rm .github/workflows for unsupported branch

.gitattributes

@@ -15,4 +15,3 @@
 *.otg      binary
 *.png      binary
 *.hsx      binary
-*.serialized binary

.github/ISSUE_TEMPLATE/bug.md

@@ -7,10 +7,6 @@ assignees: ''
 
 ---
 
-<!--
-Do NOT report Security Vulnerabilities here. Please use https://github.com/spring-projects/spring-security/security/policy
--->
-
 **Describe the bug**
 A clear and concise description of what the bug is.
 

.github/dco.yml

@@ -1,2 +0,0 @@
-require:
-  members: false

.github/dependabot.yml

@@ -1,203 +0,0 @@
-version: 2
-registries:
-  shibboleth:
-    type: maven-repository
-    url: https://build.shibboleth.net/maven/releases
-updates:
-  # 6.5.x
-  - package-ecosystem: gradle
-    target-branch: 6.5.x
-    directory: /
-    schedule:
-      interval: daily
-      time: '03:00'
-      timezone: Etc/UTC
-    labels:
-      - 'type: dependency-upgrade'
-      - 'in: build'
-    registries:
-      - shibboleth
-    ignore:
-      - dependency-name: com.nimbusds:nimbus-jose-jwt
-      - dependency-name: org.python:jython
-      - dependency-name: org.apache.directory.server:*
-      - dependency-name: org.apache.directory.shared:*
-      - dependency-name: org.junit:junit-bom
-        update-types:
-          - version-update:semver-major
-      - dependency-name: org.mockito:mockito-bom
-        update-types:
-          - version-update:semver-major
-      - dependency-name: '*'
-        update-types:
-          - version-update:semver-major
-          - version-update:semver-minor
-  - package-ecosystem: npm
-    target-branch: 6.5.x
-    directory: /docs
-    schedule:
-      interval: weekly
-    labels:
-      - 'type: task'
-      - 'type: dependency-upgrade'
-      - 'in: build'
-  - package-ecosystem: github-actions
-    target-branch: 6.5.x
-    directory: /
-    schedule:
-      interval: weekly
-    labels:
-      - 'type: task'
-      - 'type: dependency-upgrade'
-      - 'in: build'
-
-  # 7.0.x
-  - package-ecosystem: gradle
-    target-branch: 7.0.x
-    directory: /
-    schedule:
-      interval: daily
-      time: '03:00'
-      timezone: Etc/UTC
-    labels:
-      - 'type: dependency-upgrade'
-      - 'in: build'
-    registries:
-      - shibboleth
-    ignore:
-      - dependency-name: com.nimbusds:nimbus-jose-jwt
-      - dependency-name: io.spring.nullability:*
-      - dependency-name: org.python:jython
-      - dependency-name: org.apache.directory.server:*
-      - dependency-name: org.apache.directory.shared:*
-      - dependency-name: org.junit:junit-bom
-        update-types:
-          - version-update:semver-major
-      - dependency-name: org.mockito:mockito-bom
-        update-types:
-          - version-update:semver-major
-      - dependency-name: com.gradle.enterprise
-        update-types:
-          - version-update:semver-major
-          - version-update:semver-minor
-      - dependency-name: '*'
-        update-types:
-          - version-update:semver-major
-          - version-update:semver-minor
-  - package-ecosystem: npm
-    target-branch: 7.0.x
-    directory: /docs
-    schedule:
-      interval: weekly
-    labels:
-      - 'type: task'
-      - 'type: dependency-upgrade'
-      - 'in: build'
-  - package-ecosystem: github-actions
-    target-branch: 7.0.x
-    directory: /
-    schedule:
-      interval: weekly
-    labels:
-      - 'type: task'
-      - 'type: dependency-upgrade'
-      - 'in: build'
-
-  # main
-  - package-ecosystem: gradle
-    target-branch: main
-    directory: /
-    schedule:
-      interval: daily
-      time: '03:00'
-      timezone: Etc/UTC
-    labels:
-      - 'type: dependency-upgrade'
-      - 'in: build'
-    registries:
-      - shibboleth
-    ignore:
-      - dependency-name: com.nimbusds:nimbus-jose-jwt
-      - dependency-name: org.python:jython
-      - dependency-name: org.apache.directory.server:*
-      - dependency-name: org.apache.directory.shared:*
-      - dependency-name: org.junit:junit-bom
-        update-types:
-          - version-update:semver-major
-      - dependency-name: org.mockito:mockito-bom
-        update-types:
-          - version-update:semver-major
-      - dependency-name: com.gradle.enterprise
-        update-types:
-          - version-update:semver-major
-          - version-update:semver-minor
-      - dependency-name: '*'
-        update-types:
-          - version-update:semver-major
-  - package-ecosystem: npm
-    target-branch: main
-    directory: /docs
-    schedule:
-      interval: weekly
-    labels:
-      - 'type: task'
-      - 'type: dependency-upgrade'
-      - 'in: build'
-  - package-ecosystem: github-actions
-    target-branch: main
-    directory: /
-    schedule:
-      interval: weekly
-    labels:
-      - 'type: task'
-      - 'type: dependency-upgrade'
-      - 'in: build'
-
-  # docs-build
-  - package-ecosystem: gradle
-    target-branch: docs-build
-    directory: /
-    schedule:
-      interval: daily
-      time: '03:00'
-      timezone: Etc/UTC
-    labels:
-      - 'type: dependency-upgrade'
-    registries:
-      - shibboleth
-    ignore:
-      - dependency-name: com.nimbusds:nimbus-jose-jwt
-      - dependency-name: org.python:jython
-      - dependency-name: org.apache.directory.server:*
-      - dependency-name: org.apache.directory.shared:*
-      - dependency-name: org.junit:junit-bom
-        update-types:
-          - version-update:semver-major
-      - dependency-name: org.mockito:mockito-bom
-        update-types:
-          - version-update:semver-major
-      - dependency-name: com.gradle.enterprise
-        update-types:
-          - version-update:semver-major
-          - version-update:semver-minor
-      - dependency-name: '*'
-        update-types:
-          - version-update:semver-major
-  - package-ecosystem: npm
-    target-branch: docs-build
-    directory: /
-    schedule:
-      interval: weekly
-    labels:
-      - 'type: task'
-      - 'type: dependency-upgrade'
-      - 'in: build'
-  - package-ecosystem: github-actions
-    target-branch: docs-build
-    directory: /
-    schedule:
-      interval: weekly
-    labels:
-      - 'type: task'
-      - 'type: dependency-upgrade'
-      - 'in: build'

