBasePathThenHonorsBasePath() throws Exception {
-		loadConfig(IgnoringBuilderBeanConfig.class);
-		this.request.setServletPath("/spring");
-		this.request.setRequestURI("/spring/path");
-		this.springSecurityFilterChain.doFilter(this.request, this.response, this.chain);
-		assertThat(this.response.getStatus()).isEqualTo(HttpServletResponse.SC_OK);
-		setup();
-		this.request.setServletPath("");
-		this.request.setRequestURI("/path");
-		this.springSecurityFilterChain.doFilter(this.request, this.response, this.chain);
-		assertThat(this.response.getStatus()).isEqualTo(HttpServletResponse.SC_UNAUTHORIZED);
-	}
-
 	public void loadConfig(Class<?>... configs) {
 		this.context = new AnnotationConfigWebApplicationContext();
 		this.context.register(configs);
@@ -217,52 +201,6 @@ public class WebSecurityTests {

 	}

-	// gh-19128
-	@EnableWebSecurity
-	@Configuration
-	@EnableWebMvc
-	static class IgnoringBuilderBeanConfig {
-
-		@Bean
-		PathPatternRequestMatcherBuilderFactoryBean requestMatcherBuilder() {
-			PathPatternRequestMatcherBuilderFactoryBean bean = new PathPatternRequestMatcherBuilderFactoryBean();
-			bean.setBasePath("/spring");
-			return bean;
-		}
-
-		@Bean
-		WebSecurityCustomizer webSecurityCustomizer() {
-			return (web) -> web.ignoring().requestMatchers("/path");
-		}
-
-		@Bean
-		SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
-			// @formatter:off
-			http
-				.httpBasic(withDefaults())
-				.authorizeHttpRequests((requests) -> requests
-					.anyRequest().denyAll());
-			// @formatter:on
-			return http.build();
-		}
-
-		@Bean
-		UserDetailsService userDetailsService() {
-			return new InMemoryUserDetailsManager(PasswordEncodedUser.user());
-		}
-
-		@RestController
-		static class PathController {
-
-			@RequestMapping("/path")
-			String path() {
-				return "path";
-			}
-
-		}
-
-	}
-
 	@Configuration
 	@EnableWebSecurity
 	static class RequestRejectedHandlerConfig {
@@ -452,18 +452,6 @@ public class AuthorizeHttpRequestsConfigurerTests {
 		this.mvc.perform(requestWithAdmin).andExpect(status().isOk());
 	}

-	@Test
-	public void requestMatchersWhenBuilderBeanWithBasePathAndRawStringThenHonorsBasePath() throws Exception {
-		this.spring.register(RequestMatchersRawStringServletPathConfig.class, BasicController.class).autowire();
-		// @formatter:off
-		MockHttpServletRequestBuilder matchedByBasePath = get("/spring/path")
-				.servletPath("/spring")
-				.with(user("user").roles("USER"));
-		// @formatter:on
-		this.mvc.perform(matchedByBasePath).andExpect(status().isForbidden());
-		this.mvc.perform(get("/path").with(user("user").roles("USER"))).andExpect(status().isOk());
-	}
-
 	@Test
 	public void getWhenAnyRequestAuthenticatedConfiguredAndNoUserThenRespondsWithUnauthorized() throws Exception {
 		this.spring.register(AuthenticatedConfig.class, BasicController.class).autowire();
@@ -1371,32 +1359,6 @@ public class AuthorizeHttpRequestsConfigurerTests {

 	}

-	@Configuration
-	@EnableWebMvc
-	@EnableWebSecurity
-	static class RequestMatchersRawStringServletPathConfig {
-
-		@Bean
-		PathPatternRequestMatcherBuilderFactoryBean requestMatcherBuilder() {
-			PathPatternRequestMatcherBuilderFactoryBean bean = new PathPatternRequestMatcherBuilderFactoryBean();
-			bean.setBasePath("/spring");
-			return bean;
-		}
-
-		@Bean
-		SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
-			// @formatter:off
-			return http
-					.authorizeHttpRequests((authorize) -> authorize
-						.requestMatchers("/path").hasRole("ADMIN")
-						.anyRequest().permitAll()
-					)
-					.build();
-			// @formatter:on
-		}
-
-	}
-
 	@Configuration
 	@EnableWebSecurity
 	static class AuthenticatedConfig {
@@ -40,7 +40,6 @@ import org.springframework.security.config.annotation.web.configuration.WebSecur
 import org.springframework.security.config.test.SpringTestContext;
 import org.springframework.security.config.test.SpringTestContextExtension;
 import org.springframework.security.config.users.AuthenticationTestConfiguration;
-import org.springframework.security.config.web.PathPatternRequestMatcherBuilderFactoryBean;
 import org.springframework.security.core.authority.FactorGrantedAuthority;
 import org.springframework.security.core.context.SecurityContextChangedListener;
 import org.springframework.security.core.context.SecurityContextHolderStrategy;
@@ -154,17 +153,6 @@ public class FormLoginConfigurerTests {
 		// @formatter:on
 	}

-	// gh-19128
-	@Test
-	public void loginWhenBuilderBeanWithBasePathThenLoginProcessingUrlIgnoresBasePath() throws Exception {
-		this.spring.register(FormLoginBuilderBeanConfig.class).autowire();
-		// @formatter:off
-		this.mockMvc.perform(formLogin().user("invalid"))
-				.andExpect(status().isFound())
-				.andExpect(redirectedUrl("/login?error"));
-		// @formatter:on
-	}
-
 	@Test
 	public void loginWhenFormLoginConfiguredThenHasDefaultSuccessUrl() throws Exception {
 		this.spring.register(FormLoginConfig.class).autowire();
@@ -531,37 +519,6 @@ public class FormLoginConfigurerTests {

 	}

-	// gh-19128
-	@Configuration
-	@EnableWebSecurity
-	@EnableWebMvc
-	static class FormLoginBuilderBeanConfig {
-
-		@Bean
-		PathPatternRequestMatcherBuilderFactoryBean requestMatcherBuilder() {
-			PathPatternRequestMatcherBuilderFactoryBean bean = new PathPatternRequestMatcherBuilderFactoryBean();
-			bean.setBasePath("/spring");
-			return bean;
-		}
-
-		@Bean
-		SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
-			// @formatter:off
-			http
-				.authorizeHttpRequests((requests) -> requests
-					.anyRequest().authenticated())
-				.formLogin(withDefaults());
-			// @formatter:on
-			return http.build();
-		}
-
-		@Bean
-		UserDetailsService userDetailsService() {
-			return new InMemoryUserDetailsManager(PasswordEncodedUser.user());
-		}
-
-	}
-
 	@Configuration
 	@EnableWebSecurity
 	static class FormLoginInLambdaConfig {
@@ -125,34 +125,6 @@ public class HttpSecuritySecurityMatchersTests {
 		assertThat(this.response.getStatus()).isEqualTo(HttpServletResponse.SC_OK);
 	}

-	@Test
-	public void securityMatcherWhenBuilderBeanWithBasePathThenHonorsBasePath() throws Exception {
-		loadConfig(SecurityMatcherBuilderBeanConfig.class);
-		this.request.setServletPath("/spring");
-		this.request.setRequestURI("/spring/path");
-		this.springSecurityFilterChain.doFilter(this.request, this.response, this.chain);
-		assertThat(this.response.getStatus()).isEqualTo(HttpServletResponse.SC_UNAUTHORIZED);
-		setup();
-		this.request.setServletPath("");
-		this.request.setRequestURI("/path");
-		this.springSecurityFilterChain.doFilter(this.request, this.response, this.chain);
-		assertThat(this.response.getStatus()).isEqualTo(HttpServletResponse.SC_OK);
-	}
-
-	@Test
-	public void securityMatchersWhenBuilderBeanWithBasePathAndRawStringsThenHonorsBasePath() throws Exception {
-		loadConfig(SecurityMatchersBuilderBeanConfig.class);
-		this.request.setServletPath("/spring");
-		this.request.setRequestURI("/spring/path");
-		this.springSecurityFilterChain.doFilter(this.request, this.response, this.chain);
-		assertThat(this.response.getStatus()).isEqualTo(HttpServletResponse.SC_UNAUTHORIZED);
-		setup();
-		this.request.setServletPath("");
-		this.request.setRequestURI("/path");
-		this.springSecurityFilterChain.doFilter(this.request, this.response, this.chain);
-		assertThat(this.response.getStatus()).isEqualTo(HttpServletResponse.SC_OK);
-	}
-
 	@Test
 	public void securityMatchersWhenMultiMvcMatcherInLambdaThenAllPathsAreDenied() throws Exception {
 		loadConfig(MultiMvcMatcherInLambdaConfig.class);
@@ -458,83 +430,6 @@ public class HttpSecuritySecurityMatchersTests {

 	}

-	@EnableWebSecurity
-	@Configuration
-	@EnableWebMvc
-	@Import(UsersConfig.class)
-	static class SecurityMatcherBuilderBeanConfig {
-
-		@Bean
-		PathPatternRequestMatcherBuilderFactoryBean requestMatcherBuilder() {
-			PathPatternRequestMatcherBuilderFactoryBean bean = new PathPatternRequestMatcherBuilderFactoryBean();
-			bean.setBasePath("/spring");
-			return bean;
-		}
-
-		@Bean
-		SecurityFilterChain appSecurity(HttpSecurity http) throws Exception {
-			// @formatter:off
-			http
-				.securityMatcher("/path")
-				.httpBasic(withDefaults())
-				.authorizeHttpRequests((authorize) -> authorize
-					.anyRequest().denyAll());
-			// @formatter:on
-			return http.build();
-		}
-
-		@RestController
-		static class PathController {
-
-			@RequestMapping("/path")
-			String path() {
-				return "path";
-			}
-
-		}
-
-	}
-
-	@EnableWebSecurity
-	@Configuration
-	@EnableWebMvc
-	@Import(UsersConfig.class)
-	static class SecurityMatchersBuilderBeanConfig {
-
-		@Bean
-		PathPatternRequestMatcherBuilderFactoryBean requestMatcherBuilder() {
-			PathPatternRequestMatcherBuilderFactoryBean bean = new PathPatternRequestMatcherBuilderFactoryBean();
-			bean.setBasePath("/spring");
-			return bean;
-		}
-
-		@Bean
-		SecurityFilterChain appSecurity(HttpSecurity http) throws Exception {
-			// @formatter:off
-			http
-				.securityMatchers((matchers) -> matchers
-					.requestMatchers("/path")
-				)
-				.httpBasic(withDefaults())
-				.authorizeHttpRequests((authorize) -> authorize
-					.anyRequest().denyAll()
-				);
-			// @formatter:on
-			return http.build();
-		}
-
-		@RestController
-		static class PathController {
-
-			@RequestMapping("/path")
-			String path() {
-				return "path";
-			}
-
-		}
-
-	}
-
 	@Configuration
 	static class UsersConfig {

@@ -35,7 +35,6 @@ import org.springframework.security.config.annotation.web.builders.HttpSecurity;
 import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
 import org.springframework.security.config.test.SpringTestContext;
 import org.springframework.security.config.test.SpringTestContextExtension;
-import org.springframework.security.config.web.PathPatternRequestMatcherBuilderFactoryBean;
 import org.springframework.security.core.context.SecurityContextHolderStrategy;
 import org.springframework.security.core.userdetails.PasswordEncodedUser;
 import org.springframework.security.core.userdetails.UserDetailsService;
@@ -128,17 +127,6 @@ public class LogoutConfigurerTests {
 		// @formatter:on
 	}

