Revert "Mark targetDomainObject as @Nullable in PermissionEvaluator"

This reverts commit 9f1381c382.
2026-09-02 07:19:54 +00:00 · 2026-02-24 09:40:13 -06:00
1012 changed files with 4717 additions and 20803 deletions
@@ -1,7 +0,0 @@
-name: Build Release
-runs:
-  using: composite
-  steps:
-    - name: Build Release
-      shell: bash
-      run:  ./gradlew -PdeploymentRepository=$(pwd)/deployment-repository publishAllPublicationsToDeploymentRepository
@@ -1,7 +0,0 @@
-name: Test Release
-runs:
-  using: composite
-  steps:
-    - name: Test Release
-      shell: bash
-      run:  ./gradlew build
@@ -14,7 +14,6 @@ updates:
      timezone: Etc/UTC
    labels:
      - 'type: dependency-upgrade'
-      - 'in: build'
    registries:
      - shibboleth
    ignore:
@@ -61,12 +60,10 @@ updates:
      timezone: Etc/UTC
    labels:
      - 'type: dependency-upgrade'
-      - 'in: build'
    registries:
      - shibboleth
    ignore:
      - dependency-name: com.nimbusds:nimbus-jose-jwt
-      - dependency-name: io.spring.nullability:*
      - dependency-name: org.python:jython
      - dependency-name: org.apache.directory.server:*
      - dependency-name: org.apache.directory.shared:*
@@ -113,7 +110,6 @@ updates:
      timezone: Etc/UTC
    labels:
      - 'type: dependency-upgrade'
-      - 'in: build'
    registries:
      - shibboleth
    ignore:
@@ -1,17 +0,0 @@
-workflow:
-  generator:
-    project:
-      java:
-        versions:
-          primary: 25
-    workflows:
-      release-train:
-        build:
-          env:
-            COMMERCIAL_REPO_USERNAME: secrets.COMMERCIAL_ARTIFACTORY_USERNAME
-            COMMERCIAL_REPO_PASSWORD: secrets.COMMERCIAL_ARTIFACTORY_PASSWORD
-        test:
-          env:
-            COMMERCIAL_REPO_USERNAME: secrets.COMMERCIAL_ARTIFACTORY_USERNAME
-            COMMERCIAL_REPO_PASSWORD: secrets.COMMERCIAL_ARTIFACTORY_PASSWORD
-
@@ -0,0 +1,16 @@
+name: Merge Dependabot PR
+
+on:
+  pull_request:
+    branches:
+      - main
+      - '*.x'
+
+run-name: Merge Dependabot PR ${{ github.ref_name }}
+
+jobs:
+  merge-dependabot-pr:
+    permissions: write-all
+    uses: spring-io/spring-github-workflows/.github/workflows/spring-merge-dependabot-pr.yml@v7
+    with:
+      mergeArguments: --auto --rebase
@@ -0,0 +1,36 @@
+name: CI
+
+on:
+  schedule:
+    - cron: '0 10 * * *' # Once per day at 10am UTC
+  workflow_dispatch: # Manual trigger
+
+env:
+  DEVELOCITY_ACCESS_KEY: ${{ secrets.DEVELOCITY_ACCESS_KEY }}
+
+permissions:
+  contents: read
+
+jobs:
+  snapshot-test:
+    name: Test Against Snapshots
+    uses: spring-io/spring-security-release-tools/.github/workflows/test.yml@729fed56d42122f88583aff1be35c0800b7d77e9 # v1.0.14
+    strategy:
+      matrix:
+        include:
+          - java-version: 25
+            toolchain: 25
+    with:
+      java-version: ${{ matrix.java-version }}
+      test-args: --refresh-dependencies -PforceMavenRepositories=snapshot,https://oss.sonatype.org/content/repositories/snapshots -PisOverrideVersionCatalog -PtestToolchain=${{ matrix.toolchain }} -PspringFrameworkVersion=7.+ -PreactorVersion=2025.+ -PspringDataVersion=2025.+ --stacktrace
+    secrets: inherit
+  send-notification:
+    name: Send Notification
+    needs: [ snapshot-test ]
+    if: ${{ !success() }}
+    runs-on: ubuntu-latest
+    steps:
+      - name: Send Notification
+        uses: spring-io/spring-security-release-tools/.github/actions/send-notification@729fed56d42122f88583aff1be35c0800b7d77e9 # v1.0.14
+        with:
+          webhook-url: ${{ secrets.SPRING_SECURITY_CI_GCHAT_WEBHOOK_URL }}
@@ -0,0 +1,23 @@
+name: Clean build artifacts
+on:
+  schedule:
+    - cron: '0 10 * * *' # Once per day at 10am UTC
+
+permissions:
+  contents: read
+
+jobs:
+  main:
+    runs-on: ubuntu-latest
+    if: ${{ github.repository == 'spring-projects/spring-security' }}
+    permissions:
+      contents: none
+    steps:
+      - name: Delete artifacts in cron job
+        env:
+          GH_ACTIONS_REPO_TOKEN: ${{ secrets.GH_ACTIONS_REPO_TOKEN }}
+        run: |
+          echo "Running clean build artifacts logic"
+          output=$(curl -X GET -H "Authorization: token $GH_ACTIONS_REPO_TOKEN" https://api.github.com/repos/spring-projects/spring-security/actions/artifacts | grep '"id"' | cut -d : -f2 | sed 's/,*$//g')
+          echo Output is $output
+          for id in $output; do curl -X DELETE -H "Authorization: token $GH_ACTIONS_REPO_TOKEN" https://api.github.com/repos/spring-projects/spring-security/actions/artifacts/$id; done;
@@ -0,0 +1,17 @@
+name: "CodeQL Advanced"
+
+on:
+  push:
+  pull_request:
+  workflow_dispatch:
+  schedule:
+    # https://docs.github.com/en/actions/writing-workflows/choosing-when-your-workflow-runs/events-that-trigger-workflows#schedule
+    - cron: '0 5 * * *'
+permissions: read-all
+jobs:
+  codeql-analysis-call:
+    permissions:
+      actions: read
+      contents: read
+      security-events: write
+    uses: spring-io/github-actions/.github/workflows/codeql-analysis.yml@1
@@ -8,46 +8,62 @@ on:
    - cron: '0 10 * * *' # Once per day at 10am UTC
  workflow_dispatch: # Manual trigger

+env:
+  DEVELOCITY_ACCESS_KEY: ${{ secrets.DEVELOCITY_ACCESS_KEY }}
+
 permissions:
  contents: read

