Bump serialize-javascript and mocha in /javascript

Bumps [serialize-javascript](https://github.com/yahoo/serialize-javascript) to 7.1.1 and updates ancestor dependency [mocha](https://github.com/mochajs/mocha). These dependencies need to be updated together. Updates `serialize-javascript` from 6.0.2 to 7.1.1 - [Release notes](https://github.com/yahoo/serialize-javascript/releases) - [Commits](https://github.com/yahoo/serialize-javascript/compare/v6.0.2...v7.1.1) Updates `mocha` from 10.8.2 to 12.0.0 - [Release notes](https://github.com/mochajs/mocha/releases) - [Changelog](https://github.com/mochajs/mocha/blob/main/CHANGELOG.md) - [Commits](https://github.com/mochajs/mocha/compare/v10.8.2...v12.0.0) --- updated-dependencies: - dependency-name: serialize-javascript dependency-version: 7.1.1 dependency-type: indirect - dependency-name: mocha dependency-version: 12.0.0 dependency-type: direct:development ... Signed-off-by: dependabot[bot] <support@github.com>
Bump gradle-wrapper from 9.7.0 to 9.7.1
2026-09-09 02:39:53 +00:00 · 2026-09-08 18:49:02 +00:00 · 2026-09-08 18:30:55 +00:00 · 2026-09-08 18:29:29 +00:00 · 2026-09-08 12:13:48 -06:00 · 2026-09-08 12:12:06 -06:00
1077 changed files with 6363 additions and 4059 deletions
@@ -1,7 +0,0 @@
-name: Build Release
-runs:
-  using: composite
-  steps:
-    - name: Build Release
-      shell: bash
-      run:  ./gradlew -PdeploymentRepository=$(pwd)/deployment-repository publishAllPublicationsToDeploymentRepository
@@ -1,7 +0,0 @@
-name: Test Release
-runs:
-  using: composite
-  steps:
-    - name: Test Release
-      shell: bash
-      run:  ./gradlew build
@@ -20,6 +20,7 @@ updates:
      - shibboleth
    ignore:
      - dependency-name: com.nimbusds:nimbus-jose-jwt
+      - dependency-name: com.webauthn4j:webauthn4j-core
      - dependency-name: io.spring.nullability:*
      - dependency-name: org.python:jython
      - dependency-name: org.apache.directory.server:*
@@ -1,17 +0,0 @@
-workflow:
-  generator:
-    project:
-      java:
-        versions:
-          primary: 25
-    workflows:
-      release-train:
-        build:
-          env:
-            COMMERCIAL_REPO_USERNAME: secrets.COMMERCIAL_ARTIFACTORY_USERNAME
-            COMMERCIAL_REPO_PASSWORD: secrets.COMMERCIAL_ARTIFACTORY_PASSWORD
-        test:
-          env:
-            COMMERCIAL_REPO_USERNAME: secrets.COMMERCIAL_ARTIFACTORY_USERNAME
-            COMMERCIAL_REPO_PASSWORD: secrets.COMMERCIAL_ARTIFACTORY_PASSWORD
-
@@ -0,0 +1,16 @@
+name: Merge Dependabot PR
+
+on:
+  pull_request:
+    branches:
+      - main
+      - 'docs-build'
+
+run-name: Merge Dependabot PR ${{ github.ref_name }}
+
+jobs:
+  merge-dependabot-pr:
+    permissions: write-all
+    uses: spring-io/spring-github-workflows/.github/workflows/spring-merge-dependabot-pr.yml@0d3f15bb384839966a1ff5c4383731a2b747f24b # v7
+    with:
+      mergeArguments: --auto --rebase
@@ -0,0 +1,36 @@
+name: CI
+
+on:
+  schedule:
+    - cron: '0 10 * * *' # Once per day at 10am UTC
+  workflow_dispatch: # Manual trigger
+
+env:
+  DEVELOCITY_ACCESS_KEY: ${{ secrets.DEVELOCITY_ACCESS_KEY }}
+
+permissions:
+  contents: read
+
+jobs:
+  snapshot-test:
+    name: Test Against Snapshots
+    uses: spring-io/spring-security-release-tools/.github/workflows/test.yml@3f6cc7ffc137ca160061749d5f34dc30d5f36986 # v1.0.17
+    strategy:
+      matrix:
+        include:
+          - java-version: 25
+            toolchain: 25
+    with:
+      java-version: ${{ matrix.java-version }}
+      test-args: --refresh-dependencies -PforceMavenRepositories=snapshot,https://oss.sonatype.org/content/repositories/snapshots -PisOverrideVersionCatalog -PtestToolchain=${{ matrix.toolchain }} -PspringFrameworkVersion=7.0.+ -PreactorVersion=2025.+ -PspringDataVersion=2025.+ -PmicrometerVersion=1.+ --stacktrace
+    secrets: inherit
+  send-notification:
+    name: Send Notification
+    needs: [ snapshot-test ]
+    if: ${{ !success() }}
+    runs-on: ubuntu-latest
+    steps:
+      - name: Send Notification
+        uses: spring-io/spring-security-release-tools/.github/actions/send-notification@3f6cc7ffc137ca160061749d5f34dc30d5f36986 # v1.0.17
+        with:
+          webhook-url: ${{ secrets.SPRING_SECURITY_CI_GCHAT_WEBHOOK_URL }}
@@ -0,0 +1,23 @@
+name: Clean build artifacts
+on:
+  schedule:
+    - cron: '0 10 * * *' # Once per day at 10am UTC
+
+permissions:
+  contents: read
+
+jobs:
+  main:
+    runs-on: ubuntu-latest
+    if: ${{ github.repository == 'spring-projects/spring-security' }}
+    permissions:
+      contents: none
+    steps:
+      - name: Delete artifacts in cron job
+        env:
+          GH_ACTIONS_REPO_TOKEN: ${{ secrets.GH_ACTIONS_REPO_TOKEN }}
+        run: |
+          echo "Running clean build artifacts logic"
+          output=$(curl -X GET -H "Authorization: token $GH_ACTIONS_REPO_TOKEN" https://api.github.com/repos/spring-projects/spring-security/actions/artifacts | grep '"id"' | cut -d : -f2 | sed 's/,*$//g')
+          echo Output is $output
+          for id in $output; do curl -X DELETE -H "Authorization: token $GH_ACTIONS_REPO_TOKEN" https://api.github.com/repos/spring-projects/spring-security/actions/artifacts/$id; done;
@@ -0,0 +1,17 @@
+name: "CodeQL Advanced"
+
+on:
+  push:
+  pull_request:
+  workflow_dispatch:
+  schedule:
+    # https://docs.github.com/en/actions/writing-workflows/choosing-when-your-workflow-runs/events-that-trigger-workflows#schedule
+    - cron: '0 5 * * *'
+permissions: read-all
+jobs:
+  codeql-analysis-call:
+    permissions:
+      actions: read
+      contents: read
+      security-events: write
+    uses: spring-io/github-actions/.github/workflows/codeql-analysis.yml@e415dadd0910c901e7a7fabd67bbb355b2324500 # 1
@@ -8,46 +8,49 @@ on:
    - cron: '0 10 * * *' # Once per day at 10am UTC
  workflow_dispatch: # Manual trigger

+env:
+  DEVELOCITY_ACCESS_KEY: ${{ secrets.DEVELOCITY_ACCESS_KEY }}
+
 permissions:
  contents: read