-	// gh-19128
-	@Test
-	public void logoutWhenBuilderBeanWithBasePathThenLogoutUrlIgnoresBasePath() throws Exception {
-		this.spring.register(LogoutBuilderBeanConfig.class).autowire();
-		// @formatter:off
-		this.mvc.perform(post("/logout").with(csrf()))
-				.andExpect(status().isFound())
-				.andExpect(redirectedUrl("/login?logout"));
-		// @formatter:on
-	}
-
 	// SEC-2311
 	@Test
 	public void logoutWhenGetRequestAndCsrfDisabledThenRedirectsToLogin() throws Exception {
@@ -536,29 +524,6 @@ public class LogoutConfigurerTests {

 	}

-	// gh-19128
-	@Configuration
-	@EnableWebSecurity
-	static class LogoutBuilderBeanConfig {
-
-		@Bean
-		PathPatternRequestMatcherBuilderFactoryBean requestMatcherBuilder() {
-			PathPatternRequestMatcherBuilderFactoryBean bean = new PathPatternRequestMatcherBuilderFactoryBean();
-			bean.setBasePath("/spring");
-			return bean;
-		}
-
-		@Bean
-		SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
-			// @formatter:off
-			http
-				.logout(withDefaults());
-			// @formatter:on
-			return http.build();
-		}
-
-	}
-
 	@Configuration
 	@EnableWebSecurity
 	static class CsrfDisabledConfig {
@@ -26,7 +26,6 @@ import org.springframework.security.config.annotation.web.builders.HttpSecurity;
 import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
 import org.springframework.security.config.test.SpringTestContext;
 import org.springframework.security.config.test.SpringTestContextExtension;
-import org.springframework.security.config.web.PathPatternRequestMatcherBuilderFactoryBean;
 import org.springframework.security.web.SecurityFilterChain;
 import org.springframework.test.web.servlet.MockMvc;

@@ -67,16 +66,6 @@ public class PasswordManagementConfigurerTests {
 			.andExpect(redirectedUrl("/custom-change-password-page"));
 	}

-	// gh-19128
-	@Test
-	public void changePasswordWhenBuilderBeanWithBasePathThenChangePasswordUrlIgnoresBasePath() throws Exception {
-		this.spring.register(PasswordManagementBuilderBeanConfig.class).autowire();
-
-		this.mvc.perform(get("/.well-known/change-password"))
-			.andExpect(status().isFound())
-			.andExpect(redirectedUrl("/change-password"));
-	}
-
 	@Test
 	public void whenSettingNullChangePasswordPage() {
 		PasswordManagementConfigurer configurer = new PasswordManagementConfigurer();
@@ -113,29 +102,6 @@ public class PasswordManagementConfigurerTests {

 	}

-	// gh-19128
-	@Configuration
-	@EnableWebSecurity
-	static class PasswordManagementBuilderBeanConfig {
-
-		@Bean
-		PathPatternRequestMatcherBuilderFactoryBean requestMatcherBuilder() {
-			PathPatternRequestMatcherBuilderFactoryBean bean = new PathPatternRequestMatcherBuilderFactoryBean();
-			bean.setBasePath("/spring");
-			return bean;
-		}
-
-		@Bean
-		SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
-			// @formatter:off
-			return http
-					.passwordManagement(withDefaults())
-					.build();
-			// @formatter:on
-		}
-
-	}
-
 	@Configuration
 	@EnableWebSecurity
 	static class PasswordManagementWithCustomChangePasswordPageConfig {
@@ -34,7 +34,6 @@ import org.springframework.security.config.annotation.web.builders.HttpSecurity;
 import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
 import org.springframework.security.config.test.SpringTestContext;
 import org.springframework.security.config.test.SpringTestContextExtension;
-import org.springframework.security.config.web.PathPatternRequestMatcherBuilderFactoryBean;
 import org.springframework.security.core.userdetails.User;
 import org.springframework.security.provisioning.InMemoryUserDetailsManager;
 import org.springframework.security.test.web.servlet.RequestCacheResultMatcher;
@@ -186,21 +185,6 @@ public class RequestCacheConfigurerTests {
 		this.mvc.perform(formLogin(session)).andExpect(redirectedUrl("/"));
 	}

-	// gh-19128
-	@Test
-	public void getWhenBuilderBeanWithBasePathThenSavedRequestMatcherIgnoresBasePath() throws Exception {
-		this.spring.register(RequestCacheBuilderBeanConfig.class, DefaultSecurityConfig.class).autowire();
-		MockHttpServletRequestBuilder request = get("/messages").header(HttpHeaders.ACCEPT, MediaType.TEXT_HTML);
-		// @formatter:off
-		MockHttpSession session = (MockHttpSession) this.mvc.perform(request)
-				.andExpect(redirectedUrl("/login"))
-				.andReturn()
-				.getRequest()
-				.getSession();
-		// @formatter:on
-		this.mvc.perform(formLogin(session)).andExpect(RequestCacheResultMatcher.redirectToCachedRequest());
-	}
-
 	@Test
 	public void getWhenBookmarkedRequestIsAllMediaTypeThenPostAuthenticationRemembers() throws Exception {
 		this.spring.register(RequestCacheDefaultsConfig.class, DefaultSecurityConfig.class).autowire();
@@ -417,31 +401,6 @@ public class RequestCacheConfigurerTests {

 	}

-	// gh-19128
-	@Configuration
-	@EnableWebSecurity
-	static class RequestCacheBuilderBeanConfig {
-
-		@Bean
-		PathPatternRequestMatcherBuilderFactoryBean requestMatcherBuilder() {
-			PathPatternRequestMatcherBuilderFactoryBean bean = new PathPatternRequestMatcherBuilderFactoryBean();
-			bean.setBasePath("/spring");
-			return bean;
-		}
-
-		@Bean
-		SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
-			// @formatter:off
-			http
-				.authorizeHttpRequests((requests) -> requests
-					.anyRequest().authenticated())
-				.formLogin(withDefaults());
-			// @formatter:on
-			return http.build();
-		}
-
-	}
-
 	@Configuration
 	@EnableWebSecurity
 	static class RequestCacheDisabledConfig {
@@ -43,16 +43,9 @@ import org.springframework.security.provisioning.InMemoryUserDetailsManager;
 import org.springframework.security.web.FilterChainProxy;
 import org.springframework.security.web.SecurityFilterChain;
 import org.springframework.security.web.authentication.ui.DefaultResourcesFilter;
-import org.springframework.security.web.webauthn.api.Bytes;
-import org.springframework.security.web.webauthn.api.ImmutablePublicKeyCredentialUserEntity;
 import org.springframework.security.web.webauthn.api.PublicKeyCredentialCreationOptions;
-import org.springframework.security.web.webauthn.api.TestCredentialRecords;
 import org.springframework.security.web.webauthn.api.TestPublicKeyCredentialCreationOptions;
 import org.springframework.security.web.webauthn.authentication.WebAuthnAuthenticationFilter;
-import org.springframework.security.web.webauthn.management.MapPublicKeyCredentialUserEntityRepository;
-import org.springframework.security.web.webauthn.management.MapUserCredentialRepository;
-import org.springframework.security.web.webauthn.management.PublicKeyCredentialUserEntityRepository;
-import org.springframework.security.web.webauthn.management.UserCredentialRepository;
 import org.springframework.security.web.webauthn.management.WebAuthnRelyingPartyOperations;
 import org.springframework.security.web.webauthn.registration.HttpSessionPublicKeyCredentialCreationOptionsRepository;
 import org.springframework.test.web.servlet.MockMvc;
@@ -65,7 +58,6 @@ import static org.mockito.BDDMockito.willAnswer;
 import static org.mockito.Mockito.mock;
 import static org.springframework.security.test.web.servlet.request.SecurityMockMvcRequestPostProcessors.authentication;
 import static org.springframework.security.test.web.servlet.request.SecurityMockMvcRequestPostProcessors.csrf;
-import static org.springframework.test.web.servlet.request.MockMvcRequestBuilders.delete;
 import static org.springframework.test.web.servlet.request.MockMvcRequestBuilders.get;
 import static org.springframework.test.web.servlet.request.MockMvcRequestBuilders.post;
 import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.content;
@@ -265,24 +257,6 @@ public class WebAuthnConfigurerTests {
 			.andExpect(content().string(expectedBody));
 	}

-	@Test
-	void webauthnWhenDeleteAndCredentialBelongsToUserThenNoContent() throws Exception {
-		this.spring.register(DeleteCredentialConfiguration.class).autowire();
-		this.mvc
-			.perform(delete("/webauthn/register/" + DeleteCredentialConfiguration.CREDENTIAL_ID_BASE64URL)
-				.with(authentication(new TestingAuthenticationToken("user", "password", "ROLE_USER"))))
-			.andExpect(status().isNoContent());
-	}
-
-	@Test
-	void webauthnWhenDeleteAndCredentialBelongsToDifferentUserThenForbidden() throws Exception {
-		this.spring.register(DeleteCredentialConfiguration.class).autowire();
-		this.mvc
-			.perform(delete("/webauthn/register/" + DeleteCredentialConfiguration.CREDENTIAL_ID_BASE64URL)
-				.with(authentication(new TestingAuthenticationToken("other-user", "password", "ROLE_USER"))))
-			.andExpect(status().isForbidden());
-	}
-
 	@Configuration
 	@EnableWebSecurity
 	static class ConfigCredentialCreationOptionsRepository {
@@ -501,47 +475,4 @@ public class WebAuthnConfigurerTests {

 	}

-	@Configuration
-	@EnableWebSecurity
-	static class DeleteCredentialConfiguration {
-
-		static final String CREDENTIAL_ID_BASE64URL = "NauGCN7bZ5jEBwThcde51g";
-
-		static final Bytes USER_ENTITY_ID = Bytes.fromBase64("vKBFhsWT3gQnn-gHdT4VXIvjDkVXVYg5w8CLGHPunMM");
-
-		@Bean
-		UserDetailsService userDetailsService() {
-			return new InMemoryUserDetailsManager();
-		}
-
-		@Bean
-		WebAuthnRelyingPartyOperations webAuthnRelyingPartyOperations() {
-			return mock(WebAuthnRelyingPartyOperations.class);
-		}
-
-		@Bean
-		UserCredentialRepository userCredentialRepository() {
-			MapUserCredentialRepository repository = new MapUserCredentialRepository();
-			repository.save(TestCredentialRecords.userCredential().build());
-			return repository;
-		}
-
-		@Bean
-		PublicKeyCredentialUserEntityRepository userEntityRepository() {
-			MapPublicKeyCredentialUserEntityRepository repository = new MapPublicKeyCredentialUserEntityRepository();
-			repository.save(ImmutablePublicKeyCredentialUserEntity.builder()
-				.name("user")
-				.id(USER_ENTITY_ID)
-				.displayName("User")
-				.build());
-			return repository;
-		}
-
-		@Bean
-		SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
-			return http.csrf(AbstractHttpConfigurer::disable).webAuthn(Customizer.withDefaults()).build();
-		}
-
-	}
-
 }
@@ -56,7 +56,6 @@ import org.springframework.security.config.annotation.web.configurers.oauth2.cli
 import org.springframework.security.config.oauth2.client.CommonOAuth2Provider;
 import org.springframework.security.config.test.SpringTestContext;
 import org.springframework.security.config.test.SpringTestContextExtension;
-import org.springframework.security.config.web.PathPatternRequestMatcherBuilderFactoryBean;
 import org.springframework.security.context.DelegatingApplicationListener;
 import org.springframework.security.core.Authentication;
 import org.springframework.security.core.GrantedAuthority;
@@ -441,18 +440,6 @@ public class OAuth2LoginConfigurerTests {
 		then(redirectStrategy).should().sendRedirect(any(), any(), anyString());
 	}