 jobs:
  build:
    name: Build
-    uses: spring-projects/spring-security-commercial/.github/workflows/build.yml@workflows/v1
+    uses: spring-io/spring-security-release-tools/.github/workflows/build.yml@729fed56d42122f88583aff1be35c0800b7d77e9 # v1.0.14
+    strategy:
+      matrix:
+        os: [ ubuntu-latest, windows-latest ]
+        jdk: [ 25 ]
    with:
-      java-version: '25'
+      runs-on: ${{ matrix.os }}
+      java-version: ${{ matrix.jdk }}
+      distribution: temurin
    secrets: inherit
-  test:
-    name: Test Against Snapshots
-    uses: spring-projects/spring-security-commercial/.github/workflows/test.yml@workflows/v1
-    with:
-      java-version: '25'
-      test-args: --refresh-dependencies -PforceMavenRepositories=snapshot -PisOverrideVersionCatalog -PtestToolchain=25 -PspringFrameworkVersion=7.0.+ -PreactorVersion=2025.0.+ -PspringDataVersion=2026.0.+ -PmicrometerVersion=1.17.+ --stacktrace
-    secrets: inherit
-  compute-version:
-    name: Compute Version
-    runs-on: ubuntu-latest
-    outputs:
-      snapshot: ${{ steps.project-version.outputs.snapshot }}
-    steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # 7.0.0
-      - id: project-version
-        name: Extract Project Version
-        uses: spring-io/spring-release-actions/compute-version@a1f321783a0769dd2aea4fad6c2ae2f95a52b885 # 0.0.5
  deploy-artifacts:
    name: Deploy Artifacts
-    needs: [ build, test, compute-version ]
-    if: needs.compute-version.outputs.snapshot == 'true'
-    uses: spring-projects/spring-security-commercial/.github/workflows/deploy-artifacts.yml@workflows/v1
+    needs: [ build]
+    uses: spring-io/spring-security-release-tools/.github/workflows/deploy-artifacts.yml@729fed56d42122f88583aff1be35c0800b7d77e9 # v1.0.14
+    with:
+      should-deploy-artifacts: ${{ needs.build.outputs.should-deploy-artifacts }}
+      default-publish-milestones-central: true
+      java-version: 25
+    secrets: inherit
+  deploy-schema:
+    name: Deploy Schema
+    needs: [ build ]
+    uses: spring-io/spring-security-release-tools/.github/workflows/deploy-schema.yml@729fed56d42122f88583aff1be35c0800b7d77e9 # v1.0.14
+    with:
+      should-deploy-schema: ${{ needs.build.outputs.should-deploy-artifacts }}
+      java-version: 25
+    secrets: inherit
+  perform-release:
+    name: Perform Release
+    needs: [ deploy-artifacts, deploy-schema ]
+    uses: spring-io/spring-security-release-tools/.github/workflows/perform-release.yml@729fed56d42122f88583aff1be35c0800b7d77e9 # v1.0.14
+    with:
+      should-perform-release: ${{ needs.deploy-artifacts.outputs.artifacts-deployed }}
+      project-version: ${{ needs.deploy-artifacts.outputs.project-version }}
+      milestone-repo-url: https://repo1.maven.org/maven2
+      release-repo-url: https://repo1.maven.org/maven2
+      artifact-path: org/springframework/security/spring-security-core
+      slack-announcing-id: spring-security-announcing
+      java-version: 25
    secrets: inherit
  send-notification:
    name: Send Notification
-    needs: [ deploy-artifacts ]
+    needs: [ perform-release ]
    if: ${{ !success() }}
    runs-on: ubuntu-latest
    steps:
      - name: Send Notification
-        uses: spring-io/spring-security-release-tools/.github/actions/send-notification@b92832ecbc7cbe969201e6beafbde0ee400cf095 # v1.0.15
+        uses: spring-io/spring-security-release-tools/.github/actions/send-notification@729fed56d42122f88583aff1be35c0800b7d77e9 # v1.0.14
        with:
          webhook-url: ${{ secrets.SPRING_SECURITY_CI_GCHAT_WEBHOOK_URL }}
@@ -1,10 +0,0 @@
-name: Dependabot PR Build
-
-on: pull_request_target
-
-jobs:
-  build:
-    name: Build
-    uses: spring-projects/spring-security-commercial/.github/workflows/build-pull-request.yml@workflows/v1
-    if: ${{ github.actor == 'dependabot[bot]' }}
-    secrets: inherit
@@ -0,0 +1,33 @@
+name: Deploy Docs
+on:
+  push:
+    branches-ignore:
+      - "gh-pages"
+      - "dependabot/**"
+    tags: '**'
+  repository_dispatch:
+    types: request-build-reference # legacy
+  #schedule:
+  #- cron: '0 10 * * *' # Once per day at 10am UTC
+  workflow_dispatch:
+permissions: read-all
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    if: github.repository_owner == 'spring-projects'
+    steps:
+    - name: Checkout
+      uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      with:
+        ref: docs-build
+        fetch-depth: 1
+    - name: Dispatch (partial build)
+      if: github.ref_type == 'branch'
+      env:
+        GH_TOKEN: ${{ secrets.GH_ACTIONS_REPO_TOKEN }}
+      run: gh workflow run deploy-docs.yml -r $(git rev-parse --abbrev-ref HEAD) -f build-refname=${{ github.ref_name }}
+    - name: Dispatch (full build)
+      if: github.ref_type == 'tag'
+      env:
+        GH_TOKEN: ${{ secrets.GH_ACTIONS_REPO_TOKEN }}
+      run: gh workflow run deploy-docs.yml -r $(git rev-parse --abbrev-ref HEAD)
@@ -0,0 +1,27 @@
+name: Finalize Release
+
+on:
+  workflow_dispatch: # Manual trigger
+    inputs:
+      version:
+        description: The Spring Security release to finalize (e.g. 7.0.0-RC2)
+        required: true
+
+env:
+  DEVELOCITY_ACCESS_KEY: ${{ secrets.DEVELOCITY_ACCESS_KEY }}
+
+permissions:
+  contents: read
+
+jobs:
+  perform-release:
+    name: Perform Release
+    uses: spring-io/spring-security-release-tools/.github/workflows/perform-release.yml@729fed56d42122f88583aff1be35c0800b7d77e9 # v1.0.14
+    with:
+      should-perform-release: true
+      project-version: ${{ inputs.version }}
+      milestone-repo-url: https://repo1.maven.org/maven2
+      release-repo-url: https://repo1.maven.org/maven2
+      artifact-path: org/springframework/security/spring-security-core
+      slack-announcing-id: spring-security-announcing
+    secrets: inherit
@@ -0,0 +1,34 @@
+name: Execute Gradle Wrapper Upgrade
+
+on:
+  schedule:
+    - cron:  '0 2 * * *' # 2am UTC
+  workflow_dispatch:
+permissions:
+  pull-requests: write
+jobs:
+  upgrade_wrapper:
+    name: Execution
+    if: ${{ github.repository == 'spring-projects/spring-security' }}
+    runs-on: ubuntu-latest
+    steps:
+      - name: Set up Git configuration
+        env:
+          TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          git config --global url."https://unused-username:${TOKEN}@github.com/".insteadOf "https://github.com/"
+          git config --global user.name 'github-actions[bot]'
+          git config --global user.email 'github-actions[bot]@users.noreply.github.com'
+      - name: Checkout
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - name: Set up JDK 25
+        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
+        with:
+          java-version: '25'
+          distribution: 'temurin'
+      - name: Set up Gradle
+        uses: gradle/setup-gradle@f29f5a9d7b09a7c6b29859002d29d24e1674c884 # v5.0.1
+      - name: Upgrade Wrappers
+        run: ./gradlew clean upgradeGradleWrapperAll --continue -Porg.gradle.java.installations.auto-download=false
+        env:
+          WRAPPER_UPGRADE_GIT_TOKEN: ${{ secrets.GITHUB_TOKEN }}
@@ -1,63 +0,0 @@
-name: Merge Dependabot PR
-
-on: pull_request_target
-
-run-name: Merge Dependabot PR ${{ github.ref_name }}
-
-permissions: write-all
-
-jobs:
-  merge-dependabot-pr:
-    name: Merge Dependabot PR
-    runs-on: ubuntu-latest
-    if: ${{ github.event.pull_request.user.login == 'dependabot[bot]' && github.repository == 'spring-projects/spring-security-commercial' }}
-    steps:
-
-      - uses: actions/checkout@v5
-        with:
-          show-progress: false
-          ref: ${{ github.event.pull_request.head.sha }}
-
-      - uses: actions/setup-java@v4
-        with:
-          distribution: temurin
-          java-version: 17
-
-      - name: Set Milestone to Dependabot Pull Request
-        id: set-milestone
-        run: |
-          if test -f pom.xml
-          then
-            CURRENT_VERSION=$(mvn help:evaluate -Dexpression="project.version" -q -DforceStdout)
-          else
-            CURRENT_VERSION=$(cat gradle.properties | sed -n '/^version=/ { s/^version=//;p }')
-          fi
-          export CANDIDATE_VERSION=${CURRENT_VERSION/-SNAPSHOT}
-          MILESTONE=$(gh api repos/$GITHUB_REPOSITORY/milestones --jq 'map(select(.due_on != null and (.title | startswith(env.CANDIDATE_VERSION)))) | .[0] | .title')
-
-          if [ -z $MILESTONE ]
-          then
-            gh run cancel ${{ github.run_id }}
-            echo "::warning title=Cannot merge::No scheduled milestone for $CURRENT_VERSION version"
-          else
-            gh pr edit ${{ github.event.pull_request.number }} --milestone $MILESTONE
-            echo mergeEnabled=true >> $GITHUB_OUTPUT
-          fi
-        env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: Merge Dependabot pull request
-        if: steps.set-milestone.outputs.mergeEnabled
-        run: gh pr merge ${{ github.event.pull_request.number }} --auto --rebase
-        env:
-          GH_TOKEN: ${{ secrets.GH_ACTIONS_REPO_TOKEN }}
-  send-notification:
-    name: Send Notification
-    needs: [ merge-dependabot-pr ]
-    if: ${{ failure() || cancelled() }}
-    runs-on: ubuntu-latest
-    steps:
-      - name: Send Notification
-        uses: spring-io/spring-security-release-tools/.github/actions/send-notification@v1
-        with:
-          webhook-url: ${{ secrets.SPRING_SECURITY_CI_GCHAT_WEBHOOK_URL }}
@@ -0,0 +1,35 @@
+name: Check Milestone
+on:
+  milestone:
+    types: [created, opened, edited]
+env:
+  DUE_ON: ${{ github.event.milestone.due_on }}
+  TITLE: ${{ github.event.milestone.title }}
+permissions:
+  contents: read
+jobs:
+  spring-releasetrain-checks:    
+    name: Check DueOn is on a Release Date
+    runs-on: ubuntu-latest
+    if: ${{ github.repository == 'spring-projects/spring-security' }}
+    permissions:
+      contents: none
+    steps:
+    - name: Print Milestone Being Checked
+      run: echo "Validating DueOn '$DUE_ON' for milestone '$TITLE'"
+    - name: Validate DueOn
+      if: env.DUE_ON != ''
+      run: |
+        export TOOL_VERSION=0.1.1
+        wget "https://repo.maven.apache.org/maven2/io/spring/releasetrain/spring-release-train-tools/$TOOL_VERSION/spring-release-train-tools-$TOOL_VERSION.jar"
+        java -cp "spring-release-train-tools-$TOOL_VERSION.jar" io.spring.releasetrain.CheckMilestoneDueOnMain --dueOn "$DUE_ON" --expectedDayOfWeek MONDAY --expectedMondayCount 3
+  send-notification:
+    name: Send Notification
+    needs: [ spring-releasetrain-checks ]
+    if: ${{ failure() || cancelled() }}
+    runs-on: ubuntu-latest
+    steps:
+      - name: Send Notification
+        uses: spring-io/spring-security-release-tools/.github/actions/send-notification@729fed56d42122f88583aff1be35c0800b7d77e9 # v1.0.14
+        with:
+          webhook-url: ${{ secrets.SPRING_SECURITY_CI_GCHAT_WEBHOOK_URL }}
@@ -8,6 +8,44 @@ permissions:
 jobs:
  build:
    name: Build
-    uses: spring-projects/spring-security-commercial/.github/workflows/build-pull-request.yml@workflows/v1
-    if: ${{ github.actor != 'dependabot[bot]' }}
-    secrets: inherit
+    runs-on: ubuntu-latest
+    if: ${{ github.repository == 'spring-projects/spring-security' }}
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - name: Set up gradle
+        uses: spring-io/spring-gradle-build-action@efc55f07f4dfa22f2afd97f9ea1be4212eeed737 # v2.0.5
+        with:
+          java-version: '25'
+          distribution: 'temurin'
+      - name: Build with Gradle
+        run: ./gradlew clean build -PskipCheckExpectedBranchVersion --continue --scan
+  generate-docs:
+    name: Generate Docs
+    runs-on: ubuntu-latest
+    if: ${{ github.repository == 'spring-projects/spring-security' }}
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - name: Set up gradle
+        uses: spring-io/spring-gradle-build-action@efc55f07f4dfa22f2afd97f9ea1be4212eeed737 # v2.0.5
+        with:
+          java-version: '25'
+          distribution: 'temurin'
+      - name: Run Antora
+        run: ./gradlew -PbuildSrc.skipTests=true :spring-security-docs:antora
+      - name: Upload Docs
+        id: upload
+        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
+        with:
+          name: docs
+          path: docs/build/site
+          overwrite: true
+  send-notification:
+    name: Send Notification
+    needs: [ build, generate-docs ]
+    if: ${{ failure() && github.event.pull_request.user.login == 'dependabot[bot]' && github.repository == 'spring-projects/spring-security' }}
+    runs-on: ubuntu-latest
+    steps:
+      - name: Send Notification
+        uses: spring-io/spring-security-release-tools/.github/actions/send-notification@729fed56d42122f88583aff1be35c0800b7d77e9 # v1.0.14
+        with:
+          webhook-url: ${{ secrets.SPRING_SECURITY_CI_GCHAT_WEBHOOK_URL }}
@@ -0,0 +1,24 @@
+name: Release Scheduler
+on:
+  schedule:
+  - cron: '15 15 * * MON' # Every Monday at 3:15pm UTC
+  workflow_dispatch:
+permissions: read-all
+jobs:
+  dispatch_scheduled_releases:
+    name: Dispatch scheduled releases
+    if: github.repository_owner == 'spring-projects'
+    strategy:
+      matrix:
+        # List of active maintenance branches.
+        branch: [ main, 7.0.x, 6.5.x, 6.4.x, 6.3.x ]
+    runs-on: ubuntu-latest
+    steps:
+    - name: Checkout
+      uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      with:
+        fetch-depth: 1
+    - name: Dispatch
+      env:
+        GH_TOKEN: ${{ secrets.GH_ACTIONS_REPO_TOKEN }}
+      run: gh workflow run update-scheduled-release-version.yml -r ${{ matrix.branch }}
@@ -1,92 +0,0 @@
-# This file was auto-generated by github-actions-workflow-generator 0.0.6. Do not edit.
-# To update it, modify .github/workflow-generator.yml as needed and re-run the generator.
-
-name: "Release Train – Build"
-run-name: "${{ inputs.callback-ref }} – Build"
-"on":
-  workflow_dispatch:
-    inputs:
-      callback:
-        description: "Repository to which a callback should be made upon completion"
-        required: true
-        type: "string"
-      callback-ref:
-        description: "Ref in the callback repository to which a callback should be made upon completion"
-        required: true
-        type: "string"
-      release-train-maven-repository-url:
-        description: "URL of a Maven repository to be used to resolve artifacts of projects earlier in the train"
-        required: true
-        type: "string"
-permissions:
-  contents: "read"
-concurrency:
-  group: "${{ github.workflow }}-${{ github.ref }}"
-jobs:
-  build-release:
-    name: "Build Release"
-    runs-on: "ubuntu22-2-8"
-    steps:
-    - name: "Prevent Re-runs"
-      id: "prevent-re-runs"
-      run: |-
-        if [ "$GITHUB_RUN_ATTEMPT" -gt 1 ]; then
-          echo "Re-runs are prohibited. Use the 'Release Train – Retry' workflow to retry build failures"
-          exit 1
-        fi
-    - name: "Set up Java"
-      id: "set-up-java"
