Release 7.2.0-M1

Signed-off-by: Josh Cummings <3627351+jzheaux@users.noreply.github.com>
Update to Spring Data 2026.1.0-M1
2026-09-05 08:49:54 +00:00 · 2026-08-13 16:39:08 -06:00 · 2026-08-13 16:39:08 -06:00 · 2026-08-13 16:39:07 -06:00 · 2026-08-13 16:39:07 -06:00 · 2026-08-13 16:39:07 -06:00
1321 changed files with 9246 additions and 5774 deletions
@@ -0,0 +1,7 @@
+name: Build Release
+runs:
+  using: composite
+  steps:
+    - name: Build Release
+      shell: bash
+      run:  ./gradlew -PdeploymentRepository=$(pwd)/deployment-repository publishAllPublicationsToDeploymentRepository
@@ -0,0 +1,7 @@
+name: Test Release
+runs:
+  using: composite
+  steps:
+    - name: Test Release
+      shell: bash
+      run:  ./gradlew build
@@ -4,52 +4,6 @@ registries:
    type: maven-repository
    url: https://build.shibboleth.net/maven/releases
 updates:
-  # 6.5.x
-  - package-ecosystem: gradle
-    target-branch: 6.5.x
-    directory: /
-    schedule:
-      interval: daily
-      time: '03:00'
-      timezone: Etc/UTC
-    labels:
-      - 'type: dependency-upgrade'
-      - 'in: build'
-    registries:
-      - shibboleth
-    ignore:
-      - dependency-name: com.nimbusds:nimbus-jose-jwt
-      - dependency-name: org.python:jython
-      - dependency-name: org.apache.directory.server:*
-      - dependency-name: org.apache.directory.shared:*
-      - dependency-name: org.junit:junit-bom
-        update-types:
-          - version-update:semver-major
-      - dependency-name: org.mockito:mockito-bom
-        update-types:
-          - version-update:semver-major
-      - dependency-name: '*'
-        update-types:
-          - version-update:semver-major
-          - version-update:semver-minor
-  - package-ecosystem: npm
-    target-branch: 6.5.x
-    directory: /docs
-    schedule:
-      interval: weekly
-    labels:
-      - 'type: task'
-      - 'type: dependency-upgrade'
-      - 'in: build'
-  - package-ecosystem: github-actions
-    target-branch: 6.5.x
-    directory: /
-    schedule:
-      interval: weekly
-    labels:
-      - 'type: task'
-      - 'type: dependency-upgrade'
-      - 'in: build'

  # 7.0.x
  - package-ecosystem: gradle
@@ -103,6 +57,57 @@ updates:
      - 'type: dependency-upgrade'
      - 'in: build'

+  # 7.1.x
+  - package-ecosystem: gradle
+    target-branch: 7.1.x
+    directory: /
+    schedule:
+      interval: daily
+      time: '03:00'
+      timezone: Etc/UTC
+    labels:
+      - 'type: dependency-upgrade'
+      - 'in: build'
+    registries:
+      - shibboleth
+    ignore:
+      - dependency-name: com.nimbusds:nimbus-jose-jwt
+      - dependency-name: org.python:jython
+      - dependency-name: org.apache.directory.server:*
+      - dependency-name: org.apache.directory.shared:*
+      - dependency-name: org.junit:junit-bom
+        update-types:
+          - version-update:semver-major
+      - dependency-name: org.mockito:mockito-bom
+        update-types:
+          - version-update:semver-major
+      - dependency-name: com.gradle.enterprise
+        update-types:
+          - version-update:semver-major
+          - version-update:semver-minor
+      - dependency-name: '*'
+        update-types:
+          - version-update:semver-major
+          - version-update:semver-minor
+  - package-ecosystem: npm
+    target-branch: 7.1.x
+    directory: /docs
+    schedule:
+      interval: weekly
+    labels:
+      - 'type: task'
+      - 'type: dependency-upgrade'
+      - 'in: build'
+  - package-ecosystem: github-actions
+    target-branch: 7.1.x
+    directory: /
+    schedule:
+      interval: weekly
+    labels:
+      - 'type: task'
+      - 'type: dependency-upgrade'
+      - 'in: build'
+
  # main
  - package-ecosystem: gradle
    target-branch: main
@@ -0,0 +1,17 @@
+workflow:
+  generator:
+    project:
+      java:
+        versions:
+          primary: 25
+    workflows:
+      release-train:
+        build:
+          env:
+            COMMERCIAL_REPO_USERNAME: secrets.COMMERCIAL_ARTIFACTORY_USERNAME
+            COMMERCIAL_REPO_PASSWORD: secrets.COMMERCIAL_ARTIFACTORY_PASSWORD
+        test:
+          env:
+            COMMERCIAL_REPO_USERNAME: secrets.COMMERCIAL_ARTIFACTORY_USERNAME
+            COMMERCIAL_REPO_PASSWORD: secrets.COMMERCIAL_ARTIFACTORY_PASSWORD
+
@@ -1,36 +0,0 @@
-name: CI
-
-on:
-  schedule:
-    - cron: '0 10 * * *' # Once per day at 10am UTC
-  workflow_dispatch: # Manual trigger
-
-env:
-  DEVELOCITY_ACCESS_KEY: ${{ secrets.DEVELOCITY_ACCESS_KEY }}
-
-permissions:
-  contents: read
-
-jobs:
-  snapshot-test:
-    name: Test Against Snapshots
-    uses: spring-io/spring-security-release-tools/.github/workflows/test.yml@3f6cc7ffc137ca160061749d5f34dc30d5f36986 # v1.0.17
-    strategy:
-      matrix:
-        include:
-          - java-version: 25
-            toolchain: 25
-    with:
-      java-version: ${{ matrix.java-version }}
-      test-args: --refresh-dependencies -PforceMavenRepositories=snapshot,https://oss.sonatype.org/content/repositories/snapshots -PisOverrideVersionCatalog -PtestToolchain=${{ matrix.toolchain }} -PspringFrameworkVersion=7.0.+ -PreactorVersion=2025.+ -PspringDataVersion=2025.+ -PmicrometerVersion=1.+ --stacktrace
-    secrets: inherit
-  send-notification:
-    name: Send Notification
-    needs: [ snapshot-test ]
-    if: ${{ !success() }}
-    runs-on: ubuntu-latest
-    steps:
-      - name: Send Notification
-        uses: spring-io/spring-security-release-tools/.github/actions/send-notification@3f6cc7ffc137ca160061749d5f34dc30d5f36986 # v1.0.17
-        with:
-          webhook-url: ${{ secrets.SPRING_SECURITY_CI_GCHAT_WEBHOOK_URL }}
@@ -1,23 +0,0 @@
-name: Clean build artifacts
-on:
-  schedule:
-    - cron: '0 10 * * *' # Once per day at 10am UTC
-
-permissions:
-  contents: read
-
-jobs:
-  main:
-    runs-on: ubuntu-latest
-    if: ${{ github.repository == 'spring-projects/spring-security' }}
-    permissions:
-      contents: none
-    steps:
-      - name: Delete artifacts in cron job
-        env:
-          GH_ACTIONS_REPO_TOKEN: ${{ secrets.GH_ACTIONS_REPO_TOKEN }}
-        run: |
-          echo "Running clean build artifacts logic"
-          output=$(curl -X GET -H "Authorization: token $GH_ACTIONS_REPO_TOKEN" https://api.github.com/repos/spring-projects/spring-security/actions/artifacts | grep '"id"' | cut -d : -f2 | sed 's/,*$//g')
-          echo Output is $output
-          for id in $output; do curl -X DELETE -H "Authorization: token $GH_ACTIONS_REPO_TOKEN" https://api.github.com/repos/spring-projects/spring-security/actions/artifacts/$id; done;
@@ -1,17 +0,0 @@
-name: "CodeQL Advanced"
-
-on:
-  push:
-  pull_request:
-  workflow_dispatch:
-  schedule:
-    # https://docs.github.com/en/actions/writing-workflows/choosing-when-your-workflow-runs/events-that-trigger-workflows#schedule
-    - cron: '0 5 * * *'
-permissions: read-all
-jobs:
-  codeql-analysis-call:
-    permissions:
-      actions: read
-      contents: read
-      security-events: write
-    uses: spring-io/github-actions/.github/workflows/codeql-analysis.yml@e415dadd0910c901e7a7fabd67bbb355b2324500 # 1
@@ -8,49 +8,46 @@ on:
    - cron: '0 10 * * *' # Once per day at 10am UTC
  workflow_dispatch: # Manual trigger

-env:
-  DEVELOCITY_ACCESS_KEY: ${{ secrets.DEVELOCITY_ACCESS_KEY }}
-
 permissions:
  contents: read