 jobs:
  build:
    name: Build
-    uses: spring-projects/spring-security-commercial/.github/workflows/build.yml@workflows/v1
+    uses: spring-io/spring-security-release-tools/.github/workflows/build.yml@3f6cc7ffc137ca160061749d5f34dc30d5f36986 # v1.0.17
+    strategy:
+      matrix:
+        os: [ ubuntu-latest, windows-latest ]
+        jdk: [ 25 ]
    with:
-      java-version: '25'
+      runs-on: ${{ matrix.os }}
+      java-version: ${{ matrix.jdk }}
+      distribution: temurin
    secrets: inherit
-  test:
-    name: Test Against Snapshots
-    uses: spring-projects/spring-security-commercial/.github/workflows/test.yml@workflows/v1
-    with:
-      java-version: '25'
-      test-args: --refresh-dependencies -PforceMavenRepositories=snapshot -PisOverrideVersionCatalog -PtestToolchain=25 -PspringFrameworkVersion=7.0.+ -PreactorVersion=2025.0.+ -PspringDataVersion=2026.0.+ -PmicrometerVersion=1.17.+ --stacktrace
-    secrets: inherit
-  compute-version:
-    name: Compute Version
-    runs-on: ubuntu-latest
-    outputs:
-      snapshot: ${{ steps.project-version.outputs.snapshot }}
-    steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # 7.0.0
-      - id: project-version
-        name: Extract Project Version
-        uses: spring-io/spring-release-actions/compute-version@a1f321783a0769dd2aea4fad6c2ae2f95a52b885 # 0.0.5
  deploy-artifacts:
    name: Deploy Artifacts
-    needs: [ build, test, compute-version ]
-    if: needs.compute-version.outputs.snapshot == 'true'
-    uses: spring-projects/spring-security-commercial/.github/workflows/deploy-artifacts.yml@workflows/v1
+    needs: [ build ]
+    uses: spring-io/spring-security-release-tools/.github/workflows/deploy-artifacts.yml@3f6cc7ffc137ca160061749d5f34dc30d5f36986 # v1.0.17
+    with:
+      should-deploy-artifacts: ${{ needs.build.outputs.should-deploy-artifacts }}
+      default-publish-milestones-central: true
+      java-version: 25
+    secrets: inherit
+  deploy-schema:
+    name: Deploy Schema
+    needs: [ build ]
+    uses: spring-io/spring-security-release-tools/.github/workflows/deploy-schema.yml@3f6cc7ffc137ca160061749d5f34dc30d5f36986 # v1.0.17
+    with:
+      should-deploy-schema: ${{ needs.build.outputs.should-deploy-artifacts }}
+      java-version: 25
    secrets: inherit
  send-notification:
    name: Send Notification
-    needs: [ deploy-artifacts ]
+    needs: [ deploy-artifacts, deploy-schema ]
    if: ${{ !success() }}
    runs-on: ubuntu-latest
    steps:
      - name: Send Notification
-        uses: spring-io/spring-security-release-tools/.github/actions/send-notification@b92832ecbc7cbe969201e6beafbde0ee400cf095 # v1.0.15
+        uses: spring-io/spring-security-release-tools/.github/actions/send-notification@3f6cc7ffc137ca160061749d5f34dc30d5f36986 # v1.0.17
        with:
          webhook-url: ${{ secrets.SPRING_SECURITY_CI_GCHAT_WEBHOOK_URL }}
@@ -0,0 +1,76 @@
+name: Defer Issues
+
+on:
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  defer-issues:
+    name: Defer Issues
+    runs-on: ubuntu-latest
+    if: github.repository_owner == 'spring-projects'
+    permissions:
+      issues: write
+    steps:
+    - name: Checkout
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+    - name: Compute Version
+      id: compute-version
+      uses: spring-io/spring-release-actions/compute-version@1b8671612c3eb3d9b9763e2d7b66f1a80d00ee95 # 0.0.6
+    - name: Get Today's Release Version
+      id: todays-release
+      uses: spring-io/spring-release-actions/get-todays-release-version@1b8671612c3eb3d9b9763e2d7b66f1a80d00ee95 # 0.0.6
+      with:
+        snapshot-version: ${{ steps.compute-version.outputs.version }}
+        milestone-repository: ${{ github.repository }}
+        milestone-token: ${{ secrets.GITHUB_TOKEN }}
+    - name: Compute Next Version
+      id: next-version
+      uses: spring-io/spring-release-actions/compute-next-version@1b8671612c3eb3d9b9763e2d7b66f1a80d00ee95 # 0.0.6
+      with:
+        version: ${{ steps.todays-release.outputs.release-version }}
+    - name: Schedule Next Milestone
+      uses: spring-io/spring-release-actions/schedule-milestone@1b8671612c3eb3d9b9763e2d7b66f1a80d00ee95 # 0.0.6
+      with:
+        version: ${{ steps.next-version.outputs.version }}
+        version-date: ${{ steps.next-version.outputs.version-date }}
+        repository: ${{ github.repository }}
+        token: ${{ secrets.GITHUB_TOKEN }}
+    - name: Move Open Issues to Next Milestone
+      env:
+        GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        CURRENT_MILESTONE: ${{ steps.todays-release.outputs.release-version }}
+        NEXT_MILESTONE: ${{ steps.next-version.outputs.version }}
+      run: |
+        current_milestone_number=$(gh api repos/${{ github.repository }}/milestones \
+          --jq ".[] | select(.title == \"$CURRENT_MILESTONE\") | .number")
+        if [ -z "$current_milestone_number" ]; then
+          echo "No milestone found for $CURRENT_MILESTONE"
+          exit 0
+        fi
+        next_milestone_number=$(gh api repos/${{ github.repository }}/milestones \
+          --jq ".[] | select(.title == \"$NEXT_MILESTONE\") | .number")
+        if [ -z "$next_milestone_number" ]; then
+          echo "No milestone found for $NEXT_MILESTONE"
+          exit 1
+        fi
+        echo "Moving open issues from milestone '$CURRENT_MILESTONE' (#$current_milestone_number) to '$NEXT_MILESTONE' (#$next_milestone_number)"
+        page=1
+        while true; do
+          issues=$(gh api "repos/${{ github.repository }}/issues?milestone=$current_milestone_number&state=open&per_page=100&page=$page" \
+            --jq '.[].number')
+          if [ -z "$issues" ]; then
+            break
+          fi
+          for issue in $issues; do
+            echo "Moving issue/PR #$issue to milestone $NEXT_MILESTONE"
+            gh api repos/${{ github.repository }}/issues/$issue \
+              --method PATCH \
+              --field milestone=$next_milestone_number \
+              --silent
+          done
+          page=$((page + 1))
+        done
+        echo "Done."
@@ -1,10 +0,0 @@
-name: Dependabot PR Build
-
-on: pull_request_target
-
-jobs:
-  build:
-    name: Build
-    uses: spring-projects/spring-security-commercial/.github/workflows/build-pull-request.yml@workflows/v1
-    if: ${{ github.actor == 'dependabot[bot]' }}
-    secrets: inherit
@@ -0,0 +1,33 @@
+name: Deploy Docs
+on:
+  push:
+    branches-ignore:
+      - "gh-pages"
+      - "dependabot/**"
+    tags: '**'
+  repository_dispatch:
+    types: request-build-reference # legacy
+  #schedule:
+  #- cron: '0 10 * * *' # Once per day at 10am UTC
+  workflow_dispatch:
+permissions: read-all
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    if: github.repository_owner == 'spring-projects'
+    steps:
+    - name: Checkout
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      with:
+        ref: docs-build
+        fetch-depth: 1
+    - name: Dispatch (partial build)
+      if: github.ref_type == 'branch'
+      env:
+        GH_TOKEN: ${{ secrets.GH_ACTIONS_REPO_TOKEN }}
+      run: gh workflow run deploy-docs.yml -r $(git rev-parse --abbrev-ref HEAD) -f build-refname=${{ github.ref_name }}
+    - name: Dispatch (full build)
+      if: github.ref_type == 'tag'
+      env:
+        GH_TOKEN: ${{ secrets.GH_ACTIONS_REPO_TOKEN }}
+      run: gh workflow run deploy-docs.yml -r $(git rev-parse --abbrev-ref HEAD)
@@ -0,0 +1,34 @@
+name: Execute Gradle Wrapper Upgrade
+
+on:
+  schedule:
+    - cron:  '0 2 * * *' # 2am UTC
+  workflow_dispatch:
+permissions:
+  pull-requests: write
+jobs:
+  upgrade_wrapper:
+    name: Execution
+    if: ${{ github.repository == 'spring-projects/spring-security' }}
+    runs-on: ubuntu-latest
+    steps:
+      - name: Set up Git configuration
+        env:
+          TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          git config --global url."https://unused-username:${TOKEN}@github.com/".insteadOf "https://github.com/"
+          git config --global user.name 'github-actions[bot]'
+          git config --global user.email 'github-actions[bot]@users.noreply.github.com'
+      - name: Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - name: Set up JDK 25
+        uses: actions/setup-java@dd06d9cba3e5552c54d9f8ea23572deb30010f7c # v6.0.0
+        with:
+          java-version: '25'
+          distribution: 'temurin'
+      - name: Set up Gradle
+        uses: gradle/setup-gradle@f29f5a9d7b09a7c6b29859002d29d24e1674c884 # v5.0.1
+      - name: Upgrade Wrappers
+        run: ./gradlew clean upgradeGradleWrapperAll --continue -Porg.gradle.java.installations.auto-download=false
+        env:
+          WRAPPER_UPGRADE_GIT_TOKEN: ${{ secrets.GITHUB_TOKEN }}
@@ -1,63 +0,0 @@
-name: Merge Dependabot PR
-
-on: pull_request_target
-
-run-name: Merge Dependabot PR ${{ github.ref_name }}
-
-permissions: write-all
-
-jobs:
-  merge-dependabot-pr:
-    name: Merge Dependabot PR
-    runs-on: ubuntu-latest
-    if: ${{ github.event.pull_request.user.login == 'dependabot[bot]' && github.repository == 'spring-projects/spring-security-commercial' }}
-    steps:
-
-      - uses: actions/checkout@v5
-        with:
-          show-progress: false
-          ref: ${{ github.event.pull_request.head.sha }}
-
-      - uses: actions/setup-java@v4
-        with:
-          distribution: temurin
-          java-version: 17
-
-      - name: Set Milestone to Dependabot Pull Request
-        id: set-milestone
-        run: |
-          if test -f pom.xml
-          then
-            CURRENT_VERSION=$(mvn help:evaluate -Dexpression="project.version" -q -DforceStdout)
-          else
-            CURRENT_VERSION=$(cat gradle.properties | sed -n '/^version=/ { s/^version=//;p }')
-          fi
-          export CANDIDATE_VERSION=${CURRENT_VERSION/-SNAPSHOT}
-          MILESTONE=$(gh api repos/$GITHUB_REPOSITORY/milestones --jq 'map(select(.due_on != null and (.title | startswith(env.CANDIDATE_VERSION)))) | .[0] | .title')
-
-          if [ -z $MILESTONE ]
-          then
-            gh run cancel ${{ github.run_id }}
-            echo "::warning title=Cannot merge::No scheduled milestone for $CURRENT_VERSION version"
-          else
-            gh pr edit ${{ github.event.pull_request.number }} --milestone $MILESTONE
-            echo mergeEnabled=true >> $GITHUB_OUTPUT
-          fi
-        env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: Merge Dependabot pull request
-        if: steps.set-milestone.outputs.mergeEnabled
-        run: gh pr merge ${{ github.event.pull_request.number }} --auto --rebase
-        env:
-          GH_TOKEN: ${{ secrets.GH_ACTIONS_REPO_TOKEN }}
-  send-notification:
-    name: Send Notification
-    needs: [ merge-dependabot-pr ]
-    if: ${{ failure() || cancelled() }}
-    runs-on: ubuntu-latest
-    steps:
-      - name: Send Notification
-        uses: spring-io/spring-security-release-tools/.github/actions/send-notification@v1
-        with:
-          webhook-url: ${{ secrets.SPRING_SECURITY_CI_GCHAT_WEBHOOK_URL }}
@@ -8,6 +8,44 @@ permissions:
 jobs:
  build:
    name: Build
-    uses: spring-projects/spring-security-commercial/.github/workflows/build-pull-request.yml@workflows/v1
-    if: ${{ github.actor != 'dependabot[bot]' }}
-    secrets: inherit
+    runs-on: ubuntu-latest
+    if: ${{ github.repository == 'spring-projects/spring-security' }}
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - name: Set up gradle
+        uses: spring-io/spring-gradle-build-action@c8668747d7c264864c8c7f7026d0d277d14a78dc # v2.0.6
+        with:
+          java-version: '25'
+          distribution: 'temurin'
+      - name: Build with Gradle
+        run: ./gradlew clean build -PskipCheckExpectedBranchVersion --continue --scan
+  generate-docs:
+    name: Generate Docs
+    runs-on: ubuntu-latest
+    if: ${{ github.repository == 'spring-projects/spring-security' }}
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - name: Set up gradle
+        uses: spring-io/spring-gradle-build-action@c8668747d7c264864c8c7f7026d0d277d14a78dc # v2.0.6
+        with:
+          java-version: '25'
+          distribution: 'temurin'
+      - name: Run Antora
+        run: ./gradlew -PbuildSrc.skipTests=true :spring-security-docs:antora
+      - name: Upload Docs
+        id: upload
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: docs
+          path: docs/build/site
+          overwrite: true
+  send-notification:
+    name: Send Notification
+    needs: [ build, generate-docs ]
+    if: ${{ failure() && github.event.pull_request.user.login == 'dependabot[bot]' && github.repository == 'spring-projects/spring-security' }}
+    runs-on: ubuntu-latest
+    steps:
+      - name: Send Notification
+        uses: spring-io/spring-security-release-tools/.github/actions/send-notification@3f6cc7ffc137ca160061749d5f34dc30d5f36986 # v1.0.17
+        with:
+          webhook-url: ${{ secrets.SPRING_SECURITY_CI_GCHAT_WEBHOOK_URL }}
@@ -0,0 +1,30 @@
+name: Release Announcements - Publish
+
+on:
+  workflow_dispatch:
+    inputs:
+      version:
+        description: The version to publish
+        required: true
+        type: string
+
+permissions:
+  actions: write
+  contents: read
+  issues: write
+
+jobs:
+  deploy-schema:
+    name: Deploy Schema
+    uses: spring-io/spring-security-release-tools/.github/workflows/deploy-schema.yml@3f6cc7ffc137ca160061749d5f34dc30d5f36986 # v1.0.17
+    with:
+      should-deploy-schema: true
+    secrets: inherit
+  publish-release-announcements:
+    name: Publish Release Announcements
+    needs: [ deploy-schema ]
+    if: ${{ !github.event.repository.fork }}
+    uses: spring-io/spring-security-release-tools/.github/workflows/release-announcements-publish.yml@3f6cc7ffc137ca160061749d5f34dc30d5f36986 # v1.0.17
+    with:
+      version: ${{ inputs.version }}
+    secrets: inherit
@@ -0,0 +1,24 @@
+name: Release Announcements - Stage
+
+on:
+  push:
+    tags:
+      - '[0-9]+.[0-9]+.[0-9]+'
+  workflow_dispatch:
+    inputs:
+      version:
+        description: The version to stage
+        required: true
+        type: string
+
+permissions:
+  contents: read
+
+jobs:
+  stage-release-announcements:
+    name: Stage Release Announcements
+    if: ${{ !github.event.repository.fork }}
+    uses: spring-io/spring-security-release-tools/.github/workflows/release-announcements-stage.yml@3f6cc7ffc137ca160061749d5f34dc30d5f36986 # v1.0.17
+    with:
+      version: ${{ inputs.version || github.ref_name }}
+    secrets: inherit
@@ -1,92 +0,0 @@
-# This file was auto-generated by github-actions-workflow-generator 0.0.6. Do not edit.
-# To update it, modify .github/workflow-generator.yml as needed and re-run the generator.
-
-name: "Release Train – Build"
-run-name: "${{ inputs.callback-ref }} – Build"
-"on":
-  workflow_dispatch:
-    inputs:
-      callback:
-        description: "Repository to which a callback should be made upon completion"
-        required: true
-        type: "string"