-      uses: "actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95" # v5.6.0
-      with:
-        distribution: "liberica"
-        java-version: "25"
-    - name: "Check Out Code"
-      id: "check-out-code"
-      uses: "actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0" # v7.0.0
-    - name: "Build Release"
-      id: "build-release"
-      uses: "./.github/actions/release-train-build"
-      env:
-        COMMERCIAL_REPO_PASSWORD: "${{ secrets.COMMERCIAL_ARTIFACTORY_PASSWORD }}"
-        COMMERCIAL_REPO_USERNAME: "${{ secrets.COMMERCIAL_ARTIFACTORY_USERNAME }}"
-        RELEASE_TRAIN_MAVEN_REPOSITORY_PASSWORD: "${{ secrets.RELEASE_TRAIN_PARTICIPANT_MAVEN_REPOSITORY_PASSWORD }}"
-        RELEASE_TRAIN_MAVEN_REPOSITORY_URL: "${{ inputs.release-train-maven-repository-url }}"
-        RELEASE_TRAIN_MAVEN_REPOSITORY_USERNAME: "${{ secrets.RELEASE_TRAIN_PARTICIPANT_MAVEN_REPOSITORY_USERNAME }}"
-    - name: "Upload Deployment Repository"
-      id: "upload-deployment-repository"
-      uses: "actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a" # v7.0.1
-      with:
-        name: "deployment-repository"
-        path: "deployment-repository/**"
-    - name: "Upload Deployment Spec"
-      id: "upload-deployment-spec"
-      uses: "actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a" # v7.0.1
-      with:
-        archive: "false"
-        if-no-files-found: "ignore"
-        name: "deployment-spec"
-        path: ".github/actions/release-train-build/deployment-spec.yml"
-    - name: "Save Build System Caches"
-      id: "save-build-system-caches"
-      uses: "actions/cache/save@55cc8345863c7cc4c66a329aec7e433d2d1c52a9" # v6.1.0
-      with:
-        key: "release-train-${{ inputs.callback-ref }}-${{ github.ref_name }}"
-        path: |-
-          ~/.gradle/caches
-          ~/.gradle/wrapper
-    - name: "Send Callback"
-      id: "send-callback"
-      if: "${{ !cancelled() }}"
-      env:
-        GH_TOKEN: "${{ secrets.RELEASE_TRAIN_PARTICIPANT_GITHUB_TOKEN }}"
-      run: |-
-        gh workflow run callback \
-        --repo ${{ inputs.callback }} \
-        --ref ${{ inputs.callback-ref }} \
-        --field commit-hash=${{ steps.check-out-code.outputs.commit }} \
-        --field deployment-repository-artifact-identifier=${{ steps.upload-deployment-repository.outputs.artifact-id }} \
-        --field deployment-spec-artifact-identifier=${{ steps.upload-deployment-spec.outputs.artifact-id }} \
-        --field release-branch=${{ github.ref_name }} \
-        --field release-repository=${{ github.repository }} \
-        --field result=${{ job.status == 'success' && 'built' || 'build-failed' }} \
-        --field workflow-run-url=${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
@@ -1,55 +0,0 @@
-# This file was auto-generated by github-actions-workflow-generator 0.0.6. Do not edit.
-# To update it, modify .github/workflow-generator.yml as needed and re-run the generator.
-
-name: "Release Train – Join"
-run-name: "${{ inputs.release-train }} – Join"
-"on":
-  workflow_dispatch:
-    inputs:
-      deployment-destination:
-        description: "Destination to which the release should be deployed"
-        options:
-        - "Maven Central"
-        - "Spring Enterprise"
-        required: true
-        type: "choice"
-      release-train:
-        description: "Release train"
-        required: true
-        type: "string"
-      release-train-repository:
-        default: "spring-io/release-train"
-        description: "Release train repository"
-        required: true
-        type: "string"
-permissions:
-  contents: "none"
-jobs:
-  join-release-train:
-    name: "Join Release Train"
-    runs-on: "ubuntu-latest"
-    steps:
-    - name: "Join Release Train"
-      id: "join-release-train"
-      env:
-        GH_TOKEN: "${{ secrets.RELEASE_TRAIN_PARTICIPANT_GITHUB_TOKEN }}"
-      run: |-
-        run_url=$(
-          gh workflow run join \
-          --repo ${{ inputs.release-train-repository }} \
-          --ref ${{ inputs.release-train }} \
-          --field commit-hash=${{ github.sha }} \
-          --field deployment-destination=${{ inputs.deployment-destination == 'Maven Central' && 'maven-central' || 'spring-enterprise' }} \
-          --field release-branch=${{ github.ref_name }} \
-          --field release-repository=${{ github.repository }}
-        )
-        echo "Dispatched workflow run. Waiting for $run_url to complete."
-        run_id=${run_url##*/}
-        watch_exit_code=0
-        gh run watch $run_id --repo ${{ inputs.release-train-repository }} --exit-status --interval=3 > /dev/null 2>&1 || watch_exit_code=$?
-        if [[ $watch_exit_code -eq 0 ]]; then
-          echo "Workflow run succeeded."
-        else
-          echo "Workflow run failed."
-        fi
-        exit $watch_exit_code
@@ -1,46 +0,0 @@
-# This file was auto-generated by github-actions-workflow-generator 0.0.6. Do not edit.
-# To update it, modify .github/workflow-generator.yml as needed and re-run the generator.
-
-name: "Release Train – Leave"
-run-name: "${{ inputs.release-train }} – Leave"
-"on":
-  workflow_dispatch:
-    inputs:
-      release-train:
-        description: "Release train"
-        required: true
-        type: "string"
-      release-train-repository:
-        default: "spring-io/release-train"
-        description: "Release train repository"
-        required: true
-        type: "string"
-permissions:
-  contents: "none"
-jobs:
-  leave:
-    name: "Leave"
-    runs-on: "ubuntu-latest"
-    steps:
-    - name: "Leave"
-      id: "leave"
-      env:
-        GH_TOKEN: "${{ secrets.RELEASE_TRAIN_PARTICIPANT_GITHUB_TOKEN }}"
-      run: |-
-        run_url=$(
-          gh workflow run leave \
-          --repo ${{ inputs.release-train-repository }} \
-          --ref ${{ inputs.release-train }} \
-          --field release-branch=${{ github.ref_name }} \
-          --field release-repository=${{ github.repository }}
-        )
-        echo "Dispatched workflow run. Waiting for $run_url to complete."
-        run_id=${run_url##*/}
-        watch_exit_code=0
-        gh run watch $run_id --repo ${{ inputs.release-train-repository }} --exit-status --interval=3 > /dev/null 2>&1 || watch_exit_code=$?
-        if [[ $watch_exit_code -eq 0 ]]; then
-          echo "Workflow run succeeded."
-        else
-          echo "Workflow run failed."
-        fi
-        exit $watch_exit_code
@@ -1,47 +0,0 @@
-# This file was auto-generated by github-actions-workflow-generator 0.0.6. Do not edit.
-# To update it, modify .github/workflow-generator.yml as needed and re-run the generator.
-
-name: "Release Train – Ready"
-run-name: "${{ inputs.release-train }} – Ready"
-"on":
-  workflow_dispatch:
-    inputs:
-      release-train:
-        description: "Release train"
-        required: true
-        type: "string"
-      release-train-repository:
-        default: "spring-io/release-train"
-        description: "Release train repository"
-        required: true
-        type: "string"
-permissions:
-  contents: "none"
-jobs:
-  ready:
-    name: "Ready"
-    runs-on: "ubuntu-latest"
-    steps:
-    - name: "Ready"
-      id: "ready"
-      env:
-        GH_TOKEN: "${{ secrets.RELEASE_TRAIN_PARTICIPANT_GITHUB_TOKEN }}"
-      run: |-
-        run_url=$(
-          gh workflow run ready \
-          --repo ${{ inputs.release-train-repository }} \
-          --ref ${{ inputs.release-train }} \
-          --field commit-hash=${{ github.sha }} \
-          --field release-branch=${{ github.ref_name }} \
-          --field release-repository=${{ github.repository }}
-        )
-        echo "Dispatched workflow run. Waiting for $run_url to complete."
-        run_id=${run_url##*/}
-        watch_exit_code=0
-        gh run watch $run_id --repo ${{ inputs.release-train-repository }} --exit-status --interval=3 > /dev/null 2>&1 || watch_exit_code=$?
-        if [[ $watch_exit_code -eq 0 ]]; then
-          echo "Workflow run succeeded."
-        else
-          echo "Workflow run failed."
-        fi
-        exit $watch_exit_code
@@ -1,34 +0,0 @@
-# This file was auto-generated by github-actions-workflow-generator 0.0.6. Do not edit.
-# To update it, modify .github/workflow-generator.yml as needed and re-run the generator.
-
-name: "Release Train – Retry"
-run-name: "${{ inputs.release-train }} – Retry"
-"on":
-  workflow_dispatch:
-    inputs:
-      release-train:
-        description: "Release train"
-        required: true
-        type: "string"
-      release-train-repository:
-        default: "spring-io/release-train"
-        description: "Release train repository"
-        required: true
-        type: "string"
-permissions:
-  contents: "none"
-jobs:
-  trigger-retry:
-    name: "Trigger Retry"
-    runs-on: "ubuntu-latest"
-    steps:
-    - name: "Trigger Retry"
-      id: "trigger-retry"
-      env:
-        GH_TOKEN: "${{ secrets.RELEASE_TRAIN_PARTICIPANT_GITHUB_TOKEN }}"
-      run: |-
-        gh workflow run retry \
-        --repo ${{ inputs.release-train-repository }} \
-        --ref ${{ inputs.release-train }} \
-        --field release-branch=${{ github.ref_name }} \
-        --field release-repository=${{ github.repository }}
@@ -1,83 +0,0 @@
-# This file was auto-generated by github-actions-workflow-generator 0.0.6. Do not edit.
-# To update it, modify .github/workflow-generator.yml as needed and re-run the generator.
-
-name: "Release Train – Test"
-run-name: "${{ inputs.callback-ref }} – Test"
-"on":
-  workflow_dispatch:
-    inputs:
-      callback:
-        description: "Repository to which a callback should be made upon completion"
-        required: true
-        type: "string"
-      callback-ref:
-        description: "Ref in the callback repository to which a callback should be made upon completion"
-        required: true
-        type: "string"
-      release-train-maven-repository-url:
-        description: "URL of a Maven repository to be used to resolve artifacts of projects earlier in the train"
-        required: true
-        type: "string"
-permissions:
-  contents: "read"
-concurrency:
-  group: "${{ github.workflow }}-${{ github.ref }}"
-jobs:
-  test-release:
-    name: "Test Release"
-    runs-on: "ubuntu22-2-8"
-    steps:
-    - name: "Prevent Re-runs"
-      id: "prevent-re-runs"
-      run: |-
-        if [ "$GITHUB_RUN_ATTEMPT" -gt 1 ]; then
-          echo "Re-runs are prohibited. Use the 'Release Train – Retry' workflow to retry test failures"
-          exit 1
-        fi
-    - name: "Set up Java"
-      id: "set-up-java"
-      uses: "actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95" # v5.6.0
-      with:
-        distribution: "liberica"
-        java-version: "25"
-    - name: "Check Out Code"
-      id: "check-out-code"
-      uses: "actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0" # v7.0.0
-    - name: "Restore Build System Caches"
-      id: "restore-build-system-caches"
-      uses: "actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9" # v6.1.0
-      with:
-        key: "release-train-${{ inputs.callback-ref }}-${{ github.ref_name }}"
-        path: |-
-          ~/.gradle/caches
-          ~/.gradle/wrapper
-    - name: "Test Release"
-      id: "test-release"
-      uses: "./.github/actions/release-train-test"
-      env:
-        COMMERCIAL_REPO_PASSWORD: "${{ secrets.COMMERCIAL_ARTIFACTORY_PASSWORD }}"
-        COMMERCIAL_REPO_USERNAME: "${{ secrets.COMMERCIAL_ARTIFACTORY_USERNAME }}"
-        RELEASE_TRAIN_MAVEN_REPOSITORY_PASSWORD: "${{ secrets.RELEASE_TRAIN_PARTICIPANT_MAVEN_REPOSITORY_PASSWORD }}"
-        RELEASE_TRAIN_MAVEN_REPOSITORY_URL: "${{ inputs.release-train-maven-repository-url }}"
-        RELEASE_TRAIN_MAVEN_REPOSITORY_USERNAME: "${{ secrets.RELEASE_TRAIN_PARTICIPANT_MAVEN_REPOSITORY_USERNAME }}"
-    - name: "Send Callback"
-      id: "send-callback"
-      if: "${{ !cancelled() }}"
-      env:
-        GH_TOKEN: "${{ secrets.RELEASE_TRAIN_PARTICIPANT_GITHUB_TOKEN }}"
-      run: |-
-        gh workflow run callback \
-        --repo ${{ inputs.callback }} \
-        --ref ${{ inputs.callback-ref }} \
-        --field commit-hash=${{ steps.check-out-code.outputs.commit }} \
-        --field release-branch=${{ github.ref_name }} \
-        --field release-repository=${{ github.repository }} \
-        --field result=${{ job.status == 'success' && 'tested' || 'test-failed' }} \
-        --field workflow-run-url=${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
-    - name: "Upload Build System Reports"
-      id: "upload-build-system-reports"
-      if: "${{ failure() }}"
-      uses: "actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a" # v7.0.1
-      with:
-        name: "build-system-reports"
-        path: "**/build/reports"
@@ -0,0 +1,37 @@
+name: Update Antora UI Spring
+
+on:
+  schedule:
+    - cron: '0 10 * * *' # Once per day at 10am UTC
+  workflow_dispatch:
+
+permissions:
+  pull-requests: write
+  issues: write
+  contents: write
+
+jobs:
+  update-antora-ui-spring:
+    name: Update on Supported Branches
+    if: ${{ github.repository == 'spring-projects/spring-security' }}
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        branch: [ '6.5.x', '7.0.x', 'main' ]
+    steps:
+      - uses: spring-io/spring-doc-actions/update-antora-spring-ui@415e2b11a766ba64799fffb5c97a4f7e17f677cf
+        name: Update
+        with:
+          docs-branch: ${{ matrix.branch }}
+          token: ${{ secrets.GITHUB_TOKEN }}
+          antora-file-path: 'docs/antora-playbook.yml'
+  update-antora-ui-spring-docs-build:
+    name: Update on docs-build
+    if: ${{ github.repository == 'spring-projects/spring-security' }}
+    runs-on: ubuntu-latest
+    steps:
+      - uses: spring-io/spring-doc-actions/update-antora-spring-ui@415e2b11a766ba64799fffb5c97a4f7e17f677cf
+        name: Update
+        with:
+          docs-branch: 'docs-build'
+          token: ${{ secrets.GITHUB_TOKEN }}
@@ -0,0 +1,23 @@
+name: Update Scheduled Release Version
+
+on:
+  workflow_dispatch: # Manual trigger only. Triggered by release-scheduler.yml on main.
+
+permissions:
+  contents: read
+
+jobs:
+  update-scheduled-release-version:
+    name: Update Scheduled Release Version
+    uses: spring-io/spring-security-release-tools/.github/workflows/update-scheduled-release-version.yml@729fed56d42122f88583aff1be35c0800b7d77e9 # v1.0.14
+    secrets: inherit
+  send-notification:
+    name: Send Notification
+    needs: [ update-scheduled-release-version ]
+    if: ${{ failure() || cancelled() }}
+    runs-on: ubuntu-latest
+    steps:
+      - name: Send Notification
+        uses: spring-io/spring-security-release-tools/.github/actions/send-notification@729fed56d42122f88583aff1be35c0800b7d77e9 # v1.0.14
+        with:
+          webhook-url: ${{ secrets.SPRING_SECURITY_CI_GCHAT_WEBHOOK_URL }}
@@ -68,27 +68,6 @@ The https://github.com/spring-projects/spring-security/tree/docs-build[playbook