.github/workflows/auto-merge-dependabot.yml

@@ -1,17 +0,0 @@
-name: Merge Dependabot PR
-
-on:
-  pull_request:
-    branches:
-      - main
-      - '*.x'
-      - 'docs-build'
-
-run-name: Merge Dependabot PR ${{ github.ref_name }}
-
-jobs:
-  merge-dependabot-pr:
-    permissions: write-all
-    uses: spring-io/spring-github-workflows/.github/workflows/spring-merge-dependabot-pr.yml@0d3f15bb384839966a1ff5c4383731a2b747f24b # v7
-    with:
-      mergeArguments: --auto --rebase

.github/workflows/check-snapshots.yml

@@ -1,36 +0,0 @@
-name: CI
-
-on:
-  schedule:
-    - cron: '0 10 * * *' # Once per day at 10am UTC
-  workflow_dispatch: # Manual trigger
-
-env:
-  DEVELOCITY_ACCESS_KEY: ${{ secrets.DEVELOCITY_ACCESS_KEY }}
-
-permissions:
-  contents: read
-
-jobs:
-  snapshot-test:
-    name: Test Against Snapshots
-    uses: spring-io/spring-security-release-tools/.github/workflows/test.yml@b92832ecbc7cbe969201e6beafbde0ee400cf095 # v1.0.15
-    strategy:
-      matrix:
-        include:
-          - java-version: 25
-            toolchain: 25
-    with:
-      java-version: ${{ matrix.java-version }}
-      test-args: --refresh-dependencies -PforceMavenRepositories=snapshot,https://oss.sonatype.org/content/repositories/snapshots -PisOverrideVersionCatalog -PtestToolchain=${{ matrix.toolchain }} -PspringFrameworkVersion=7.0.+ -PreactorVersion=2025.+ -PspringDataVersion=2025.+ -PmicrometerVersion=1.+ --stacktrace
-    secrets: inherit
-  send-notification:
-    name: Send Notification
-    needs: [ snapshot-test ]
-    if: ${{ !success() }}
-    runs-on: ubuntu-latest
-    steps:
-      - name: Send Notification
-        uses: spring-io/spring-security-release-tools/.github/actions/send-notification@b92832ecbc7cbe969201e6beafbde0ee400cf095 # v1.0.15
-        with:
-          webhook-url: ${{ secrets.SPRING_SECURITY_CI_GCHAT_WEBHOOK_URL }}