-      callback-ref:
-        description: "Ref in the callback repository to which a callback should be made upon completion"
-        required: true
-        type: "string"
-      release-train-maven-repository-url:
-        description: "URL of a Maven repository to be used to resolve artifacts of projects earlier in the train"
-        required: true
-        type: "string"
-permissions:
-  contents: "read"
-concurrency:
-  group: "${{ github.workflow }}-${{ github.ref }}"
-jobs:
-  build-release:
-    name: "Build Release"
-    runs-on: "ubuntu22-2-8"
-    steps:
-    - name: "Prevent Re-runs"
-      id: "prevent-re-runs"
-      run: |-
-        if [ "$GITHUB_RUN_ATTEMPT" -gt 1 ]; then
-          echo "Re-runs are prohibited. Use the 'Release Train – Retry' workflow to retry build failures"
-          exit 1
-        fi
-    - name: "Set up Java"
-      id: "set-up-java"
-      uses: "actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95" # v5.6.0
-      with:
-        distribution: "liberica"
-        java-version: "25"
-    - name: "Check Out Code"
-      id: "check-out-code"
-      uses: "actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0" # v7.0.0
-    - name: "Build Release"
-      id: "build-release"
-      uses: "./.github/actions/release-train-build"
-      env:
-        COMMERCIAL_REPO_PASSWORD: "${{ secrets.COMMERCIAL_ARTIFACTORY_PASSWORD }}"
-        COMMERCIAL_REPO_USERNAME: "${{ secrets.COMMERCIAL_ARTIFACTORY_USERNAME }}"
-        RELEASE_TRAIN_MAVEN_REPOSITORY_PASSWORD: "${{ secrets.RELEASE_TRAIN_PARTICIPANT_MAVEN_REPOSITORY_PASSWORD }}"
-        RELEASE_TRAIN_MAVEN_REPOSITORY_URL: "${{ inputs.release-train-maven-repository-url }}"
-        RELEASE_TRAIN_MAVEN_REPOSITORY_USERNAME: "${{ secrets.RELEASE_TRAIN_PARTICIPANT_MAVEN_REPOSITORY_USERNAME }}"
-    - name: "Upload Deployment Repository"
-      id: "upload-deployment-repository"
-      uses: "actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a" # v7.0.1
-      with:
-        name: "deployment-repository"
-        path: "deployment-repository/**"
-    - name: "Upload Deployment Spec"
-      id: "upload-deployment-spec"
-      uses: "actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a" # v7.0.1
-      with:
-        archive: "false"
-        if-no-files-found: "ignore"
-        name: "deployment-spec"
-        path: ".github/actions/release-train-build/deployment-spec.yml"
-    - name: "Save Build System Caches"
-      id: "save-build-system-caches"
-      uses: "actions/cache/save@55cc8345863c7cc4c66a329aec7e433d2d1c52a9" # v6.1.0
-      with:
-        key: "release-train-${{ inputs.callback-ref }}-${{ github.ref_name }}"
-        path: |-
-          ~/.gradle/caches
-          ~/.gradle/wrapper
-    - name: "Send Callback"
-      id: "send-callback"
-      if: "${{ !cancelled() }}"
-      env:
-        GH_TOKEN: "${{ secrets.RELEASE_TRAIN_PARTICIPANT_GITHUB_TOKEN }}"
-      run: |-
-        gh workflow run callback \
-        --repo ${{ inputs.callback }} \
-        --ref ${{ inputs.callback-ref }} \
-        --field commit-hash=${{ steps.check-out-code.outputs.commit }} \
-        --field deployment-repository-artifact-identifier=${{ steps.upload-deployment-repository.outputs.artifact-id }} \
-        --field deployment-spec-artifact-identifier=${{ steps.upload-deployment-spec.outputs.artifact-id }} \
-        --field release-branch=${{ github.ref_name }} \
-        --field release-repository=${{ github.repository }} \
-        --field result=${{ job.status == 'success' && 'built' || 'build-failed' }} \
-        --field workflow-run-url=${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
@@ -1,55 +0,0 @@
-# This file was auto-generated by github-actions-workflow-generator 0.0.6. Do not edit.
-# To update it, modify .github/workflow-generator.yml as needed and re-run the generator.
-
-name: "Release Train – Join"
-run-name: "${{ inputs.release-train }} – Join"
-"on":
-  workflow_dispatch:
-    inputs:
-      deployment-destination:
-        description: "Destination to which the release should be deployed"
-        options:
-        - "Maven Central"
-        - "Spring Enterprise"
-        required: true
-        type: "choice"
-      release-train:
-        description: "Release train"
-        required: true
-        type: "string"
-      release-train-repository:
-        default: "spring-io/release-train"
-        description: "Release train repository"
-        required: true
-        type: "string"
-permissions:
-  contents: "none"
-jobs:
-  join-release-train:
-    name: "Join Release Train"
-    runs-on: "ubuntu-latest"
-    steps:
-    - name: "Join Release Train"
-      id: "join-release-train"
-      env:
-        GH_TOKEN: "${{ secrets.RELEASE_TRAIN_PARTICIPANT_GITHUB_TOKEN }}"
-      run: |-
-        run_url=$(
-          gh workflow run join \
-          --repo ${{ inputs.release-train-repository }} \
-          --ref ${{ inputs.release-train }} \
-          --field commit-hash=${{ github.sha }} \
-          --field deployment-destination=${{ inputs.deployment-destination == 'Maven Central' && 'maven-central' || 'spring-enterprise' }} \
-          --field release-branch=${{ github.ref_name }} \
-          --field release-repository=${{ github.repository }}
-        )
-        echo "Dispatched workflow run. Waiting for $run_url to complete."
-        run_id=${run_url##*/}
-        watch_exit_code=0
-        gh run watch $run_id --repo ${{ inputs.release-train-repository }} --exit-status --interval=3 > /dev/null 2>&1 || watch_exit_code=$?
-        if [[ $watch_exit_code -eq 0 ]]; then
-          echo "Workflow run succeeded."
-        else
-          echo "Workflow run failed."
-        fi
-        exit $watch_exit_code
@@ -1,46 +0,0 @@
-# This file was auto-generated by github-actions-workflow-generator 0.0.6. Do not edit.
-# To update it, modify .github/workflow-generator.yml as needed and re-run the generator.
-
-name: "Release Train – Leave"
-run-name: "${{ inputs.release-train }} – Leave"
-"on":
-  workflow_dispatch:
-    inputs:
-      release-train:
-        description: "Release train"
-        required: true
-        type: "string"
-      release-train-repository:
-        default: "spring-io/release-train"
-        description: "Release train repository"
-        required: true
-        type: "string"
-permissions:
-  contents: "none"
-jobs:
-  leave:
-    name: "Leave"
-    runs-on: "ubuntu-latest"
-    steps:
-    - name: "Leave"
-      id: "leave"
-      env:
-        GH_TOKEN: "${{ secrets.RELEASE_TRAIN_PARTICIPANT_GITHUB_TOKEN }}"
-      run: |-
-        run_url=$(
-          gh workflow run leave \
-          --repo ${{ inputs.release-train-repository }} \
-          --ref ${{ inputs.release-train }} \
-          --field release-branch=${{ github.ref_name }} \
-          --field release-repository=${{ github.repository }}
-        )
-        echo "Dispatched workflow run. Waiting for $run_url to complete."
-        run_id=${run_url##*/}
-        watch_exit_code=0
-        gh run watch $run_id --repo ${{ inputs.release-train-repository }} --exit-status --interval=3 > /dev/null 2>&1 || watch_exit_code=$?
-        if [[ $watch_exit_code -eq 0 ]]; then
-          echo "Workflow run succeeded."
-        else
-          echo "Workflow run failed."
-        fi
-        exit $watch_exit_code
@@ -1,47 +0,0 @@
-# This file was auto-generated by github-actions-workflow-generator 0.0.6. Do not edit.
-# To update it, modify .github/workflow-generator.yml as needed and re-run the generator.
-
-name: "Release Train – Ready"
-run-name: "${{ inputs.release-train }} – Ready"
-"on":
-  workflow_dispatch:
-    inputs:
-      release-train:
-        description: "Release train"
-        required: true
-        type: "string"
-      release-train-repository:
-        default: "spring-io/release-train"
-        description: "Release train repository"
-        required: true
-        type: "string"
-permissions:
-  contents: "none"
-jobs:
-  ready:
-    name: "Ready"
-    runs-on: "ubuntu-latest"
-    steps:
-    - name: "Ready"
-      id: "ready"
-      env:
-        GH_TOKEN: "${{ secrets.RELEASE_TRAIN_PARTICIPANT_GITHUB_TOKEN }}"
-      run: |-
-        run_url=$(
-          gh workflow run ready \
-          --repo ${{ inputs.release-train-repository }} \
-          --ref ${{ inputs.release-train }} \
-          --field commit-hash=${{ github.sha }} \
-          --field release-branch=${{ github.ref_name }} \
-          --field release-repository=${{ github.repository }}
-        )
-        echo "Dispatched workflow run. Waiting for $run_url to complete."
-        run_id=${run_url##*/}
-        watch_exit_code=0
-        gh run watch $run_id --repo ${{ inputs.release-train-repository }} --exit-status --interval=3 > /dev/null 2>&1 || watch_exit_code=$?
-        if [[ $watch_exit_code -eq 0 ]]; then
-          echo "Workflow run succeeded."
-        else
-          echo "Workflow run failed."
-        fi
-        exit $watch_exit_code
@@ -1,34 +0,0 @@
-# This file was auto-generated by github-actions-workflow-generator 0.0.6. Do not edit.
-# To update it, modify .github/workflow-generator.yml as needed and re-run the generator.
-
-name: "Release Train – Retry"
-run-name: "${{ inputs.release-train }} – Retry"
-"on":
-  workflow_dispatch:
-    inputs:
-      release-train:
-        description: "Release train"
-        required: true
-        type: "string"
-      release-train-repository:
-        default: "spring-io/release-train"
-        description: "Release train repository"
-        required: true
-        type: "string"
-permissions:
-  contents: "none"
-jobs:
-  trigger-retry:
-    name: "Trigger Retry"
-    runs-on: "ubuntu-latest"
-    steps:
-    - name: "Trigger Retry"
-      id: "trigger-retry"
-      env:
-        GH_TOKEN: "${{ secrets.RELEASE_TRAIN_PARTICIPANT_GITHUB_TOKEN }}"
-      run: |-
-        gh workflow run retry \
-        --repo ${{ inputs.release-train-repository }} \
-        --ref ${{ inputs.release-train }} \
-        --field release-branch=${{ github.ref_name }} \
-        --field release-repository=${{ github.repository }}
@@ -1,83 +0,0 @@
-# This file was auto-generated by github-actions-workflow-generator 0.0.6. Do not edit.
-# To update it, modify .github/workflow-generator.yml as needed and re-run the generator.
-
-name: "Release Train – Test"
-run-name: "${{ inputs.callback-ref }} – Test"
-"on":
-  workflow_dispatch:
-    inputs:
-      callback:
-        description: "Repository to which a callback should be made upon completion"
-        required: true
-        type: "string"
-      callback-ref:
-        description: "Ref in the callback repository to which a callback should be made upon completion"
-        required: true
-        type: "string"
-      release-train-maven-repository-url:
-        description: "URL of a Maven repository to be used to resolve artifacts of projects earlier in the train"
-        required: true
-        type: "string"
-permissions:
-  contents: "read"
-concurrency:
-  group: "${{ github.workflow }}-${{ github.ref }}"
-jobs:
-  test-release:
-    name: "Test Release"
-    runs-on: "ubuntu22-2-8"
-    steps:
-    - name: "Prevent Re-runs"
-      id: "prevent-re-runs"
-      run: |-
-        if [ "$GITHUB_RUN_ATTEMPT" -gt 1 ]; then
-          echo "Re-runs are prohibited. Use the 'Release Train – Retry' workflow to retry test failures"
-          exit 1
-        fi
-    - name: "Set up Java"
-      id: "set-up-java"
-      uses: "actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95" # v5.6.0
-      with:
-        distribution: "liberica"
-        java-version: "25"
-    - name: "Check Out Code"
-      id: "check-out-code"
-      uses: "actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0" # v7.0.0
-    - name: "Restore Build System Caches"
-      id: "restore-build-system-caches"
-      uses: "actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9" # v6.1.0
-      with:
-        key: "release-train-${{ inputs.callback-ref }}-${{ github.ref_name }}"
-        path: |-
-          ~/.gradle/caches
-          ~/.gradle/wrapper
-    - name: "Test Release"
-      id: "test-release"
-      uses: "./.github/actions/release-train-test"
-      env:
-        COMMERCIAL_REPO_PASSWORD: "${{ secrets.COMMERCIAL_ARTIFACTORY_PASSWORD }}"
-        COMMERCIAL_REPO_USERNAME: "${{ secrets.COMMERCIAL_ARTIFACTORY_USERNAME }}"
-        RELEASE_TRAIN_MAVEN_REPOSITORY_PASSWORD: "${{ secrets.RELEASE_TRAIN_PARTICIPANT_MAVEN_REPOSITORY_PASSWORD }}"
-        RELEASE_TRAIN_MAVEN_REPOSITORY_URL: "${{ inputs.release-train-maven-repository-url }}"
-        RELEASE_TRAIN_MAVEN_REPOSITORY_USERNAME: "${{ secrets.RELEASE_TRAIN_PARTICIPANT_MAVEN_REPOSITORY_USERNAME }}"
-    - name: "Send Callback"
-      id: "send-callback"
-      if: "${{ !cancelled() }}"
-      env:
-        GH_TOKEN: "${{ secrets.RELEASE_TRAIN_PARTICIPANT_GITHUB_TOKEN }}"
-      run: |-
-        gh workflow run callback \
-        --repo ${{ inputs.callback }} \
-        --ref ${{ inputs.callback-ref }} \
-        --field commit-hash=${{ steps.check-out-code.outputs.commit }} \
-        --field release-branch=${{ github.ref_name }} \
-        --field release-repository=${{ github.repository }} \
-        --field result=${{ job.status == 'success' && 'tested' || 'test-failed' }} \
-        --field workflow-run-url=${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
-    - name: "Upload Build System Reports"
-      id: "upload-build-system-reports"
-      if: "${{ failure() }}"
-      uses: "actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a" # v7.0.1
-      with:
-        name: "build-system-reports"
-        path: "**/build/reports"
@@ -0,0 +1,37 @@
+name: Update Antora UI Spring
+
+on:
+  schedule:
+    - cron: '0 10 * * *' # Once per day at 10am UTC
+  workflow_dispatch:
+
+permissions:
+  pull-requests: write
+  issues: write
+  contents: write
+
+jobs:
+  update-antora-ui-spring:
+    name: Update on Supported Branches
+    if: ${{ github.repository == 'spring-projects/spring-security' }}
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        branch: [ '6.5.x', '7.0.x', '7.1.x', 'main' ]
+    steps:
+      - uses: spring-io/spring-doc-actions/update-antora-spring-ui@415e2b11a766ba64799fffb5c97a4f7e17f677cf # v0.0.22
+        name: Update
+        with:
+          docs-branch: ${{ matrix.branch }}
+          token: ${{ secrets.GITHUB_TOKEN }}
+          antora-file-path: 'docs/antora-playbook.yml'
+  update-antora-ui-spring-docs-build:
+    name: Update on docs-build
+    if: ${{ github.repository == 'spring-projects/spring-security' }}
+    runs-on: ubuntu-latest
+    steps:
+      - uses: spring-io/spring-doc-actions/update-antora-spring-ui@415e2b11a766ba64799fffb5c97a4f7e17f677cf # v0.0.22
+        name: Update
+        with:
+          docs-branch: 'docs-build'
+          token: ${{ secrets.GITHUB_TOKEN }}
@@ -90,7 +90,7 @@ public class ExpressionBasedAnnotationAttributeFactory implements PrePostInvocat
 	}