 Discover more commands with `./gradlew tasks`.

-=== IDE setup (IntelliJ)
-
-No special steps are needed to open Spring Security in IntelliJ.
-
-=== IDE setup (Eclipse and VS Code)
-
-To work in Eclipse or VS Code, first generate Eclipse metadata so you can import the project into Eclipse or VS Code:
-
-[indent=0]
----
-./gradlew cleanEclipse eclipse
----
-
-If you have not built the project yet, run `./gradlew publishToMavenLocal` first so dependencies are resolved.
-
-*VS Code:* Open the repository root as a folder. The repository includes `.vscode/settings.json` which disables automatic Gradle import so that the generated Eclipse metadata (`.classpath`, `.project`) is used. Do not use the Gradle for Java extension to import the project.
-
-*Eclipse:* File → Import → General → Existing Projects into Workspace, then select the repository root.
-
-The build uses a custom Eclipse plugin to work around Gradle dependency cycles that confuse IDE metadata generation. You may see Eclipse warnings about `xml-apis` from some test dependencies; those are excluded in the build and can be ignored.
-
 == Getting Support
 Check out the https://stackoverflow.com/questions/tagged/spring-security[Spring Security tags on Stack Overflow].
 https://spring.io/support[Commercial support] is available too.
@@ -20,8 +20,6 @@ import java.io.Serial;
 import java.util.ArrayList;
 import java.util.List;

