Bump io-spring-javaformat from 0.0.47 to 0.0.48

Bumps `io-spring-javaformat` from 0.0.47 to 0.0.48.

Updates `io.spring.javaformat:spring-javaformat-checkstyle` from 0.0.47 to 0.0.48
- [Release notes](https://github.com/spring-io/spring-javaformat/releases)
- [Commits](https://github.com/spring-io/spring-javaformat/compare/v0.0.47...v0.0.48)

Updates `io.spring.javaformat:spring-javaformat-gradle-plugin` from 0.0.47 to 0.0.48
- [Release notes](https://github.com/spring-io/spring-javaformat/releases)
- [Commits](https://github.com/spring-io/spring-javaformat/compare/v0.0.47...v0.0.48)

---
updated-dependencies:
- dependency-name: io.spring.javaformat:spring-javaformat-checkstyle
  dependency-version: 0.0.48
  dependency-type: direct:production
  update-type: version-update:semver-patch
- dependency-name: io.spring.javaformat:spring-javaformat-gradle-plugin
  dependency-version: 0.0.48
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>

.github/workflows/auto-merge-dependabot.yml

@@ -0,0 +1,17 @@
+name: Merge Dependabot PR
+
+on:
+  pull_request:
+    branches:
+      - main
+      - '*.x'
+      - 'docs-build'
+
+run-name: Merge Dependabot PR ${{ github.ref_name }}
+
+jobs:
+  merge-dependabot-pr:
+    permissions: write-all
+    uses: spring-io/spring-github-workflows/.github/workflows/spring-merge-dependabot-pr.yml@0d3f15bb384839966a1ff5c4383731a2b747f24b # v7
+    with:
+      mergeArguments: --auto --rebase

gradle/libs.versions.toml

@@ -2,7 +2,7 @@
 com-squareup-okhttp3 = "3.14.9"
 io-micrometer = "1.17.1"
 io-rsocket = "1.1.5"
-io-spring-javaformat = "0.0.47"
+io-spring-javaformat = "0.0.48"
 io-spring-nohttp = "0.0.11"
 jakarta-websocket = "2.2.0"
 org-apache-maven-resolver = "1.9.27"

oauth2/oauth2-client/src/main/java/org/springframework/security/oauth2/client/RefreshOidcUserReactiveOAuth2AuthorizationSuccessHandler.java

@@ -24,12 +24,9 @@ import java.util.List;
 import java.util.Map;
 import java.util.Objects;
 
-import org.apache.commons.logging.Log;
-import org.apache.commons.logging.LogFactory;
 import org.jspecify.annotations.Nullable;
 import reactor.core.publisher.Mono;
 
-import org.springframework.core.log.LogMessage;
 import org.springframework.security.core.Authentication;
 import org.springframework.security.core.GrantedAuthority;
 import org.springframework.security.core.authority.mapping.GrantedAuthoritiesMapper;
@@ -82,7 +79,7 @@ public final class RefreshOidcUserReactiveOAuth2AuthorizationSuccessHandler
 			.map((c) -> c.get(ServerWebExchange.class));
 	// @formatter:on
 
-	private ServerSecurityContextRepository serverSecurityContextRepository = new NonRotatingWebSessionServerSecurityContextRepository();
+	private ServerSecurityContextRepository serverSecurityContextRepository = new WebSessionServerSecurityContextRepository();
 
 	private ReactiveJwtDecoderFactory<ClientRegistration> jwtDecoderFactory = new ReactiveOidcIdTokenDecoderFactory();
 
@@ -144,7 +141,8 @@ public final class RefreshOidcUserReactiveOAuth2AuthorizationSuccessHandler
 
 	/**
 	 * Sets a {@link ServerSecurityContextRepository} to use for refreshing a
-	 * {@link SecurityContext}.
+	 * {@link SecurityContext}, defaults to
+	 * {@link WebSessionServerSecurityContextRepository}.
 	 * @param serverSecurityContextRepository the {@link ServerSecurityContextRepository}
 	 * to use
 	 */
@@ -318,28 +316,4 @@ public final class RefreshOidcUserReactiveOAuth2AuthorizationSuccessHandler
 		return this.serverSecurityContextRepository.save(exchange, securityContext);
 	}
 