 	/**
-	 * Delay the lookup of the {@link ExpressionParser} to prevent SEC-2136
+	 * Delay the lookup of the {@link ExpressionParser} to prevent SEC-2136.
 	 * @return
 	 */
 	private ExpressionParser getParser() {
@@ -30,6 +30,9 @@ import org.springframework.security.access.prepost.PostInvocationAuthorizationAd
 import org.springframework.security.core.Authentication;

 /**
+ * A {@link PostInvocationAuthorizationAdvice} that applies {@code PostFilter} and
+ * {@code PostAuthorize} expressions.
+ *
 * @author Luke Taylor
 * @since 3.0
 * @deprecated Use
@@ -23,6 +23,8 @@ import org.springframework.expression.ParseException;
 import org.springframework.security.access.prepost.PostInvocationAttribute;

 /**
+ * A {@link PostInvocationAttribute} based on filter and authorize expressions.
+ *
 * @author Luke Taylor
 * @since 3.0
 * @deprecated Use
@@ -23,6 +23,8 @@ import org.springframework.expression.ParseException;
 import org.springframework.security.access.prepost.PreInvocationAttribute;

 /**
+ * A {@link PreInvocationAttribute} based on parsed {@link Expression}s.
+ *
 * @author Luke Taylor
 * @since 3.0
 * @deprecated Use
@@ -59,12 +59,12 @@ public class MapBasedMethodSecurityMetadataSource extends AbstractFallbackMethod
 	private @Nullable ClassLoader beanClassLoader = ClassUtils.getDefaultClassLoader();

 	/**
-	 * Map from RegisteredMethod to ConfigAttribute list
+	 * Map from RegisteredMethod to ConfigAttribute list.
 	 */
 	protected final Map<RegisteredMethod, List<ConfigAttribute>> methodMap = new HashMap<>();

 	/**
-	 * Map from RegisteredMethod to name pattern used for registration
+	 * Map from RegisteredMethod to name pattern used for registration.
 	 */
 	private final Map<RegisteredMethod, String> nameMap = new HashMap<>();

@@ -72,7 +72,7 @@ public class MapBasedMethodSecurityMetadataSource extends AbstractFallbackMethod
 	}

 	/**
-	 * Creates the <tt>MapBasedMethodSecurityMetadataSource</tt> from a
+	 * Creates the <tt>MapBasedMethodSecurityMetadataSource</tt> from a.
 	 * @param methodMap map of method names to <tt>ConfigAttribute</tt>s.
 	 */
 	public MapBasedMethodSecurityMetadataSource(Map<String, List<ConfigAttribute>> methodMap) {
@@ -236,6 +236,7 @@ public class MapBasedMethodSecurityMetadataSource extends AbstractFallbackMethod
 	}

 	/**
+	 * Returns the size of the method map.
 	 * @return map size (for unit tests and diagnostics)
 	 */
 	public int getMethodMapSize() {
@@ -41,7 +41,7 @@ import org.springframework.security.core.parameters.AnnotationParameterNameDisco
 public @interface P {

 	/**
-	 * The parameter name
+	 * The parameter name.
 	 * @return
 	 */
 	String value();
@@ -74,7 +74,7 @@ public class PrePostAdviceReactiveMethodInterceptor implements MethodInterceptor
 	private static final int RETURN_TYPE_METHOD_PARAMETER_INDEX = -1;

 	/**
-	 * Creates a new instance
+	 * Creates a new instance.
 	 * @param attributeSource the {@link MethodSecurityMetadataSource} to use
 	 * @param preInvocationAdvice the {@link PreInvocationAuthorizationAdvice} to use
 	 * @param postInvocationAdvice the {@link PostInvocationAuthorizationAdvice} to use
@@ -22,6 +22,9 @@ import org.springframework.aop.framework.AopInfrastructureBean;
 import org.springframework.security.authorization.AuthorizationManager;

 /**
+ * A factory for creating {@link PreInvocationAttribute}s and
+ * {@link PostInvocationAttribute}s.
+ *
 * @author Luke Taylor
 * @since 3.0
 * @see org.springframework.security.authorization.method.AuthorizationManagerBeforeMethodInterceptor
@@ -19,7 +19,7 @@ package org.springframework.security.messaging.access.expression;
 import org.springframework.expression.EvaluationContext;

 /**
- * Allows post processing the {@link EvaluationContext}
+ * Allows post processing the {@link EvaluationContext}.
 *
 * <p>
 * This API is intentionally kept package scope as it may evolve over time.
@@ -46,7 +46,7 @@ class MessageExpressionConfigAttribute implements ConfigAttribute, EvaluationCon
 	private final MessageMatcher<Object> matcher;

 	/**
-	 * Creates a new instance
+	 * Creates a new instance.
 	 * @param authorizeExpression the {@link Expression} to use. Cannot be null
 	 * @param matcher the {@link MessageMatcher} used to match the messages.
 	 */
@@ -48,7 +48,7 @@ public final class ChannelSecurityInterceptor extends AbstractSecurityIntercepto
 	private final MessageSecurityMetadataSource metadataSource;

 	/**
-	 * Creates a new instance
+	 * Creates a new instance.
 	 * @param metadataSource the MessageSecurityMetadataSource to use. Cannot be null.
 	 *
 	 * @see DefaultMessageSecurityMetadataSource
@@ -20,7 +20,7 @@ import org.springframework.messaging.Message;
 import org.springframework.security.access.SecurityMetadataSource;

 /**
- * A {@link SecurityMetadataSource} that is used for securing {@link Message}
+ * A {@link SecurityMetadataSource} that is used for securing {@link Message}.
 *
 * @author Rob Winch
 * @since 4.0
@@ -32,6 +32,8 @@ import org.springframework.security.web.RedirectStrategy;
 import org.springframework.util.Assert;

 /**
+ * A {@link ChannelEntryPoint} that retries the request on a different scheme and port.
+ *
 * @author Luke Taylor
 * @deprecated please use
 * {@link org.springframework.security.web.transport.HttpsRedirectFilter} and its
@@ -45,12 +47,12 @@ public abstract class AbstractRetryEntryPoint implements ChannelEntryPoint {
 	private PortMapper portMapper = new PortMapperImpl();

 	/**
-	 * The scheme ("http://" or "https://")
+	 * The scheme ("http://" or "https://").
 	 */
 	private final String scheme;

 	/**
-	 * The standard port for the scheme (80 for http, 443 for https)
+	 * The standard port for the scheme (80 for http, 443 for https).
 	 */
 	private final int standardPort;

@@ -28,6 +28,8 @@ import org.springframework.security.core.Authentication;
 import org.springframework.security.web.FilterInvocation;

 /**
+ * The default implementation of {@link SecurityExpressionHandler} for web security.
+ *
 * @author Luke Taylor
 * @author Eddú Meléndez
 * @author Steve Riesenberg
@@ -54,7 +54,7 @@ public class FilterSecurityInterceptor extends AbstractSecurityInterceptor imple
 	private boolean observeOncePerRequest = false;

 	/**
-	 * Not used (we rely on IoC container lifecycle services instead)
+	 * Not used (we rely on IoC container lifecycle services instead).
 	 * @param arg0 ignored
 	 *
 	 */
@@ -63,7 +63,7 @@ public class FilterSecurityInterceptor extends AbstractSecurityInterceptor imple
 	}

 	/**
-	 * Not used (we rely on IoC container lifecycle services instead)
+	 * Not used (we rely on IoC container lifecycle services instead).
 	 */
 	@Override
 	public void destroy() {
@@ -147,7 +147,7 @@ public class AclAuthorizationStrategyImpl implements AclAuthorizationStrategy {
 	/**
 	 * Creates a principal-like sid from the authentication information.
 	 * @param authentication the authentication information that can provide principal and
-	 * thus the sid's id will be dependant on the value inside
+	 * thus the sid's id will be dependent on the value inside
 	 * @return a sid with the ID taken from the authentication information
 	 */
 	protected Sid createCurrentUser(Authentication authentication) {
@@ -92,9 +92,9 @@ public class AclImpl implements Acl, MutableAcl, AuditableAcl, OwnershipAcl {
 	 * @param aclAuthorizationStrategy authorization strategy
 	 * @param grantingStrategy the {@code PermissionGrantingStrategy} which will be used
 	 * by the {@code isGranted()} method
-	 * @param parentAcl the parent (may be may be {@code null})
-	 * @param loadedSids the loaded SIDs if only a subset were loaded (may be {@code null}
-	 * )
+	 * @param parentAcl the parent (may be {@code null})
+	 * @param loadedSids the loaded SIDs if only a subset were loaded (may be
+	 * {@code null})
 	 * @param entriesInheriting if ACEs from the parent should inherit into this ACL
 	 * @param owner the owner (required)
 	 */
@@ -141,7 +141,7 @@ public class BasicLookupStrategy implements LookupStrategy {
 	private AclClassIdUtils aclClassIdUtils;