 jobs:
  build:
    name: Build
-    uses: spring-io/spring-security-release-tools/.github/workflows/build.yml@3f6cc7ffc137ca160061749d5f34dc30d5f36986 # v1.0.17
-    strategy:
-      matrix:
-        os: [ ubuntu-latest, windows-latest ]
-        jdk: [ 25 ]
+    uses: spring-projects/spring-security-commercial/.github/workflows/build.yml@workflows/v1
    with:
-      runs-on: ${{ matrix.os }}
-      java-version: ${{ matrix.jdk }}
-      distribution: temurin
+      java-version: '25'
    secrets: inherit
+  test:
+    name: Test Against Snapshots
+    uses: spring-projects/spring-security-commercial/.github/workflows/test.yml@workflows/v1
+    with:
+      java-version: '25'
+      test-args: --refresh-dependencies -PforceMavenRepositories=snapshot -PisOverrideVersionCatalog -PtestToolchain=25 -PspringFrameworkVersion=7.0.+ -PreactorVersion=2025.0.+ -PspringDataVersion=2026.0.+ -PmicrometerVersion=1.17.+ --stacktrace
+    secrets: inherit
+  compute-version:
+    name: Compute Version
+    runs-on: ubuntu-latest
+    outputs:
+      snapshot: ${{ steps.project-version.outputs.snapshot }}
+    steps:
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # 7.0.0
+      - id: project-version
+        name: Extract Project Version
+        uses: spring-io/spring-release-actions/compute-version@a1f321783a0769dd2aea4fad6c2ae2f95a52b885 # 0.0.5
  deploy-artifacts:
    name: Deploy Artifacts
-    needs: [ build ]
-    uses: spring-io/spring-security-release-tools/.github/workflows/deploy-artifacts.yml@3f6cc7ffc137ca160061749d5f34dc30d5f36986 # v1.0.17
-    with:
-      should-deploy-artifacts: ${{ needs.build.outputs.should-deploy-artifacts }}
-      default-publish-milestones-central: true
-      java-version: 25
-    secrets: inherit
-  deploy-schema:
-    name: Deploy Schema
-    needs: [ build ]
-    uses: spring-io/spring-security-release-tools/.github/workflows/deploy-schema.yml@3f6cc7ffc137ca160061749d5f34dc30d5f36986 # v1.0.17
-    with:
-      should-deploy-schema: ${{ needs.build.outputs.should-deploy-artifacts }}
-      java-version: 25
+    needs: [ build, test, compute-version ]
+    if: needs.compute-version.outputs.snapshot == 'true'
+    uses: spring-projects/spring-security-commercial/.github/workflows/deploy-artifacts.yml@workflows/v1
    secrets: inherit
  send-notification:
    name: Send Notification
-    needs: [ deploy-artifacts, deploy-schema ]
+    needs: [ deploy-artifacts ]
    if: ${{ !success() }}
    runs-on: ubuntu-latest
    steps:
      - name: Send Notification
-        uses: spring-io/spring-security-release-tools/.github/actions/send-notification@3f6cc7ffc137ca160061749d5f34dc30d5f36986 # v1.0.17
+        uses: spring-io/spring-security-release-tools/.github/actions/send-notification@b92832ecbc7cbe969201e6beafbde0ee400cf095 # v1.0.15
        with:
          webhook-url: ${{ secrets.SPRING_SECURITY_CI_GCHAT_WEBHOOK_URL }}
@@ -1,76 +0,0 @@
-name: Defer Issues
-
-on:
-  workflow_dispatch:
-
-permissions:
-  contents: read
-
-jobs:
-  defer-issues:
-    name: Defer Issues
-    runs-on: ubuntu-latest
-    if: github.repository_owner == 'spring-projects'
-    permissions:
-      issues: write
-    steps:
-    - name: Checkout
-      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-    - name: Compute Version
-      id: compute-version
-      uses: spring-io/spring-release-actions/compute-version@1b8671612c3eb3d9b9763e2d7b66f1a80d00ee95 # 0.0.6
-    - name: Get Today's Release Version
-      id: todays-release
-      uses: spring-io/spring-release-actions/get-todays-release-version@1b8671612c3eb3d9b9763e2d7b66f1a80d00ee95 # 0.0.6
-      with:
-        snapshot-version: ${{ steps.compute-version.outputs.version }}
-        milestone-repository: ${{ github.repository }}
-        milestone-token: ${{ secrets.GITHUB_TOKEN }}
-    - name: Compute Next Version
-      id: next-version
-      uses: spring-io/spring-release-actions/compute-next-version@1b8671612c3eb3d9b9763e2d7b66f1a80d00ee95 # 0.0.6
-      with:
-        version: ${{ steps.todays-release.outputs.release-version }}
-    - name: Schedule Next Milestone
-      uses: spring-io/spring-release-actions/schedule-milestone@1b8671612c3eb3d9b9763e2d7b66f1a80d00ee95 # 0.0.6
-      with:
-        version: ${{ steps.next-version.outputs.version }}
-        version-date: ${{ steps.next-version.outputs.version-date }}
-        repository: ${{ github.repository }}
-        token: ${{ secrets.GITHUB_TOKEN }}
-    - name: Move Open Issues to Next Milestone
-      env:
-        GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        CURRENT_MILESTONE: ${{ steps.todays-release.outputs.release-version }}
-        NEXT_MILESTONE: ${{ steps.next-version.outputs.version }}
-      run: |
-        current_milestone_number=$(gh api repos/${{ github.repository }}/milestones \
-          --jq ".[] | select(.title == \"$CURRENT_MILESTONE\") | .number")
-        if [ -z "$current_milestone_number" ]; then
-          echo "No milestone found for $CURRENT_MILESTONE"
-          exit 0
-        fi
-        next_milestone_number=$(gh api repos/${{ github.repository }}/milestones \
-          --jq ".[] | select(.title == \"$NEXT_MILESTONE\") | .number")
-        if [ -z "$next_milestone_number" ]; then
-          echo "No milestone found for $NEXT_MILESTONE"
-          exit 1
-        fi
-        echo "Moving open issues from milestone '$CURRENT_MILESTONE' (#$current_milestone_number) to '$NEXT_MILESTONE' (#$next_milestone_number)"
-        page=1
-        while true; do
-          issues=$(gh api "repos/${{ github.repository }}/issues?milestone=$current_milestone_number&state=open&per_page=100&page=$page" \
-            --jq '.[].number')
-          if [ -z "$issues" ]; then
-            break
-          fi
-          for issue in $issues; do
-            echo "Moving issue/PR #$issue to milestone $NEXT_MILESTONE"
-            gh api repos/${{ github.repository }}/issues/$issue \
-              --method PATCH \
-              --field milestone=$next_milestone_number \
-              --silent
-          done
-          page=$((page + 1))
-        done
-        echo "Done."
@@ -0,0 +1,10 @@
+name: Dependabot PR Build
+
+on: pull_request_target
+
+jobs:
+  build:
+    name: Build
+    uses: spring-projects/spring-security-commercial/.github/workflows/build-pull-request.yml@workflows/v1
+    if: ${{ github.actor == 'dependabot[bot]' }}
+    secrets: inherit
@@ -1,33 +0,0 @@
-name: Deploy Docs
-on:
-  push:
-    branches-ignore:
-      - "gh-pages"
-      - "dependabot/**"
-    tags: '**'
-  repository_dispatch:
-    types: request-build-reference # legacy
-  #schedule:
-  #- cron: '0 10 * * *' # Once per day at 10am UTC
-  workflow_dispatch:
-permissions: read-all
-jobs:
-  build:
-    runs-on: ubuntu-latest
-    if: github.repository_owner == 'spring-projects'
-    steps:
-    - name: Checkout
-      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      with:
-        ref: docs-build
-        fetch-depth: 1
-    - name: Dispatch (partial build)
-      if: github.ref_type == 'branch'
-      env:
-        GH_TOKEN: ${{ secrets.GH_ACTIONS_REPO_TOKEN }}
-      run: gh workflow run deploy-docs.yml -r $(git rev-parse --abbrev-ref HEAD) -f build-refname=${{ github.ref_name }}
-    - name: Dispatch (full build)
-      if: github.ref_type == 'tag'
-      env:
-        GH_TOKEN: ${{ secrets.GH_ACTIONS_REPO_TOKEN }}
-      run: gh workflow run deploy-docs.yml -r $(git rev-parse --abbrev-ref HEAD)
@@ -1,34 +0,0 @@
-name: Execute Gradle Wrapper Upgrade
-
-on:
-  schedule:
-    - cron:  '0 2 * * *' # 2am UTC
-  workflow_dispatch:
-permissions:
-  pull-requests: write
-jobs:
-  upgrade_wrapper:
-    name: Execution
-    if: ${{ github.repository == 'spring-projects/spring-security' }}
-    runs-on: ubuntu-latest
-    steps:
-      - name: Set up Git configuration
-        env:
-          TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: |
-          git config --global url."https://unused-username:${TOKEN}@github.com/".insteadOf "https://github.com/"
-          git config --global user.name 'github-actions[bot]'
-          git config --global user.email 'github-actions[bot]@users.noreply.github.com'
-      - name: Checkout
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - name: Set up JDK 25
-        uses: actions/setup-java@dd06d9cba3e5552c54d9f8ea23572deb30010f7c # v6.0.0
-        with:
-          java-version: '25'
-          distribution: 'temurin'
-      - name: Set up Gradle
-        uses: gradle/setup-gradle@f29f5a9d7b09a7c6b29859002d29d24e1674c884 # v5.0.1
-      - name: Upgrade Wrappers
-        run: ./gradlew clean upgradeGradleWrapperAll --continue -Porg.gradle.java.installations.auto-download=false
-        env:
-          WRAPPER_UPGRADE_GIT_TOKEN: ${{ secrets.GITHUB_TOKEN }}
@@ -0,0 +1,63 @@
+name: Merge Dependabot PR
+
+on: pull_request_target
+
+run-name: Merge Dependabot PR ${{ github.ref_name }}
+
+permissions: write-all
+
+jobs:
+  merge-dependabot-pr:
+    name: Merge Dependabot PR
+    runs-on: ubuntu-latest
+    if: ${{ github.event.pull_request.user.login == 'dependabot[bot]' && github.repository == 'spring-projects/spring-security-commercial' }}
+    steps:
+
+      - uses: actions/checkout@v5
+        with:
+          show-progress: false
+          ref: ${{ github.event.pull_request.head.sha }}
+
+      - uses: actions/setup-java@v4
+        with:
+          distribution: temurin
+          java-version: 17
+
+      - name: Set Milestone to Dependabot Pull Request
+        id: set-milestone
+        run: |
+          if test -f pom.xml
+          then
+            CURRENT_VERSION=$(mvn help:evaluate -Dexpression="project.version" -q -DforceStdout)
+          else
+            CURRENT_VERSION=$(cat gradle.properties | sed -n '/^version=/ { s/^version=//;p }')
+          fi
+          export CANDIDATE_VERSION=${CURRENT_VERSION/-SNAPSHOT}
+          MILESTONE=$(gh api repos/$GITHUB_REPOSITORY/milestones --jq 'map(select(.due_on != null and (.title | startswith(env.CANDIDATE_VERSION)))) | .[0] | .title')
+
+          if [ -z $MILESTONE ]
+          then
+            gh run cancel ${{ github.run_id }}
+            echo "::warning title=Cannot merge::No scheduled milestone for $CURRENT_VERSION version"
+          else
+            gh pr edit ${{ github.event.pull_request.number }} --milestone $MILESTONE
+            echo mergeEnabled=true >> $GITHUB_OUTPUT
+          fi
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Merge Dependabot pull request
+        if: steps.set-milestone.outputs.mergeEnabled
+        run: gh pr merge ${{ github.event.pull_request.number }} --auto --rebase
+        env:
+          GH_TOKEN: ${{ secrets.GH_ACTIONS_REPO_TOKEN }}
+  send-notification:
+    name: Send Notification
+    needs: [ merge-dependabot-pr ]
+    if: ${{ failure() || cancelled() }}
+    runs-on: ubuntu-latest
+    steps:
+      - name: Send Notification
+        uses: spring-io/spring-security-release-tools/.github/actions/send-notification@v1
+        with:
+          webhook-url: ${{ secrets.SPRING_SECURITY_CI_GCHAT_WEBHOOK_URL }}
@@ -8,44 +8,6 @@ permissions:
 jobs:
  build:
    name: Build
-    runs-on: ubuntu-latest
-    if: ${{ github.repository == 'spring-projects/spring-security' }}
-    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - name: Set up gradle
-        uses: spring-io/spring-gradle-build-action@c8668747d7c264864c8c7f7026d0d277d14a78dc # v2.0.6
-        with:
-          java-version: '25'
-          distribution: 'temurin'
-      - name: Build with Gradle
-        run: ./gradlew clean build -PskipCheckExpectedBranchVersion --continue --scan
-  generate-docs:
-    name: Generate Docs
-    runs-on: ubuntu-latest
-    if: ${{ github.repository == 'spring-projects/spring-security' }}
-    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - name: Set up gradle
-        uses: spring-io/spring-gradle-build-action@c8668747d7c264864c8c7f7026d0d277d14a78dc # v2.0.6
-        with:
-          java-version: '25'
-          distribution: 'temurin'
-      - name: Run Antora
-        run: ./gradlew -PbuildSrc.skipTests=true :spring-security-docs:antora
-      - name: Upload Docs
-        id: upload
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
-        with:
-          name: docs
-          path: docs/build/site
-          overwrite: true
-  send-notification:
-    name: Send Notification
-    needs: [ build, generate-docs ]
-    if: ${{ failure() && github.event.pull_request.user.login == 'dependabot[bot]' && github.repository == 'spring-projects/spring-security' }}
-    runs-on: ubuntu-latest
-    steps:
-      - name: Send Notification
-        uses: spring-io/spring-security-release-tools/.github/actions/send-notification@3f6cc7ffc137ca160061749d5f34dc30d5f36986 # v1.0.17
-        with:
-          webhook-url: ${{ secrets.SPRING_SECURITY_CI_GCHAT_WEBHOOK_URL }}
+    uses: spring-projects/spring-security-commercial/.github/workflows/build-pull-request.yml@workflows/v1
+    if: ${{ github.actor != 'dependabot[bot]' }}
+    secrets: inherit
@@ -1,30 +0,0 @@
-name: Release Announcements - Publish
-
-on:
-  workflow_dispatch:
-    inputs:
-      version:
-        description: The version to publish
-        required: true
-        type: string
-
-permissions:
-  actions: write
-  contents: read
-  issues: write
-
-jobs:
-  deploy-schema:
-    name: Deploy Schema
-    uses: spring-io/spring-security-release-tools/.github/workflows/deploy-schema.yml@3f6cc7ffc137ca160061749d5f34dc30d5f36986 # v1.0.17
-    with:
-      should-deploy-schema: true
-    secrets: inherit
-  publish-release-announcements:
-    name: Publish Release Announcements
-    needs: [ deploy-schema ]
-    if: ${{ !github.event.repository.fork }}
-    uses: spring-io/spring-security-release-tools/.github/workflows/release-announcements-publish.yml@3f6cc7ffc137ca160061749d5f34dc30d5f36986 # v1.0.17
-    with:
-      version: ${{ inputs.version }}
-    secrets: inherit
@@ -1,24 +0,0 @@
-name: Release Announcements - Stage
-
-on:
-  push:
-    tags:
-      - '[0-9]+.[0-9]+.[0-9]+'
-  workflow_dispatch:
-    inputs:
-      version:
-        description: The version to stage
-        required: true
-        type: string
-
-permissions:
-  contents: read
-
-jobs:
-  stage-release-announcements:
-    name: Stage Release Announcements
-    if: ${{ !github.event.repository.fork }}
-    uses: spring-io/spring-security-release-tools/.github/workflows/release-announcements-stage.yml@3f6cc7ffc137ca160061749d5f34dc30d5f36986 # v1.0.17
-    with:
-      version: ${{ inputs.version || github.ref_name }}
-    secrets: inherit
@@ -0,0 +1,92 @@
+# This file was auto-generated by github-actions-workflow-generator 0.0.6. Do not edit.
+# To update it, modify .github/workflow-generator.yml as needed and re-run the generator.
+
+name: "Release Train – Build"
+run-name: "${{ inputs.callback-ref }} – Build"
+"on":
+  workflow_dispatch:
+    inputs:
+      callback:
+        description: "Repository to which a callback should be made upon completion"