-	// gh-19128
-	@Test
-	public void oauth2LoginWhenBuilderBeanWithBasePathThenLoginProcessingUrlIgnoresBasePath() throws Exception {
-		loadConfig(OAuth2LoginBuilderBeanConfig.class);
-		String requestUri = "/login/oauth2/code/google";
-		this.request = get(requestUri).build();
-		this.request.setParameter("code", "code123");
-		this.request.setParameter("state", "state123");
-		this.springSecurityFilterChain.doFilter(this.request, this.response, this.filterChain);
-		assertThat(this.response.getRedirectedUrl()).endsWith("/login?error");
-	}
-
 	// gh-5347
 	@Test
 	public void oauth2LoginWithOneClientConfiguredThenRedirectForAuthorization() throws Exception {
@@ -801,31 +788,6 @@ public class OAuth2LoginConfigurerTests {

 	}

-	// gh-19128
-	@Configuration
-	@EnableWebSecurity
-	static class OAuth2LoginBuilderBeanConfig extends CommonSecurityFilterChainConfig {
-
-		@Bean
-		PathPatternRequestMatcherBuilderFactoryBean requestMatcherBuilder() {
-			PathPatternRequestMatcherBuilderFactoryBean bean = new PathPatternRequestMatcherBuilderFactoryBean();
-			bean.setBasePath("/spring");
-			return bean;
-		}
-
-		@Bean
-		SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
-			// @formatter:off
-			http
-				.oauth2Login((login) -> login
-					.clientRegistrationRepository(
-						new InMemoryClientRegistrationRepository(GOOGLE_CLIENT_REGISTRATION)));
-			// @formatter:on
-			return super.configureFilterChain(http);
-		}
-
-	}
-
 	@Configuration
 	@EnableWebSecurity
 	static class OAuth2LoginConfigFormLogin extends CommonSecurityFilterChainConfig {
@@ -45,7 +45,6 @@ import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.context.annotation.Bean;
 import org.springframework.context.annotation.Configuration;
 import org.springframework.context.annotation.Import;
-import org.springframework.context.annotation.Primary;
 import org.springframework.http.HttpHeaders;
 import org.springframework.jdbc.core.JdbcOperations;
 import org.springframework.jdbc.core.JdbcTemplate;
@@ -159,8 +158,6 @@ public class OAuth2ClientCredentialsGrantTests {

 	private static AuthenticationFailureHandler authenticationFailureHandler;

-	private static PasswordEncoder passwordEncoder;
-
 	public final SpringTestContext spring = new SpringTestContext(this);

 	@Autowired
@@ -186,9 +183,6 @@ public class OAuth2ClientCredentialsGrantTests {
 		authenticationProvidersConsumer = mock(Consumer.class);
 		authenticationSuccessHandler = mock(AuthenticationSuccessHandler.class);
 		authenticationFailureHandler = mock(AuthenticationFailureHandler.class);
-		passwordEncoder = mock(PasswordEncoder.class);
-		given(passwordEncoder.matches(any(), any())).willReturn(true);
-		given(passwordEncoder.upgradeEncoding(any())).willReturn(false);
 		db = new EmbeddedDatabaseBuilder().generateUniqueName(true)
 			.setType(EmbeddedDatabaseType.HSQL)
 			.setScriptEncoding("UTF-8")
@@ -502,26 +496,6 @@ public class OAuth2ClientCredentialsGrantTests {
 			.andExpect(jsonPath("$.token_type").value(OAuth2AccessToken.TokenType.DPOP.getValue()));
 	}

-	@Test
-	public void requestWhenTokenRequestWithMultiplePasswordEncodersThenPrimaryPasswordEncoderUsed() throws Exception {
-		this.spring.register(AuthorizationServerConfigurationWithMultiplePasswordEncoders.class).autowire();
-
-		RegisteredClient registeredClient = TestRegisteredClients.registeredClient2().build();
-		this.registeredClientRepository.save(registeredClient);
-
-		this.mvc
-			.perform(post(DEFAULT_TOKEN_ENDPOINT_URI)
-				.param(OAuth2ParameterNames.GRANT_TYPE, AuthorizationGrantType.CLIENT_CREDENTIALS.getValue())
-				.param(OAuth2ParameterNames.SCOPE, "scope1 scope2")
-				.header(HttpHeaders.AUTHORIZATION,
-						"Basic " + encodeBasicAuth(registeredClient.getClientId(), registeredClient.getClientSecret())))
-			.andExpect(status().isOk())
-			.andExpect(jsonPath("$.access_token").isNotEmpty())
-			.andExpect(jsonPath("$.scope").value("scope1 scope2"));
-
-		verify(passwordEncoder).matches(any(), any());
-	}
-
 	private static String generateDPoPProof(String tokenEndpointUri) {
 		// @formatter:off
 		Map<String, Object> publicJwk = TestJwks.DEFAULT_EC_JWK
@@ -684,16 +658,4 @@ public class OAuth2ClientCredentialsGrantTests {

 	}

-	@EnableWebSecurity
-	@Configuration(proxyBeanMethods = false)
-	static class AuthorizationServerConfigurationWithMultiplePasswordEncoders extends AuthorizationServerConfiguration {
-
-		@Primary
-		@Bean
-		PasswordEncoder primaryPasswordEncoder() {
-			return passwordEncoder;
-		}
-
-	}
-
 }
@@ -79,7 +79,6 @@ import org.springframework.security.oauth2.server.authorization.OAuth2Authorizat
 import org.springframework.security.oauth2.server.authorization.OAuth2ClientRegistration;
 import org.springframework.security.oauth2.server.authorization.authentication.OAuth2ClientRegistrationAuthenticationProvider;
 import org.springframework.security.oauth2.server.authorization.authentication.OAuth2ClientRegistrationAuthenticationToken;
-import org.springframework.security.oauth2.server.authorization.authentication.OAuth2ClientRegistrationAuthenticationValidator;
 import org.springframework.security.oauth2.server.authorization.client.JdbcRegisteredClientRepository;
 import org.springframework.security.oauth2.server.authorization.client.JdbcRegisteredClientRepository.RegisteredClientParametersMapper;
 import org.springframework.security.oauth2.server.authorization.client.RegisteredClient;
@@ -412,102 +411,6 @@ public class OAuth2ClientRegistrationTests {
 			.isCloseTo(expectedSecretExpiryDate, allowedDelta);
 	}

-	@Test
-	public void requestWhenProtocolRelativeRedirectUriThenBadRequest() throws Exception {
-		this.spring.register(DefaultValidatorConfiguration.class).autowire();
-		assertThat(requestWhenInvalidClientMetadataThenBadRequest("""
-				{
-				  "client_name": "client-name",
-				  "redirect_uris": ["//client.example.com/path"],
-				  "grant_types": ["authorization_code"]
-				}
-				""")).isEqualTo(HttpStatus.BAD_REQUEST.value());
-	}
-
-	@Test
-	public void requestWhenJavascriptSchemeRedirectUriThenBadRequest() throws Exception {
-		this.spring.register(DefaultValidatorConfiguration.class).autowire();
-		assertThat(requestWhenInvalidClientMetadataThenBadRequest("""
-				{
-				  "client_name": "client-name",
-				  "redirect_uris": ["javascript:alert(document.cookie)"],
-				  "grant_types": ["authorization_code"]
-				}
-				""")).isEqualTo(HttpStatus.BAD_REQUEST.value());
-	}
-
-	@Test
-	public void requestWhenDataSchemeRedirectUriThenBadRequest() throws Exception {
-		this.spring.register(DefaultValidatorConfiguration.class).autowire();
-		assertThat(requestWhenInvalidClientMetadataThenBadRequest("""
-				{
-				  "client_name": "client-name",
-				  "redirect_uris": ["data:text/html,<h1>content</h1>"],
-				  "grant_types": ["authorization_code"]
-				}
-				""")).isEqualTo(HttpStatus.BAD_REQUEST.value());
-	}
-
-	@Test
-	public void requestWhenHttpJwkSetUriThenBadRequest() throws Exception {
-		this.spring.register(DefaultValidatorConfiguration.class).autowire();
-		assertThat(requestWhenInvalidClientMetadataThenBadRequest("""
-				{
-				  "client_name": "client-name",
-				  "redirect_uris": ["https://client.example.com"],
-				  "grant_types": ["authorization_code"],
-				  "jwks_uri": "http://169.254.169.254/keys",
-				  "token_endpoint_auth_method": "private_key_jwt"
-				}
-				""")).isEqualTo(HttpStatus.BAD_REQUEST.value());
-	}
-
-	@Test
-	public void requestWhenArbitraryScopeThenBadRequest() throws Exception {
-		this.spring.register(DefaultValidatorConfiguration.class).autowire();
-		assertThat(requestWhenInvalidClientMetadataThenBadRequest("""
-				{
-				  "client_name": "client-name",
-				  "redirect_uris": ["https://client.example.com"],
-				  "grant_types": ["client_credentials"],
-				  "scope": "read write"
-				}
-				""")).isEqualTo(HttpStatus.BAD_REQUEST.value());
-	}
-
-	private int requestWhenInvalidClientMetadataThenBadRequest(String json) throws Exception {
-		String clientRegistrationScope = "client.create";
-		// @formatter:off
-		RegisteredClient clientRegistrar = RegisteredClient.withId("client-registrar-" + System.nanoTime())
-				.clientId("client-registrar-" + System.nanoTime())
-				.clientSecret("{noop}secret")
-				.clientAuthenticationMethod(ClientAuthenticationMethod.CLIENT_SECRET_BASIC)
-				.authorizationGrantType(AuthorizationGrantType.CLIENT_CREDENTIALS)
-				.scope(clientRegistrationScope)
-				.build();
-		// @formatter:on
-		this.registeredClientRepository.save(clientRegistrar);
-
-		MvcResult tokenResult = this.mvc
-			.perform(post(ISSUER.concat(DEFAULT_TOKEN_ENDPOINT_URI))
-				.param(OAuth2ParameterNames.GRANT_TYPE, AuthorizationGrantType.CLIENT_CREDENTIALS.getValue())
-				.param(OAuth2ParameterNames.SCOPE, clientRegistrationScope)
-				.with(httpBasic(clientRegistrar.getClientId(), "secret")))
-			.andExpect(status().isOk())
-			.andReturn();
-		OAuth2AccessToken accessToken = readAccessTokenResponse(tokenResult.getResponse()).getAccessToken();
-
-		HttpHeaders httpHeaders = new HttpHeaders();
-		httpHeaders.setBearerAuth(accessToken.getTokenValue());
-
-		MvcResult registerResult = this.mvc
-			.perform(post(ISSUER.concat(DEFAULT_OAUTH2_CLIENT_REGISTRATION_ENDPOINT_URI)).headers(httpHeaders)
-				.contentType(MediaType.APPLICATION_JSON)
-				.content(json))
-			.andReturn();
-		return registerResult.getResponse().getStatus();
-	}
-
 	private OAuth2ClientRegistration registerClient(OAuth2ClientRegistration clientRegistration) throws Exception {
 		// ***** (1) Obtain the "initial" access token used for registering the client

@@ -593,17 +496,6 @@ public class OAuth2ClientRegistrationTests {
 		return clientRegistrationHttpMessageConverter.read(OAuth2ClientRegistration.class, httpResponse);
 	}