-	private static final class NonRotatingWebSessionServerSecurityContextRepository
-			implements ServerSecurityContextRepository {
-
-		private static final Log logger = LogFactory.getLog(NonRotatingWebSessionServerSecurityContextRepository.class);
-
-		@Override
-		public Mono<SecurityContext> load(ServerWebExchange exchange) {
-			return Mono.empty();
-		}
-
-		@Override
-		public Mono<Void> save(ServerWebExchange exchange, @Nullable SecurityContext context) {
-			Assert.notNull(context, "context cannot be null");
-			// Save SecurityContext in WebSession without rotating session id.
-			return exchange.getSession().doOnNext((session) -> {
-				session.getAttributes()
-					.put(WebSessionServerSecurityContextRepository.DEFAULT_SPRING_SECURITY_CONTEXT_ATTR_NAME, context);
-				logger.debug(LogMessage.format("Saved SecurityContext '%s' in WebSession: '%s'", context, session));
-			}).then();
-
-		}
-
-	}
-
 }

oauth2/oauth2-client/src/test/java/org/springframework/security/oauth2/client/RefreshOidcUserReactiveOAuth2AuthorizationSuccessHandlerTests.java

@@ -50,9 +50,7 @@ import org.springframework.security.oauth2.jwt.ReactiveJwtDecoder;
 import org.springframework.security.oauth2.jwt.ReactiveJwtDecoderFactory;
 import org.springframework.security.web.server.context.WebSessionServerSecurityContextRepository;
 import org.springframework.web.server.ServerWebExchange;
-import org.springframework.web.server.WebSession;
 
-import static org.assertj.core.api.Assertions.assertThat;
 import static org.assertj.core.api.Assertions.assertThatException;
 import static org.mockito.ArgumentMatchers.any;
 import static org.mockito.BDDMockito.given;
@@ -142,51 +140,6 @@ class RefreshOidcUserReactiveOAuth2AuthorizationSuccessHandlerTests {
 			.verifyComplete();
 	}
 