-import org.jspecify.annotations.Nullable;
-
 import org.springframework.security.authorization.AuthorizationManager;
 import org.springframework.security.core.annotation.SecurityAnnotationScanner;
 import org.springframework.util.Assert;
@@ -52,7 +50,7 @@ public class SecurityConfig implements ConfigAttribute {
 	}

 	@Override
-	public boolean equals(@Nullable Object obj) {
+	public boolean equals(Object obj) {
 		if (obj instanceof ConfigAttribute attr) {
 			return this.attrib.equals(attr.getAttribute());
 		}
@@ -114,10 +114,8 @@ public final class DelegatingMethodSecurityMetadataSource extends AbstractMethod
 		}

 		@Override
-		public boolean equals(@Nullable Object other) {
-			if (!(other instanceof DefaultCacheKey otherKey)) {
-				return false;
-			}
+		public boolean equals(Object other) {
+			DefaultCacheKey otherKey = (DefaultCacheKey) other;
 			return (this.method.equals(otherKey.method)
 					&& ObjectUtils.nullSafeEquals(this.targetClass, otherKey.targetClass));
 		}
@@ -265,7 +265,7 @@ public class MapBasedMethodSecurityMetadataSource extends AbstractFallbackMethod
 		}

 		@Override
-		public boolean equals(@Nullable Object obj) {
+		public boolean equals(Object obj) {
 			if (this == obj) {
 				return true;
 			}
@@ -145,7 +145,6 @@ public class PrePostAdviceReactiveMethodInterceptor implements MethodInterceptor
 			.map((r) -> (attr != null) ? this.postAdvice.after(auth, invocation, attr, r) : r));
 	}

-	@SuppressWarnings("unchecked")
 	private static <T extends Publisher<?>> @Nullable T proceed(final MethodInvocation invocation) {
 		try {
 			return (T) invocation.proceed();
@@ -111,7 +111,6 @@ public class AclEntryAfterInvocationCollectionFilteringProvider extends Abstract
 		return returnedObject;
 	}

-	@SuppressWarnings({ "unchecked", "rawtypes" })
 	private Filterer getFilterer(Object returnedObject) {
 		if (returnedObject instanceof Collection) {
 			return new CollectionFilterer((Collection) returnedObject);
@@ -50,7 +50,6 @@ class MessageExpressionConfigAttribute implements ConfigAttribute, EvaluationCon
 	 * @param authorizeExpression the {@link Expression} to use. Cannot be null
 	 * @param matcher the {@link MessageMatcher} used to match the messages.
 	 */
-	@SuppressWarnings("unchecked")
 	MessageExpressionConfigAttribute(Expression authorizeExpression, MessageMatcher<?> matcher) {
 		Assert.notNull(authorizeExpression, "authorizeExpression cannot be null");
 		Assert.notNull(matcher, "matcher cannot be null");
@@ -41,7 +41,6 @@ public class DefaultWebSecurityExpressionHandler extends AbstractSecurityExpress
 	private String defaultRolePrefix = DEFAULT_ROLE_PREFIX;

 	@Override
-	@SuppressWarnings("deprecation")
 	protected SecurityExpressionOperations createSecurityExpressionRoot(@Nullable Authentication authentication,
 			FilterInvocation fi) {
 		FilterInvocationExpressionRoot root = new FilterInvocationExpressionRoot(() -> authentication, fi);
@@ -35,7 +35,6 @@ import org.springframework.security.web.FilterInvocation;
 */
@Deprecated
@NullUnmarked
-@SuppressWarnings("serial")
 class WebExpressionConfigAttribute implements ConfigAttribute, EvaluationContextPostProcessor<FilterInvocation> {

 	private final Expression authorizeExpression;
@@ -29,7 +29,6 @@ import static org.assertj.core.api.Assertions.assertThatIllegalArgumentException
 *
 * @author Ben Alex
 */
-@SuppressWarnings("deprecation")
 public class AuthenticationCredentialsNotFoundEventTests {