+        required: true
+        type: "string"
+      callback-ref:
+        description: "Ref in the callback repository to which a callback should be made upon completion"
+        required: true
+        type: "string"
+      release-train-maven-repository-url:
+        description: "URL of a Maven repository to be used to resolve artifacts of projects earlier in the train"
+        required: true
+        type: "string"
+permissions:
+  contents: "read"
+concurrency:
+  group: "${{ github.workflow }}-${{ github.ref }}"
+jobs:
+  build-release:
+    name: "Build Release"
+    runs-on: "ubuntu22-2-8"
+    steps:
+    - name: "Prevent Re-runs"
+      id: "prevent-re-runs"
+      run: |-
+        if [ "$GITHUB_RUN_ATTEMPT" -gt 1 ]; then
+          echo "Re-runs are prohibited. Use the 'Release Train – Retry' workflow to retry build failures"
+          exit 1
+        fi
+    - name: "Set up Java"
+      id: "set-up-java"
+      uses: "actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95" # v5.6.0
+      with:
+        distribution: "liberica"
+        java-version: "25"
+    - name: "Check Out Code"
+      id: "check-out-code"
+      uses: "actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0" # v7.0.0
+    - name: "Build Release"
+      id: "build-release"
+      uses: "./.github/actions/release-train-build"
+      env:
+        COMMERCIAL_REPO_PASSWORD: "${{ secrets.COMMERCIAL_ARTIFACTORY_PASSWORD }}"
+        COMMERCIAL_REPO_USERNAME: "${{ secrets.COMMERCIAL_ARTIFACTORY_USERNAME }}"
+        RELEASE_TRAIN_MAVEN_REPOSITORY_PASSWORD: "${{ secrets.RELEASE_TRAIN_PARTICIPANT_MAVEN_REPOSITORY_PASSWORD }}"
+        RELEASE_TRAIN_MAVEN_REPOSITORY_URL: "${{ inputs.release-train-maven-repository-url }}"
+        RELEASE_TRAIN_MAVEN_REPOSITORY_USERNAME: "${{ secrets.RELEASE_TRAIN_PARTICIPANT_MAVEN_REPOSITORY_USERNAME }}"
+    - name: "Upload Deployment Repository"
+      id: "upload-deployment-repository"
+      uses: "actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a" # v7.0.1
+      with:
+        name: "deployment-repository"
+        path: "deployment-repository/**"
+    - name: "Upload Deployment Spec"
+      id: "upload-deployment-spec"
+      uses: "actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a" # v7.0.1
+      with:
+        archive: "false"
+        if-no-files-found: "ignore"
+        name: "deployment-spec"
+        path: ".github/actions/release-train-build/deployment-spec.yml"
+    - name: "Save Build System Caches"
+      id: "save-build-system-caches"
+      uses: "actions/cache/save@55cc8345863c7cc4c66a329aec7e433d2d1c52a9" # v6.1.0
+      with:
+        key: "release-train-${{ inputs.callback-ref }}-${{ github.ref_name }}"
+        path: |-
+          ~/.gradle/caches
+          ~/.gradle/wrapper
+    - name: "Send Callback"
+      id: "send-callback"
+      if: "${{ !cancelled() }}"
+      env:
+        GH_TOKEN: "${{ secrets.RELEASE_TRAIN_PARTICIPANT_GITHUB_TOKEN }}"
+      run: |-
+        gh workflow run callback \
+        --repo ${{ inputs.callback }} \
+        --ref ${{ inputs.callback-ref }} \
+        --field commit-hash=${{ steps.check-out-code.outputs.commit }} \
+        --field deployment-repository-artifact-identifier=${{ steps.upload-deployment-repository.outputs.artifact-id }} \
+        --field deployment-spec-artifact-identifier=${{ steps.upload-deployment-spec.outputs.artifact-id }} \
+        --field release-branch=${{ github.ref_name }} \
+        --field release-repository=${{ github.repository }} \
+        --field result=${{ job.status == 'success' && 'built' || 'build-failed' }} \
+        --field workflow-run-url=${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
@@ -0,0 +1,55 @@
+# This file was auto-generated by github-actions-workflow-generator 0.0.6. Do not edit.
+# To update it, modify .github/workflow-generator.yml as needed and re-run the generator.
+
+name: "Release Train – Join"
+run-name: "${{ inputs.release-train }} – Join"
+"on":
+  workflow_dispatch:
+    inputs:
+      deployment-destination:
+        description: "Destination to which the release should be deployed"
+        options:
+        - "Maven Central"
+        - "Spring Enterprise"
+        required: true
+        type: "choice"
+      release-train:
+        description: "Release train"
+        required: true
+        type: "string"
+      release-train-repository:
+        default: "spring-io/release-train"
+        description: "Release train repository"
+        required: true
+        type: "string"
+permissions:
+  contents: "none"
+jobs:
+  join-release-train:
+    name: "Join Release Train"
+    runs-on: "ubuntu-latest"
+    steps:
+    - name: "Join Release Train"
+      id: "join-release-train"
+      env:
+        GH_TOKEN: "${{ secrets.RELEASE_TRAIN_PARTICIPANT_GITHUB_TOKEN }}"
+      run: |-
+        run_url=$(
+          gh workflow run join \
+          --repo ${{ inputs.release-train-repository }} \
+          --ref ${{ inputs.release-train }} \
+          --field commit-hash=${{ github.sha }} \
+          --field deployment-destination=${{ inputs.deployment-destination == 'Maven Central' && 'maven-central' || 'spring-enterprise' }} \
+          --field release-branch=${{ github.ref_name }} \
+          --field release-repository=${{ github.repository }}
+        )
+        echo "Dispatched workflow run. Waiting for $run_url to complete."
+        run_id=${run_url##*/}
+        watch_exit_code=0
+        gh run watch $run_id --repo ${{ inputs.release-train-repository }} --exit-status --interval=3 > /dev/null 2>&1 || watch_exit_code=$?
+        if [[ $watch_exit_code -eq 0 ]]; then
+          echo "Workflow run succeeded."
+        else
+          echo "Workflow run failed."
+        fi
+        exit $watch_exit_code
@@ -0,0 +1,46 @@
+# This file was auto-generated by github-actions-workflow-generator 0.0.6. Do not edit.
+# To update it, modify .github/workflow-generator.yml as needed and re-run the generator.
+
+name: "Release Train – Leave"
+run-name: "${{ inputs.release-train }} – Leave"
+"on":
+  workflow_dispatch:
+    inputs:
+      release-train:
+        description: "Release train"
+        required: true
+        type: "string"
+      release-train-repository:
+        default: "spring-io/release-train"
+        description: "Release train repository"
+        required: true
+        type: "string"
+permissions:
+  contents: "none"
+jobs:
+  leave:
+    name: "Leave"
+    runs-on: "ubuntu-latest"
+    steps:
+    - name: "Leave"
+      id: "leave"
+      env:
+        GH_TOKEN: "${{ secrets.RELEASE_TRAIN_PARTICIPANT_GITHUB_TOKEN }}"
+      run: |-
+        run_url=$(
+          gh workflow run leave \
+          --repo ${{ inputs.release-train-repository }} \
+          --ref ${{ inputs.release-train }} \
+          --field release-branch=${{ github.ref_name }} \
+          --field release-repository=${{ github.repository }}
+        )
+        echo "Dispatched workflow run. Waiting for $run_url to complete."
+        run_id=${run_url##*/}
+        watch_exit_code=0
+        gh run watch $run_id --repo ${{ inputs.release-train-repository }} --exit-status --interval=3 > /dev/null 2>&1 || watch_exit_code=$?
+        if [[ $watch_exit_code -eq 0 ]]; then
+          echo "Workflow run succeeded."
+        else
+          echo "Workflow run failed."
+        fi
+        exit $watch_exit_code
@@ -0,0 +1,47 @@
+# This file was auto-generated by github-actions-workflow-generator 0.0.6. Do not edit.
+# To update it, modify .github/workflow-generator.yml as needed and re-run the generator.
+
+name: "Release Train – Ready"
+run-name: "${{ inputs.release-train }} – Ready"
+"on":
+  workflow_dispatch:
+    inputs:
+      release-train:
+        description: "Release train"
+        required: true
+        type: "string"
+      release-train-repository:
+        default: "spring-io/release-train"
+        description: "Release train repository"
+        required: true
+        type: "string"
+permissions:
+  contents: "none"
+jobs:
+  ready:
+    name: "Ready"
+    runs-on: "ubuntu-latest"
+    steps:
+    - name: "Ready"
+      id: "ready"
+      env:
+        GH_TOKEN: "${{ secrets.RELEASE_TRAIN_PARTICIPANT_GITHUB_TOKEN }}"
+      run: |-
+        run_url=$(
+          gh workflow run ready \
+          --repo ${{ inputs.release-train-repository }} \
+          --ref ${{ inputs.release-train }} \
+          --field commit-hash=${{ github.sha }} \
+          --field release-branch=${{ github.ref_name }} \
+          --field release-repository=${{ github.repository }}
+        )
+        echo "Dispatched workflow run. Waiting for $run_url to complete."
+        run_id=${run_url##*/}
+        watch_exit_code=0
+        gh run watch $run_id --repo ${{ inputs.release-train-repository }} --exit-status --interval=3 > /dev/null 2>&1 || watch_exit_code=$?
+        if [[ $watch_exit_code -eq 0 ]]; then
+          echo "Workflow run succeeded."
+        else
+          echo "Workflow run failed."
+        fi
+        exit $watch_exit_code
@@ -0,0 +1,34 @@
+# This file was auto-generated by github-actions-workflow-generator 0.0.6. Do not edit.
+# To update it, modify .github/workflow-generator.yml as needed and re-run the generator.
+
+name: "Release Train – Retry"
+run-name: "${{ inputs.release-train }} – Retry"
+"on":
+  workflow_dispatch:
+    inputs:
+      release-train:
+        description: "Release train"
+        required: true
+        type: "string"
+      release-train-repository:
+        default: "spring-io/release-train"
+        description: "Release train repository"
+        required: true
+        type: "string"
+permissions:
+  contents: "none"
+jobs:
+  trigger-retry:
+    name: "Trigger Retry"
+    runs-on: "ubuntu-latest"
+    steps:
+    - name: "Trigger Retry"
+      id: "trigger-retry"
+      env:
+        GH_TOKEN: "${{ secrets.RELEASE_TRAIN_PARTICIPANT_GITHUB_TOKEN }}"
+      run: |-
+        gh workflow run retry \
+        --repo ${{ inputs.release-train-repository }} \
+        --ref ${{ inputs.release-train }} \
+        --field release-branch=${{ github.ref_name }} \
+        --field release-repository=${{ github.repository }}
@@ -0,0 +1,83 @@
+# This file was auto-generated by github-actions-workflow-generator 0.0.6. Do not edit.
+# To update it, modify .github/workflow-generator.yml as needed and re-run the generator.
+
+name: "Release Train – Test"
+run-name: "${{ inputs.callback-ref }} – Test"
+"on":
+  workflow_dispatch:
+    inputs:
+      callback:
+        description: "Repository to which a callback should be made upon completion"
+        required: true
+        type: "string"
+      callback-ref:
+        description: "Ref in the callback repository to which a callback should be made upon completion"
+        required: true
+        type: "string"
+      release-train-maven-repository-url:
+        description: "URL of a Maven repository to be used to resolve artifacts of projects earlier in the train"
+        required: true
+        type: "string"
+permissions:
+  contents: "read"
+concurrency:
+  group: "${{ github.workflow }}-${{ github.ref }}"
+jobs:
+  test-release:
+    name: "Test Release"
+    runs-on: "ubuntu22-2-8"
+    steps:
+    - name: "Prevent Re-runs"
+      id: "prevent-re-runs"
+      run: |-
+        if [ "$GITHUB_RUN_ATTEMPT" -gt 1 ]; then
+          echo "Re-runs are prohibited. Use the 'Release Train – Retry' workflow to retry test failures"
+          exit 1
+        fi
+    - name: "Set up Java"
+      id: "set-up-java"
+      uses: "actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95" # v5.6.0
+      with:
+        distribution: "liberica"
+        java-version: "25"
+    - name: "Check Out Code"
+      id: "check-out-code"
+      uses: "actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0" # v7.0.0
+    - name: "Restore Build System Caches"
+      id: "restore-build-system-caches"
+      uses: "actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9" # v6.1.0
+      with:
+        key: "release-train-${{ inputs.callback-ref }}-${{ github.ref_name }}"
+        path: |-
+          ~/.gradle/caches
+          ~/.gradle/wrapper
+    - name: "Test Release"
+      id: "test-release"
+      uses: "./.github/actions/release-train-test"
+      env:
+        COMMERCIAL_REPO_PASSWORD: "${{ secrets.COMMERCIAL_ARTIFACTORY_PASSWORD }}"
+        COMMERCIAL_REPO_USERNAME: "${{ secrets.COMMERCIAL_ARTIFACTORY_USERNAME }}"
+        RELEASE_TRAIN_MAVEN_REPOSITORY_PASSWORD: "${{ secrets.RELEASE_TRAIN_PARTICIPANT_MAVEN_REPOSITORY_PASSWORD }}"
+        RELEASE_TRAIN_MAVEN_REPOSITORY_URL: "${{ inputs.release-train-maven-repository-url }}"
+        RELEASE_TRAIN_MAVEN_REPOSITORY_USERNAME: "${{ secrets.RELEASE_TRAIN_PARTICIPANT_MAVEN_REPOSITORY_USERNAME }}"
+    - name: "Send Callback"
+      id: "send-callback"
+      if: "${{ !cancelled() }}"
+      env:
+        GH_TOKEN: "${{ secrets.RELEASE_TRAIN_PARTICIPANT_GITHUB_TOKEN }}"
+      run: |-
+        gh workflow run callback \
+        --repo ${{ inputs.callback }} \
+        --ref ${{ inputs.callback-ref }} \
+        --field commit-hash=${{ steps.check-out-code.outputs.commit }} \
+        --field release-branch=${{ github.ref_name }} \
+        --field release-repository=${{ github.repository }} \
+        --field result=${{ job.status == 'success' && 'tested' || 'test-failed' }} \
+        --field workflow-run-url=${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
+    - name: "Upload Build System Reports"
+      id: "upload-build-system-reports"
+      if: "${{ failure() }}"
+      uses: "actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a" # v7.0.1
+      with:
+        name: "build-system-reports"
+        path: "**/build/reports"
@@ -1,37 +0,0 @@
-name: Update Antora UI Spring
-
-on:
-  schedule:
-    - cron: '0 10 * * *' # Once per day at 10am UTC
-  workflow_dispatch:
-
-permissions:
-  pull-requests: write
-  issues: write
-  contents: write
-
-jobs:
-  update-antora-ui-spring:
-    name: Update on Supported Branches
-    if: ${{ github.repository == 'spring-projects/spring-security' }}
-    runs-on: ubuntu-latest
-    strategy:
-      matrix:
-        branch: [ '6.5.x', '7.0.x', 'main' ]
-    steps:
-      - uses: spring-io/spring-doc-actions/update-antora-spring-ui@415e2b11a766ba64799fffb5c97a4f7e17f677cf # v0.0.22
-        name: Update
-        with:
-          docs-branch: ${{ matrix.branch }}
-          token: ${{ secrets.GITHUB_TOKEN }}
-          antora-file-path: 'docs/antora-playbook.yml'
-  update-antora-ui-spring-docs-build:
-    name: Update on docs-build
-    if: ${{ github.repository == 'spring-projects/spring-security' }}
-    runs-on: ubuntu-latest
-    steps:
-      - uses: spring-io/spring-doc-actions/update-antora-spring-ui@415e2b11a766ba64799fffb5c97a4f7e17f677cf # v0.0.22
-        name: Update
-        with:
-          docs-branch: 'docs-build'
-          token: ${{ secrets.GITHUB_TOKEN }}
@@ -90,7 +90,7 @@ public class ExpressionBasedAnnotationAttributeFactory implements PrePostInvocat
 	}