-	// gh-19424
-	@Test
-	void onAuthorizationSuccessWhenDefaultServerSecurityContextRepositoryThenWebSessionIdNotChanged() {
-		ClientRegistration clientRegistration = TestClientRegistrations.clientRegistration().build();
-		Instant authTime = Instant.now();
-		DefaultOidcUser principal = createOidcUser(authTime);
-		OAuth2AuthenticationToken authenticationToken = new OAuth2AuthenticationToken(principal,
-				principal.getAuthorities(), clientRegistration.getRegistrationId());
-		OAuth2AccessToken accessToken = createAccessToken();
-		OAuth2AuthorizedClient authorizedClient = new OAuth2AuthorizedClient(clientRegistration, principal.getName(),
-				accessToken, null);
-		MockServerWebExchange exchange = MockServerWebExchange.from(MockServerHttpRequest.get("/").build());
-		Map<String, Object> attributes = Map.of(ServerWebExchange.class.getName(), exchange,
-				OidcParameterNames.ID_TOKEN, "id-token-1234");
-		Map<String, Object> claims = new HashMap<>();
-		claims.put("iss", principal.getIssuer());
-		claims.put("sub", principal.getSubject());
-		claims.put("aud", principal.getAudience());
-		claims.put("auth_time", authTime);
-		claims.put("nonce", principal.getNonce());
-		Jwt jwt = mock(Jwt.class);
-		given(jwt.getTokenValue()).willReturn("id-token-1234");
-		given(jwt.getIssuedAt()).willReturn(principal.getIssuedAt());
-		given(jwt.getClaims()).willReturn(claims);
-		ReactiveJwtDecoder jwtDecoder = mock(ReactiveJwtDecoder.class);
-		given(jwtDecoder.decode(any())).willReturn(Mono.just(jwt));
-		ReactiveJwtDecoderFactory<ClientRegistration> reactiveJwtDecoderFactory = mock(ReactiveJwtDecoderFactory.class);
-		given(reactiveJwtDecoderFactory.createDecoder(any())).willReturn(jwtDecoder);
-		ReactiveOAuth2UserService<OidcUserRequest, OidcUser> userService = mock(ReactiveOAuth2UserService.class);
-		given(userService.loadUser(any())).willReturn(Mono.just(principal));
-		RefreshOidcUserReactiveOAuth2AuthorizationSuccessHandler handler = new RefreshOidcUserReactiveOAuth2AuthorizationSuccessHandler();
-		handler.setJwtDecoderFactory(reactiveJwtDecoderFactory);
-		handler.setUserService(userService);
-		String originalSessionId = exchange.getSession().map(WebSession::getId).block();
-		StepVerifier.create(handler.onAuthorizationSuccess(authorizedClient, authenticationToken, attributes))
-			.verifyComplete();
-		StepVerifier.create(exchange.getSession())
-			.assertNext((session) -> assertThat(session.getId()).isEqualTo(originalSessionId))
-			.verifyComplete();
-		WebSessionServerSecurityContextRepository securityContextRepository = new WebSessionServerSecurityContextRepository();
-		StepVerifier.create(securityContextRepository.load(exchange).mapNotNull(SecurityContext::getAuthentication))
-			.expectNext(authenticationToken)
-			.verifyComplete();
-	}
-
 	@Test
 	void onAuthorizationSuccessWhenIdTokenIssuerNotSameThenException() {
 		ClientRegistration clientRegistration = TestClientRegistrations.clientRegistration().build();

oauth2/oauth2-client/src/test/java/org/springframework/security/oauth2/client/web/reactive/function/client/ServerOAuth2AuthorizedClientExchangeFilterFunctionITests.java

@@ -35,7 +35,6 @@ import org.junit.jupiter.api.BeforeEach;
 import org.junit.jupiter.api.Test;
 import org.mockito.ArgumentCaptor;
 import reactor.core.publisher.Mono;
-import reactor.test.StepVerifier;
 import reactor.util.context.Context;
 
 import org.springframework.http.HttpHeaders;
@@ -78,7 +77,6 @@ import org.springframework.web.reactive.function.client.ExchangeFunction;
 import org.springframework.web.reactive.function.client.WebClient;
 import org.springframework.web.reactive.function.client.WebClientResponseException;
 import org.springframework.web.server.ServerWebExchange;
-import org.springframework.web.server.WebSession;
 
 import static org.assertj.core.api.Assertions.assertThat;
 import static org.assertj.core.api.Assertions.assertThatExceptionOfType;
@@ -322,8 +320,6 @@ public class ServerOAuth2AuthorizedClientExchangeFilterFunctionITests {
 		doReturn(Mono.just(authorizedClient)).when(this.authorizedClientRepository)
 			.loadAuthorizedClient(eq(clientRegistration.getRegistrationId()), eq(this.authentication),
 					eq(this.exchange));
-		// Capture the original session id.
-		String originalSessionId = this.exchange.getSession().map(WebSession::getId).block();
 		this.webClient.get()
 			.uri(this.serverUrl)
 			.attributes(ServletOAuth2AuthorizedClientExchangeFilterFunction
@@ -360,10 +356,6 @@ public class ServerOAuth2AuthorizedClientExchangeFilterFunctionITests {
 				assertThat(oidcUser.getSubject()).isEqualTo("subject-1234");
 				assertThat(oidcUser.getName()).isEqualTo("refreshed-username");
 			});
-		// Verify that session id was not changed.
-		StepVerifier.create(this.exchange.getSession())
-			.assertNext((session) -> assertThat(session.getId()).isEqualTo(originalSessionId))
-			.verifyComplete();
 	}
 
 	@Test