 	@Test
@@ -32,7 +32,6 @@ import static org.assertj.core.api.Assertions.assertThatIllegalArgumentException
 *
 * @author Ben Alex
 */
-@SuppressWarnings("deprecation")
 public class AuthorizationFailureEventTests {

 	private final UsernamePasswordAuthenticationToken foo = UsernamePasswordAuthenticationToken.unauthenticated("foo",
@@ -29,7 +29,6 @@ import static org.assertj.core.api.Assertions.assertThatIllegalArgumentException
 *
 * @author Ben Alex
 */
-@SuppressWarnings("deprecation")
 public class AuthorizedEventTests {

 	@Test
@@ -27,7 +27,6 @@ import static org.assertj.core.api.Assertions.assertThatIllegalArgumentException
 *
 * @author Ben Alex
 */
-@SuppressWarnings("deprecation")
 public class SecurityConfigTests {

 	@Test
@@ -32,7 +32,6 @@ import static org.assertj.core.api.Assertions.assertThat;
 * @author Luke Taylor
 * @author Ben Alex
 */
-@SuppressWarnings("deprecation")
 public class Jsr250MethodSecurityMetadataSourceTests {

 	Jsr250MethodSecurityMetadataSource mds;
@@ -31,7 +31,6 @@ import static org.assertj.core.api.Assertions.assertThat;
 /**
 * @author Luke Taylor
 */
-@SuppressWarnings("deprecation")
 public class Jsr250VoterTests {

 	// SEC-1443
@@ -46,7 +46,6 @@ import static org.assertj.core.api.Assertions.fail;
 * @author Ben Alex
 * @author Luke Taylor
 */
-@SuppressWarnings("deprecation")
 public class SecuredAnnotationSecurityMetadataSourceTests {

 	private SecuredAnnotationSecurityMetadataSource mds = new SecuredAnnotationSecurityMetadataSource();
@@ -79,13 +79,11 @@ public class DefaultMethodSecurityExpressionHandlerTests {
 	}

 	@Test
-	@SuppressWarnings("deprecation")
 	public void setTrustResolverNull() {
 		assertThatIllegalArgumentException().isThrownBy(() -> this.handler.setTrustResolver(null));
 	}

 	@Test
-	@SuppressWarnings("deprecation")
 	public void createEvaluationContextCustomTrustResolver() {
 		setupMocks();
 		this.handler.setTrustResolver(this.trustResolver);
@@ -177,7 +175,7 @@ public class DefaultMethodSecurityExpressionHandlerTests {
 	@Test
 	public void createEvaluationContextSupplierAuthentication() {
 		setupMocks();
-		Supplier<Authentication> mockAuthenticationSupplier = mock();
+		Supplier<Authentication> mockAuthenticationSupplier = mock(Supplier.class);
 		given(mockAuthenticationSupplier.get()).willReturn(this.authentication);
 		EvaluationContext context = this.handler.createEvaluationContext(mockAuthenticationSupplier,
 				this.methodInvocation);
@@ -39,7 +39,6 @@ import static org.assertj.core.api.Assertions.assertThatIllegalArgumentException
 * @since 5.2
 */
@ExtendWith(MockitoExtension.class)
-@SuppressWarnings("deprecation")
 public class ExpressionBasedPreInvocationAdviceTests {

 	@Mock
@@ -34,7 +34,7 @@ import org.springframework.security.util.SimpleMethodInvocation;
 import static org.assertj.core.api.Assertions.assertThat;
 import static org.assertj.core.api.Assertions.assertThatIllegalArgumentException;

-@SuppressWarnings({ "unchecked", "deprecation" })
+@SuppressWarnings("unchecked")
 public class MethodExpressionVoterTests {

 	private TestingAuthenticationToken joe = new TestingAuthenticationToken("joe", "joespass", "ROLE_blah");
@@ -27,7 +27,6 @@ import org.springframework.expression.spel.support.StandardEvaluationContext;
 import org.springframework.security.access.PermissionEvaluator;
 import org.springframework.security.access.expression.ExpressionUtils;
 import org.springframework.security.authentication.AuthenticationTrustResolver;
-import org.springframework.security.authorization.DefaultAuthorizationManagerFactory;
 import org.springframework.security.core.Authentication;

 import static org.mockito.ArgumentMatchers.any;
@@ -59,9 +58,7 @@ public class MethodSecurityExpressionRootTests {
 		this.ctx = new StandardEvaluationContext();
 		this.ctx.setRootObject(this.root);
 		this.trustResolver = mock(AuthenticationTrustResolver.class);
-		DefaultAuthorizationManagerFactory<MethodInvocation> authorizationManagerFactory = new DefaultAuthorizationManagerFactory<>();
-		authorizationManagerFactory.setTrustResolver(this.trustResolver);
-		this.root.setAuthorizationManagerFactory(authorizationManagerFactory);
+		this.root.setTrustResolver(this.trustResolver);
 	}

 	@Test
@@ -44,7 +44,6 @@ import static org.assertj.core.api.Assertions.assertThat;
 * @author Luke Taylor
 * @since 3.0
 */
-@SuppressWarnings("deprecation")
 public class PrePostAnnotationSecurityMetadataSourceTests {

 	private PrePostAnnotationSecurityMetadataSource mds = new PrePostAnnotationSecurityMetadataSource(
@@ -32,7 +32,6 @@ import static org.mockito.Mockito.mock;
 *
 * @author Ben Alex
 */
-@SuppressWarnings("deprecation")
 public class AbstractSecurityInterceptorTests {

 	@Test
@@ -38,7 +38,7 @@ import static org.assertj.core.api.Assertions.assertThatIllegalArgumentException
 *
 * @author Ben Alex
 */
-@SuppressWarnings({ "unchecked", "deprecation" })
+@SuppressWarnings("unchecked")
 public class AfterInvocationProviderManagerTests {

 	@Test
@@ -34,7 +34,6 @@ import static org.assertj.core.api.Assertions.assertThat;
 *
 * @author Ben Alex
 */
-@SuppressWarnings("deprecation")
 public class InterceptorStatusTokenTests {

 	@Test
@@ -27,7 +27,6 @@ import static org.assertj.core.api.Assertions.assertThat;
 *
 * @author Ben Alex
 */
-@SuppressWarnings("deprecation")
 public class NullRunAsManagerTests {

 	@Test
@@ -31,7 +31,6 @@ import static org.assertj.core.api.Assertions.assertThatIllegalArgumentException
 /**
 * Tests {@link RunAsImplAuthenticationProvider}.
 */
-@SuppressWarnings("deprecation")
 public class RunAsImplAuthenticationProviderTests {

 	@Test
@@ -34,7 +34,6 @@ import static org.assertj.core.api.Assertions.fail;
 *
 * @author Ben Alex
 */
-@SuppressWarnings("deprecation")
 public class RunAsManagerImplTests {

 	@Test
@@ -29,7 +29,6 @@ import static org.assertj.core.api.Assertions.assertThatExceptionOfType;
 *
 * @author Ben Alex
 */
-@SuppressWarnings("deprecation")
 public class RunAsUserTokenTests {

 	@Test
@@ -65,7 +65,7 @@ import static org.mockito.Mockito.verifyNoMoreInteractions;
 * @author Ben Alex
 * @author Rob Winch
 */
-@SuppressWarnings({ "unchecked", "deprecation" })
+@SuppressWarnings("unchecked")
 public class MethodSecurityInterceptorTests {

 	private TestingAuthenticationToken token;
@@ -33,7 +33,6 @@ import static org.mockito.Mockito.mock;
 *
 * @author Ben Alex
 */
-@SuppressWarnings("deprecation")
 public class MethodSecurityMetadataSourceAdvisorTests {

 	@Test
@@ -62,7 +62,6 @@ import static org.mockito.Mockito.verifyNoMoreInteractions;
 * @author Luke Taylor
 * @author Rob Winch
 */
-@SuppressWarnings("deprecation")
 public class AspectJMethodSecurityInterceptorTests {

 	private TestingAuthenticationToken token;
@@ -34,7 +34,6 @@ import static org.assertj.core.api.Assertions.assertThat;
 * @author Luke Taylor
 * @since 2.0.4
 */
-@SuppressWarnings("deprecation")
 public class MapBasedMethodSecurityMetadataSourceTests {

 	private final List<ConfigAttribute> ROLE_A = SecurityConfig.createList("ROLE_A");
@@ -49,7 +49,6 @@ import static org.mockito.Mockito.mock;
 *
 * @author Ben Alex
 */
-@SuppressWarnings("deprecation")
 public class MethodInvocationPrivilegeEvaluatorTests {

 	private TestingAuthenticationToken token;
@@ -36,7 +36,7 @@ import static org.mockito.Mockito.mock;
 /**
 * @author Luke Taylor
 */
-@SuppressWarnings({ "unchecked", "deprecation" })
+@SuppressWarnings({ "unchecked" })
 public class DelegatingMethodSecurityMetadataSourceTests {

 	DelegatingMethodSecurityMetadataSource mds;
@@ -29,7 +29,6 @@ import org.springframework.security.access.intercept.aspectj.MethodInvocationAda
 import static org.assertj.core.api.Assertions.assertThat;