 	/**
-	 * Delay the lookup of the {@link ExpressionParser} to prevent SEC-2136.
+	 * Delay the lookup of the {@link ExpressionParser} to prevent SEC-2136
 	 * @return
 	 */
 	private ExpressionParser getParser() {
@@ -30,9 +30,6 @@ import org.springframework.security.access.prepost.PostInvocationAuthorizationAd
 import org.springframework.security.core.Authentication;

 /**
- * A {@link PostInvocationAuthorizationAdvice} that applies {@code PostFilter} and
- * {@code PostAuthorize} expressions.
- *
 * @author Luke Taylor
 * @since 3.0
 * @deprecated Use
@@ -23,8 +23,6 @@ import org.springframework.expression.ParseException;
 import org.springframework.security.access.prepost.PostInvocationAttribute;

 /**
- * A {@link PostInvocationAttribute} based on filter and authorize expressions.
- *
 * @author Luke Taylor
 * @since 3.0
 * @deprecated Use
@@ -23,8 +23,6 @@ import org.springframework.expression.ParseException;
 import org.springframework.security.access.prepost.PreInvocationAttribute;

 /**
- * A {@link PreInvocationAttribute} based on parsed {@link Expression}s.
- *
 * @author Luke Taylor
 * @since 3.0
 * @deprecated Use
@@ -59,12 +59,12 @@ public class MapBasedMethodSecurityMetadataSource extends AbstractFallbackMethod
 	private @Nullable ClassLoader beanClassLoader = ClassUtils.getDefaultClassLoader();

 	/**
-	 * Map from RegisteredMethod to ConfigAttribute list.
+	 * Map from RegisteredMethod to ConfigAttribute list
 	 */
 	protected final Map<RegisteredMethod, List<ConfigAttribute>> methodMap = new HashMap<>();

 	/**
-	 * Map from RegisteredMethod to name pattern used for registration.
+	 * Map from RegisteredMethod to name pattern used for registration
 	 */
 	private final Map<RegisteredMethod, String> nameMap = new HashMap<>();

@@ -72,7 +72,7 @@ public class MapBasedMethodSecurityMetadataSource extends AbstractFallbackMethod
 	}

 	/**
-	 * Creates the <tt>MapBasedMethodSecurityMetadataSource</tt> from a.
+	 * Creates the <tt>MapBasedMethodSecurityMetadataSource</tt> from a
 	 * @param methodMap map of method names to <tt>ConfigAttribute</tt>s.
 	 */
 	public MapBasedMethodSecurityMetadataSource(Map<String, List<ConfigAttribute>> methodMap) {
@@ -236,7 +236,6 @@ public class MapBasedMethodSecurityMetadataSource extends AbstractFallbackMethod
 	}

 	/**
-	 * Returns the size of the method map.
 	 * @return map size (for unit tests and diagnostics)
 	 */
 	public int getMethodMapSize() {
@@ -41,7 +41,7 @@ import org.springframework.security.core.parameters.AnnotationParameterNameDisco
 public @interface P {

 	/**
-	 * The parameter name.
+	 * The parameter name
 	 * @return
 	 */
 	String value();
@@ -74,7 +74,7 @@ public class PrePostAdviceReactiveMethodInterceptor implements MethodInterceptor
 	private static final int RETURN_TYPE_METHOD_PARAMETER_INDEX = -1;

 	/**
-	 * Creates a new instance.
+	 * Creates a new instance
 	 * @param attributeSource the {@link MethodSecurityMetadataSource} to use
 	 * @param preInvocationAdvice the {@link PreInvocationAuthorizationAdvice} to use
 	 * @param postInvocationAdvice the {@link PostInvocationAuthorizationAdvice} to use
@@ -22,9 +22,6 @@ import org.springframework.aop.framework.AopInfrastructureBean;
 import org.springframework.security.authorization.AuthorizationManager;

 /**
- * A factory for creating {@link PreInvocationAttribute}s and
- * {@link PostInvocationAttribute}s.
- *
 * @author Luke Taylor
 * @since 3.0
 * @see org.springframework.security.authorization.method.AuthorizationManagerBeforeMethodInterceptor
@@ -19,7 +19,7 @@ package org.springframework.security.messaging.access.expression;
 import org.springframework.expression.EvaluationContext;

 /**
- * Allows post processing the {@link EvaluationContext}.
+ * Allows post processing the {@link EvaluationContext}
 *
 * <p>
 * This API is intentionally kept package scope as it may evolve over time.
@@ -46,7 +46,7 @@ class MessageExpressionConfigAttribute implements ConfigAttribute, EvaluationCon
 	private final MessageMatcher<Object> matcher;

 	/**
-	 * Creates a new instance.
+	 * Creates a new instance
 	 * @param authorizeExpression the {@link Expression} to use. Cannot be null
 	 * @param matcher the {@link MessageMatcher} used to match the messages.
 	 */
@@ -48,7 +48,7 @@ public final class ChannelSecurityInterceptor extends AbstractSecurityIntercepto
 	private final MessageSecurityMetadataSource metadataSource;

 	/**
-	 * Creates a new instance.
+	 * Creates a new instance
 	 * @param metadataSource the MessageSecurityMetadataSource to use. Cannot be null.
 	 *
 	 * @see DefaultMessageSecurityMetadataSource
@@ -20,7 +20,7 @@ import org.springframework.messaging.Message;
 import org.springframework.security.access.SecurityMetadataSource;

 /**
- * A {@link SecurityMetadataSource} that is used for securing {@link Message}.
+ * A {@link SecurityMetadataSource} that is used for securing {@link Message}
 *
 * @author Rob Winch
 * @since 4.0
@@ -32,8 +32,6 @@ import org.springframework.security.web.RedirectStrategy;
 import org.springframework.util.Assert;

 /**
- * A {@link ChannelEntryPoint} that retries the request on a different scheme and port.
- *
 * @author Luke Taylor
 * @deprecated please use
 * {@link org.springframework.security.web.transport.HttpsRedirectFilter} and its
@@ -47,12 +45,12 @@ public abstract class AbstractRetryEntryPoint implements ChannelEntryPoint {
 	private PortMapper portMapper = new PortMapperImpl();

 	/**
-	 * The scheme ("http://" or "https://").
+	 * The scheme ("http://" or "https://")
 	 */
 	private final String scheme;

 	/**
-	 * The standard port for the scheme (80 for http, 443 for https).
+	 * The standard port for the scheme (80 for http, 443 for https)
 	 */
 	private final int standardPort;

@@ -28,8 +28,6 @@ import org.springframework.security.core.Authentication;
 import org.springframework.security.web.FilterInvocation;

 /**
- * The default implementation of {@link SecurityExpressionHandler} for web security.
- *
 * @author Luke Taylor
 * @author Eddú Meléndez
 * @author Steve Riesenberg
@@ -54,7 +54,7 @@ public class FilterSecurityInterceptor extends AbstractSecurityInterceptor imple
 	private boolean observeOncePerRequest = false;

 	/**
-	 * Not used (we rely on IoC container lifecycle services instead).
+	 * Not used (we rely on IoC container lifecycle services instead)
 	 * @param arg0 ignored
 	 *
 	 */
@@ -63,7 +63,7 @@ public class FilterSecurityInterceptor extends AbstractSecurityInterceptor imple
 	}

 	/**
-	 * Not used (we rely on IoC container lifecycle services instead).
+	 * Not used (we rely on IoC container lifecycle services instead)
 	 */
 	@Override
 	public void destroy() {
@@ -141,7 +141,7 @@ public class BasicLookupStrategy implements LookupStrategy {
 	private AclClassIdUtils aclClassIdUtils;

 	/**
-	 * Constructor accepting mandatory arguments.
+	 * Constructor accepting mandatory arguments
 	 * @param dataSource to access the database
 	 * @param aclCache the cache where fully-loaded elements can be stored
 	 * @param aclAuthorizationStrategy authorization strategy (required)
@@ -152,7 +152,7 @@ public class BasicLookupStrategy implements LookupStrategy {
 	}

 	/**
-	 * Creates a new instance.
+	 * Creates a new instance
 	 * @param dataSource to access the database
 	 * @param aclCache the cache where fully-loaded elements can be stored
 	 * @param aclAuthorizationStrategy authorization strategy (required)
@@ -565,7 +565,7 @@ public class BasicLookupStrategy implements LookupStrategy {

 		/**
 		 * Accepts the current <code>ResultSet</code> row, and converts it into an
-		 * <code>AclImpl</code> that contains a <code>StubAclParent</code>.
+		 * <code>AclImpl</code> that contains a <code>StubAclParent</code>
 		 * @param acls the Map we should add the converted Acl to
 		 * @param rs the ResultSet focused on a current row
 		 * @throws SQLException if something goes wrong converting values
@@ -479,7 +479,6 @@ public class JdbcMutableAclService extends JdbcAclService implements MutableAclS
 	}

 	/**
-	 * Sets whether the database enforces foreign key constraints.
 	 * @param foreignKeysInDatabase if false this class will perform additional FK
 	 * constrain checking, which may cause deadlocks (the default is true, so deadlocks
 	 * are avoided but the database is expected to enforce FKs)
@@ -15,7 +15,7 @@
 */

 /**
- * JDBC-based persistence of ACL information.
+ * JDBC-based persistence of ACL information
 */
@NullMarked
 package org.springframework.security.acls.jdbc;
@@ -37,7 +37,6 @@ import org.jspecify.annotations.Nullable;
 public interface ObjectIdentity extends Serializable {

 	/**
-	 * Compares this <tt>ObjectIdentity</tt> to the given object for equality.
 	 * @param obj to be compared
 	 * @return <tt>true</tt> if the objects are equal, <tt>false</tt> otherwise
 	 * @see Object#equals(Object)
@@ -68,7 +67,6 @@ public interface ObjectIdentity extends Serializable {
 	String getType();

 	/**
-	 * Returns a hash code representation of the <tt>ObjectIdentity</tt>.
 	 * @return a hash code representation of the <tt>ObjectIdentity</tt>
 	 * @see Object#hashCode()
 	 */
@@ -31,8 +31,6 @@ import java.io.Serializable;
 public interface ObjectIdentityGenerator {

 	/**
-	 * Creates an {@link ObjectIdentity} using the supplied identifier and type
-	 * information.
 	 * @param id the identifier of the domain object, not null
 	 * @param type the type of the object (often a class name), not null
 	 * @return the identity constructed using the supplied identifier and type
@@ -18,7 +18,7 @@ package org.springframework.security.acls.model;

 /**
 * Strategy interface that provides the ability to determine which {@link ObjectIdentity}
- * will be returned for a particular domain object.
+ * will be returned for a particular domain object
 *
 * @author Ben Alex
 */
@@ -27,6 +27,7 @@ apply plugin: 'org.jetbrains.kotlin.jvm'
 apply plugin: 'org.springframework.security.versions.verify-dependencies-versions'
 apply plugin: 'org.springframework.security.check-expected-branch-version'
 apply plugin: 'io.spring.security.release'
+apply from: 'commercial-settings.gradle'

 group = 'org.springframework.security'
 description = 'Spring Security'
@@ -41,10 +42,12 @@ repositories {
 }

 springRelease {
+	repositoryOwner = "spring-projects"
+	repositoryName = "spring-security-commercial"
 	weekOfMonth = 3
 	dayOfWeek = 1
-	referenceDocUrl = "https://docs.spring.io/spring-security/reference/{version}/index.html"
-	apiDocUrl = "https://docs.spring.io/spring-security/reference/{version}/api/java/index.html"
+	referenceDocUrl = "https://docs.spring.vmware.com/spring-security/reference/{version}/index.html"
+	apiDocUrl = "https://docs.spring.vmware.com/spring-security/reference/{version}/api/java/index.html"
 	replaceSnapshotVersionInReferenceDocUrl = true
 }

@@ -72,12 +75,6 @@ allprojects {
 	}
 }

-develocity {
-	buildScan {
-		termsOfUseUrl = 'https://gradle.com/help/legal-terms-of-use'
-		termsOfUseAgree = 'yes'
-	}
-}

 nohttp {
 	source.exclude "buildSrc/build/**", "**/build/**", "**/target/**", "javascript/.gradle/**", "javascript/package-lock.json", "javascript/node_modules/**", "javascript/build/**", "javascript/dist/**"
@@ -13,7 +13,16 @@ java {
 repositories {
 	gradlePluginPortal()
 	mavenCentral()
-	maven { url = 'https://repo.spring.io/snapshot' }
+	if (project.hasProperty("artifactoryUsername") && project.hasProperty("artifactoryPassword")) {
+		maven {
+			name "spring-commercial-release"
+			url "https://usw1.packages.broadcom.com/spring-enterprise-maven-prod-local"
+			credentials {
+				username project.artifactoryUsername
+				password project.artifactoryPassword
+			}
+		}
+	}
 	if (System.getenv("RELEASE_TRAIN_MAVEN_REPOSITORY_URL") != null) {
 		maven {
 			name = "Release Train"
@@ -72,7 +72,7 @@ public class CasAuthenticationToken extends AbstractAuthenticationToken implemen
 	}

 	/**
-	 * Private constructor for Jackson Deserialization support.
+	 * Private constructor for Jackson Deserialization support
 	 * @param keyHash hashCode of provided key to identify if this object made by a given
 	 * {@link CasAuthenticationProvider}
 	 * @param principal typically the UserDetails object (cannot be <code>null</code>)
@@ -182,7 +182,7 @@ public class CasAuthenticationToken extends AbstractAuthenticationToken implemen
 	}

 	/**
-	 * A builder of {@link CasAuthenticationToken} instances.
+	 * A builder of {@link CasAuthenticationToken} instances
 	 *
 	 * @since 7.0
 	 */
@@ -208,7 +208,7 @@ public class CasAuthenticationToken extends AbstractAuthenticationToken implemen
 		}

 		/**
-		 * Use this key.
+		 * Use this key
 		 * @param key the key to use
 		 * @return the {@link Builder} for further configurations
 		 */
@@ -232,7 +232,7 @@ public class CasAuthenticationToken extends AbstractAuthenticationToken implemen
 		}

 		/**
-		 * Use this {@link UserDetails}.
+		 * Use this {@link UserDetails}
 		 * @param userDetails the {@link UserDetails} to use
 		 * @return the {@link Builder} for further configurations
 		 */
@@ -242,7 +242,7 @@ public class CasAuthenticationToken extends AbstractAuthenticationToken implemen
 		}

 		/**
-		 * Use this {@link Assertion}.
+		 * Use this {@link Assertion}
 		 * @param assertion the {@link Assertion} to use
 		 * @return the {@link Builder} for further configurations
 		 */
@@ -121,7 +121,7 @@ public class CasServiceTicketAuthenticationToken extends AbstractAuthenticationT
 	}