 	/**
-	 * Constructor accepting mandatory arguments
+	 * Constructor accepting mandatory arguments.
 	 * @param dataSource to access the database
 	 * @param aclCache the cache where fully-loaded elements can be stored
 	 * @param aclAuthorizationStrategy authorization strategy (required)
@@ -152,7 +152,7 @@ public class BasicLookupStrategy implements LookupStrategy {
 	}

 	/**
-	 * Creates a new instance
+	 * Creates a new instance.
 	 * @param dataSource to access the database
 	 * @param aclCache the cache where fully-loaded elements can be stored
 	 * @param aclAuthorizationStrategy authorization strategy (required)
@@ -565,7 +565,7 @@ public class BasicLookupStrategy implements LookupStrategy {

 		/**
 		 * Accepts the current <code>ResultSet</code> row, and converts it into an
-		 * <code>AclImpl</code> that contains a <code>StubAclParent</code>
+		 * <code>AclImpl</code> that contains a <code>StubAclParent</code>.
 		 * @param acls the Map we should add the converted Acl to
 		 * @param rs the ResultSet focused on a current row
 		 * @throws SQLException if something goes wrong converting values
@@ -479,6 +479,7 @@ public class JdbcMutableAclService extends JdbcAclService implements MutableAclS
 	}

 	/**
+	 * Sets whether the database enforces foreign key constraints.
 	 * @param foreignKeysInDatabase if false this class will perform additional FK
 	 * constrain checking, which may cause deadlocks (the default is true, so deadlocks
 	 * are avoided but the database is expected to enforce FKs)
@@ -15,7 +15,7 @@
 */

 /**
- * JDBC-based persistence of ACL information
+ * JDBC-based persistence of ACL information.
 */
@NullMarked
 package org.springframework.security.acls.jdbc;
@@ -37,6 +37,7 @@ import org.jspecify.annotations.Nullable;
 public interface ObjectIdentity extends Serializable {

 	/**
+	 * Compares this <tt>ObjectIdentity</tt> to the given object for equality.
 	 * @param obj to be compared
 	 * @return <tt>true</tt> if the objects are equal, <tt>false</tt> otherwise
 	 * @see Object#equals(Object)
@@ -67,6 +68,7 @@ public interface ObjectIdentity extends Serializable {
 	String getType();

 	/**
+	 * Returns a hash code representation of the <tt>ObjectIdentity</tt>.
 	 * @return a hash code representation of the <tt>ObjectIdentity</tt>
 	 * @see Object#hashCode()
 	 */
@@ -31,6 +31,8 @@ import java.io.Serializable;
 public interface ObjectIdentityGenerator {

 	/**
+	 * Creates an {@link ObjectIdentity} using the supplied identifier and type
+	 * information.
 	 * @param id the identifier of the domain object, not null
 	 * @param type the type of the object (often a class name), not null
 	 * @return the identity constructed using the supplied identifier and type
@@ -18,7 +18,7 @@ package org.springframework.security.acls.model;

 /**
 * Strategy interface that provides the ability to determine which {@link ObjectIdentity}
- * will be returned for a particular domain object
+ * will be returned for a particular domain object.
 *
 * @author Ben Alex
 */
@@ -27,7 +27,6 @@ apply plugin: 'org.jetbrains.kotlin.jvm'
 apply plugin: 'org.springframework.security.versions.verify-dependencies-versions'
 apply plugin: 'org.springframework.security.check-expected-branch-version'
 apply plugin: 'io.spring.security.release'
-apply from: 'commercial-settings.gradle'

 group = 'org.springframework.security'
 description = 'Spring Security'
@@ -42,12 +41,10 @@ repositories {
 }

 springRelease {
-	repositoryOwner = "spring-projects"
-	repositoryName = "spring-security-commercial"
 	weekOfMonth = 3
 	dayOfWeek = 1
-	referenceDocUrl = "https://docs.spring.vmware.com/spring-security/reference/{version}/index.html"
-	apiDocUrl = "https://docs.spring.vmware.com/spring-security/reference/{version}/api/java/index.html"
+	referenceDocUrl = "https://docs.spring.io/spring-security/reference/{version}/index.html"
+	apiDocUrl = "https://docs.spring.io/spring-security/reference/{version}/api/java/index.html"
 	replaceSnapshotVersionInReferenceDocUrl = true
 }

@@ -75,6 +72,12 @@ allprojects {
 	}
 }

+develocity {
+	buildScan {
+		termsOfUseUrl = 'https://gradle.com/help/legal-terms-of-use'
+		termsOfUseAgree = 'yes'
+	}
+}

 nohttp {
 	source.exclude "buildSrc/build/**", "**/build/**", "**/target/**", "javascript/.gradle/**", "javascript/package-lock.json", "javascript/node_modules/**", "javascript/build/**", "javascript/dist/**"
@@ -13,16 +13,7 @@ java {
 repositories {
 	gradlePluginPortal()
 	mavenCentral()
-	if (project.hasProperty("artifactoryUsername") && project.hasProperty("artifactoryPassword")) {
-		maven {
-			name "spring-commercial-release"
-			url "https://usw1.packages.broadcom.com/spring-enterprise-maven-prod-local"
-			credentials {
-				username project.artifactoryUsername
-				password project.artifactoryPassword
-			}
-		}
-	}
+	maven { url = 'https://repo.spring.io/snapshot' }
 	if (System.getenv("RELEASE_TRAIN_MAVEN_REPOSITORY_URL") != null) {
 		maven {
 			name = "Release Train"
@@ -72,7 +72,7 @@ public class CasAuthenticationToken extends AbstractAuthenticationToken implemen
 	}

 	/**
-	 * Private constructor for Jackson Deserialization support
+	 * Private constructor for Jackson Deserialization support.
 	 * @param keyHash hashCode of provided key to identify if this object made by a given
 	 * {@link CasAuthenticationProvider}
 	 * @param principal typically the UserDetails object (cannot be <code>null</code>)
@@ -182,7 +182,7 @@ public class CasAuthenticationToken extends AbstractAuthenticationToken implemen
 	}

 	/**
-	 * A builder of {@link CasAuthenticationToken} instances
+	 * A builder of {@link CasAuthenticationToken} instances.
 	 *
 	 * @since 7.0
 	 */
@@ -208,7 +208,7 @@ public class CasAuthenticationToken extends AbstractAuthenticationToken implemen
 		}

 		/**
-		 * Use this key
+		 * Use this key.
 		 * @param key the key to use
 		 * @return the {@link Builder} for further configurations
 		 */
@@ -232,7 +232,7 @@ public class CasAuthenticationToken extends AbstractAuthenticationToken implemen
 		}

 		/**
-		 * Use this {@link UserDetails}
+		 * Use this {@link UserDetails}.
 		 * @param userDetails the {@link UserDetails} to use
 		 * @return the {@link Builder} for further configurations
 		 */
@@ -242,7 +242,7 @@ public class CasAuthenticationToken extends AbstractAuthenticationToken implemen
 		}

 		/**
-		 * Use this {@link Assertion}
+		 * Use this {@link Assertion}.
 		 * @param assertion the {@link Assertion} to use
 		 * @return the {@link Builder} for further configurations
 		 */
@@ -121,7 +121,7 @@ public class CasServiceTicketAuthenticationToken extends AbstractAuthenticationT
 	}

 	/**
-	 * A builder of {@link CasServiceTicketAuthenticationToken} instances
+	 * A builder of {@link CasServiceTicketAuthenticationToken} instances.
 	 *
 	 * @since 7.0
 	 */
@@ -32,6 +32,7 @@ import org.jspecify.annotations.Nullable;
 public final class NullStatelessTicketCache implements StatelessTicketCache {

 	/**
+	 * Always returns {@code null} since tickets are not stored.
 	 * @return null since we are not storing any tickets.
 	 */
 	@Override
@@ -20,9 +20,11 @@ import java.util.Date;
 import java.util.Map;

 import com.fasterxml.jackson.annotation.JsonAutoDetect;
+import com.fasterxml.jackson.annotation.JsonAutoDetect.Visibility;
 import com.fasterxml.jackson.annotation.JsonCreator;
 import com.fasterxml.jackson.annotation.JsonProperty;
 import com.fasterxml.jackson.annotation.JsonTypeInfo;
+import com.fasterxml.jackson.annotation.JsonTypeInfo.Id;
 import org.apereo.cas.client.authentication.AttributePrincipal;

 /**
@@ -36,14 +38,14 @@ import org.apereo.cas.client.authentication.AttributePrincipal;
 * @see CasJacksonModule
 * @see org.springframework.security.jackson.SecurityJacksonModules
 */
-@JsonTypeInfo(use = JsonTypeInfo.Id.CLASS)
-@JsonAutoDetect(fieldVisibility = JsonAutoDetect.Visibility.ANY, getterVisibility = JsonAutoDetect.Visibility.NONE,
-		isGetterVisibility = JsonAutoDetect.Visibility.NONE)
+@JsonTypeInfo(use = Id.CLASS)
+@JsonAutoDetect(fieldVisibility = Visibility.ANY, getterVisibility = Visibility.NONE,
+		isGetterVisibility = Visibility.NONE)
 class AssertionImplMixin {

 	/**
 	 * Mixin Constructor helps in deserialize
-	 * {@link org.apereo.cas.client.validation.AssertionImpl}
+	 * {@link org.apereo.cas.client.validation.AssertionImpl}.
 	 * @param principal the Principal to associate with the Assertion.
 	 * @param validFromDate when the assertion is valid from.
 	 * @param validUntilDate when the assertion is valid to.
@@ -19,9 +19,11 @@ package org.springframework.security.cas.jackson;
 import java.util.Map;

 import com.fasterxml.jackson.annotation.JsonAutoDetect;
+import com.fasterxml.jackson.annotation.JsonAutoDetect.Visibility;
 import com.fasterxml.jackson.annotation.JsonCreator;
 import com.fasterxml.jackson.annotation.JsonProperty;
 import com.fasterxml.jackson.annotation.JsonTypeInfo;
+import com.fasterxml.jackson.annotation.JsonTypeInfo.Id;
 import org.apereo.cas.client.proxy.ProxyRetriever;

 /**
@@ -35,14 +37,14 @@ import org.apereo.cas.client.proxy.ProxyRetriever;
 * @see CasJacksonModule
 * @see org.springframework.security.jackson.SecurityJacksonModules
 */
-@JsonTypeInfo(use = JsonTypeInfo.Id.CLASS)
-@JsonAutoDetect(fieldVisibility = JsonAutoDetect.Visibility.ANY, getterVisibility = JsonAutoDetect.Visibility.NONE,
-		isGetterVisibility = JsonAutoDetect.Visibility.NONE)
+@JsonTypeInfo(use = Id.CLASS)
+@JsonAutoDetect(fieldVisibility = Visibility.ANY, getterVisibility = Visibility.NONE,
+		isGetterVisibility = Visibility.NONE)
 class AttributePrincipalImplMixin {