-	private static Consumer<List<AuthenticationProvider>> scopePermissiveValidatorCustomizer() {
-		return (authenticationProviders) -> authenticationProviders.forEach((authenticationProvider) -> {
-			if (authenticationProvider instanceof OAuth2ClientRegistrationAuthenticationProvider provider) {
-				provider.setAuthenticationValidator(
-						OAuth2ClientRegistrationAuthenticationValidator.DEFAULT_REDIRECT_URI_VALIDATOR
-							.andThen(OAuth2ClientRegistrationAuthenticationValidator.DEFAULT_JWK_SET_URI_VALIDATOR)
-							.andThen(OAuth2ClientRegistrationAuthenticationValidator.SIMPLE_SCOPE_VALIDATOR));
-			}
-		});
-	}
-
 	@EnableWebSecurity
 	@Configuration(proxyBeanMethods = false)
 	static class CustomClientRegistrationConfiguration extends AuthorizationServerConfiguration {
@@ -620,7 +512,7 @@ public class OAuth2ClientRegistrationTests {
 													.clientRegistrationRequestConverter(authenticationConverter)
 													.clientRegistrationRequestConverters(authenticationConvertersConsumer)
 													.authenticationProvider(authenticationProvider)
-													.authenticationProviders(scopePermissiveValidatorCustomizer().andThen(authenticationProvidersConsumer))
+													.authenticationProviders(authenticationProvidersConsumer)
 													.clientRegistrationResponseHandler(authenticationSuccessHandler)
 													.errorResponseHandler(authenticationFailureHandler)
 									)
@@ -647,7 +539,7 @@ public class OAuth2ClientRegistrationTests {
 							authorizationServer
 									.clientRegistrationEndpoint((clientRegistration) ->
 											clientRegistration
-													.authenticationProviders(scopePermissiveValidatorCustomizer().andThen(configureClientRegistrationConverters()))
+													.authenticationProviders(configureClientRegistrationConverters())
 									)
 					)
 					.authorizeHttpRequests((authorize) ->
@@ -685,7 +577,7 @@ public class OAuth2ClientRegistrationTests {
 							authorizationServer
 									.clientRegistrationEndpoint((clientRegistration) ->
 											clientRegistration
-													.authenticationProviders(scopePermissiveValidatorCustomizer().andThen(configureClientRegistrationConverters()))
+													.authenticationProviders(configureClientRegistrationConverters())
 									)
 					)
 					.authorizeHttpRequests((authorize) ->
@@ -722,7 +614,6 @@ public class OAuth2ClientRegistrationTests {
 									.clientRegistrationEndpoint((clientRegistration) ->
 											clientRegistration
 													.openRegistrationAllowed(true)
-													.authenticationProviders(scopePermissiveValidatorCustomizer())
 									)
 					)
 					.authorizeHttpRequests((authorize) ->
@@ -736,30 +627,6 @@ public class OAuth2ClientRegistrationTests {

 	}

-	@EnableWebSecurity
-	@Configuration(proxyBeanMethods = false)
-	static class DefaultValidatorConfiguration extends AuthorizationServerConfiguration {
-
-		// Override with Customizer.withDefaults() so the default (strict)
-		// OAuth2ClientRegistrationAuthenticationValidator is in effect.
-		// @formatter:off
-		@Bean
-		@Override
-		SecurityFilterChain authorizationServerSecurityFilterChain(HttpSecurity http) throws Exception {
-			http
-					.oauth2AuthorizationServer((authorizationServer) ->
-							authorizationServer
-									.clientRegistrationEndpoint(Customizer.withDefaults())
-					)
-					.authorizeHttpRequests((authorize) ->
-							authorize.anyRequest().authenticated()
-					);
-			return http.build();
-		}
-		// @formatter:on
-
-	}
-
 	@EnableWebSecurity
 	@Configuration(proxyBeanMethods = false)
 	static class AuthorizationServerConfiguration {
@@ -770,10 +637,7 @@ public class OAuth2ClientRegistrationTests {
 			http
 					.oauth2AuthorizationServer((authorizationServer) ->
 							authorizationServer
-									.clientRegistrationEndpoint((clientRegistration) ->
-											clientRegistration
-													.authenticationProviders(scopePermissiveValidatorCustomizer())
-									)
+									.clientRegistrationEndpoint(Customizer.withDefaults())
 					)
 					.authorizeHttpRequests((authorize) ->
 							authorize.anyRequest().authenticated()
@@ -359,7 +359,7 @@ public class OAuth2DeviceCodeGrantTests {
 	}

 	@Test
-	public void requestWhenDeviceAuthorizationConsentRequestUnauthenticatedThenUnauthorized() throws Exception {
+	public void requestWhenDeviceAuthorizationConsentRequestUnauthenticatedThenBadRequest() throws Exception {
 		this.spring.register(AuthorizationServerConfiguration.class).autowire();

 		// @formatter:off
@@ -392,7 +392,7 @@ public class OAuth2DeviceCodeGrantTests {
 		// @formatter:off
 		this.mvc.perform(post(DEFAULT_DEVICE_VERIFICATION_ENDPOINT_URI)
 				.params(parameters))
-				.andExpect(status().isUnauthorized());
+				.andExpect(status().isBadRequest());
 		// @formatter:on
 	}

@@ -97,7 +97,6 @@ import org.springframework.security.oauth2.server.authorization.oidc.OidcClientR
 import org.springframework.security.oauth2.server.authorization.oidc.authentication.OidcClientConfigurationAuthenticationProvider;
 import org.springframework.security.oauth2.server.authorization.oidc.authentication.OidcClientRegistrationAuthenticationProvider;
 import org.springframework.security.oauth2.server.authorization.oidc.authentication.OidcClientRegistrationAuthenticationToken;
-import org.springframework.security.oauth2.server.authorization.oidc.authentication.OidcClientRegistrationAuthenticationValidator;
 import org.springframework.security.oauth2.server.authorization.oidc.converter.OidcClientRegistrationRegisteredClientConverter;
 import org.springframework.security.oauth2.server.authorization.oidc.converter.RegisteredClientOidcClientRegistrationConverter;
 import org.springframework.security.oauth2.server.authorization.oidc.http.converter.OidcClientRegistrationHttpMessageConverter;
@@ -546,129 +545,6 @@ public class OidcClientRegistrationTests {
 			.isCloseTo(expectedSecretExpiryDate, allowedDelta);
 	}

-	@Test
-	public void requestWhenProtocolRelativeRedirectUriThenBadRequest() throws Exception {
-		this.spring.register(DefaultValidatorConfiguration.class).autowire();
-		assertThat(requestWhenInvalidClientMetadataThenBadRequest("""
-				{
-				  "client_name": "client-name",
-				  "redirect_uris": ["//client.example.com/path"],
-				  "grant_types": ["authorization_code"]
-				}
-				""")).isEqualTo(HttpStatus.BAD_REQUEST.value());
-	}
-
-	@Test
-	public void requestWhenJavascriptSchemeRedirectUriThenBadRequest() throws Exception {
-		this.spring.register(DefaultValidatorConfiguration.class).autowire();
-		assertThat(requestWhenInvalidClientMetadataThenBadRequest("""
-				{
-				  "client_name": "client-name",
-				  "redirect_uris": ["javascript:alert(document.cookie)"],
-				  "grant_types": ["authorization_code"]
-				}
-				""")).isEqualTo(HttpStatus.BAD_REQUEST.value());
-	}
-
-	@Test
-	public void requestWhenDataSchemeRedirectUriThenBadRequest() throws Exception {
-		this.spring.register(DefaultValidatorConfiguration.class).autowire();
-		assertThat(requestWhenInvalidClientMetadataThenBadRequest("""
-				{
-				  "client_name": "client-name",
-				  "redirect_uris": ["data:text/html,<h1>content</h1>"],
-				  "grant_types": ["authorization_code"]
-				}
-				""")).isEqualTo(HttpStatus.BAD_REQUEST.value());
-	}
-
-	@Test
-	public void requestWhenJavascriptSchemePostLogoutRedirectUriThenBadRequest() throws Exception {
-		this.spring.register(DefaultValidatorConfiguration.class).autowire();
-		assertThat(requestWhenInvalidClientMetadataThenBadRequest("""
-				{
-				  "client_name": "client-name",
-				  "redirect_uris": ["https://client.example.com"],
-				  "post_logout_redirect_uris": ["javascript:alert(document.cookie)"],
-				  "grant_types": ["authorization_code"]
-				}
-				""")).isEqualTo(HttpStatus.BAD_REQUEST.value());
-	}
-
-	@Test
-	public void requestWhenDataSchemePostLogoutRedirectUriThenBadRequest() throws Exception {
-		this.spring.register(DefaultValidatorConfiguration.class).autowire();
-		assertThat(requestWhenInvalidClientMetadataThenBadRequest("""
-				{
-				  "client_name": "client-name",
-				  "redirect_uris": ["https://client.example.com"],
-				  "post_logout_redirect_uris": ["data:text/html,<h1>content</h1>"],
-				  "grant_types": ["authorization_code"]
-				}
-				""")).isEqualTo(HttpStatus.BAD_REQUEST.value());
-	}
-
-	@Test
-	public void requestWhenHttpJwkSetUriThenBadRequest() throws Exception {
-		this.spring.register(DefaultValidatorConfiguration.class).autowire();
-		assertThat(requestWhenInvalidClientMetadataThenBadRequest("""
-				{
-				  "client_name": "client-name",
-				  "redirect_uris": ["https://client.example.com"],
-				  "grant_types": ["authorization_code"],
-				  "jwks_uri": "http://169.254.169.254/keys",
-				  "token_endpoint_auth_method": "private_key_jwt"
-				}
-				""")).isEqualTo(HttpStatus.BAD_REQUEST.value());
-	}
-
-	@Test
-	public void requestWhenArbitraryScopeThenBadRequest() throws Exception {
-		this.spring.register(DefaultValidatorConfiguration.class).autowire();
-		assertThat(requestWhenInvalidClientMetadataThenBadRequest("""
-				{
-				  "client_name": "client-name",
-				  "redirect_uris": ["https://client.example.com"],
-				  "grant_types": ["authorization_code"],
-				  "scope": "read write"
-				}
-				""")).isEqualTo(HttpStatus.BAD_REQUEST.value());
-	}
-
-	private int requestWhenInvalidClientMetadataThenBadRequest(String json) throws Exception {
-		String clientRegistrationScope = "client.create";
-		String clientId = "client-registrar-" + System.nanoTime();
-		// @formatter:off
-		RegisteredClient clientRegistrar = RegisteredClient.withId(clientId)
-				.clientId(clientId)
-				.clientSecret("{noop}secret")
-				.clientAuthenticationMethod(ClientAuthenticationMethod.CLIENT_SECRET_BASIC)
-				.authorizationGrantType(AuthorizationGrantType.CLIENT_CREDENTIALS)
-				.scope(clientRegistrationScope)
-				.build();
-		// @formatter:on
-		this.registeredClientRepository.save(clientRegistrar);
-
-		MvcResult tokenResult = this.mvc
-			.perform(post(ISSUER.concat(DEFAULT_TOKEN_ENDPOINT_URI))
-				.param(OAuth2ParameterNames.GRANT_TYPE, AuthorizationGrantType.CLIENT_CREDENTIALS.getValue())
-				.param(OAuth2ParameterNames.SCOPE, clientRegistrationScope)
-				.with(httpBasic(clientId, "secret")))
-			.andExpect(status().isOk())
-			.andReturn();
-		OAuth2AccessToken accessToken = readAccessTokenResponse(tokenResult.getResponse()).getAccessToken();
-
-		HttpHeaders httpHeaders = new HttpHeaders();
-		httpHeaders.setBearerAuth(accessToken.getTokenValue());
-
-		MvcResult registerResult = this.mvc
-			.perform(post(ISSUER.concat(DEFAULT_OIDC_CLIENT_REGISTRATION_ENDPOINT_URI)).headers(httpHeaders)
-				.contentType(MediaType.APPLICATION_JSON)
-				.content(json))
-			.andReturn();
-		return registerResult.getResponse().getStatus();
-	}
-
 	private OidcClientRegistration registerClient(OidcClientRegistration clientRegistration) throws Exception {
 		// ***** (1) Obtain the "initial" access token used for registering the client