 	/**
-	 * A builder of {@link CasServiceTicketAuthenticationToken} instances.
+	 * A builder of {@link CasServiceTicketAuthenticationToken} instances
 	 *
 	 * @since 7.0
 	 */
@@ -32,7 +32,6 @@ import org.jspecify.annotations.Nullable;
 public final class NullStatelessTicketCache implements StatelessTicketCache {

 	/**
-	 * Always returns {@code null} since tickets are not stored.
 	 * @return null since we are not storing any tickets.
 	 */
 	@Override
@@ -20,11 +20,9 @@ import java.util.Date;
 import java.util.Map;

 import com.fasterxml.jackson.annotation.JsonAutoDetect;
-import com.fasterxml.jackson.annotation.JsonAutoDetect.Visibility;
 import com.fasterxml.jackson.annotation.JsonCreator;
 import com.fasterxml.jackson.annotation.JsonProperty;
 import com.fasterxml.jackson.annotation.JsonTypeInfo;
-import com.fasterxml.jackson.annotation.JsonTypeInfo.Id;
 import org.apereo.cas.client.authentication.AttributePrincipal;

 /**
@@ -38,14 +36,14 @@ import org.apereo.cas.client.authentication.AttributePrincipal;
 * @see CasJacksonModule
 * @see org.springframework.security.jackson.SecurityJacksonModules
 */
-@JsonTypeInfo(use = Id.CLASS)
-@JsonAutoDetect(fieldVisibility = Visibility.ANY, getterVisibility = Visibility.NONE,
-		isGetterVisibility = Visibility.NONE)
+@JsonTypeInfo(use = JsonTypeInfo.Id.CLASS)
+@JsonAutoDetect(fieldVisibility = JsonAutoDetect.Visibility.ANY, getterVisibility = JsonAutoDetect.Visibility.NONE,
+		isGetterVisibility = JsonAutoDetect.Visibility.NONE)
 class AssertionImplMixin {

 	/**
 	 * Mixin Constructor helps in deserialize
-	 * {@link org.apereo.cas.client.validation.AssertionImpl}.
+	 * {@link org.apereo.cas.client.validation.AssertionImpl}
 	 * @param principal the Principal to associate with the Assertion.
 	 * @param validFromDate when the assertion is valid from.
 	 * @param validUntilDate when the assertion is valid to.
@@ -19,11 +19,9 @@ package org.springframework.security.cas.jackson;
 import java.util.Map;

 import com.fasterxml.jackson.annotation.JsonAutoDetect;
-import com.fasterxml.jackson.annotation.JsonAutoDetect.Visibility;
 import com.fasterxml.jackson.annotation.JsonCreator;
 import com.fasterxml.jackson.annotation.JsonProperty;
 import com.fasterxml.jackson.annotation.JsonTypeInfo;
-import com.fasterxml.jackson.annotation.JsonTypeInfo.Id;
 import org.apereo.cas.client.proxy.ProxyRetriever;

 /**
@@ -37,14 +35,14 @@ import org.apereo.cas.client.proxy.ProxyRetriever;
 * @see CasJacksonModule
 * @see org.springframework.security.jackson.SecurityJacksonModules
 */
-@JsonTypeInfo(use = Id.CLASS)
-@JsonAutoDetect(fieldVisibility = Visibility.ANY, getterVisibility = Visibility.NONE,
-		isGetterVisibility = Visibility.NONE)
+@JsonTypeInfo(use = JsonTypeInfo.Id.CLASS)
+@JsonAutoDetect(fieldVisibility = JsonAutoDetect.Visibility.ANY, getterVisibility = JsonAutoDetect.Visibility.NONE,
+		isGetterVisibility = JsonAutoDetect.Visibility.NONE)
 class AttributePrincipalImplMixin {

 	/**
 	 * Mixin Constructor helps in deserialize
-	 * {@link org.apereo.cas.client.authentication.AttributePrincipalImpl}.
+	 * {@link org.apereo.cas.client.authentication.AttributePrincipalImpl}
 	 * @param name the unique identifier for the principal.
 	 * @param attributes the key/value pairs for this principal.
 	 * @param proxyGrantingTicket the ticket associated with this principal.
@@ -19,11 +19,9 @@ package org.springframework.security.cas.jackson;
 import java.util.Collection;

 import com.fasterxml.jackson.annotation.JsonAutoDetect;
-import com.fasterxml.jackson.annotation.JsonAutoDetect.Visibility;
 import com.fasterxml.jackson.annotation.JsonCreator;
 import com.fasterxml.jackson.annotation.JsonProperty;
 import com.fasterxml.jackson.annotation.JsonTypeInfo;
-import com.fasterxml.jackson.annotation.JsonTypeInfo.Id;
 import org.apereo.cas.client.validation.Assertion;

 import org.springframework.security.cas.authentication.CasAuthenticationProvider;
@@ -40,13 +38,13 @@ import org.springframework.security.core.userdetails.UserDetails;
 * @see CasJacksonModule
 * @see org.springframework.security.jackson.SecurityJacksonModules
 */
-@JsonTypeInfo(use = Id.CLASS)
-@JsonAutoDetect(fieldVisibility = Visibility.ANY, isGetterVisibility = Visibility.NONE,
-		getterVisibility = Visibility.NONE, creatorVisibility = Visibility.ANY)
+@JsonTypeInfo(use = JsonTypeInfo.Id.CLASS)
+@JsonAutoDetect(fieldVisibility = JsonAutoDetect.Visibility.ANY, isGetterVisibility = JsonAutoDetect.Visibility.NONE,
+		getterVisibility = JsonAutoDetect.Visibility.NONE, creatorVisibility = JsonAutoDetect.Visibility.ANY)
 class CasAuthenticationTokenMixin {

 	/**
-	 * Mixin Constructor helps in deserialize {@link CasAuthenticationToken}.
+	 * Mixin Constructor helps in deserialize {@link CasAuthenticationToken}
 	 * @param keyHash hashCode of provided key to identify if this object made by a given
 	 * {@link CasAuthenticationProvider}
 	 * @param principal typically the UserDetails object (cannot be <code>null</code>)
@@ -20,13 +20,10 @@ import java.util.Date;
 import java.util.Map;

 import com.fasterxml.jackson.annotation.JsonAutoDetect;
-import com.fasterxml.jackson.annotation.JsonAutoDetect.Visibility;
 import com.fasterxml.jackson.annotation.JsonCreator;
 import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
 import com.fasterxml.jackson.annotation.JsonProperty;
 import com.fasterxml.jackson.annotation.JsonTypeInfo;
-import com.fasterxml.jackson.annotation.JsonTypeInfo.As;
-import com.fasterxml.jackson.annotation.JsonTypeInfo.Id;
 import org.apereo.cas.client.authentication.AttributePrincipal;

 /**
@@ -52,15 +49,15 @@ import org.apereo.cas.client.authentication.AttributePrincipal;
 */
@SuppressWarnings("removal")
@Deprecated(forRemoval = true)
-@JsonTypeInfo(use = Id.CLASS, include = As.PROPERTY)
-@JsonAutoDetect(fieldVisibility = Visibility.ANY, getterVisibility = Visibility.NONE,
-		isGetterVisibility = Visibility.NONE)
+@JsonTypeInfo(use = JsonTypeInfo.Id.CLASS, include = JsonTypeInfo.As.PROPERTY)
+@JsonAutoDetect(fieldVisibility = JsonAutoDetect.Visibility.ANY, getterVisibility = JsonAutoDetect.Visibility.NONE,
+		isGetterVisibility = JsonAutoDetect.Visibility.NONE)
@JsonIgnoreProperties(ignoreUnknown = true)
 class AssertionImplMixin {

 	/**
 	 * Mixin Constructor helps in deserialize
-	 * {@link org.apereo.cas.client.validation.AssertionImpl}.
+	 * {@link org.apereo.cas.client.validation.AssertionImpl}
 	 * @param principal the Principal to associate with the Assertion.
 	 * @param validFromDate when the assertion is valid from.
 	 * @param validUntilDate when the assertion is valid to.
@@ -19,13 +19,10 @@ package org.springframework.security.cas.jackson2;
 import java.util.Map;

 import com.fasterxml.jackson.annotation.JsonAutoDetect;
-import com.fasterxml.jackson.annotation.JsonAutoDetect.Visibility;
 import com.fasterxml.jackson.annotation.JsonCreator;
 import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
 import com.fasterxml.jackson.annotation.JsonProperty;
 import com.fasterxml.jackson.annotation.JsonTypeInfo;
-import com.fasterxml.jackson.annotation.JsonTypeInfo.As;
-import com.fasterxml.jackson.annotation.JsonTypeInfo.Id;
 import org.apereo.cas.client.proxy.ProxyRetriever;

 /**
@@ -50,15 +47,15 @@ import org.apereo.cas.client.proxy.ProxyRetriever;
 */
@SuppressWarnings("removal")
@Deprecated(forRemoval = true)
-@JsonTypeInfo(use = Id.CLASS, include = As.PROPERTY)
-@JsonAutoDetect(fieldVisibility = Visibility.ANY, getterVisibility = Visibility.NONE,
-		isGetterVisibility = Visibility.NONE)
+@JsonTypeInfo(use = JsonTypeInfo.Id.CLASS, include = JsonTypeInfo.As.PROPERTY)
+@JsonAutoDetect(fieldVisibility = JsonAutoDetect.Visibility.ANY, getterVisibility = JsonAutoDetect.Visibility.NONE,
+		isGetterVisibility = JsonAutoDetect.Visibility.NONE)
@JsonIgnoreProperties(ignoreUnknown = true)
 class AttributePrincipalImplMixin {

 	/**
 	 * Mixin Constructor helps in deserialize
-	 * {@link org.apereo.cas.client.authentication.AttributePrincipalImpl}.
+	 * {@link org.apereo.cas.client.authentication.AttributePrincipalImpl}
 	 * @param name the unique identifier for the principal.
 	 * @param attributes the key/value pairs for this principal.
 	 * @param proxyGrantingTicket the ticket associated with this principal.
@@ -19,13 +19,10 @@ package org.springframework.security.cas.jackson2;
 import java.util.Collection;

 import com.fasterxml.jackson.annotation.JsonAutoDetect;
-import com.fasterxml.jackson.annotation.JsonAutoDetect.Visibility;
 import com.fasterxml.jackson.annotation.JsonCreator;
 import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
 import com.fasterxml.jackson.annotation.JsonProperty;
 import com.fasterxml.jackson.annotation.JsonTypeInfo;
-import com.fasterxml.jackson.annotation.JsonTypeInfo.As;
-import com.fasterxml.jackson.annotation.JsonTypeInfo.Id;
 import org.apereo.cas.client.validation.Assertion;

 import org.springframework.security.cas.authentication.CasAuthenticationProvider;
@@ -58,14 +55,14 @@ import org.springframework.security.core.userdetails.UserDetails;
 */
@SuppressWarnings("removal")
@Deprecated(forRemoval = true)
-@JsonTypeInfo(use = Id.CLASS, include = As.PROPERTY)
-@JsonAutoDetect(fieldVisibility = Visibility.ANY, isGetterVisibility = Visibility.NONE,
-		getterVisibility = Visibility.NONE, creatorVisibility = Visibility.ANY)
+@JsonTypeInfo(use = JsonTypeInfo.Id.CLASS, include = JsonTypeInfo.As.PROPERTY)
+@JsonAutoDetect(fieldVisibility = JsonAutoDetect.Visibility.ANY, isGetterVisibility = JsonAutoDetect.Visibility.NONE,
+		getterVisibility = JsonAutoDetect.Visibility.NONE, creatorVisibility = JsonAutoDetect.Visibility.ANY)
@JsonIgnoreProperties(ignoreUnknown = true)
 class CasAuthenticationTokenMixin {

 	/**
-	 * Mixin Constructor helps in deserialize {@link CasAuthenticationToken}.
+	 * Mixin Constructor helps in deserialize {@link CasAuthenticationToken}
 	 * @param keyHash hashCode of provided key to identify if this object made by a given
 	 * {@link CasAuthenticationProvider}
 	 * @param principal typically the UserDetails object (cannot be <code>null</code>)
@@ -155,7 +155,7 @@ public class CasAuthenticationEntryPoint implements AuthenticationEntryPoint, In
 	}

 	/**
-	 * Sets the {@link RedirectStrategy} to use.
+	 * Sets the {@link RedirectStrategy} to use
 	 * @param redirectStrategy the {@link RedirectStrategy} to use
 	 * @since 6.3
 	 */
@@ -69,7 +69,7 @@ public final class CasGatewayAuthenticationRedirectFilter extends GenericFilterB
 	private RedirectStrategy redirectStrategy = new DefaultRedirectStrategy();

 	/**
-	 * Constructs a new instance of this class.
+	 * Constructs a new instance of this class
 	 * @param serviceProperties the {@link ServiceProperties}
 	 */
 	public CasGatewayAuthenticationRedirectFilter(String casLoginUrl, ServiceProperties serviceProperties) {
@@ -44,7 +44,7 @@ final class DefaultServiceAuthenticationDetails extends WebAuthenticationDetails
 	private final String serviceUrl;

 	/**
-	 * Creates a new instance.
+	 * Creates a new instance
 	 * @param request the current {@link HttpServletRequest} to obtain the
 	 * {@link #getServiceUrl()} from.
 	 * @param artifactPattern the {@link Pattern} that will be used to clean up the query
@@ -53,7 +53,7 @@ public class ServiceAuthenticationDetailsSource
 	}

 	/**
-	 * Creates an implementation that uses the specified artifactParameterName.
+	 * Creates an implementation that uses the specified artifactParameterName
 	 * @param serviceProperties The ServiceProperties to use to construct the serviceUrl.
 	 * @param artifactParameterName the artifactParameterName that is removed from the
 	 * current URL. The result becomes the service url. Cannot be null and cannot be an
@@ -66,7 +66,6 @@ public class ServiceAuthenticationDetailsSource
 	}