 	/**
 	 * Mixin Constructor helps in deserialize
-	 * {@link org.apereo.cas.client.authentication.AttributePrincipalImpl}
+	 * {@link org.apereo.cas.client.authentication.AttributePrincipalImpl}.
 	 * @param name the unique identifier for the principal.
 	 * @param attributes the key/value pairs for this principal.
 	 * @param proxyGrantingTicket the ticket associated with this principal.
@@ -19,9 +19,11 @@ package org.springframework.security.cas.jackson;
 import java.util.Collection;

 import com.fasterxml.jackson.annotation.JsonAutoDetect;
+import com.fasterxml.jackson.annotation.JsonAutoDetect.Visibility;
 import com.fasterxml.jackson.annotation.JsonCreator;
 import com.fasterxml.jackson.annotation.JsonProperty;
 import com.fasterxml.jackson.annotation.JsonTypeInfo;
+import com.fasterxml.jackson.annotation.JsonTypeInfo.Id;
 import org.apereo.cas.client.validation.Assertion;

 import org.springframework.security.cas.authentication.CasAuthenticationProvider;
@@ -38,13 +40,13 @@ import org.springframework.security.core.userdetails.UserDetails;
 * @see CasJacksonModule
 * @see org.springframework.security.jackson.SecurityJacksonModules
 */
-@JsonTypeInfo(use = JsonTypeInfo.Id.CLASS)
-@JsonAutoDetect(fieldVisibility = JsonAutoDetect.Visibility.ANY, isGetterVisibility = JsonAutoDetect.Visibility.NONE,
-		getterVisibility = JsonAutoDetect.Visibility.NONE, creatorVisibility = JsonAutoDetect.Visibility.ANY)
+@JsonTypeInfo(use = Id.CLASS)
+@JsonAutoDetect(fieldVisibility = Visibility.ANY, isGetterVisibility = Visibility.NONE,
+		getterVisibility = Visibility.NONE, creatorVisibility = Visibility.ANY)
 class CasAuthenticationTokenMixin {

 	/**
-	 * Mixin Constructor helps in deserialize {@link CasAuthenticationToken}
+	 * Mixin Constructor helps in deserialize {@link CasAuthenticationToken}.
 	 * @param keyHash hashCode of provided key to identify if this object made by a given
 	 * {@link CasAuthenticationProvider}
 	 * @param principal typically the UserDetails object (cannot be <code>null</code>)
@@ -20,10 +20,13 @@ import java.util.Date;
 import java.util.Map;

 import com.fasterxml.jackson.annotation.JsonAutoDetect;
+import com.fasterxml.jackson.annotation.JsonAutoDetect.Visibility;
 import com.fasterxml.jackson.annotation.JsonCreator;
 import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
 import com.fasterxml.jackson.annotation.JsonProperty;
 import com.fasterxml.jackson.annotation.JsonTypeInfo;
+import com.fasterxml.jackson.annotation.JsonTypeInfo.As;
+import com.fasterxml.jackson.annotation.JsonTypeInfo.Id;
 import org.apereo.cas.client.authentication.AttributePrincipal;

 /**
@@ -49,15 +52,15 @@ import org.apereo.cas.client.authentication.AttributePrincipal;
 */
@SuppressWarnings("removal")
@Deprecated(forRemoval = true)
-@JsonTypeInfo(use = JsonTypeInfo.Id.CLASS, include = JsonTypeInfo.As.PROPERTY)
-@JsonAutoDetect(fieldVisibility = JsonAutoDetect.Visibility.ANY, getterVisibility = JsonAutoDetect.Visibility.NONE,
-		isGetterVisibility = JsonAutoDetect.Visibility.NONE)
+@JsonTypeInfo(use = Id.CLASS, include = As.PROPERTY)
+@JsonAutoDetect(fieldVisibility = Visibility.ANY, getterVisibility = Visibility.NONE,
+		isGetterVisibility = Visibility.NONE)
@JsonIgnoreProperties(ignoreUnknown = true)
 class AssertionImplMixin {

 	/**
 	 * Mixin Constructor helps in deserialize
-	 * {@link org.apereo.cas.client.validation.AssertionImpl}
+	 * {@link org.apereo.cas.client.validation.AssertionImpl}.
 	 * @param principal the Principal to associate with the Assertion.
 	 * @param validFromDate when the assertion is valid from.
 	 * @param validUntilDate when the assertion is valid to.
@@ -19,10 +19,13 @@ package org.springframework.security.cas.jackson2;
 import java.util.Map;

 import com.fasterxml.jackson.annotation.JsonAutoDetect;
+import com.fasterxml.jackson.annotation.JsonAutoDetect.Visibility;
 import com.fasterxml.jackson.annotation.JsonCreator;
 import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
 import com.fasterxml.jackson.annotation.JsonProperty;
 import com.fasterxml.jackson.annotation.JsonTypeInfo;
+import com.fasterxml.jackson.annotation.JsonTypeInfo.As;
+import com.fasterxml.jackson.annotation.JsonTypeInfo.Id;
 import org.apereo.cas.client.proxy.ProxyRetriever;

 /**
@@ -47,15 +50,15 @@ import org.apereo.cas.client.proxy.ProxyRetriever;
 */
@SuppressWarnings("removal")
@Deprecated(forRemoval = true)
-@JsonTypeInfo(use = JsonTypeInfo.Id.CLASS, include = JsonTypeInfo.As.PROPERTY)
-@JsonAutoDetect(fieldVisibility = JsonAutoDetect.Visibility.ANY, getterVisibility = JsonAutoDetect.Visibility.NONE,
-		isGetterVisibility = JsonAutoDetect.Visibility.NONE)
+@JsonTypeInfo(use = Id.CLASS, include = As.PROPERTY)
+@JsonAutoDetect(fieldVisibility = Visibility.ANY, getterVisibility = Visibility.NONE,
+		isGetterVisibility = Visibility.NONE)
@JsonIgnoreProperties(ignoreUnknown = true)
 class AttributePrincipalImplMixin {

 	/**
 	 * Mixin Constructor helps in deserialize
-	 * {@link org.apereo.cas.client.authentication.AttributePrincipalImpl}
+	 * {@link org.apereo.cas.client.authentication.AttributePrincipalImpl}.
 	 * @param name the unique identifier for the principal.
 	 * @param attributes the key/value pairs for this principal.
 	 * @param proxyGrantingTicket the ticket associated with this principal.
@@ -19,10 +19,13 @@ package org.springframework.security.cas.jackson2;
 import java.util.Collection;

 import com.fasterxml.jackson.annotation.JsonAutoDetect;
+import com.fasterxml.jackson.annotation.JsonAutoDetect.Visibility;
 import com.fasterxml.jackson.annotation.JsonCreator;
 import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
 import com.fasterxml.jackson.annotation.JsonProperty;
 import com.fasterxml.jackson.annotation.JsonTypeInfo;
+import com.fasterxml.jackson.annotation.JsonTypeInfo.As;
+import com.fasterxml.jackson.annotation.JsonTypeInfo.Id;
 import org.apereo.cas.client.validation.Assertion;

 import org.springframework.security.cas.authentication.CasAuthenticationProvider;
@@ -55,14 +58,14 @@ import org.springframework.security.core.userdetails.UserDetails;
 */
@SuppressWarnings("removal")
@Deprecated(forRemoval = true)
-@JsonTypeInfo(use = JsonTypeInfo.Id.CLASS, include = JsonTypeInfo.As.PROPERTY)
-@JsonAutoDetect(fieldVisibility = JsonAutoDetect.Visibility.ANY, isGetterVisibility = JsonAutoDetect.Visibility.NONE,
-		getterVisibility = JsonAutoDetect.Visibility.NONE, creatorVisibility = JsonAutoDetect.Visibility.ANY)
+@JsonTypeInfo(use = Id.CLASS, include = As.PROPERTY)
+@JsonAutoDetect(fieldVisibility = Visibility.ANY, isGetterVisibility = Visibility.NONE,
+		getterVisibility = Visibility.NONE, creatorVisibility = Visibility.ANY)
@JsonIgnoreProperties(ignoreUnknown = true)
 class CasAuthenticationTokenMixin {

 	/**
-	 * Mixin Constructor helps in deserialize {@link CasAuthenticationToken}
+	 * Mixin Constructor helps in deserialize {@link CasAuthenticationToken}.
 	 * @param keyHash hashCode of provided key to identify if this object made by a given
 	 * {@link CasAuthenticationProvider}
 	 * @param principal typically the UserDetails object (cannot be <code>null</code>)
@@ -155,7 +155,7 @@ public class CasAuthenticationEntryPoint implements AuthenticationEntryPoint, In
 	}

 	/**
-	 * Sets the {@link RedirectStrategy} to use
+	 * Sets the {@link RedirectStrategy} to use.
 	 * @param redirectStrategy the {@link RedirectStrategy} to use
 	 * @since 6.3
 	 */
@@ -69,7 +69,7 @@ public final class CasGatewayAuthenticationRedirectFilter extends GenericFilterB
 	private RedirectStrategy redirectStrategy = new DefaultRedirectStrategy();

 	/**
-	 * Constructs a new instance of this class
+	 * Constructs a new instance of this class.
 	 * @param serviceProperties the {@link ServiceProperties}
 	 */
 	public CasGatewayAuthenticationRedirectFilter(String casLoginUrl, ServiceProperties serviceProperties) {
@@ -44,7 +44,7 @@ final class DefaultServiceAuthenticationDetails extends WebAuthenticationDetails
 	private final String serviceUrl;

 	/**
-	 * Creates a new instance
+	 * Creates a new instance.
 	 * @param request the current {@link HttpServletRequest} to obtain the
 	 * {@link #getServiceUrl()} from.
 	 * @param artifactPattern the {@link Pattern} that will be used to clean up the query
@@ -53,7 +53,7 @@ public class ServiceAuthenticationDetailsSource
 	}

 	/**
-	 * Creates an implementation that uses the specified artifactParameterName
+	 * Creates an implementation that uses the specified artifactParameterName.
 	 * @param serviceProperties The ServiceProperties to use to construct the serviceUrl.
 	 * @param artifactParameterName the artifactParameterName that is removed from the
 	 * current URL. The result becomes the service url. Cannot be null and cannot be an
@@ -66,6 +66,7 @@ public class ServiceAuthenticationDetailsSource
 	}

 	/**
+	 * Builds the {@code ServiceAuthenticationDetails} from the given request.
 	 * @param context the {@code HttpServletRequest} object.
 	 * @return the {@code ServiceAuthenticationDetails} containing information about the
 	 * current request
@@ -1,27 +0,0 @@
-subprojects {
-	repositories {
-		mavenCentral()
-		def repoUsername = project.findProperty("artifactoryUsername") ?: System.getenv("COMMERCIAL_REPO_USERNAME")
-		def repoPassword = project.findProperty("artifactoryPassword") ?: System.getenv("COMMERCIAL_REPO_PASSWORD")
-		if (repoUsername && repoPassword) {
-			maven {
-				name "spring-commercial-release"
-				url "https://usw1.packages.broadcom.com/spring-enterprise-maven-prod-local"
-				credentials {
-					username repoUsername
-					password repoPassword
-				}
-			}
-			if ("$version".endsWith("-SNAPSHOT")) {
-				maven {
-					name "spring-commercial-snapshot"
-					url "https://usw1.packages.broadcom.com/spring-enterprise-maven-dev-local"
-					credentials {
-						username repoUsername
-						password repoPassword
-					}
-				}
-			}
-		}
-	}
-}
@@ -25,6 +25,8 @@ import org.springframework.security.ldap.userdetails.LdapAuthoritiesPopulator;
 import org.springframework.security.ldap.userdetails.PersonContextMapper;

 /**
+ * Test configurations for namespace-based LDAP {@code AuthenticationProvider} setup.
+ *
 * @author Rob Winch
 *
 */
@@ -50,6 +50,8 @@ import static org.assertj.core.api.Assertions.assertThat;
 import static org.assertj.core.api.Assertions.assertThatExceptionOfType;

 /**
+ * Integration tests for anonymous authentication over RSocket.
+ *
 * @author Andrey Litvitski
 */
@ContextConfiguration
@@ -50,6 +50,8 @@ import static org.assertj.core.api.Assertions.assertThat;
 import static org.assertj.core.api.Assertions.assertThatExceptionOfType;

 /**
+ * Integration tests for securing RSocket requests and responses.
+ *
 * @author Rob Winch
 */
@ContextConfiguration
@@ -60,6 +60,8 @@ import static org.mockito.Mockito.times;
 import static org.mockito.Mockito.verify;