@@ -766,18 +642,6 @@ public class OidcClientRegistrationTests {
 		return clientRegistrationHttpMessageConverter.read(OidcClientRegistration.class, httpResponse);
 	}

-	private static Consumer<List<AuthenticationProvider>> scopePermissiveValidatorCustomizer() {
-		return (authenticationProviders) -> authenticationProviders.forEach((authenticationProvider) -> {
-			if (authenticationProvider instanceof OidcClientRegistrationAuthenticationProvider provider) {
-				provider.setAuthenticationValidator(
-						OidcClientRegistrationAuthenticationValidator.DEFAULT_REDIRECT_URI_VALIDATOR.andThen(
-								OidcClientRegistrationAuthenticationValidator.DEFAULT_POST_LOGOUT_REDIRECT_URI_VALIDATOR)
-							.andThen(OidcClientRegistrationAuthenticationValidator.DEFAULT_JWK_SET_URI_VALIDATOR)
-							.andThen(OidcClientRegistrationAuthenticationValidator.SIMPLE_SCOPE_VALIDATOR));
-			}
-		});
-	}
-
 	@EnableWebSecurity
 	@Configuration(proxyBeanMethods = false)
 	static class CustomClientRegistrationConfiguration extends AuthorizationServerConfiguration {
@@ -796,7 +660,7 @@ public class OidcClientRegistrationTests {
 																	.clientRegistrationRequestConverter(authenticationConverter)
 																	.clientRegistrationRequestConverters(authenticationConvertersConsumer)
 																	.authenticationProvider(authenticationProvider)
-																	.authenticationProviders(scopePermissiveValidatorCustomizer().andThen(authenticationProvidersConsumer))
+																	.authenticationProviders(authenticationProvidersConsumer)
 																	.clientRegistrationResponseHandler(authenticationSuccessHandler)
 																	.errorResponseHandler(authenticationFailureHandler)
 													)
@@ -826,7 +690,7 @@ public class OidcClientRegistrationTests {
 											oidc
 													.clientRegistrationEndpoint((clientRegistration) ->
 															clientRegistration
-																	.authenticationProviders(scopePermissiveValidatorCustomizer().andThen(configureClientRegistrationConverters()))
+																	.authenticationProviders(configureClientRegistrationConverters())
 													)
 									)
 					)
@@ -867,7 +731,7 @@ public class OidcClientRegistrationTests {
 											oidc
 													.clientRegistrationEndpoint((clientRegistration) ->
 															clientRegistration
-																	.authenticationProviders(scopePermissiveValidatorCustomizer().andThen(configureClientRegistrationConverters()))
+																	.authenticationProviders(configureClientRegistrationConverters())
 													)
 									)
 					)
@@ -891,33 +755,6 @@ public class OidcClientRegistrationTests {

 	}

-	@EnableWebSecurity
-	@Configuration(proxyBeanMethods = false)
-	static class DefaultValidatorConfiguration extends AuthorizationServerConfiguration {
-
-		// Override with Customizer.withDefaults() so the default (strict)
-		// OidcClientRegistrationAuthenticationValidator is in effect.
-		// @formatter:off
-		@Bean
-		@Override
-		SecurityFilterChain authorizationServerSecurityFilterChain(HttpSecurity http) throws Exception {
-			http
-					.oauth2AuthorizationServer((authorizationServer) ->
-							authorizationServer
-									.oidc((oidc) ->
-											oidc
-													.clientRegistrationEndpoint(Customizer.withDefaults())
-									)
-					)
-					.authorizeHttpRequests((authorize) ->
-							authorize.anyRequest().authenticated()
-					);
-			return http.build();
-		}
-		// @formatter:on
-
-	}
-
 	@EnableWebSecurity
 	@Configuration(proxyBeanMethods = false)
 	static class AuthorizationServerConfiguration {
@@ -930,10 +767,7 @@ public class OidcClientRegistrationTests {
 							authorizationServer
 									.oidc((oidc) ->
 											oidc
-													.clientRegistrationEndpoint((clientRegistration) ->
-															clientRegistration
-																	.authenticationProviders(scopePermissiveValidatorCustomizer())
-													)
+													.clientRegistrationEndpoint(Customizer.withDefaults())
 									)
 					)
 					.authorizeHttpRequests((authorize) ->
@@ -60,7 +60,6 @@ import org.springframework.security.config.test.SpringTestContext;
 import org.springframework.security.config.test.SpringTestContextExtension;
 import org.springframework.security.core.Authentication;
 import org.springframework.security.core.GrantedAuthority;
-import org.springframework.security.core.authority.FactorGrantedAuthority;
 import org.springframework.security.core.session.SessionRegistry;
 import org.springframework.security.core.session.SessionRegistryImpl;
 import org.springframework.security.crypto.password.NoOpPasswordEncoder;
@@ -211,8 +210,7 @@ public class OidcTests {
 				registeredClient);
 		MvcResult mvcResult = this.mvc
 			.perform(get(DEFAULT_AUTHORIZATION_ENDPOINT_URI).queryParams(authorizationRequestParameters)
-				.with(user("user").roles("A", "B")
-					.authorities(FactorGrantedAuthority.fromAuthority(FactorGrantedAuthority.PASSWORD_AUTHORITY))))
+				.with(user("user").roles("A", "B")))
 			.andExpect(status().is3xxRedirection())
 			.andReturn();
 		String redirectedUrl = mvcResult.getResponse().getRedirectedUrl();
@@ -272,8 +270,7 @@ public class OidcTests {
 				registeredClient);
 		MvcResult mvcResult = this.mvc
 			.perform(get(DEFAULT_AUTHORIZATION_ENDPOINT_URI).queryParams(authorizationRequestParameters)
-				.with(user("user").roles("A", "B")
-					.authorities(FactorGrantedAuthority.fromAuthority(FactorGrantedAuthority.PASSWORD_AUTHORITY))))
+				.with(user("user").roles("A", "B")))
 			.andExpect(status().is3xxRedirection())
 			.andReturn();
 		String redirectedUrl = mvcResult.getResponse().getRedirectedUrl();
@@ -338,8 +335,7 @@ public class OidcTests {
 				registeredClient);
 		MvcResult mvcResult = this.mvc
 			.perform(get(issuer.concat(DEFAULT_AUTHORIZATION_ENDPOINT_URI)).queryParams(authorizationRequestParameters)
-				.with(user("user")
-					.authorities(FactorGrantedAuthority.fromAuthority(FactorGrantedAuthority.PASSWORD_AUTHORITY))))
+				.with(user("user")))
 			.andExpect(status().is3xxRedirection())
 			.andReturn();

@@ -392,8 +388,7 @@ public class OidcTests {
 				registeredClient1);
 		MvcResult mvcResult = this.mvc
 			.perform(get(DEFAULT_AUTHORIZATION_ENDPOINT_URI).queryParams(authorizationRequestParameters)
-				.with(user("user1")
-					.authorities(FactorGrantedAuthority.fromAuthority(FactorGrantedAuthority.PASSWORD_AUTHORITY))))
+				.with(user("user1")))
 			.andExpect(status().is3xxRedirection())
 			.andReturn();

@@ -429,8 +424,7 @@ public class OidcTests {
 		authorizationRequestParameters = getAuthorizationRequestParameters(registeredClient2);
 		mvcResult = this.mvc
 			.perform(get(DEFAULT_AUTHORIZATION_ENDPOINT_URI).queryParams(authorizationRequestParameters)
-				.with(user("user2")
-					.authorities(FactorGrantedAuthority.fromAuthority(FactorGrantedAuthority.PASSWORD_AUTHORITY))))
+				.with(user("user2")))
 			.andExpect(status().is3xxRedirection())
 			.andReturn();

@@ -503,8 +497,7 @@ public class OidcTests {
 				registeredClient);
 		MvcResult mvcResult = this.mvc
 			.perform(get(DEFAULT_AUTHORIZATION_ENDPOINT_URI).queryParams(authorizationRequestParameters)
-				.with(user("user")
-					.authorities(FactorGrantedAuthority.fromAuthority(FactorGrantedAuthority.PASSWORD_AUTHORITY))))
+				.with(user("user")))
 			.andExpect(status().is3xxRedirection())
 			.andReturn();
 		String redirectedUrl = mvcResult.getResponse().getRedirectedUrl();
@@ -544,8 +537,7 @@ public class OidcTests {
 				registeredClient);
 		MvcResult mvcResult = this.mvc
 			.perform(get(DEFAULT_AUTHORIZATION_ENDPOINT_URI).queryParams(authorizationRequestParameters)
-				.with(user("user")
-					.authorities(FactorGrantedAuthority.fromAuthority(FactorGrantedAuthority.PASSWORD_AUTHORITY))))
+				.with(user("user")))
 			.andExpect(status().is3xxRedirection())
 			.andReturn();
 		String redirectedUrl = mvcResult.getResponse().getRedirectedUrl();
@@ -22,7 +22,6 @@ import java.security.interfaces.ECPrivateKey;
 import java.security.interfaces.ECPublicKey;
 import java.security.interfaces.RSAPrivateKey;
 import java.security.interfaces.RSAPublicKey;
-import java.time.Duration;
 import java.time.Instant;
 import java.time.temporal.ChronoUnit;
 import java.util.Base64;
@@ -31,7 +30,6 @@ import java.util.HashMap;
 import java.util.Map;
 import java.util.Set;
 import java.util.UUID;
-import java.util.function.Function;

 import com.nimbusds.jose.jwk.ECKey;
 import com.nimbusds.jose.jwk.JWK;
@@ -49,26 +47,20 @@ import org.springframework.context.annotation.Configuration;
 import org.springframework.http.HttpHeaders;
 import org.springframework.http.HttpMethod;
 import org.springframework.security.config.Customizer;
-import org.springframework.security.config.ObjectPostProcessor;
 import org.springframework.security.config.annotation.web.builders.HttpSecurity;
 import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
 import org.springframework.security.config.test.SpringTestContext;
 import org.springframework.security.config.test.SpringTestContextExtension;
-import org.springframework.security.oauth2.core.OAuth2TokenValidator;
 import org.springframework.security.oauth2.core.endpoint.OAuth2ParameterNames;
 import org.springframework.security.oauth2.jose.TestJwks;
 import org.springframework.security.oauth2.jose.TestKeys;
 import org.springframework.security.oauth2.jose.jws.SignatureAlgorithm;
-import org.springframework.security.oauth2.jwt.DPoPProofContext;
-import org.springframework.security.oauth2.jwt.DPoPProofJwtDecoderFactory;
-import org.springframework.security.oauth2.jwt.DPoPProofReplayValidator;
 import org.springframework.security.oauth2.jwt.JwsHeader;
 import org.springframework.security.oauth2.jwt.Jwt;
 import org.springframework.security.oauth2.jwt.JwtClaimsSet;
 import org.springframework.security.oauth2.jwt.JwtEncoderParameters;
 import org.springframework.security.oauth2.jwt.NimbusJwtDecoder;
 import org.springframework.security.oauth2.jwt.NimbusJwtEncoder;
-import org.springframework.security.oauth2.server.resource.authentication.DPoPAuthenticationProvider;
 import org.springframework.security.web.SecurityFilterChain;
 import org.springframework.test.web.servlet.MockMvc;
 import org.springframework.web.bind.annotation.RequestMapping;
@@ -253,10 +245,8 @@ public class DPoPAuthenticationConfigurerTests {
 						.requestMatchers("/resource2").hasAnyAuthority("SCOPE_resource2.read", "SCOPE_resource2.write")
 						.anyRequest().authenticated()
 				)
-				.oauth2ResourceServer((oauth2ResourceServer) ->
-					oauth2ResourceServer
-						.jwt(Customizer.withDefaults())
-						.withObjectPostProcessor(dPoPProofVerifierFactoryCustomizer()));
+				.oauth2ResourceServer((oauth2) -> oauth2
+						.jwt(Customizer.withDefaults()));
 			// @formatter:on
 			return http.build();
 		}
@@ -266,25 +256,6 @@ public class DPoPAuthenticationConfigurerTests {
 			return NimbusJwtDecoder.withPublicKey(PROVIDER_RSA_PUBLIC_KEY).build();
 		}