 	/**
-	 * Builds the {@code ServiceAuthenticationDetails} from the given request.
 	 * @param context the {@code HttpServletRequest} object.
 	 * @return the {@code ServiceAuthenticationDetails} containing information about the
 	 * current request
@@ -0,0 +1,27 @@
+subprojects {
+	repositories {
+		mavenCentral()
+		def repoUsername = project.findProperty("artifactoryUsername") ?: System.getenv("COMMERCIAL_REPO_USERNAME")
+		def repoPassword = project.findProperty("artifactoryPassword") ?: System.getenv("COMMERCIAL_REPO_PASSWORD")
+		if (repoUsername && repoPassword) {
+			maven {
+				name "spring-commercial-release"
+				url "https://usw1.packages.broadcom.com/spring-enterprise-maven-prod-local"
+				credentials {
+					username repoUsername
+					password repoPassword
+				}
+			}
+			if ("$version".endsWith("-SNAPSHOT")) {
+				maven {
+					name "spring-commercial-snapshot"
+					url "https://usw1.packages.broadcom.com/spring-enterprise-maven-dev-local"
+					credentials {
+						username repoUsername
+						password repoPassword
+					}
+				}
+			}
+		}
+	}
+}
@@ -25,8 +25,6 @@ import org.springframework.security.ldap.userdetails.LdapAuthoritiesPopulator;
 import org.springframework.security.ldap.userdetails.PersonContextMapper;

 /**
- * Test configurations for namespace-based LDAP {@code AuthenticationProvider} setup.
- *
 * @author Rob Winch
 *
 */
@@ -50,8 +50,6 @@ import static org.assertj.core.api.Assertions.assertThat;
 import static org.assertj.core.api.Assertions.assertThatExceptionOfType;

 /**
- * Integration tests for anonymous authentication over RSocket.
- *
 * @author Andrey Litvitski
 */
@ContextConfiguration
@@ -50,8 +50,6 @@ import static org.assertj.core.api.Assertions.assertThat;
 import static org.assertj.core.api.Assertions.assertThatExceptionOfType;

 /**
- * Integration tests for securing RSocket requests and responses.
- *
 * @author Rob Winch
 */
@ContextConfiguration
@@ -60,8 +60,6 @@ import static org.mockito.Mockito.times;
 import static org.mockito.Mockito.verify;

 /**
- * Integration tests for RSocket security observations.
- *
 * @author Rob Winch
 */
@ContextConfiguration
@@ -50,8 +50,6 @@ import static org.assertj.core.api.Assertions.assertThat;
 import static org.assertj.core.api.Assertions.assertThatExceptionOfType;

 /**
- * Integration tests for RSocket security combined with WebFlux security.
- *
 * @author Rob Winch
 */
@ContextConfiguration
@@ -59,8 +59,6 @@ import static org.mockito.BDDMockito.given;
 import static org.mockito.Mockito.mock;

 /**
- * Integration tests for RSocket JWT authentication.
- *
 * @author Rob Winch
 */
@ContextConfiguration
@@ -53,8 +53,6 @@ import static org.assertj.core.api.Assertions.assertThat;
 import static org.assertj.core.api.Assertions.assertThatExceptionOfType;

 /**
- * Integration tests for connecting to an {@link RSocketMessageHandler} secured server.
- *
 * @author Rob Winch
 * @author Luis Felipe Vega
 * @author Jesús Ascama Arias
@@ -55,8 +55,6 @@ import static org.assertj.core.api.Assertions.assertThat;
 import static org.assertj.core.api.Assertions.assertThatExceptionOfType;

 /**
- * Integration tests for securing an {@link RSocketMessageHandler}.
- *
 * @author Rob Winch
 */
@ContextConfiguration
@@ -55,8 +55,6 @@ import static org.assertj.core.api.Assertions.assertThat;
 import static org.assertj.core.api.Assertions.assertThatExceptionOfType;

 /**
- * Integration tests for securing RSocket requests using simple authentication metadata.
- *
 * @author Rob Winch
 */
@ContextConfiguration
@@ -32,8 +32,6 @@ import org.springframework.test.util.ReflectionTestUtils;
 import static org.assertj.core.api.Assertions.assertThat;

 /**
- * Tests for the {@code ldap-server} XML namespace element.
- *
 * @author Luke Taylor
 * @author Rob Winch
 */
@@ -39,8 +39,6 @@ import static org.assertj.core.api.Assertions.assertThat;
 import static org.mockito.Mockito.mock;

 /**
- * Tests for the {@code ldap-user-service} bean definition parser.
- *
 * @author Luke Taylor
 * @author Rob Winch
 * @author Eddú Meléndez
@@ -31,7 +31,7 @@ public abstract class BeanIds {

 	/**
 	 * The "global" AuthenticationManager instance, registered by the
-	 * &lt;authentication-manager&gt; element.
+	 * &lt;authentication-manager&gt; element
 	 */
 	public static final String AUTHENTICATION_MANAGER = PREFIX + "authenticationManager";

@@ -25,9 +25,6 @@ import org.springframework.beans.factory.xml.ParserContext;
 import org.springframework.security.config.debug.SecurityDebugBeanFactoryPostProcessor;

 /**
- * Parses the {@code debug} element to register a
- * {@link SecurityDebugBeanFactoryPostProcessor}.
- *
 * @author Luke Taylor
 */
 public class DebugBeanDefinitionParser implements BeanDefinitionParser {
@@ -94,7 +94,7 @@ public final class SecurityNamespaceHandler implements NamespaceHandler {
 	public BeanDefinition parse(Element element, ParserContext pc) {
 		if (!namespaceMatchesVersion(element)) {
 			pc.getReaderContext()
-				.fatal("You cannot use any XSD older than spring-security-7.1.xsd. Either change to spring-security.xsd or spring-security-7.1.xsd",
+				.fatal("You cannot use any XSD older than spring-security-7.2.xsd. Either change to spring-security.xsd or spring-security-7.2.xsd",
 						element);
 		}
 		String name = pc.getDelegate().getLocalName(element);
@@ -219,7 +219,7 @@ public final class SecurityNamespaceHandler implements NamespaceHandler {

 	private boolean matchesVersionInternal(Element element) {
 		String schemaLocation = element.getAttributeNS("http://www.w3.org/2001/XMLSchema-instance", "schemaLocation");
-		return schemaLocation.matches("(?m).*spring-security-7\\.1.*.xsd.*")
+		return schemaLocation.matches("(?m).*spring-security-7\\.2.*.xsd.*")
 				|| schemaLocation.matches("(?m).*spring-security.xsd.*")
 				|| !schemaLocation.matches("(?m).*spring-security.*");
 	}
@@ -187,7 +187,7 @@ public abstract class AbstractConfiguredSecurityBuilder<O, B extends SecurityBui
 	}

 	/**
-	 * Gets the shared objects.
+	 * Gets the shared objects
 	 * @return the shared Objects
 	 */
 	public Map<Class<?>, Object> getSharedObjects() {
@@ -315,7 +315,7 @@ public abstract class AbstractConfiguredSecurityBuilder<O, B extends SecurityBui

 	/**
 	 * Executes the build using the {@link SecurityConfigurer}'s that have been applied
-	 * using the following steps:.
+	 * using the following steps:
 	 *
 	 * <ul>
 	 * <li>Invokes {@link #beforeInit()} for any subclass to hook into</li>
@@ -406,7 +406,7 @@ public abstract class AbstractConfiguredSecurityBuilder<O, B extends SecurityBui
 	}

 	/**
-	 * The build state for the application.
+	 * The build state for the application
 	 *
 	 * @author Rob Winch
 	 * @since 3.2
@@ -414,7 +414,7 @@ public abstract class AbstractConfiguredSecurityBuilder<O, B extends SecurityBui
 	private enum BuildState {

 		/**
-		 * This is the state before the {@link SecurityBuilder#build()} is invoked.
+		 * This is the state before the {@link SecurityBuilder#build()} is invoked
 		 */
 		UNBUILT(0),

@@ -455,7 +455,7 @@ public abstract class AbstractConfiguredSecurityBuilder<O, B extends SecurityBui
 		}

 		/**
-		 * Determines if the state is CONFIGURING or later.
+		 * Determines if the state is CONFIGURING or later
 		 * @return
 		 */
 		public boolean isConfigured() {
@@ -17,7 +17,7 @@
 package org.springframework.security.config.annotation;

 /**
- * Interface for building an Object.
+ * Interface for building an Object
 *
 * @param <O> The type of the Object being built
 * @author Rob Winch
@@ -115,7 +115,7 @@ public abstract class SecurityConfigurerAdapter<O, B extends SecurityBuilder<O>>
 		}

 		/**
-		 * Adds an {@link ObjectPostProcessor} to use.
+		 * Adds an {@link ObjectPostProcessor} to use
 		 * @param objectPostProcessor the {@link ObjectPostProcessor} to add
 		 * @return true if the {@link ObjectPostProcessor} was added, else false
 		 */
@@ -22,7 +22,7 @@ import org.springframework.security.authentication.ProviderManager;
 import org.springframework.security.config.annotation.SecurityBuilder;

 /**
- * Interface for operating on a SecurityBuilder that creates a {@link ProviderManager}.
+ * Interface for operating on a SecurityBuilder that creates a {@link ProviderManager}
 *
 * @param <B> the type of the {@link SecurityBuilder}
 * @author Rob Winch
@@ -66,7 +66,7 @@ public class AuthenticationManagerBuilder
 	private AuthenticationEventPublisher eventPublisher;

 	/**
-	 * Creates a new instance.
+	 * Creates a new instance
 	 * @param objectPostProcessor the {@link ObjectPostProcessor} instance to use.
 	 */
 	public AuthenticationManagerBuilder(ObjectPostProcessor<Object> objectPostProcessor) {
@@ -92,7 +92,7 @@ public class AuthenticationManagerBuilder
 	}

 	/**
-	 * Sets the {@link AuthenticationEventPublisher}.
+	 * Sets the {@link AuthenticationEventPublisher}
 	 * @param eventPublisher the {@link AuthenticationEventPublisher} to use
 	 * @return the {@link AuthenticationManagerBuilder} for further customizations
 	 */
@@ -103,7 +103,6 @@ public class AuthenticationManagerBuilder
 	}

 	/**
-	 * Sets whether the {@link AuthenticationManager} should clear the credentials.
 	 * @param eraseCredentials true if {@link AuthenticationManager} should clear the
 	 * credentials from the {@link Authentication} object after authenticating
 	 * @return the {@link AuthenticationManagerBuilder} for further customizations
@@ -54,7 +54,7 @@ import org.springframework.security.crypto.password.PasswordEncoder;
 import org.springframework.util.Assert;

 /**
- * Exports the authentication {@link Configuration}.
+ * Exports the authentication {@link Configuration}
 *
 * @author Rob Winch
 * @author Ngoc Nhan
@@ -265,7 +265,7 @@ public class AuthenticationConfiguration {
 		private PasswordEncoder defaultPasswordEncoder;

 		/**
-		 * Creates a new instance.
+		 * Creates a new instance
 		 * @param objectPostProcessor the {@link ObjectPostProcessor} instance to use.
 		 */
 		DefaultPasswordEncoderAuthenticationManagerBuilder(ObjectPostProcessor<Object> objectPostProcessor,
@@ -42,7 +42,6 @@ class InitializeAuthenticationProviderBeanManagerConfigurer extends GlobalAuthen
 	private final ApplicationContext context;

 	/**
-	 * Creates a new instance.
 	 * @param context the ApplicationContext to look up beans.
 	 */
 	InitializeAuthenticationProviderBeanManagerConfigurer(ApplicationContext context) {
@@ -49,7 +49,6 @@ class InitializeUserDetailsBeanManagerConfigurer extends GlobalAuthenticationCon
 	private final ApplicationContext context;

 	/**
-	 * Creates a new instance using the given {@link ApplicationContext}.
 	 * @param context
 	 */
 	InitializeUserDetailsBeanManagerConfigurer(ApplicationContext context) {
@@ -113,8 +112,6 @@ class InitializeUserDetailsBeanManagerConfigurer extends GlobalAuthenticationCon
 		}

 		/**
-		 * Returns a bean of the requested class if there's just a single registered
-		 * component, null otherwise.
 		 * @return a bean of the requested class if there's just a single registered
 		 * component, null otherwise.
 		 */
@@ -136,7 +136,7 @@ public class LdapAuthenticationProviderConfigurer<B extends ProviderManagerBuild

 	/**
 	 * Gets the {@link LdapAuthoritiesPopulator} and defaults to
-	 * {@link DefaultLdapAuthoritiesPopulator}.
+	 * {@link DefaultLdapAuthoritiesPopulator}
 	 * @return the {@link LdapAuthoritiesPopulator}
 	 */
 	private LdapAuthoritiesPopulator getLdapAuthoritiesPopulator() {
@@ -185,7 +185,7 @@ public class LdapAuthenticationProviderConfigurer<B extends ProviderManagerBuild
 	}

 	/**
-	 * Creates the {@link LdapAuthenticator} to use.
+	 * Creates the {@link LdapAuthenticator} to use
 	 * @param contextSource the {@link BaseLdapPathContextSource} to use
 	 * @return the {@link LdapAuthenticator} to use
 	 */
@@ -203,7 +203,7 @@ public class LdapAuthenticationProviderConfigurer<B extends ProviderManagerBuild
 	}

 	/**
-	 * Creates {@link PasswordComparisonAuthenticator}.
+	 * Creates {@link PasswordComparisonAuthenticator}
 	 * @param contextSource the {@link BaseLdapPathContextSource} to use
 	 * @return
 	 */
@@ -218,7 +218,7 @@ public class LdapAuthenticationProviderConfigurer<B extends ProviderManagerBuild
 	}

 	/**
-	 * Creates a {@link BindAuthenticator}.
+	 * Creates a {@link BindAuthenticator}
 	 * @param contextSource the {@link BaseLdapPathContextSource} to use
 	 * @return the {@link BindAuthenticator} to use
 	 */
@@ -395,7 +395,6 @@ public class LdapAuthenticationProviderConfigurer<B extends ProviderManagerBuild
 	}