 /**
+ * Integration tests for RSocket security observations.
+ *
 * @author Rob Winch
 */
@ContextConfiguration
@@ -50,6 +50,8 @@ import static org.assertj.core.api.Assertions.assertThat;
 import static org.assertj.core.api.Assertions.assertThatExceptionOfType;

 /**
+ * Integration tests for RSocket security combined with WebFlux security.
+ *
 * @author Rob Winch
 */
@ContextConfiguration
@@ -59,6 +59,8 @@ import static org.mockito.BDDMockito.given;
 import static org.mockito.Mockito.mock;

 /**
+ * Integration tests for RSocket JWT authentication.
+ *
 * @author Rob Winch
 */
@ContextConfiguration
@@ -53,6 +53,8 @@ import static org.assertj.core.api.Assertions.assertThat;
 import static org.assertj.core.api.Assertions.assertThatExceptionOfType;

 /**
+ * Integration tests for connecting to an {@link RSocketMessageHandler} secured server.
+ *
 * @author Rob Winch
 * @author Luis Felipe Vega
 * @author Jesús Ascama Arias
@@ -55,6 +55,8 @@ import static org.assertj.core.api.Assertions.assertThat;
 import static org.assertj.core.api.Assertions.assertThatExceptionOfType;

 /**
+ * Integration tests for securing an {@link RSocketMessageHandler}.
+ *
 * @author Rob Winch
 */
@ContextConfiguration
@@ -55,6 +55,8 @@ import static org.assertj.core.api.Assertions.assertThat;
 import static org.assertj.core.api.Assertions.assertThatExceptionOfType;

 /**
+ * Integration tests for securing RSocket requests using simple authentication metadata.
+ *
 * @author Rob Winch
 */
@ContextConfiguration
@@ -32,6 +32,8 @@ import org.springframework.test.util.ReflectionTestUtils;
 import static org.assertj.core.api.Assertions.assertThat;

 /**
+ * Tests for the {@code ldap-server} XML namespace element.
+ *
 * @author Luke Taylor
 * @author Rob Winch
 */
@@ -39,6 +39,8 @@ import static org.assertj.core.api.Assertions.assertThat;
 import static org.mockito.Mockito.mock;

 /**
+ * Tests for the {@code ldap-user-service} bean definition parser.
+ *
 * @author Luke Taylor
 * @author Rob Winch
 * @author Eddú Meléndez
@@ -31,7 +31,7 @@ public abstract class BeanIds {

 	/**
 	 * The "global" AuthenticationManager instance, registered by the
-	 * &lt;authentication-manager&gt; element
+	 * &lt;authentication-manager&gt; element.
 	 */
 	public static final String AUTHENTICATION_MANAGER = PREFIX + "authenticationManager";

@@ -25,6 +25,9 @@ import org.springframework.beans.factory.xml.ParserContext;
 import org.springframework.security.config.debug.SecurityDebugBeanFactoryPostProcessor;

 /**
+ * Parses the {@code debug} element to register a
+ * {@link SecurityDebugBeanFactoryPostProcessor}.
+ *
 * @author Luke Taylor
 */
 public class DebugBeanDefinitionParser implements BeanDefinitionParser {
@@ -187,7 +187,7 @@ public abstract class AbstractConfiguredSecurityBuilder<O, B extends SecurityBui
 	}

 	/**
-	 * Gets the shared objects
+	 * Gets the shared objects.
 	 * @return the shared Objects
 	 */
 	public Map<Class<?>, Object> getSharedObjects() {
@@ -315,7 +315,7 @@ public abstract class AbstractConfiguredSecurityBuilder<O, B extends SecurityBui

 	/**
 	 * Executes the build using the {@link SecurityConfigurer}'s that have been applied
-	 * using the following steps:
+	 * using the following steps:.
 	 *
 	 * <ul>
 	 * <li>Invokes {@link #beforeInit()} for any subclass to hook into</li>
@@ -406,7 +406,7 @@ public abstract class AbstractConfiguredSecurityBuilder<O, B extends SecurityBui
 	}

 	/**
-	 * The build state for the application
+	 * The build state for the application.
 	 *
 	 * @author Rob Winch
 	 * @since 3.2
@@ -414,7 +414,7 @@ public abstract class AbstractConfiguredSecurityBuilder<O, B extends SecurityBui
 	private enum BuildState {

 		/**
-		 * This is the state before the {@link SecurityBuilder#build()} is invoked
+		 * This is the state before the {@link SecurityBuilder#build()} is invoked.
 		 */
 		UNBUILT(0),

@@ -455,7 +455,7 @@ public abstract class AbstractConfiguredSecurityBuilder<O, B extends SecurityBui
 		}

 		/**
-		 * Determines if the state is CONFIGURING or later
+		 * Determines if the state is CONFIGURING or later.
 		 * @return
 		 */
 		public boolean isConfigured() {
@@ -17,7 +17,7 @@
 package org.springframework.security.config.annotation;

 /**
- * Interface for building an Object
+ * Interface for building an Object.
 *
 * @param <O> The type of the Object being built
 * @author Rob Winch
@@ -115,7 +115,7 @@ public abstract class SecurityConfigurerAdapter<O, B extends SecurityBuilder<O>>
 		}

 		/**
-		 * Adds an {@link ObjectPostProcessor} to use
+		 * Adds an {@link ObjectPostProcessor} to use.
 		 * @param objectPostProcessor the {@link ObjectPostProcessor} to add
 		 * @return true if the {@link ObjectPostProcessor} was added, else false
 		 */
@@ -22,7 +22,7 @@ import org.springframework.security.authentication.ProviderManager;
 import org.springframework.security.config.annotation.SecurityBuilder;

 /**
- * Interface for operating on a SecurityBuilder that creates a {@link ProviderManager}
+ * Interface for operating on a SecurityBuilder that creates a {@link ProviderManager}.
 *
 * @param <B> the type of the {@link SecurityBuilder}
 * @author Rob Winch
@@ -66,7 +66,7 @@ public class AuthenticationManagerBuilder
 	private AuthenticationEventPublisher eventPublisher;

 	/**
-	 * Creates a new instance
+	 * Creates a new instance.
 	 * @param objectPostProcessor the {@link ObjectPostProcessor} instance to use.
 	 */
 	public AuthenticationManagerBuilder(ObjectPostProcessor<Object> objectPostProcessor) {
@@ -92,7 +92,7 @@ public class AuthenticationManagerBuilder
 	}

 	/**
-	 * Sets the {@link AuthenticationEventPublisher}
+	 * Sets the {@link AuthenticationEventPublisher}.
 	 * @param eventPublisher the {@link AuthenticationEventPublisher} to use
 	 * @return the {@link AuthenticationManagerBuilder} for further customizations
 	 */
@@ -103,6 +103,7 @@ public class AuthenticationManagerBuilder
 	}

 	/**
+	 * Sets whether the {@link AuthenticationManager} should clear the credentials.
 	 * @param eraseCredentials true if {@link AuthenticationManager} should clear the
 	 * credentials from the {@link Authentication} object after authenticating
 	 * @return the {@link AuthenticationManagerBuilder} for further customizations
@@ -54,7 +54,7 @@ import org.springframework.security.crypto.password.PasswordEncoder;
 import org.springframework.util.Assert;

 /**
- * Exports the authentication {@link Configuration}
+ * Exports the authentication {@link Configuration}.
 *
 * @author Rob Winch
 * @author Ngoc Nhan
@@ -265,7 +265,7 @@ public class AuthenticationConfiguration {
 		private PasswordEncoder defaultPasswordEncoder;

 		/**
-		 * Creates a new instance
+		 * Creates a new instance.
 		 * @param objectPostProcessor the {@link ObjectPostProcessor} instance to use.
 		 */
 		DefaultPasswordEncoderAuthenticationManagerBuilder(ObjectPostProcessor<Object> objectPostProcessor,
@@ -42,6 +42,7 @@ class InitializeAuthenticationProviderBeanManagerConfigurer extends GlobalAuthen
 	private final ApplicationContext context;

 	/**
+	 * Creates a new instance.
 	 * @param context the ApplicationContext to look up beans.
 	 */
 	InitializeAuthenticationProviderBeanManagerConfigurer(ApplicationContext context) {
@@ -49,6 +49,7 @@ class InitializeUserDetailsBeanManagerConfigurer extends GlobalAuthenticationCon
 	private final ApplicationContext context;

 	/**
+	 * Creates a new instance using the given {@link ApplicationContext}.
 	 * @param context
 	 */
 	InitializeUserDetailsBeanManagerConfigurer(ApplicationContext context) {
@@ -112,6 +113,8 @@ class InitializeUserDetailsBeanManagerConfigurer extends GlobalAuthenticationCon
 		}

 		/**
+		 * Returns a bean of the requested class if there's just a single registered
+		 * component, null otherwise.
 		 * @return a bean of the requested class if there's just a single registered
 		 * component, null otherwise.
 		 */
@@ -136,7 +136,7 @@ public class LdapAuthenticationProviderConfigurer<B extends ProviderManagerBuild

 	/**
 	 * Gets the {@link LdapAuthoritiesPopulator} and defaults to
-	 * {@link DefaultLdapAuthoritiesPopulator}
+	 * {@link DefaultLdapAuthoritiesPopulator}.
 	 * @return the {@link LdapAuthoritiesPopulator}
 	 */
 	private LdapAuthoritiesPopulator getLdapAuthoritiesPopulator() {
@@ -185,7 +185,7 @@ public class LdapAuthenticationProviderConfigurer<B extends ProviderManagerBuild
 	}

 	/**
-	 * Creates the {@link LdapAuthenticator} to use
+	 * Creates the {@link LdapAuthenticator} to use.
 	 * @param contextSource the {@link BaseLdapPathContextSource} to use
 	 * @return the {@link LdapAuthenticator} to use
 	 */
@@ -203,7 +203,7 @@ public class LdapAuthenticationProviderConfigurer<B extends ProviderManagerBuild
 	}

 	/**
-	 * Creates {@link PasswordComparisonAuthenticator}
+	 * Creates {@link PasswordComparisonAuthenticator}.
 	 * @param contextSource the {@link BaseLdapPathContextSource} to use
 	 * @return
 	 */
@@ -218,7 +218,7 @@ public class LdapAuthenticationProviderConfigurer<B extends ProviderManagerBuild
 	}

 	/**
-	 * Creates a {@link BindAuthenticator}
+	 * Creates a {@link BindAuthenticator}.
 	 * @param contextSource the {@link BaseLdapPathContextSource} to use
 	 * @return the {@link BindAuthenticator} to use
 	 */
@@ -395,6 +395,7 @@ public class LdapAuthenticationProviderConfigurer<B extends ProviderManagerBuild
 	}

 	/**
+	 * Enables password-based comparison for authentication.
 	 * @return the {@link PasswordCompareConfigurer} for further customizations
 	 */
 	public PasswordCompareConfigurer passwordCompare() {
@@ -403,7 +404,7 @@ public class LdapAuthenticationProviderConfigurer<B extends ProviderManagerBuild
 	}

 	/**
-	 * Sets up Password based comparison
+	 * Sets up Password based comparison.
 	 *
 	 * @author Rob Winch
 	 */
@@ -434,7 +435,7 @@ public class LdapAuthenticationProviderConfigurer<B extends ProviderManagerBuild

 		/**
 		 * Allows obtaining a reference to the
-		 * {@link LdapAuthenticationProviderConfigurer} for further customizations
+		 * {@link LdapAuthenticationProviderConfigurer} for further customizations.
 		 * @return attribute in the directory which contains the user password
 		 */
 		public LdapAuthenticationProviderConfigurer<B> and() {
@@ -547,7 +548,7 @@ public class LdapAuthenticationProviderConfigurer<B extends ProviderManagerBuild

 		/**
 		 * Gets the {@link LdapAuthenticationProviderConfigurer} for further
-		 * customizations
+		 * customizations.
 		 * @return the {@link LdapAuthenticationProviderConfigurer} for further
 		 * customizations
 		 */
@@ -35,7 +35,7 @@ public class InMemoryUserDetailsManagerConfigurer<B extends ProviderManagerBuild
 		extends UserDetailsManagerConfigurer<B, InMemoryUserDetailsManagerConfigurer<B>> {