@ExtendWith(MockitoExtension.class)
-@SuppressWarnings("deprecation")
 public class PostInvocationAdviceProviderTests {

 	@Mock
@@ -29,7 +29,6 @@ import org.springframework.security.access.intercept.aspectj.MethodInvocationAda
 import static org.assertj.core.api.Assertions.assertThat;

@ExtendWith(MockitoExtension.class)
-@SuppressWarnings("deprecation")
 public class PreInvocationAuthorizationAdviceVoterTests {

 	@Mock
@@ -36,7 +36,7 @@ import static org.assertj.core.api.Assertions.assertThatIllegalArgumentException
 *
 * @author Ben Alex
 */
-@SuppressWarnings({ "unchecked", "deprecation" })
+@SuppressWarnings("unchecked")
 public class AbstractAccessDecisionManagerTests {

 	@Test
@@ -31,7 +31,6 @@ import static org.assertj.core.api.Assertions.assertThat;
 /**
 * @author Luke Taylor
 */
-@SuppressWarnings("deprecation")
 public class AbstractAclVoterTests {

 	private AbstractAclVoter voter = new AbstractAclVoter() {
@@ -40,7 +40,6 @@ import static org.mockito.Mockito.mock;
 *
 * @author Ben Alex
 */
-@SuppressWarnings("deprecation")
 public class AffirmativeBasedTests {

 	private final List<ConfigAttribute> attrs = new ArrayList<>();
@@ -37,7 +37,6 @@ import static org.assertj.core.api.Assertions.assertThatIllegalArgumentException
 *
 * @author Ben Alex
 */
-@SuppressWarnings("deprecation")
 public class AuthenticatedVoterTests {

 	private Authentication createAnonymous() {
@@ -35,7 +35,6 @@ import static org.assertj.core.api.Assertions.assertThatExceptionOfType;
 *
 * @author Ben Alex
 */
-@SuppressWarnings("deprecation")
 public class ConsensusBasedTests {

 	@Test
@@ -32,7 +32,6 @@ import org.springframework.security.core.Authentication;
 *
 * @author Ben Alex
 */
-@SuppressWarnings("deprecation")
 public class DenyAgainVoter implements AccessDecisionVoter<Object> {

 	@Override
@@ -34,7 +34,6 @@ import org.springframework.security.core.Authentication;
 *
 * @author Ben Alex
 */
-@SuppressWarnings("deprecation")
 public class DenyVoter implements AccessDecisionVoter<Object> {

 	@Override
@@ -25,7 +25,6 @@ import org.springframework.security.authentication.TestingAuthenticationToken;

 import static org.assertj.core.api.Assertions.assertThat;

-@SuppressWarnings("deprecation")
 public class RoleHierarchyVoterTests {

 	@Test
@@ -28,7 +28,6 @@ import static org.assertj.core.api.Assertions.assertThat;
 /**
 * @author Luke Taylor
 */
-@SuppressWarnings("deprecation")
 public class RoleVoterTests {

 	@Test
@@ -35,7 +35,6 @@ import static org.assertj.core.api.Assertions.assertThatExceptionOfType;
 *
 * @author Ben Alex
 */
-@SuppressWarnings("deprecation")
 public class UnanimousBasedTests {

 	private UnanimousBased makeDecisionManager() {
@@ -44,7 +44,7 @@ import static org.mockito.Mockito.verify;
 /**
 * @author Luke Taylor
 */
-@SuppressWarnings({ "unchecked", "deprecation" })
+@SuppressWarnings({ "unchecked" })
 public class AclEntryAfterInvocationCollectionFilteringProviderTests {

 	@Test
@@ -48,7 +48,7 @@ import static org.mockito.Mockito.verify;
 /**
 * @author Luke Taylor
 */
-@SuppressWarnings({ "unchecked", "deprecation" })
+@SuppressWarnings({ "unchecked" })
 public class AclEntryAfterInvocationProviderTests {

 	@Test
@@ -35,7 +35,6 @@ import static org.assertj.core.api.Assertions.assertThat;
 import static org.mockito.BDDMockito.given;

@ExtendWith(MockitoExtension.class)
-@SuppressWarnings("deprecation")
 public class ExpressionBasedMessageSecurityMetadataSourceFactoryTests {

 	@Mock
@@ -58,7 +57,7 @@ public class ExpressionBasedMessageSecurityMetadataSourceFactoryTests {

 	MessageSecurityMetadataSource source;

-	MessageSecurityExpressionRoot<Object> rootObject;
+	MessageSecurityExpressionRoot rootObject;

 	@BeforeEach
 	public void setup() {
@@ -69,7 +68,7 @@ public class ExpressionBasedMessageSecurityMetadataSourceFactoryTests {
 		this.matcherToExpression.put(this.matcher2, this.expression2);
 		this.source = ExpressionBasedMessageSecurityMetadataSourceFactory
 			.createExpressionMessageMetadataSource(this.matcherToExpression);
-		this.rootObject = new MessageSecurityExpressionRoot<>(this.authentication, this.message);
+		this.rootObject = new MessageSecurityExpressionRoot(this.authentication, this.message);
 	}

 	@Test
@@ -37,7 +37,6 @@ import static org.mockito.Mockito.mock;
 import static org.mockito.Mockito.verify;

@ExtendWith(MockitoExtension.class)
-@SuppressWarnings("deprecation")
 public class MessageExpressionConfigAttributeTests {

 	@Mock
@@ -44,7 +44,6 @@ import static org.mockito.Mockito.mock;
 import static org.mockito.Mockito.verify;

@ExtendWith(MockitoExtension.class)
-@SuppressWarnings("deprecation")
 public class MessageExpressionVoterTests {

 	@Mock
@@ -77,7 +76,6 @@ public class MessageExpressionVoterTests {
 	}

 	@Test
-	@SuppressWarnings("unchecked")
 	public void voteGranted() {
 		given(this.expression.getValue(any(EvaluationContext.class), eq(Boolean.class))).willReturn(true);
 		given(this.matcher.matcher(any())).willCallRealMethod();
@@ -86,7 +84,6 @@ public class MessageExpressionVoterTests {
 	}

 	@Test
-	@SuppressWarnings("unchecked")
 	public void voteDenied() {
 		given(this.expression.getValue(any(EvaluationContext.class), eq(Boolean.class))).willReturn(false);
 		given(this.matcher.matcher(any())).willCallRealMethod();
@@ -95,7 +92,6 @@ public class MessageExpressionVoterTests {
 	}

 	@Test
-	@SuppressWarnings("unchecked")
 	public void voteAbstain() {
 		this.attributes = Arrays.<ConfigAttribute>asList(new SecurityConfig("ROLE_USER"));
 		assertThat(this.voter.vote(this.authentication, this.message, this.attributes))
@@ -103,13 +99,11 @@ public class MessageExpressionVoterTests {
 	}

 	@Test
-	@SuppressWarnings("unchecked")
 	public void supportsObjectClassFalse() {
 		assertThat(this.voter.supports(Object.class)).isFalse();
 	}

 	@Test
-	@SuppressWarnings("unchecked")
 	public void supportsMessageClassTrue() {
 		assertThat(this.voter.supports(Message.class)).isTrue();
 	}
@@ -125,13 +119,11 @@ public class MessageExpressionVoterTests {
 	}

 	@Test
-	@SuppressWarnings("unchecked")
 	public void setExpressionHandlerNull() {
 		assertThatIllegalArgumentException().isThrownBy(() -> this.voter.setExpressionHandler(null));
 	}

 	@Test
-	@SuppressWarnings("unchecked")
 	public void customExpressionHandler() {
 		this.voter.setExpressionHandler(this.expressionHandler);
 		given(this.expressionHandler.createEvaluationContext(this.authentication, this.message))
@@ -144,7 +136,6 @@ public class MessageExpressionVoterTests {
 	}

 	@Test
-	@SuppressWarnings("unchecked")
 	public void postProcessEvaluationContext() {
 		final MessageExpressionConfigAttribute configAttribute = mock(MessageExpressionConfigAttribute.class);
 		this.voter.setExpressionHandler(this.expressionHandler);
@@ -47,7 +47,6 @@ import static org.mockito.BDDMockito.given;
 import static org.mockito.BDDMockito.willThrow;

@ExtendWith(MockitoExtension.class)
-@SuppressWarnings("deprecation")
 public class ChannelSecurityInterceptorTests {

 	@Mock
@@ -36,7 +36,6 @@ import static org.assertj.core.api.Assertions.assertThat;
 import static org.mockito.BDDMockito.given;

@ExtendWith(MockitoExtension.class)
-@SuppressWarnings("deprecation")
 public class DefaultMessageSecurityMetadataSourceTests {