 	/**
-	 * Enables password-based comparison for authentication.
 	 * @return the {@link PasswordCompareConfigurer} for further customizations
 	 */
 	public PasswordCompareConfigurer passwordCompare() {
@@ -404,7 +403,7 @@ public class LdapAuthenticationProviderConfigurer<B extends ProviderManagerBuild
 	}

 	/**
-	 * Sets up Password based comparison.
+	 * Sets up Password based comparison
 	 *
 	 * @author Rob Winch
 	 */
@@ -435,7 +434,7 @@ public class LdapAuthenticationProviderConfigurer<B extends ProviderManagerBuild

 		/**
 		 * Allows obtaining a reference to the
-		 * {@link LdapAuthenticationProviderConfigurer} for further customizations.
+		 * {@link LdapAuthenticationProviderConfigurer} for further customizations
 		 * @return attribute in the directory which contains the user password
 		 */
 		public LdapAuthenticationProviderConfigurer<B> and() {
@@ -548,7 +547,7 @@ public class LdapAuthenticationProviderConfigurer<B extends ProviderManagerBuild

 		/**
 		 * Gets the {@link LdapAuthenticationProviderConfigurer} for further
-		 * customizations.
+		 * customizations
 		 * @return the {@link LdapAuthenticationProviderConfigurer} for further
 		 * customizations
 		 */
@@ -35,7 +35,7 @@ public class InMemoryUserDetailsManagerConfigurer<B extends ProviderManagerBuild
 		extends UserDetailsManagerConfigurer<B, InMemoryUserDetailsManagerConfigurer<B>> {

 	/**
-	 * Creates a new instance.
+	 * Creates a new instance
 	 */
 	public InMemoryUserDetailsManagerConfigurer() {
 		super(new InMemoryUserDetailsManager(new ArrayList<>()));
@@ -140,7 +140,7 @@ public class JdbcUserDetailsManagerConfigurer<B extends ProviderManagerBuilder<B
 	}

 	/**
-	 * Defines the {@link UserCache} to use.
+	 * Defines the {@link UserCache} to use
 	 * @param userCache the {@link UserCache} to use
 	 * @return the {@link JdbcUserDetailsManagerConfigurer} for further customizations
 	 */
@@ -112,7 +112,7 @@ public class UserDetailsManagerConfigurer<B extends ProviderManagerBuilder<B>, C
 		private final C builder;

 		/**
-		 * Creates a new instance.
+		 * Creates a new instance
 		 * @param builder the builder to return
 		 */
 		private UserDetailsBuilder(C builder) {
@@ -25,7 +25,7 @@ import org.springframework.security.core.userdetails.UserDetailsService;
 import org.springframework.security.crypto.password.PasswordEncoder;

 /**
- * Allows configuring a {@link DaoAuthenticationProvider}.
+ * Allows configuring a {@link DaoAuthenticationProvider}
 *
 * @param <B> the type of the {@link SecurityBuilder}
 * @param <C> the type of {@link AbstractDaoAuthenticationConfigurer} this is
@@ -41,7 +41,7 @@ public abstract class AbstractDaoAuthenticationConfigurer<B extends ProviderMana
 	private final U userDetailsService;

 	/**
-	 * Creates a new instance.
+	 * Creates a new instance
 	 * @param userDetailsService
 	 */
 	AbstractDaoAuthenticationConfigurer(U userDetailsService) {
@@ -88,7 +88,7 @@ public abstract class AbstractDaoAuthenticationConfigurer<B extends ProviderMana

 	/**
 	 * Gets the {@link UserDetailsService} that is used with the
-	 * {@link DaoAuthenticationProvider}.
+	 * {@link DaoAuthenticationProvider}
 	 * @return the {@link UserDetailsService} that is used with the
 	 * {@link DaoAuthenticationProvider}
 	 */
@@ -21,7 +21,7 @@ import org.springframework.security.config.annotation.authentication.ProviderMan
 import org.springframework.security.core.userdetails.UserDetailsService;

 /**
- * Allows configuring a {@link DaoAuthenticationProvider}.
+ * Allows configuring a {@link DaoAuthenticationProvider}
 *
 * @param <B> The type of {@link ProviderManagerBuilder} this is
 * @param <U> The type of {@link UserDetailsService} that is being used
@@ -32,7 +32,7 @@ public class DaoAuthenticationConfigurer<B extends ProviderManagerBuilder<B>, U
 		extends AbstractDaoAuthenticationConfigurer<B, DaoAuthenticationConfigurer<B, U>, U> {

 	/**
-	 * Creates a new instance.
+	 * Creates a new instance
 	 * @param userDetailsService
 	 */
 	public DaoAuthenticationConfigurer(U userDetailsService) {
@@ -34,7 +34,7 @@ public abstract class UserDetailsAwareConfigurer<B extends ProviderManagerBuilde
 		extends SecurityConfigurerAdapter<AuthenticationManager, B> {

 	/**
-	 * Gets the {@link UserDetailsService} or null if it is not available.
+	 * Gets the {@link UserDetailsService} or null if it is not available
 	 * @return the {@link UserDetailsService} or null if it is not available
 	 */
 	public abstract U getUserDetailsService();
@@ -35,7 +35,7 @@ public class UserDetailsServiceConfigurer<B extends ProviderManagerBuilder<B>, C
 		extends AbstractDaoAuthenticationConfigurer<B, C, U> {

 	/**
-	 * Creates a new instance.
+	 * Creates a new instance
 	 * @param userDetailsService the {@link UserDetailsService} that should be used
 	 */
 	public UserDetailsServiceConfigurer(U userDetailsService) {
@@ -28,8 +28,6 @@ import org.springframework.core.Ordered;
 import org.springframework.security.authorization.ReactiveAuthorizationManager;

 /**
- * Enables Spring Security reactive method security.
- *
 * @author Rob Winch
 * @since 5.0
 */
@@ -39,8 +39,6 @@ import org.springframework.security.access.prepost.PrePostAnnotationSecurityMeta
 import org.springframework.security.config.core.GrantedAuthorityDefaults;

 /**
- * Configures the infrastructure beans for reactive method security.
- *
 * @author Rob Winch
 * @author Tadaya Tsuyukubo
 * @since 5.0
@@ -30,8 +30,6 @@ import org.springframework.util.Assert;
 import org.springframework.util.ClassUtils;

 /**
- * Selects the imports to register for {@link EnableReactiveMethodSecurity}.
- *
 * @author Rob Winch
 * @author Evgeniy Cheban
 * @since 5.0
@@ -154,7 +154,7 @@ public class RSocketSecurity {
 	/**
 	 * Adds support for validating a username and password using <a href=
 	 * "https://github.com/rsocket/rsocket/blob/5920ed374d008abb712cb1fd7c9d91778b2f4a68/Extensions/Security/Simple.md">Simple
-	 * Authentication</a>.
+	 * Authentication</a>
 	 * @param simple a customizer
 	 * @return RSocketSecurity for additional configuration
 	 * @since 5.3
@@ -168,7 +168,7 @@ public class RSocketSecurity {
 	}

 	/**
-	 * Adds anonymous authentication.
+	 * Adds anonymous authentication
 	 * @param anonymous a customizer
 	 * @return this instance
 	 * @since 7.0
@@ -265,9 +265,6 @@ public class RSocketSecurity {
 	}

 	/**
-	 * Specifies the {@link ReactiveAuthenticationManager} to use for simple
-	 * authentication.
-	 *
 	 * @since 5.3
 	 */
 	public final class SimpleAuthenticationSpec {
@@ -289,7 +286,7 @@ public class RSocketSecurity {
 			return this.authenticationManager;
 		}

-		AuthenticationPayloadInterceptor build() {
+		protected AuthenticationPayloadInterceptor build() {
 			ReactiveAuthenticationManager manager = getAuthenticationManager();
 			AuthenticationPayloadInterceptor result = new AuthenticationPayloadInterceptor(manager);
 			result.setAuthenticationConverter(new AuthenticationPayloadExchangeConverter());
@@ -307,7 +304,7 @@ public class RSocketSecurity {
 			this.parent = parent;
 		}

-		AnonymousPayloadInterceptor build() {
+		protected AnonymousPayloadInterceptor build() {
 			AnonymousPayloadInterceptor result = new AnonymousPayloadInterceptor("anonymousUser");
 			result.setOrder(PayloadInterceptorOrder.ANONYMOUS.getOrder());
 			return result;
@@ -338,7 +335,7 @@ public class RSocketSecurity {
 			return this.authenticationManager;
 		}

-		AuthenticationPayloadInterceptor build() {
+		protected AuthenticationPayloadInterceptor build() {
 			ReactiveAuthenticationManager manager = getAuthenticationManager();
 			AuthenticationPayloadInterceptor result = new AuthenticationPayloadInterceptor(manager);
 			result.setOrder(PayloadInterceptorOrder.AUTHENTICATION.getOrder());
@@ -371,7 +368,7 @@ public class RSocketSecurity {
 			return RSocketSecurity.this.authenticationManager;
 		}

-		List<AuthenticationPayloadInterceptor> build() {
+		protected List<AuthenticationPayloadInterceptor> build() {
 			ReactiveAuthenticationManager manager = getAuthenticationManager();
 			AuthenticationPayloadInterceptor legacy = new AuthenticationPayloadInterceptor(manager);
 			legacy.setAuthenticationConverter(new BearerPayloadExchangeConverter());
@@ -396,7 +393,7 @@ public class RSocketSecurity {
 		/**
 		 * Matches if
 		 * {@link org.springframework.security.rsocket.api.PayloadExchangeType#isRequest()}
-		 * is true, else not a match.
+		 * is true, else not a match
 		 * @return the Access to set up the authorization rule.
 		 */
 		public Access anyRequest() {
@@ -404,7 +401,7 @@ public class RSocketSecurity {
 		}

 		/**
-		 * Always matches.
+		 * Always matches
 		 * @return the Access to set up the authorization rule.
 		 */
 		public Access anyExchange() {
@@ -30,8 +30,6 @@ import org.springframework.security.core.userdetails.ReactiveUserDetailsService;
 import org.springframework.security.crypto.password.PasswordEncoder;

 /**
- * {@link Configuration} for RSocket security infrastructure beans.
- *
 * @author Rob Winch
 * @since 5.2
 */
@@ -26,8 +26,6 @@ import org.springframework.security.rsocket.core.SecuritySocketAcceptorIntercept
 import org.springframework.security.rsocket.util.matcher.PayloadExchangeMatcher.MatchResult;

 /**
- * {@link Configuration} that exposes a {@link SecuritySocketAcceptorInterceptor} bean.
- *
 * @author Rob Winch
 * @since 5.2
 */
@@ -61,7 +61,7 @@ public abstract class AbstractRequestMatcherRegistry<C> {
 	}

 	/**
-	 * Gets the {@link ApplicationContext}.
+	 * Gets the {@link ApplicationContext}
 	 * @return the {@link ApplicationContext}
 	 */
 	protected final ApplicationContext getApplicationContext() {
@@ -111,7 +111,7 @@ public abstract class AbstractRequestMatcherRegistry<C> {

 	/**
 	 * Associates a list of {@link RequestMatcher} instances with the
-	 * {@link AbstractRequestMatcherRegistry}.
+	 * {@link AbstractRequestMatcherRegistry}
 	 * @param requestMatchers the {@link RequestMatcher} instances
 	 * @return the object that is chained after creating the {@link RequestMatcher}
 	 */
@@ -203,7 +203,6 @@ public abstract class AbstractRequestMatcherRegistry<C> {
 	 * If a specific {@link RequestMatcher} must be specified, use
 	 * {@link #requestMatchers(RequestMatcher...)} instead
 	 * </p>
-	 * .
 	 * @param method the {@link HttpMethod} to use or {@code null} for any
 	 * {@link HttpMethod}.
 	 * @return the object that is chained after creating the {@link RequestMatcher}.
@@ -53,9 +53,6 @@ import org.springframework.security.web.session.SessionManagementFilter;
 import org.springframework.web.filter.CorsFilter;

 /**
- * A builder for a {@link DefaultSecurityFilterChain} that allows configuring and ordering
- * the standard Spring Security {@link Filter} instances.
- *
 * @param <H>
 * @author Rob Winch
 */
@@ -92,14 +89,14 @@ public interface HttpSecurityBuilder<H extends HttpSecurityBuilder<H>>
 	<C> C getSharedObject(Class<C> sharedType);

 	/**
-	 * Allows adding an additional {@link AuthenticationProvider} to be used.
+	 * Allows adding an additional {@link AuthenticationProvider} to be used
 	 * @param authenticationProvider the {@link AuthenticationProvider} to be added
 	 * @return the {@link HttpSecurity} for further customizations
 	 */
 	H authenticationProvider(AuthenticationProvider authenticationProvider);

 	/**
-	 * Allows adding an additional {@link UserDetailsService} to be used.
+	 * Allows adding an additional {@link UserDetailsService} to be used
 	 * @param userDetailsService the {@link UserDetailsService} to be added
 	 * @return the {@link HttpSecurity} for further customizations
 	 */
@@ -159,7 +159,7 @@ public final class HttpSecurity extends AbstractConfiguredSecurityBuilder<Defaul
 	private AuthenticationManager authenticationManager;

 	/**
-	 * Creates a new instance.
+	 * Creates a new instance
 	 * @param objectPostProcessor the {@link ObjectPostProcessor} that should be used
 	 * @param authenticationBuilder the {@link AuthenticationManagerBuilder} to use for
 	 * additional updates
@@ -2092,7 +2092,7 @@ public final class HttpSecurity extends AbstractConfiguredSecurityBuilder<Defaul
 	}

 	/**
-	 * Allows mapping HTTP requests that this {@link HttpSecurity} will be used for.
+	 * Allows mapping HTTP requests that this {@link HttpSecurity} will be used for
 	 *
 	 * @author Rob Winch
 	 * @since 3.2
@@ -144,7 +144,7 @@ public final class WebSecurity extends AbstractConfiguredSecurityBuilder<Filter,
 	private ServletContext servletContext;