-		private ObjectPostProcessor<DPoPAuthenticationProvider> dPoPProofVerifierFactoryCustomizer() {
-			return new ObjectPostProcessor<>() {
-				@Override
-				public <O extends DPoPAuthenticationProvider> O postProcess(O authenticationProvider) {
-					DPoPProofReplayValidator.InMemoryCache inMemoryCache = new DPoPProofReplayValidator.InMemoryCache();
-					inMemoryCache.setMaxSize(50_000);
-					inMemoryCache.setMaxRequestsPerKey(500);
-					DPoPProofReplayValidator dPoPProofReplayValidator = new DPoPProofReplayValidator(inMemoryCache);
-					dPoPProofReplayValidator.setClockSkew(Duration.ofSeconds(60));
-					Function<DPoPProofContext, OAuth2TokenValidator<Jwt>> jwtValidatorFactory = DPoPProofJwtDecoderFactory
-						.createDefaultJwtValidatorFactory(Collections.singletonList(dPoPProofReplayValidator));
-					DPoPProofJwtDecoderFactory dPoPProofJwtDecoderFactory = new DPoPProofJwtDecoderFactory();
-					dPoPProofJwtDecoderFactory.setJwtValidatorFactory(jwtValidatorFactory);
-					authenticationProvider.setDPoPProofVerifierFactory(dPoPProofJwtDecoderFactory);
-					return authenticationProvider;
-				}
-			};
-		}
-
 	}

 	@RestController
@@ -40,7 +40,6 @@ import org.springframework.security.config.annotation.web.builders.HttpSecurity;
 import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
 import org.springframework.security.config.test.SpringTestContext;
 import org.springframework.security.config.test.SpringTestContextExtension;
-import org.springframework.security.config.web.PathPatternRequestMatcherBuilderFactoryBean;
 import org.springframework.security.core.userdetails.PasswordEncodedUser;
 import org.springframework.security.core.userdetails.UserDetailsService;
 import org.springframework.security.provisioning.InMemoryUserDetailsManager;
@@ -99,19 +98,6 @@ public class OneTimeTokenLoginConfigurerTests {
 			.andExpectAll(status().isFound(), redirectedUrl("/"), authenticated());
 	}

-	// gh-19128
-	@Test
-	void oneTimeTokenWhenBuilderBeanWithBasePathThenGenerateAndLoginUrlsIgnoreBasePath() throws Exception {
-		this.spring.register(OneTimeTokenBuilderBeanConfig.class).autowire();
-		this.mvc.perform(post("/ott/generate").param("username", "user").with(csrf()))
-			.andExpectAll(status().isFound(), redirectedUrl("/login/ott"));
-
-		String token = getLastToken().getTokenValue();
-
-		this.mvc.perform(post("/login/ott").param("token", token).with(csrf()))
-			.andExpectAll(status().isFound(), redirectedUrl("/"), authenticated());
-	}
-
 	@Test
 	void oneTimeTokenWhenDifferentAuthenticationUrlsThenCanAuthenticate() throws Exception {
 		this.spring.register(OneTimeTokenDifferentUrlsConfig.class).autowire();
@@ -310,41 +296,6 @@ public class OneTimeTokenLoginConfigurerTests {

 	}

-	// gh-19128
-	@Configuration(proxyBeanMethods = false)
-	@EnableWebSecurity
-	@Import(UserDetailsServiceConfig.class)
-	static class OneTimeTokenBuilderBeanConfig {
-
-		@Bean
-		PathPatternRequestMatcherBuilderFactoryBean requestMatcherBuilder() {
-			PathPatternRequestMatcherBuilderFactoryBean bean = new PathPatternRequestMatcherBuilderFactoryBean();
-			bean.setBasePath("/spring");
-			return bean;
-		}
-
-		@Bean
-		SecurityFilterChain securityFilterChain(HttpSecurity http,
-				OneTimeTokenGenerationSuccessHandler ottSuccessHandler) throws Exception {
-			// @formatter:off
-			http
-					.authorizeHttpRequests((authorize) -> authorize
-							.anyRequest().authenticated()
-					)
-					.oneTimeTokenLogin((ott) -> ott
-							.tokenGenerationSuccessHandler(ottSuccessHandler)
-					);
-			// @formatter:on
-			return http.build();
-		}
-
-		@Bean
-		TestOneTimeTokenGenerationSuccessHandler ottSuccessHandler() {
-			return new TestOneTimeTokenGenerationSuccessHandler();
-		}
-
-	}
-
 	@Configuration(proxyBeanMethods = false)
 	@EnableWebSecurity
 	@Import(UserDetailsServiceConfig.class)
@@ -57,7 +57,6 @@ import org.springframework.security.config.annotation.web.builders.HttpSecurity;
 import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
 import org.springframework.security.config.test.SpringTestContext;
 import org.springframework.security.config.test.SpringTestContextExtension;
-import org.springframework.security.config.web.PathPatternRequestMatcherBuilderFactoryBean;
 import org.springframework.security.core.Authentication;
 import org.springframework.security.core.AuthenticationException;
 import org.springframework.security.core.annotation.AuthenticationPrincipal;
@@ -245,14 +244,6 @@ public class Saml2LoginConfigurerTests {
 		performSaml2Login("ROLE_AUTH_MANAGER");
 	}

-	// gh-19128
-	@Test
-	public void saml2LoginWhenBuilderBeanWithBasePathThenAuthenticateUriIgnoresBasePath() throws Exception {
-		this.spring.register(Saml2LoginBuilderBeanConfig.class).autowire();
-		MvcResult result = this.mvc.perform(get("/saml2/authenticate/registration-id")).andReturn();
-		assertThat(result.getResponse().getRedirectedUrl()).contains("SAMLRequest");
-	}
-
 	@Test
 	public void authenticationRequestWhenAuthenticationRequestResolverBeanThenUses() throws Exception {
 		this.spring.register(CustomAuthenticationRequestResolverBean.class).autowire();
@@ -531,33 +522,6 @@ public class Saml2LoginConfigurerTests {

 	}

-	// gh-19128
-	@Configuration
-	@EnableWebSecurity
-	@Import(Saml2LoginConfigBeans.class)
-	static class Saml2LoginBuilderBeanConfig {
-
-		@Bean
-		PathPatternRequestMatcherBuilderFactoryBean requestMatcherBuilder() {
-			PathPatternRequestMatcherBuilderFactoryBean bean = new PathPatternRequestMatcherBuilderFactoryBean();
-			bean.setBasePath("/spring");
-			return bean;
-		}
-
-		@Bean
-		SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
-			// @formatter:off
-			http
-				.authorizeHttpRequests((authz) -> authz
-					.anyRequest().authenticated()
-				)
-				.saml2Login(Customizer.withDefaults());
-			// @formatter:on
-			return http.build();
-		}
-
-	}
-
 	@Configuration
 	@EnableWebSecurity
 	@Import(Saml2LoginConfigBeans.class)
@@ -49,7 +49,6 @@ import org.springframework.security.config.annotation.web.builders.HttpSecurity;
 import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
 import org.springframework.security.config.test.SpringTestContext;
 import org.springframework.security.config.test.SpringTestContextExtension;
-import org.springframework.security.config.web.PathPatternRequestMatcherBuilderFactoryBean;
 import org.springframework.security.core.authority.AuthorityUtils;
 import org.springframework.security.core.context.SecurityContextHolderStrategy;
 import org.springframework.security.saml2.core.Saml2Utils;
@@ -197,17 +196,6 @@ public class Saml2LogoutConfigurerTests {
 		verify(logoutHandler).logout(any(), any(), any());
 	}

-	// gh-19128
-	@Test
-	public void saml2LogoutWhenBuilderBeanWithBasePathThenLogoutUrlIgnoresBasePath() throws Exception {
-		this.spring.register(Saml2LogoutBuilderBeanConfig.class).autowire();
-		MvcResult result = this.mvc.perform(post("/logout").with(authentication(this.user)).with(csrf()))
-			.andExpect(status().isFound())
-			.andReturn();
-		String location = result.getResponse().getHeader("Location");
-		assertThat(location).startsWith("https://ap.example.org/logout/saml2/request");
-	}
-
 	@Test
 	public void saml2LogoutWhenUnauthenticatedThenEntryPoint() throws Exception {
 		this.spring.register(Saml2LogoutDefaultsConfig.class).autowire();
@@ -589,32 +577,6 @@ public class Saml2LogoutConfigurerTests {

 	}

-	// gh-19128
-	@Configuration
-	@EnableWebSecurity
-	@Import(Saml2LoginConfigBeans.class)
-	static class Saml2LogoutBuilderBeanConfig {
-
-		@Bean
-		PathPatternRequestMatcherBuilderFactoryBean requestMatcherBuilder() {
-			PathPatternRequestMatcherBuilderFactoryBean bean = new PathPatternRequestMatcherBuilderFactoryBean();
-			bean.setBasePath("/spring");
-			return bean;
-		}
-
-		@Bean
-		SecurityFilterChain web(HttpSecurity http) throws Exception {
-			// @formatter:off
-			http
-				.authorizeHttpRequests((authorize) -> authorize.anyRequest().authenticated())
-				.saml2Login(withDefaults())
-				.saml2Logout(withDefaults());
-			// @formatter:on
-			return http.build();
-		}
-
-	}
-
 	@Configuration
 	@EnableWebSecurity
 	@Import(Saml2LoginConfigBeans.class)
@@ -30,7 +30,6 @@ import org.springframework.security.config.annotation.web.builders.HttpSecurity;
 import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
 import org.springframework.security.config.test.SpringTestContext;
 import org.springframework.security.config.test.SpringTestContextExtension;
-import org.springframework.security.config.web.PathPatternRequestMatcherBuilderFactoryBean;
 import org.springframework.security.saml2.provider.service.metadata.OpenSaml5MetadataResolver;
 import org.springframework.security.saml2.provider.service.metadata.RequestMatcherMetadataResponseResolver;
 import org.springframework.security.saml2.provider.service.metadata.Saml2MetadataResponse;
@@ -125,15 +124,6 @@ public class Saml2MetadataConfigurerTests {
 		this.mvc.perform(get("/saml2/metadata")).andExpect(status().isForbidden());
 	}

-	// gh-19128
-	@Test
-	void saml2MetadataWhenBuilderBeanWithBasePathThenMetadataUrlIgnoresBasePath() throws Exception {
-		this.spring.register(MetadataBuilderBeanConfig.class).autowire();
-		this.mvc.perform(get("/saml/metadata"))
-			.andExpect(status().isOk())
-			.andExpect(content().string(containsString("md:EntityDescriptor")));
-	}
-
 	@EnableWebSecurity
 	@Configuration
 	@Import(RelyingPartyRegistrationConfig.class)
@@ -151,31 +141,6 @@ public class Saml2MetadataConfigurerTests {

 	}

-	// gh-19128
-	@EnableWebSecurity
-	@Configuration
-	@Import(RelyingPartyRegistrationConfig.class)
-	static class MetadataBuilderBeanConfig {
-
-		@Bean
-		PathPatternRequestMatcherBuilderFactoryBean requestMatcherBuilder() {
-			PathPatternRequestMatcherBuilderFactoryBean bean = new PathPatternRequestMatcherBuilderFactoryBean();
-			bean.setBasePath("/spring");
-			return bean;
-		}
-
-		@Bean
-		SecurityFilterChain filters(HttpSecurity http) throws Exception {
-			// @formatter:off
-			http
-				.authorizeHttpRequests((authorize) -> authorize.anyRequest().authenticated())
-				.saml2Metadata((saml2) -> saml2.metadataUrl("/saml/metadata"));
-			return http.build();
-			// @formatter:on
-		}
-
-	}
-
 	@EnableWebSecurity
 	@Configuration
 	@Import(RelyingPartyRegistrationConfig.class)
@@ -107,7 +107,7 @@ public class ServerHttpSecurityConfigurationTests {
 	}