 	/**
-	 * Creates a new instance
+	 * Creates a new instance.
 	 */
 	public InMemoryUserDetailsManagerConfigurer() {
 		super(new InMemoryUserDetailsManager(new ArrayList<>()));
@@ -140,7 +140,7 @@ public class JdbcUserDetailsManagerConfigurer<B extends ProviderManagerBuilder<B
 	}

 	/**
-	 * Defines the {@link UserCache} to use
+	 * Defines the {@link UserCache} to use.
 	 * @param userCache the {@link UserCache} to use
 	 * @return the {@link JdbcUserDetailsManagerConfigurer} for further customizations
 	 */
@@ -103,7 +103,7 @@ public class UserDetailsManagerConfigurer<B extends ProviderManagerBuilder<B>, C

 	/**
 	 * Builds the user to be added. At minimum the username, password, and authorities
-	 * should provided. The remaining attributes have reasonable defaults.
+	 * should be provided. The remaining attributes have reasonable defaults.
 	 */
 	public final class UserDetailsBuilder {

@@ -112,7 +112,7 @@ public class UserDetailsManagerConfigurer<B extends ProviderManagerBuilder<B>, C
 		private final C builder;

 		/**
-		 * Creates a new instance
+		 * Creates a new instance.
 		 * @param builder the builder to return
 		 */
 		private UserDetailsBuilder(C builder) {
@@ -25,7 +25,7 @@ import org.springframework.security.core.userdetails.UserDetailsService;
 import org.springframework.security.crypto.password.PasswordEncoder;

 /**
- * Allows configuring a {@link DaoAuthenticationProvider}
+ * Allows configuring a {@link DaoAuthenticationProvider}.
 *
 * @param <B> the type of the {@link SecurityBuilder}
 * @param <C> the type of {@link AbstractDaoAuthenticationConfigurer} this is
@@ -41,7 +41,7 @@ public abstract class AbstractDaoAuthenticationConfigurer<B extends ProviderMana
 	private final U userDetailsService;

 	/**
-	 * Creates a new instance
+	 * Creates a new instance.
 	 * @param userDetailsService
 	 */
 	AbstractDaoAuthenticationConfigurer(U userDetailsService) {
@@ -88,7 +88,7 @@ public abstract class AbstractDaoAuthenticationConfigurer<B extends ProviderMana

 	/**
 	 * Gets the {@link UserDetailsService} that is used with the
-	 * {@link DaoAuthenticationProvider}
+	 * {@link DaoAuthenticationProvider}.
 	 * @return the {@link UserDetailsService} that is used with the
 	 * {@link DaoAuthenticationProvider}
 	 */
@@ -21,7 +21,7 @@ import org.springframework.security.config.annotation.authentication.ProviderMan
 import org.springframework.security.core.userdetails.UserDetailsService;

 /**
- * Allows configuring a {@link DaoAuthenticationProvider}
+ * Allows configuring a {@link DaoAuthenticationProvider}.
 *
 * @param <B> The type of {@link ProviderManagerBuilder} this is
 * @param <U> The type of {@link UserDetailsService} that is being used
@@ -32,7 +32,7 @@ public class DaoAuthenticationConfigurer<B extends ProviderManagerBuilder<B>, U
 		extends AbstractDaoAuthenticationConfigurer<B, DaoAuthenticationConfigurer<B, U>, U> {

 	/**
-	 * Creates a new instance
+	 * Creates a new instance.
 	 * @param userDetailsService
 	 */
 	public DaoAuthenticationConfigurer(U userDetailsService) {
@@ -34,7 +34,7 @@ public abstract class UserDetailsAwareConfigurer<B extends ProviderManagerBuilde
 		extends SecurityConfigurerAdapter<AuthenticationManager, B> {

 	/**
-	 * Gets the {@link UserDetailsService} or null if it is not available
+	 * Gets the {@link UserDetailsService} or null if it is not available.
 	 * @return the {@link UserDetailsService} or null if it is not available
 	 */
 	public abstract U getUserDetailsService();
@@ -35,7 +35,7 @@ public class UserDetailsServiceConfigurer<B extends ProviderManagerBuilder<B>, C
 		extends AbstractDaoAuthenticationConfigurer<B, C, U> {

 	/**
-	 * Creates a new instance
+	 * Creates a new instance.
 	 * @param userDetailsService the {@link UserDetailsService} that should be used
 	 */
 	public UserDetailsServiceConfigurer(U userDetailsService) {
@@ -28,6 +28,8 @@ import org.springframework.core.Ordered;
 import org.springframework.security.authorization.ReactiveAuthorizationManager;

 /**
+ * Enables Spring Security reactive method security.
+ *
 * @author Rob Winch
 * @since 5.0
 */
@@ -32,6 +32,7 @@ import org.springframework.context.annotation.Configuration;
 import org.springframework.context.annotation.ImportAware;
 import org.springframework.context.annotation.Role;
 import org.springframework.core.type.AnnotationMetadata;
+import org.springframework.security.access.PermissionEvaluator;
 import org.springframework.security.access.expression.method.DefaultMethodSecurityExpressionHandler;
 import org.springframework.security.access.expression.method.MethodSecurityExpressionHandler;
 import org.springframework.security.access.hierarchicalroles.RoleHierarchy;
@@ -127,6 +128,11 @@ final class PrePostMethodSecurityConfiguration implements ImportAware, Applicati
 		this.expressionHandler.setAuthorizationManagerFactory(authorizationManagerFactory);
 	}

+	@Autowired(required = false)
+	void setPermissionEvaluator(PermissionEvaluator permissionEvaluator) {
+		this.expressionHandler.setPermissionEvaluator(permissionEvaluator);
+	}
+
 	@Autowired(required = false)
 	void setTemplateDefaults(AnnotationTemplateExpressionDefaults templateDefaults) {
 		this.preFilterMethodInterceptor.setTemplateDefaults(templateDefaults);
@@ -39,6 +39,8 @@ import org.springframework.security.access.prepost.PrePostAnnotationSecurityMeta
 import org.springframework.security.config.core.GrantedAuthorityDefaults;

 /**
+ * Configures the infrastructure beans for reactive method security.
+ *
 * @author Rob Winch
 * @author Tadaya Tsuyukubo
 * @since 5.0
@@ -30,6 +30,8 @@ import org.springframework.util.Assert;
 import org.springframework.util.ClassUtils;

 /**
+ * Selects the imports to register for {@link EnableReactiveMethodSecurity}.
+ *
 * @author Rob Winch
 * @author Evgeniy Cheban
 * @since 5.0
@@ -154,7 +154,7 @@ public class RSocketSecurity {
 	/**
 	 * Adds support for validating a username and password using <a href=
 	 * "https://github.com/rsocket/rsocket/blob/5920ed374d008abb712cb1fd7c9d91778b2f4a68/Extensions/Security/Simple.md">Simple
-	 * Authentication</a>
+	 * Authentication</a>.
 	 * @param simple a customizer
 	 * @return RSocketSecurity for additional configuration
 	 * @since 5.3
@@ -168,7 +168,7 @@ public class RSocketSecurity {
 	}

 	/**
-	 * Adds anonymous authentication
+	 * Adds anonymous authentication.
 	 * @param anonymous a customizer
 	 * @return this instance
 	 * @since 7.0
@@ -265,6 +265,9 @@ public class RSocketSecurity {
 	}

 	/**
+	 * Specifies the {@link ReactiveAuthenticationManager} to use for simple
+	 * authentication.
+	 *
 	 * @since 5.3
 	 */
 	public final class SimpleAuthenticationSpec {
@@ -286,7 +289,7 @@ public class RSocketSecurity {
 			return this.authenticationManager;
 		}

-		protected AuthenticationPayloadInterceptor build() {
+		AuthenticationPayloadInterceptor build() {
 			ReactiveAuthenticationManager manager = getAuthenticationManager();
 			AuthenticationPayloadInterceptor result = new AuthenticationPayloadInterceptor(manager);
 			result.setAuthenticationConverter(new AuthenticationPayloadExchangeConverter());
@@ -304,7 +307,7 @@ public class RSocketSecurity {
 			this.parent = parent;
 		}

-		protected AnonymousPayloadInterceptor build() {
+		AnonymousPayloadInterceptor build() {
 			AnonymousPayloadInterceptor result = new AnonymousPayloadInterceptor("anonymousUser");
 			result.setOrder(PayloadInterceptorOrder.ANONYMOUS.getOrder());
 			return result;
@@ -335,7 +338,7 @@ public class RSocketSecurity {
 			return this.authenticationManager;
 		}

-		protected AuthenticationPayloadInterceptor build() {
+		AuthenticationPayloadInterceptor build() {
 			ReactiveAuthenticationManager manager = getAuthenticationManager();
 			AuthenticationPayloadInterceptor result = new AuthenticationPayloadInterceptor(manager);
 			result.setOrder(PayloadInterceptorOrder.AUTHENTICATION.getOrder());
@@ -368,7 +371,7 @@ public class RSocketSecurity {
 			return RSocketSecurity.this.authenticationManager;
 		}

-		protected List<AuthenticationPayloadInterceptor> build() {
+		List<AuthenticationPayloadInterceptor> build() {
 			ReactiveAuthenticationManager manager = getAuthenticationManager();
 			AuthenticationPayloadInterceptor legacy = new AuthenticationPayloadInterceptor(manager);
 			legacy.setAuthenticationConverter(new BearerPayloadExchangeConverter());
@@ -393,7 +396,7 @@ public class RSocketSecurity {
 		/**
 		 * Matches if
 		 * {@link org.springframework.security.rsocket.api.PayloadExchangeType#isRequest()}
-		 * is true, else not a match
+		 * is true, else not a match.
 		 * @return the Access to set up the authorization rule.
 		 */
 		public Access anyRequest() {
@@ -401,7 +404,7 @@ public class RSocketSecurity {
 		}

 		/**
-		 * Always matches
+		 * Always matches.
 		 * @return the Access to set up the authorization rule.
 		 */
 		public Access anyExchange() {
@@ -30,6 +30,8 @@ import org.springframework.security.core.userdetails.ReactiveUserDetailsService;
 import org.springframework.security.crypto.password.PasswordEncoder;

 /**
+ * {@link Configuration} for RSocket security infrastructure beans.
+ *
 * @author Rob Winch
 * @since 5.2
 */
@@ -26,6 +26,8 @@ import org.springframework.security.rsocket.core.SecuritySocketAcceptorIntercept
 import org.springframework.security.rsocket.util.matcher.PayloadExchangeMatcher.MatchResult;

 /**
+ * {@link Configuration} that exposes a {@link SecuritySocketAcceptorInterceptor} bean.
+ *
 * @author Rob Winch
 * @since 5.2
 */
@@ -61,7 +61,7 @@ public abstract class AbstractRequestMatcherRegistry<C> {
 	}

 	/**
-	 * Gets the {@link ApplicationContext}
+	 * Gets the {@link ApplicationContext}.
 	 * @return the {@link ApplicationContext}
 	 */
 	protected final ApplicationContext getApplicationContext() {
@@ -111,7 +111,7 @@ public abstract class AbstractRequestMatcherRegistry<C> {

 	/**
 	 * Associates a list of {@link RequestMatcher} instances with the
-	 * {@link AbstractRequestMatcherRegistry}
+	 * {@link AbstractRequestMatcherRegistry}.
 	 * @param requestMatchers the {@link RequestMatcher} instances
 	 * @return the object that is chained after creating the {@link RequestMatcher}
 	 */
@@ -203,6 +203,7 @@ public abstract class AbstractRequestMatcherRegistry<C> {
 	 * If a specific {@link RequestMatcher} must be specified, use
 	 * {@link #requestMatchers(RequestMatcher...)} instead
 	 * </p>
+	 * .
 	 * @param method the {@link HttpMethod} to use or {@code null} for any
 	 * {@link HttpMethod}.
 	 * @return the object that is chained after creating the {@link RequestMatcher}.
--- a/Show More
+++ b/Show More