 	/**
-	 * Creates a new instance.
+	 * Creates a new instance
 	 * @param objectPostProcessor the {@link ObjectPostProcessor} to use
 	 * @see WebSecurityConfiguration
 	 */
@@ -279,7 +279,7 @@ public final class WebSecurity extends AbstractConfiguredSecurityBuilder<Filter,
 	}

 	/**
-	 * Executes the Runnable immediately after the build takes place.
+	 * Executes the Runnable immediately after the build takes place
 	 * @param postBuildAction
 	 * @return the {@link WebSecurity} for further customizations
 	 */
@@ -290,7 +290,7 @@ public final class WebSecurity extends AbstractConfiguredSecurityBuilder<Filter,

 	/**
 	 * Sets the handler to handle
-	 * {@link org.springframework.security.web.firewall.RequestRejectedException}.
+	 * {@link org.springframework.security.web.firewall.RequestRejectedException}
 	 * @param requestRejectedHandler
 	 * @return the {@link WebSecurity} for further customizations
 	 * @since 5.7
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
Josh Cummings	b512ea6352	Release 7.2.0-M1 Signed-off-by: Josh Cummings <3627351+jzheaux@users.noreply.github.com>	2026-08-13 16:39:08 -06:00
Josh Cummings	076ef2cc74	Update to Spring Data 2026.1.0-M1 Closes gh-19531 Signed-off-by: Josh Cummings <3627351+jzheaux@users.noreply.github.com>	2026-08-13 16:39:08 -06:00
Josh Cummings	3cedc1a2e4	Update to Micrometer 1.18.0-M1 Closes gh-19530 Signed-off-by: Josh Cummings <3627351+jzheaux@users.noreply.github.com>	2026-08-13 16:39:07 -06:00
Josh Cummings	d32b23e497	Update to Reactor 2026.0.0-M1 Closes gh-19529 Signed-off-by: Josh Cummings <3627351+jzheaux@users.noreply.github.com>	2026-08-13 16:39:07 -06:00
Josh Cummings	b58eef0d5d	Update to Spring Framework 7.1.0-M1 Closes gh-19528 Signed-off-by: Josh Cummings <3627351+jzheaux@users.noreply.github.com>	2026-08-13 16:39:07 -06:00
Josh Cummings	1202f08f3e	Configure Build for Commercial Repositories Signed-off-by: Josh Cummings <3627351+jzheaux@users.noreply.github.com>	2026-08-13 16:39:07 -06:00
Josh Cummings	8e315eae11	Configure with Commercial Workflows Signed-off-by: Josh Cummings <3627351+jzheaux@users.noreply.github.com>	2026-08-13 16:39:07 -06:00
Josh Cummings	03a504b4ff	Remove OSS CI configuration	2026-08-13 16:39:07 -06:00
Josh Cummings	3c458bc661	Use jspecify Nullable in DPoPProofReplayValidator org.springframework.lang.Nullable is banned by the bannedNullabilityImports checkstyle rule on this line; the embargoed commit that introduced this file predates that rule's adoption here. Switch to org.jspecify.annotations.Nullable to match the rest of the codebase (already used correctly elsewhere in this same file). Signed-off-by: Josh Cummings <3627351+jzheaux@users.noreply.github.com>	2026-08-13 16:34:32 -06:00
Josh Cummings	1bb9ed906e	Align Null Behavior Previously, ExternalInetAddressMatcher treated a null InetAddress as external by negating InternalInetAddressMatcher's result. This commit makes ExternalInetAddressMatcher return false for a null address, so that neither the internal nor the external matcher classifies an unknown address as a match. Signed-off-by: Josh Cummings <3627351+jzheaux@users.noreply.github.com>	2026-08-13 16:34:32 -06:00
Josh Cummings	fc9a3f95ec	Deprecate AesBytesEncryptor This commit separates AesBytesEncryptor into two separate implememtations, allowing for a migration away from default arrangements that used a null IV Signed-off-by: Josh Cummings <3627351+jzheaux@users.noreply.github.com>	2026-08-13 16:34:32 -06:00
Josh Cummings	7f1700d043	Improve Equivalence Tests This commit adds equals and hashCode implementations as well as a readResolve implementation to ensure that deserialization mechanisms can correctly assess the equality of a constnat and a corresponding deserialized instance. For defense-in-depth reasons, this commit also favors .equals over == for these constants. Signed-off-by: Josh Cummings <3627351+jzheaux@users.noreply.github.com>	2026-08-13 16:34:32 -06:00
Joe Grandja	56456601ab	Bind UnboundIdContainer to loopback address	2026-08-13 16:34:32 -06:00
Joe Grandja	249ea55494	Apply html encoding in DefaultConsentPage	2026-08-13 16:34:32 -06:00
Joe Grandja	43f42d8e32	Provide ability to configure DPoP proof replay	2026-08-13 16:34:32 -06:00
Josh Cummings	734d989c32	Use Constant-Time Comparison This commit updates password encoders to use a constant-time comparison method to defend against timing attacks Signed-off-by: Josh Cummings <3627351+jzheaux@users.noreply.github.com>	2026-08-13 16:34:32 -06:00
Josh Cummings	2f572278d4	Use Utf8#isEqual Signed-off-by: Josh Cummings <3627351+jzheaux@users.noreply.github.com>	2026-08-13 16:34:32 -06:00
Josh Cummings	816066ab60	Use Constant-Time Equals This commit updates the filter to use constant-time equals for sensitive material Signed-off-by: Josh Cummings <3627351+jzheaux@users.noreply.github.com>	2026-08-13 16:34:32 -06:00
Josh Cummings	fb3f864d27	Use Constant-Time Equals This commit updates the filter to use constant-time equals for sensitive material Signed-off-by: Josh Cummings <3627351+jzheaux@users.noreply.github.com>	2026-08-13 16:34:32 -06:00
Josh Cummings	ab29661a68	Add Utf8#isEqual This commit adds a constant-time equals method, useful for comparing password hashes or other sensitive material Signed-off-by: Josh Cummings <3627351+jzheaux@users.noreply.github.com>	2026-08-13 16:34:32 -06:00
Josh Cummings	35abf87e2e	Use MessageDigest#isEqual This commit favors constant-time comparison to mitigate timing attacks Signed-off-by: Josh Cummings <3627351+jzheaux@users.noreply.github.com>	2026-08-13 16:34:32 -06:00
Josh Cummings	4e3811cb29	Add Tests for User and Device Code Signed-off-by: Josh Cummings <3627351+jzheaux@users.noreply.github.com>	2026-08-13 16:34:31 -06:00
Josh Cummings	82241b6cb8	Merge branch '7.1.x' Closes gh-19549	2026-08-13 15:59:03 -06:00
Josh Cummings	6eb16dc35e	Merge branch '7.1.x' Closes gh-19546	2026-08-13 15:20:47 -06:00
Josh Cummings	1ad93f45f8	Add Test Coverage for Implicit CORS Bean Detection Verify that <cors> detects a PreFlightRequestHandler bean and uses a PreFlightRequestFilter when no explicit ref or configuration-source-ref is given and no mvcHandlerMappingIntrospector bean is present. See gh-19542 Signed-off-by: Josh Cummings <3627351+jzheaux@users.noreply.github.com>	2026-08-13 13:25:09 -06:00
Josh Cummings	8c9a8e3f6c	Suppress Removal Warnings on RestOperations Usage Spring Framework 7.1 deprecates RestTemplate and related types for removal. Suppress the resulting warnings at existing internal usage sites until they are migrated to RestClient per gh-19027. Closes gh-19544 Signed-off-by: Josh Cummings <3627351+jzheaux@users.noreply.github.com>	2026-08-13 11:59:50 -06:00
Josh Cummings	a8f54db7e4	Disable CORS Tests Relying on HandlerMappingIntrospector Spring Framework 7.1 removes HandlerMappingIntrospector-derived implicit CORS handling for plain requests; these tests assert the old behavior. Closes gh-19543 Signed-off-by: Josh Cummings <3627351+jzheaux@users.noreply.github.com>	2026-08-13 11:54:26 -06:00
Josh Cummings	24bfdc1dee	Support Implicit CORS Bean Detection in <cors> Namespace Add CorsFilterFactoryBean so the <cors> XML element can detect a CorsConfigurationSource or PreFlightRequestHandler bean implicitly, matching CorsConfigurer's existing Java config behavior. Closes gh-19542 Signed-off-by: Josh Cummings <3627351+jzheaux@users.noreply.github.com>	2026-08-13 11:53:36 -06:00
Josh Cummings	8876c30b00	Disable Lowercase HTTP Method Firewall Test Spring Framework's HttpMethod#valueOf now normalizes casing, so StrictServerWebExchangeFirewall no longer detects a non-canonical-case HTTP method as distinct from its canonical form. Closes gh-19541 Signed-off-by: Josh Cummings <3627351+jzheaux@users.noreply.github.com>	2026-08-13 11:51:30 -06:00
Josh Cummings	94d36e603b	Merge branch '7.1.x' Closes gh-19540	2026-08-13 11:37:03 -06:00
dependabot[bot]	329e9e6d71	Bump org.apache.httpcomponents.client5:httpclient5 from 5.6.3 to 5.6.4 Bumps [org.apache.httpcomponents.client5:httpclient5](https://github.com/apache/httpcomponents-client) from 5.6.3 to 5.6.4. - [Changelog](https://github.com/apache/httpcomponents-client/blob/rel/v5.6.4/RELEASE_NOTES.txt) - [Commits](https://github.com/apache/httpcomponents-client/compare/rel/v5.6.3...rel/v5.6.4) --- updated-dependencies: - dependency-name: org.apache.httpcomponents.client5:httpclient5 dependency-version: 5.6.4 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>	2026-08-13 03:18:39 +00:00
Josh Cummings	09a3280442	Merge branch '7.1.x'	2026-08-11 19:41:02 -06:00
Josh Cummings	88aedba0bf	Update What's New Issue gh-17655 Signed-off-by: Josh Cummings <3627351+jzheaux@users.noreply.github.com>	2026-08-11 16:30:43 -06:00
Josh Cummings	f95a956345	Merge branch '7.1.x'	2026-08-11 16:20:05 -06:00
Josh Cummings	30cc0f21a9	Fix Documentation Sample Structure Signed-off-by: Josh Cummings <3627351+jzheaux@users.noreply.github.com>	2026-08-11 15:18:49 -07:00
Josh Cummings	c096e45242	Support Account Status Checks in OneTimeTokenReactiveAuthenticationManager Add the same opt-in UserDetailsChecker support to OneTimeTokenReactiveAuthenticationManager, mirroring OneTimeTokenAuthenticationProvider for the reactive stack. Issue gh-17655 Signed-off-by: Josh Cummings <3627351+jzheaux@users.noreply.github.com>	2026-08-11 15:18:49 -07:00
Josh Cummings	b3e262187c	Make OneTimeTokenAuthenticationProvider Account Status Checks Opt-In OneTimeTokenAuthenticationProvider no longer validates account status by default. Applications can opt in via setUserDetailsChecker, for example by providing AccountStatusUserDetailsChecker to reject locked, disabled, or expired accounts. Issue gh-17655 Signed-off-by: Josh Cummings <3627351+jzheaux@users.noreply.github.com>	2026-08-11 15:18:49 -07:00
Andrey Litvitski	64fa98da1a	Validate account status in OneTimeTokenAuthenticationProvider The main problem is that OneTimeTokenAuthenticationProvider does not extend from AbstractUserDetailsAuthenticationProvider, which has a preauthentication check for user details. However, we do not need to extend from it because it does not fit the context of the class. In this regard, I decided to add my own checker to this commit, which performs a preauthentication check before authorizing the account, similar to how it is done in AbstractUserDetailsAuthenticationProvider. I also added a test to OneTimeTokenAuthenticationProviderTests that identifies this problem. Closes gh-17655 Signed-off-by: Andrey Litvitski <andrey1010102008@gmail.com>	2026-08-11 15:18:49 -07:00
Josh Cummings	26b20b2dd2	Merge branch '7.1.x'	2026-08-11 14:00:54 -06:00
dependabot[bot]	e4d43fb89a	Bump com.nimbusds:oauth2-oidc-sdk from 11.38.1 to 11.38.2 Bumps [com.nimbusds:oauth2-oidc-sdk](https://bitbucket.org/connect2id/oauth-2.0-sdk-with-openid-connect-extensions) from 11.38.1 to 11.38.2 and com.nimbusds:nimbus-jose-jwt from 10.9 to 10.9.1, which oauth2-oidc-sdk 11.38.2 requires. - [Changelog](https://bitbucket.org/connect2id/oauth-2.0-sdk-with-openid-connect-extensions/src/master/CHANGELOG.txt) - [Commits](https://bitbucket.org/connect2id/oauth-2.0-sdk-with-openid-connect-extensions/branches/compare/11.38.2..11.38.1) --- updated-dependencies: - dependency-name: com.nimbusds:oauth2-oidc-sdk dependency-version: 11.38.2 dependency-type: direct:production update-type: version-update:semver-patch - dependency-name: com.nimbusds:nimbus-jose-jwt dependency-version: 10.9.1 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>	2026-08-11 17:59:52 +00:00
Josh Cummings	04c08bb42a	Merge branch '7.1.x'	2026-08-11 11:09:29 -06:00
Josh Cummings	73c93cebaf	Remove 6.5.x from Dependabot Signed-off-by: Josh Cummings <3627351+jzheaux@users.noreply.github.com>	2026-08-11 10:25:22 -06:00
Josh Cummings	3c6df7df1f	Update to 7.2.0-SNAPSHOT	2026-08-11 10:25:22 -06:00
dependabot[bot]	70b161c772	Bump org.junit:junit-bom from 6.1.2 to 6.1.3 Bumps [org.junit:junit-bom](https://github.com/junit-team/junit-framework) from 6.1.2 to 6.1.3. - [Release notes](https://github.com/junit-team/junit-framework/releases) - [Commits](https://github.com/junit-team/junit-framework/compare/r6.1.2...r6.1.3) --- updated-dependencies: - dependency-name: org.junit:junit-bom dependency-version: 6.1.3 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>	2026-08-11 03:24:26 +00:00