 	@Test
-	public void loadConfigWhenReactiveUserAuthenticationServiceConfiguredThenServerHttpSecurityExists() {
+	public void loadConfigWhenReactiveUserDetailsServiceConfiguredThenServerHttpSecurityExists() {
 		this.spring
 			.register(ServerHttpSecurityConfiguration.class, ReactiveAuthenticationTestConfiguration.class,
 					WebFluxSecurityConfiguration.class)
@@ -116,16 +116,6 @@ public class ServerHttpSecurityConfigurationTests {
 		assertThat(serverHttpSecurity).isNotNull();
 	}

-	@Test
-	public void loadConfigWhenOnlyReactiveUserDetailsServiceConfiguredThenServerHttpSecurityExists() {
-		this.spring
-			.register(ServerHttpSecurityConfiguration.class, ReactiveUserDetailsServiceOnlyTestConfiguration.class,
-					WebFluxSecurityConfiguration.class)
-			.autowire();
-		ServerHttpSecurity serverHttpSecurity = this.spring.getContext().getBean(ServerHttpSecurity.class);
-		assertThat(serverHttpSecurity).isNotNull();
-	}
-
 	@Test
 	public void loadConfigWhenProxyingEnabledAndSubclassThenServerHttpSecurityExists() {
 		this.spring
@@ -591,14 +581,4 @@ public class ServerHttpSecurityConfigurationTests {

 	}

-	@Configuration(proxyBeanMethods = false)
-	static class ReactiveUserDetailsServiceOnlyTestConfiguration {
-
-		@Bean
-		static ReactiveUserDetailsService userDetailsService() {
-			return (username) -> Mono.just(PasswordEncodedUser.user());
-		}
-
-	}
-
 }
@@ -65,7 +65,7 @@ public class XsdDocumentedTests {

 	String schema31xDocumentLocation = "org/springframework/security/config/spring-security-3.1.xsd";

-	String schemaDocumentLocation = "org/springframework/security/config/spring-security-7.0.xsd";
+	String schemaDocumentLocation = "org/springframework/security/config/spring-security-7.1.xsd";

 	XmlSupport xml = new XmlSupport();

@@ -151,8 +151,8 @@ public class XsdDocumentedTests {
 				.list((dir, name) -> name.endsWith(".xsd"));
 		// @formatter:on
 		assertThat(schemas.length)
-			.withFailMessage("the count is equal to 28, if not then schemaDocument needs updating")
-			.isEqualTo(28);
+			.withFailMessage("the count is equal to 29, if not then schemaDocument needs updating")
+			.isEqualTo(29);
 	}

 	/**
@@ -28,17 +28,14 @@ import jakarta.servlet.http.HttpSession;
 import org.junit.jupiter.api.Test;
 import org.junit.jupiter.api.extension.ExtendWith;

-import org.springframework.beans.BeansException;
 import org.springframework.beans.factory.BeanCreationException;
 import org.springframework.beans.factory.annotation.Autowired;
-import org.springframework.beans.factory.config.BeanPostProcessor;
 import org.springframework.beans.factory.parsing.BeanDefinitionParsingException;
 import org.springframework.beans.factory.xml.XmlBeanDefinitionStoreException;
 import org.springframework.security.config.test.SpringTestContext;
 import org.springframework.security.config.test.SpringTestContextExtension;
 import org.springframework.security.core.Authentication;
 import org.springframework.security.web.authentication.session.SessionLimit;
-import org.springframework.security.web.header.HeaderWriterFilter;
 import org.springframework.test.web.servlet.MockMvc;
 import org.springframework.test.web.servlet.ResultMatcher;
 import org.springframework.test.web.servlet.request.MockHttpServletRequestBuilder;
@@ -153,16 +150,6 @@ public class HttpHeadersConfigTests {
 		// @formatter:on
 	}

-	@Test
-	public void requestWhenHeadersEagerlyConfiguredThenHeadersAreWritten() throws Exception {
-		this.spring.configLocations(this.xml("HeadersEagerlyConfigured")).autowire();
-		// @formatter:off
-		this.mvc.perform(get("/").secure(true))
-				.andExpect(status().isOk())
-				.andExpect(includesDefaults());
-		// @formatter:on
-	}
-
 	@Test
 	public void requestWhenFrameOptionsConfiguredThenIncludesHeader() throws Exception {
 		Map<String, String> headers = new HashMap<>(defaultHeaders);
@@ -968,18 +955,6 @@ public class HttpHeadersConfigTests {

 	}

-	public static class EagerHeadersBeanPostProcessor implements BeanPostProcessor {
-
-		@Override
-		public Object postProcessAfterInitialization(Object bean, String beanName) throws BeansException {
-			if (bean instanceof HeaderWriterFilter headerWriterFilter) {
-				headerWriterFilter.setShouldWriteHeadersEagerly(true);
-			}
-			return bean;
-		}
-
-	}
-
 	public static class CustomSessionLimit implements SessionLimit {

 		@Override
@@ -314,78 +314,6 @@ public class InterceptUrlConfigTests {
 				.autowire());
 	}

-	@Test
-	public void requestWhenUsingDefaultMatcherAndServletPathThenAuthorizesRequestsAccordingly() throws Exception {
-		this.spring.configLocations(this.xml("DefaultMatcherServletPath")).autowire();
-		// @formatter:off
-		this.mvc.perform(get("/spring/path").with(userCredentials()))
-				.andExpect(status().isForbidden());
-		this.mvc.perform(get("/path").with(userCredentials()))
-				.andExpect(status().isOk());
-		// @formatter:on
-	}
-
-	@Test
-	public void requestWhenUsingDefaultMatcherAndServletPathAndAuthorizationManagerThenAuthorizesRequestsAccordingly()
-			throws Exception {
-		this.spring.configLocations(this.xml("DefaultMatcherServletPathAuthorizationManager")).autowire();
-		// @formatter:off
-		this.mvc.perform(get("/spring/path").with(userCredentials()))
-				.andExpect(status().isForbidden());
-		this.mvc.perform(get("/path").with(userCredentials()))
-				.andExpect(status().isOk());
-		// @formatter:on
-		assertThat(this.spring.getContext().getBean(AuthorizationManager.class)).isNotNull();
-	}
-
-	@Test
-	public void requestWhenUsingRegexMatcherThenAuthorizesRequestsAccordingly() throws Exception {
-		this.spring.configLocations(this.xml("RegexMatcher")).autowire();
-		// @formatter:off
-		this.mvc.perform(get("/path").with(userCredentials()))
-				.andExpect(status().isForbidden());
-		this.mvc.perform(get("/other").with(userCredentials()))
-				.andExpect(status().isNotFound());
-		// @formatter:on
-	}
-
-	@Test
-	public void requestWhenUsingRegexMatcherAndAuthorizationManagerThenAuthorizesRequestsAccordingly()
-			throws Exception {
-		this.spring.configLocations(this.xml("RegexMatcherAuthorizationManager")).autowire();
-		// @formatter:off
-		this.mvc.perform(get("/path").with(userCredentials()))
-				.andExpect(status().isForbidden());
-		this.mvc.perform(get("/other").with(userCredentials()))
-				.andExpect(status().isNotFound());
-		// @formatter:on
-		assertThat(this.spring.getContext().getBean(AuthorizationManager.class)).isNotNull();
-	}
-
-	@Test
-	public void requestWhenUsingCiRegexMatcherThenAuthorizesRequestsAccordingly() throws Exception {
-		this.spring.configLocations(this.xml("CiRegexMatcher")).autowire();
-		// @formatter:off
-		this.mvc.perform(get("/path").with(userCredentials()))
-				.andExpect(status().isForbidden());
-		this.mvc.perform(get("/PATH").with(userCredentials()))
-				.andExpect(status().isForbidden());
-		// @formatter:on
-	}
-
-	@Test
-	public void requestWhenUsingCiRegexMatcherAndAuthorizationManagerThenAuthorizesRequestsAccordingly()
-			throws Exception {
-		this.spring.configLocations(this.xml("CiRegexMatcherAuthorizationManager")).autowire();
-		// @formatter:off
-		this.mvc.perform(get("/path").with(userCredentials()))
-				.andExpect(status().isForbidden());
-		this.mvc.perform(get("/PATH").with(userCredentials()))
-				.andExpect(status().isForbidden());
-		// @formatter:on
-		assertThat(this.spring.getContext().getBean(AuthorizationManager.class)).isNotNull();
-	}
-
 	@Test
 	public void requestWhenUsingFilterAllDispatcherTypesAndAuthorizationManagerThenAuthorizesRequestsAccordingly()
 			throws Exception {
@@ -19,7 +19,6 @@ package org.springframework.security.config.http;
 import java.io.ByteArrayOutputStream;
 import java.io.IOException;
 import java.io.OutputStream;
-import java.security.AccessController;
 import java.security.Principal;
 import java.security.cert.X509Certificate;
 import java.util.Arrays;
@@ -989,7 +988,7 @@ public class MiscHttpConfigTests {

 		@GetMapping("/username")
 		String username() {
-			Subject subject = Subject.getSubject(AccessController.getContext());
+			Subject subject = Subject.current();
 			return subject.getPrincipals().iterator().next().getName();
 		}

@@ -1,37 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<!--
-  ~ Copyright 2004-present the original author or authors.
-  ~
-  ~ Licensed under the Apache License, Version 2.0 (the "License");
-  ~ you may not use this file except in compliance with the License.
-  ~ You may obtain a copy of the License at
-  ~
-  ~      https://www.apache.org/licenses/LICENSE-2.0
-  ~
-  ~ Unless required by applicable law or agreed to in writing, software
-  ~ distributed under the License is distributed on an "AS IS" BASIS,
-  ~ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-  ~ See the License for the specific language governing permissions and
-  ~ limitations under the License.
-  -->
-
-<b:beans xmlns:b="http://www.springframework.org/schema/beans"
-		xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
-		xmlns="http://www.springframework.org/schema/security"
-		xsi:schemaLocation="
-			http://www.springframework.org/schema/security
-			https://www.springframework.org/schema/security/spring-security.xsd
-			http://www.springframework.org/schema/beans
-			https://www.springframework.org/schema/beans/spring-beans.xsd">
-
-	<http auto-config="true">
-		<headers/>
-		<intercept-url pattern="/**" access="permitAll"/>
-	</http>
-
-	<b:bean class="org.springframework.security.config.http.HttpHeadersConfigTests.EagerHeadersBeanPostProcessor"/>
-
-	<b:bean name="simple" class="org.springframework.security.config.http.HttpHeadersConfigTests.SimpleController"/>
-
-	<b:import resource="userservice.xml"/>
-</b:beans>
@@ -24,7 +24,7 @@
 			http://www.springframework.org/schema/beans
 			https://www.springframework.org/schema/beans/spring-beans.xsd">

-	<http request-matcher="path" use-authorization-manager="false">
+	<http request-matcher="ant" use-authorization-manager="false">
 		<intercept-url pattern="/path" access="denyAll" servlet-path="/spring"/>
 		<http-basic/>
 	</http>
@@ -24,7 +24,7 @@
 			http://www.springframework.org/schema/beans
 			https://www.springframework.org/schema/beans/spring-beans.xsd">