 	@Mock
@@ -43,7 +43,6 @@ import org.springframework.security.web.access.intercept.FilterSecurityIntercept
 *
 * @author Ben Alex
 */
-@SuppressWarnings("deprecation")
 public class DefaultWebInvocationPrivilegeEvaluatorTests {

 	private AccessDecisionManager adm;
@@ -42,7 +42,7 @@ import static org.mockito.Mockito.mock;
 *
 * @author Ben Alex
 */
-@SuppressWarnings({ "unchecked", "deprecation" })
+@SuppressWarnings("unchecked")
 public class ChannelDecisionManagerImplTests {

 	@Test
@@ -39,7 +39,6 @@ import static org.mockito.Mockito.mock;
 *
 * @author Ben Alex
 */
-@SuppressWarnings("deprecation")
 public class ChannelProcessingFilterTests {

 	@Test
@@ -35,7 +35,6 @@ import static org.mockito.Mockito.mock;
 *
 * @author Ben Alex
 */
-@SuppressWarnings("deprecation")
 public class InsecureChannelProcessorTests {

 	@Test
@@ -36,7 +36,6 @@ import static org.mockito.Mockito.mock;
 *
 * @author Ben Alex
 */
-@SuppressWarnings("deprecation")
 public class RetryWithHttpEntryPointTests {

 	@Test
@@ -33,7 +33,6 @@ import static org.assertj.core.api.Assertions.assertThatIllegalArgumentException
 *
 * @author Ben Alex
 */
-@SuppressWarnings("deprecation")
 public class RetryWithHttpsEntryPointTests {

 	@Test
@@ -35,7 +35,6 @@ import static org.mockito.Mockito.mock;
 *
 * @author Ben Alex
 */
-@SuppressWarnings("deprecation")
 public class SecureChannelProcessorTests {

 	@Test
@@ -64,7 +64,6 @@ public class DefaultWebSecurityExpressionHandlerTests {
 	}

 	@Test
-	@SuppressWarnings("deprecation")
 	public void expressionPropertiesAreResolvedAgainstAppContextBeans() {
 		StaticApplicationContext appContext = new StaticApplicationContext();
 		RootBeanDefinition bean = new RootBeanDefinition(SecurityConfig.class);
@@ -79,13 +78,11 @@ public class DefaultWebSecurityExpressionHandlerTests {
 	}

 	@Test
-	@SuppressWarnings("deprecation")
 	public void setTrustResolverNull() {
 		assertThatIllegalArgumentException().isThrownBy(() -> this.handler.setTrustResolver(null));
 	}

 	@Test
-	@SuppressWarnings("deprecation")
 	public void createEvaluationContextCustomTrustResolver() {
 		this.handler.setTrustResolver(this.trustResolver);
 		Expression expression = this.handler.getExpressionParser().parseExpression("anonymous");
@@ -33,7 +33,6 @@ import static org.assertj.core.api.Assertions.assertThatIllegalArgumentException
 /**
 * @author Luke Taylor
 */
-@SuppressWarnings("deprecation")
 public class ExpressionBasedFilterInvocationSecurityMetadataSourceTests {

 	@Test
@@ -41,7 +41,7 @@ import static org.mockito.Mockito.mock;
 /**
 * @author Luke Taylor
 */
-@SuppressWarnings({ "unchecked", "deprecation" })
+@SuppressWarnings({ "unchecked" })
 public class WebExpressionVoterTests {

 	private Authentication user = new TestingAuthenticationToken("user", "pass", "X");
@@ -40,7 +40,6 @@ import static org.mockito.Mockito.mock;
 *
 * @author Ben Alex
 */
-@SuppressWarnings("deprecation")
 public class DefaultFilterInvocationSecurityMetadataSourceTests {

 	private DefaultFilterInvocationSecurityMetadataSource fids;
@@ -62,7 +62,6 @@ import static org.mockito.Mockito.verifyNoMoreInteractions;
 * @author Luke Taylor
 * @author Rob Winch
 */
-@SuppressWarnings("deprecation")
 public class FilterSecurityInterceptorTests {

 	private AuthenticationManager am;
@@ -23,7 +23,6 @@ import java.util.Locale;

 import org.apache.commons.logging.Log;
 import org.apache.commons.logging.LogFactory;
-import org.jspecify.annotations.Nullable;

 import org.springframework.core.log.LogMessage;
 import org.springframework.security.access.PermissionEvaluator;
@@ -74,7 +73,7 @@ public class AclPermissionEvaluator implements PermissionEvaluator {
 	 * be overridden using a null check in the expression itself).
 	 */
 	@Override
-	public boolean hasPermission(Authentication authentication, @Nullable Object domainObject, Object permission) {
+	public boolean hasPermission(Authentication authentication, Object domainObject, Object permission) {
 		if (domainObject == null) {
 			return false;
 		}
@@ -16,8 +16,6 @@

 package org.springframework.security.acls.domain;

-import org.jspecify.annotations.Nullable;
-
 import org.springframework.security.acls.model.Permission;

 /**
@@ -54,7 +52,7 @@ public abstract class AbstractPermission implements Permission {
 	}

 	@Override
-	public final boolean equals(@Nullable Object obj) {
+	public final boolean equals(Object obj) {
 		if (obj == null) {
 			return false;
 		}
@@ -63,7 +63,7 @@ public class AccessControlEntryImpl implements AccessControlEntry, AuditableAcce
 	}

 	@Override
-	public boolean equals(@Nullable Object arg0) {
+	public boolean equals(Object arg0) {
 		if (!(arg0 instanceof AccessControlEntryImpl)) {
 			return false;
 		}
@@ -278,7 +278,7 @@ public class AclImpl implements Acl, MutableAcl, AuditableAcl, OwnershipAcl {
 	}

 	@Override
-	public boolean equals(@Nullable Object obj) {
+	public boolean equals(Object obj) {
 		if (obj == this) {
 			return true;
 		}
@@ -16,8 +16,6 @@

 package org.springframework.security.acls.domain;

-import org.jspecify.annotations.Nullable;
-
 import org.springframework.security.acls.model.Sid;
 import org.springframework.security.core.GrantedAuthority;
 import org.springframework.util.Assert;
@@ -49,7 +47,7 @@ public class GrantedAuthoritySid implements Sid {
 	}

 	@Override
-	public boolean equals(@Nullable Object object) {
+	public boolean equals(Object object) {
 		if ((object == null) || !(object instanceof GrantedAuthoritySid)) {
 			return false;
 		}
@@ -19,8 +19,6 @@ package org.springframework.security.acls.domain;
 import java.io.Serializable;
 import java.lang.reflect.Method;

-import org.jspecify.annotations.Nullable;
-
 import org.springframework.security.acls.model.ObjectIdentity;
 import org.springframework.util.Assert;
 import org.springframework.util.ClassUtils;
@@ -99,7 +97,7 @@ public class ObjectIdentityImpl implements ObjectIdentity {
 	 * @return <code>true</code> if the presented object matches this object
 	 */
 	@Override
-	public boolean equals(@Nullable Object obj) {
+	public boolean equals(Object obj) {
 		if (obj == null || !(obj instanceof ObjectIdentityImpl)) {
 			return false;
 		}
@@ -16,8 +16,6 @@

 package org.springframework.security.acls.domain;

-import org.jspecify.annotations.Nullable;
-
 import org.springframework.security.acls.model.Sid;
 import org.springframework.security.core.Authentication;
 import org.springframework.util.Assert;
@@ -48,7 +46,7 @@ public class PrincipalSid implements Sid {
 	}

 	@Override
-	public boolean equals(@Nullable Object object) {
+	public boolean equals(Object object) {
 		if ((object == null) || !(object instanceof PrincipalSid)) {
 			return false;
 		}
@@ -18,8 +18,6 @@ package org.springframework.security.acls.model;

 import java.io.Serializable;

-import org.jspecify.annotations.Nullable;
-
 /**
 * Represents the identity of an individual domain object instance.
 *
@@ -42,7 +40,7 @@ public interface ObjectIdentity extends Serializable {
 	 * @see Object#equals(Object)
 	 */
 	@Override
-	boolean equals(@Nullable Object obj);
+	boolean equals(Object obj);

 	/**
 	 * Obtains the actual identifier. This identifier must not be reused to represent
@@ -18,8 +18,6 @@ package org.springframework.security.acls.model;

 import java.io.Serializable;

-import org.jspecify.annotations.Nullable;
-
 /**
 * A security identity recognised by the ACL system.
 *
@@ -42,7 +40,7 @@ public interface Sid extends Serializable {
 	 * @return <code>true</code> if the objects are equal, <code>false</code> otherwise
 	 */
 	@Override
-	boolean equals(@Nullable Object obj);
+	boolean equals(Object obj);

 	/**
 	 * Refer to the <code>java.lang.Object</code> documentation for the interface
@@ -1,6 +1,5 @@
 apply plugin: 'io.spring.convention.spring-module'
 apply plugin: 'io.freefair.aspectj'
-apply plugin: 'javadoc-warnings-error'
 apply plugin: 'compile-warnings-error'

 compileAspectj {
--- a/Show More
+++ b/Show More