-	<http request-matcher="path">
+	<http request-matcher="ant">
 		<intercept-url pattern="/path" access="denyAll" servlet-path="/spring"/>
 		<http-basic/>
 	</http>
@@ -1,36 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<!--
-  ~ Copyright 2004-present the original author or authors.
-  ~
-  ~ Licensed under the Apache License, Version 2.0 (the "License");
-  ~ you may not use this file except in compliance with the License.
-  ~ You may obtain a copy of the License at
-  ~
-  ~      https://www.apache.org/licenses/LICENSE-2.0
-  ~
-  ~ Unless required by applicable law or agreed to in writing, software
-  ~ distributed under the License is distributed on an "AS IS" BASIS,
-  ~ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-  ~ See the License for the specific language governing permissions and
-  ~ limitations under the License.
-  -->
-
-<b:beans xmlns:b="http://www.springframework.org/schema/beans"
-		xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
-		xmlns="http://www.springframework.org/schema/security"
-		xsi:schemaLocation="
-			http://www.springframework.org/schema/security
-			https://www.springframework.org/schema/security/spring-security.xsd
-			http://www.springframework.org/schema/beans
-			https://www.springframework.org/schema/beans/spring-beans.xsd">
-
-	<http request-matcher="ciRegex" use-authorization-manager="false">
-		<intercept-url pattern="\A/PATH\Z" access="denyAll"/>
-		<intercept-url pattern="\A/.*\Z" access="permitAll"/>
-		<http-basic/>
-	</http>
-
-	<b:bean name="path" class="org.springframework.security.config.http.InterceptUrlConfigTests.PathController"/>
-
-	<b:import resource="userservice.xml"/>
-</b:beans>
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
github-actions[bot]	ab8b139278	Release 7.1.0-M1	2026-01-19 15:23:49 +00:00
dependabot[bot]	e19c34771b	Bump ch.qos.logback:logback-classic from 1.5.24 to 1.5.25 Bumps [ch.qos.logback:logback-classic](https://github.com/qos-ch/logback) from 1.5.24 to 1.5.25. - [Release notes](https://github.com/qos-ch/logback/releases) - [Commits](https://github.com/qos-ch/logback/compare/v_1.5.24...v_1.5.25) --- updated-dependencies: - dependency-name: ch.qos.logback:logback-classic dependency-version: 1.5.25 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>	2026-01-19 10:06:16 -05:00
dependabot[bot]	318b4a785c	Bump org.springframework.data:spring-data-bom from 2025.1.1 to 2025.1.2 Bumps [org.springframework.data:spring-data-bom](https://github.com/spring-projects/spring-data-bom) from 2025.1.1 to 2025.1.2. - [Release notes](https://github.com/spring-projects/spring-data-bom/releases) - [Commits](https://github.com/spring-projects/spring-data-bom/compare/2025.1.1...2025.1.2) --- updated-dependencies: - dependency-name: org.springframework.data:spring-data-bom dependency-version: 2025.1.2 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>	2026-01-19 10:03:41 -05:00
Robert Winch	c73696f129	doclint -missing Temporarily using -missing to allow build to pass	2026-01-16 21:55:49 -06:00
Robert Winch	35d103843b	Externalize java-toolchain configuration We should not use subprojects to perform configuration becaause it does not allow for lazy loading and it can cause ordering problems. In this case, the toolchain was not being used but instead it was using the JAVA_HOME. By splitting the configuration into a plugin and applying it to each project it fixes the toolchain configuration	2026-01-16 16:54:00 -06:00
Robert Winch	8746ef746c	Bump io.projectreactor:reactor-bom from 2025.0.1 to 2025.0.2	2026-01-16 15:19:56 -06:00
Robert Winch	e72c39cabc	Merge branch '7.0.x'	2026-01-16 15:19:42 -06:00
Robert Winch	a8ca5b7d42	Remove 6.4.x from antora ui updates 6.4.x is no longer supported	2026-01-16 15:16:34 -06:00
Robert Winch	afa5804170	Remove 6.4.x dependabot 6.4.x is no longer has OSS support	2026-01-16 15:15:37 -06:00
dependabot[bot]	15dd96bddb	Bump io.spring.nullability:io.spring.nullability.gradle.plugin Bumps [io.spring.nullability:io.spring.nullability.gradle.plugin](https://github.com/spring-gradle-plugins/nullability-plugin) from 0.0.6 to 0.0.9. - [Release notes](https://github.com/spring-gradle-plugins/nullability-plugin/releases) - [Commits](https://github.com/spring-gradle-plugins/nullability-plugin/compare/v0.0.6...v0.0.9) --- updated-dependencies: - dependency-name: io.spring.nullability:io.spring.nullability.gradle.plugin dependency-version: 0.0.9 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>	2026-01-16 15:10:17 -06:00
Robert Winch	6b2e0444dd	Bump org.springframework:spring-framework-bom from 7.0.3-SNAPSHOT to 7.0.3 Closes gh-18515	2026-01-16 15:08:15 -06:00
Robert Winch	577d294fdc	Remove milestone repository Spring uses central for milestones now	2026-01-16 15:06:23 -06:00
Robert Winch	0993e5735e	Add missing @NullMarked Closes gh-18514	2026-01-16 14:53:16 -06:00
Robert Winch	048b6bdd88	Update to JDK 25 (release = 17) This commit updates the build to use JDK 25 while remaining compatable with JDK 17. Note that we must update our JAAS related tests to use release=25 due to the disabling of the Security Manager. See https://docs.oracle.com/en/java/javase/25/security/security-manager-is-permanently-disabled.html Closes gh-18512	2026-01-16 11:25:59 -06:00
Robert Winch	6e9b4f86a4	Fix nullability for JDK 25 Closes gh-18511	2026-01-16 10:53:19 -06:00
Robert Winch	38b66e8407	Update to Gradle 9.2.1 Closes gh-18510	2026-01-16 10:48:28 -06:00
Robert Winch	9e5b3d9ea1	Update to Kotlin 2.3.0 Closes gh-18509	2026-01-16 10:46:58 -06:00
Robert Winch	7563932106	Update jococo 0.8.14 Closes gh-18508	2026-01-16 10:46:53 -06:00
Robert Winch	48f958cbbf	Fix OAuth2AuthorizationRequestRedirectFilter constructor tests OAuth2AuthorizationRequestRedirectFilterTests attempt to validate the constructors throw IllegalArgumentException if an invalid argument is provided, but they are flawed because it is the relective code that is throwing the IllegalArgumentException due to imprecise type information. This changes the tests to no longer use unnecessary reflection and casts the types so that the type information is used to target the correct constructor. Closes gh-18507	2026-01-16 10:34:10 -06:00
Josh Cummings	30d6b3a02b	Merge branch '7.0.x'	2026-01-15 12:41:29 -07:00
Tran Ngoc Nhan	cfe13c7c76	Fix typos Signed-off-by: Tran Ngoc Nhan <ngocnhan.tran1996@gmail.com>	2026-01-15 10:52:01 -07:00
Josh Cummings	3336f5f2ec	Merge branch '7.0.x'	2026-01-14 14:47:31 -07:00
Josh Cummings	565896404c	Merge branch '7.0.x'	2026-01-14 14:36:12 -07:00
$박기현\qkrrl$ 박기현\qkrrl	91d8a04ec2	Fix duplicated use-authorization-manager in docs Signed-off-by: 박기현\qkrrl <qkrrlgus114@naver.com>	2026-01-14 14:21:38 -07:00
Marcus Hert da Coregio	8254f589b8	Create Jackson Mixin for OneTimeTokenAuthentication Closes gh-18095 Signed-off-by: Marcus Hert da Coregio <marcusdacoregio@gmail.com>	2026-01-14 10:35:02 -07:00
dependabot[bot]	3f773abf7c	Bump io.projectreactor:reactor-bom from 2025.0.1 to 2025.0.2 Bumps [io.projectreactor:reactor-bom](https://github.com/reactor/reactor) from 2025.0.1 to 2025.0.2. - [Release notes](https://github.com/reactor/reactor/releases) - [Commits](https://github.com/reactor/reactor/compare/2025.0.1...2025.0.2) --- updated-dependencies: - dependency-name: io.projectreactor:reactor-bom dependency-version: 2025.0.2 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>	2026-01-14 03:05:35 +00:00
Joe Grandja	92b7c41f2f	Ensure Cursor imports Spring Security Closes gh-8492	2026-01-13 17:01:21 -05:00
Bae Jihong	8692185de1	Fix javadoc warnings for spring-security-oauth2-client - Fix a javadoc warning - Apply javadoc-warnings-error plugin Closes gh-18460 Signed-off-by: Bae Jihong <dasog@naver.com>	2026-01-13 10:01:13 -06:00
Robert Winch	7ca0f7723e	Fix checkstyle	2026-01-12 16:28:22 -06:00
Stefano Cordio	a612522ecd	Add nullability contract to `PasswordEncoder#encode` Signed-off-by: Stefano Cordio <stefano.cordio@gmail.com>	2026-01-12 16:28:22 -06:00
Robert Winch	fe138d6434	Merge branch '7.0.x'	2026-01-12 16:05:51 -06:00
Robert Winch	93ae52aa58	Merge branch '7.0.x'	2026-01-12 15:48:57 -06:00
Robert Winch	43fe5f6b46	Fix update-antora-ui-spring.yml	2026-01-12 14:37:34 -06:00
Robert Winch	f47f81351e	Merge branch '7.0.x'	2026-01-12 14:32:23 -06:00
paulvas	0d47870928	Fix: migrate compiler-warnings-error plugin to gradle Fixes: gh-18434 Signed-off-by: paulvas <paulvas@gmail.com>	2026-01-12 13:57:57 -06:00
paulvas	da4362111a	Fix: Enforce compiler warnings in oauth2-core To prevent future compiler warnings from being introduced, this change applies the `compile-warnings-error` plugin to the `spring-security-oauth2-core` module. This ensures that any new warnings will fail the build, maintaining code quality and preventing warning accumulation. Fixes: gh-18434 Signed-off-by: Pavel Vassiliev <paulvas@gmail.com> Signed-off-by: paulvas <paulvas@gmail.com>	2026-01-12 13:57:57 -06:00
Pavel Vassiliev	1ddccd8a39	Fix spring-security-oauth2-core compiler warnings Closes: gh-18434 Signed-off-by: Pavel Vassiliev <paulvas@gmail.com> Signed-off-by: paulvas <paulvas@gmail.com>	2026-01-12 13:57:57 -06:00
Robert Winch	2825aa3ff1	Merge branch '7.0.x' Closes gh-18485	2026-01-12 13:44:13 -06:00
Robert Winch	ec06f08bb6	Merge branch '7.0.x'	2026-01-12 13:38:52 -06:00
rigu1	0a6883c586	Fix Javadoc warnings in spring-security-web * Use <code> tags for external references in DelegatingMissingAuthorityAccessDeniedHandler and SwitchUserWebFilter * Fix typo in SessionAuthenticationException * Apply javadoc-warnings-error plugin Closes gh-18468 Signed-off-by: rigu1 <dlsrbtla@gmail.com>	2026-01-12 13:24:47 -06:00
rigu1	c07a2e57bd	Add javadoc-warnings-error build plugin Signed-off-by: rigu1 <dlsrbtla@gmail.com>	2026-01-12 13:24:47 -06:00
Robert Winch	5a7d93ee3b	Merge branch '7.0.x' Closes gh-18471	2026-01-09 16:55:02 -06:00
Robert Winch	a3b57c470f	Merge branch '7.0.x'	2026-01-09 15:25:02 -06:00
Robert Winch	d1a32b4b62	Merge branch '7.0.x'	2026-01-09 15:23:29 -06:00
Robert Winch	3833650d33	Update to 7.1.0-SNAPSHOT	2026-01-09 10:32:03 -06:00