.github/workflows/clean_build_artifacts.yml

@@ -1,23 +0,0 @@
-name: Clean build artifacts
-on:
-  schedule:
-    - cron: '0 10 * * *' # Once per day at 10am UTC
-
-permissions:
-  contents: read
-
-jobs:
-  main:
-    runs-on: ubuntu-latest
-    if: ${{ github.repository == 'spring-projects/spring-security' }}
-    permissions:
-      contents: none
-    steps:
-      - name: Delete artifacts in cron job
-        env:
-          GH_ACTIONS_REPO_TOKEN: ${{ secrets.GH_ACTIONS_REPO_TOKEN }}
-        run: |
-          echo "Running clean build artifacts logic"
-          output=$(curl -X GET -H "Authorization: token $GH_ACTIONS_REPO_TOKEN" https://api.github.com/repos/spring-projects/spring-security/actions/artifacts | grep '"id"' | cut -d : -f2 | sed 's/,*$//g')
-          echo Output is $output
-          for id in $output; do curl -X DELETE -H "Authorization: token $GH_ACTIONS_REPO_TOKEN" https://api.github.com/repos/spring-projects/spring-security/actions/artifacts/$id; done;

.github/workflows/codeql.yml

@@ -1,17 +0,0 @@
-name: "CodeQL Advanced"
-
-on:
-  push:
-  pull_request:
-  workflow_dispatch:
-  schedule:
-    # https://docs.github.com/en/actions/writing-workflows/choosing-when-your-workflow-runs/events-that-trigger-workflows#schedule
-    - cron: '0 5 * * *'
-permissions: read-all
-jobs:
-  codeql-analysis-call:
-    permissions:
-      actions: read
-      contents: read
-      security-events: write
-    uses: spring-io/github-actions/.github/workflows/codeql-analysis.yml@e415dadd0910c901e7a7fabd67bbb355b2324500 # 1

.github/workflows/continuous-integration-workflow.yml

@@ -1,69 +0,0 @@
-name: CI
-
-on:
-  push:
-    branches-ignore:
-      - "dependabot/**"
-  schedule:
-    - cron: '0 10 * * *' # Once per day at 10am UTC
-  workflow_dispatch: # Manual trigger
-
-env:
-  DEVELOCITY_ACCESS_KEY: ${{ secrets.DEVELOCITY_ACCESS_KEY }}
-
-permissions:
-  contents: read
-
-jobs:
-  build:
-    name: Build
-    uses: spring-io/spring-security-release-tools/.github/workflows/build.yml@b92832ecbc7cbe969201e6beafbde0ee400cf095 # v1.0.15
-    strategy:
-      matrix:
-        os: [ ubuntu-latest, windows-latest ]
-        jdk: [ 25 ]
-    with:
-      runs-on: ${{ matrix.os }}
-      java-version: ${{ matrix.jdk }}
-      distribution: temurin
-    secrets: inherit
-  deploy-artifacts:
-    name: Deploy Artifacts
-    needs: [ build ]
-    uses: spring-io/spring-security-release-tools/.github/workflows/deploy-artifacts.yml@b92832ecbc7cbe969201e6beafbde0ee400cf095 # v1.0.15
-    with:
-      should-deploy-artifacts: ${{ needs.build.outputs.should-deploy-artifacts }}
-      default-publish-milestones-central: true
-      java-version: 25
-    secrets: inherit
-  deploy-schema:
-    name: Deploy Schema
-    needs: [ build ]
-    uses: spring-io/spring-security-release-tools/.github/workflows/deploy-schema.yml@b92832ecbc7cbe969201e6beafbde0ee400cf095 # v1.0.15
-    with:
-      should-deploy-schema: ${{ needs.build.outputs.should-deploy-artifacts }}
-      java-version: 25
-    secrets: inherit
-  perform-release:
-    name: Perform Release
-    needs: [ deploy-artifacts, deploy-schema ]
-    uses: spring-io/spring-security-release-tools/.github/workflows/perform-release.yml@b92832ecbc7cbe969201e6beafbde0ee400cf095 # v1.0.15
-    with:
-      should-perform-release: ${{ needs.deploy-artifacts.outputs.artifacts-deployed }}
-      project-version: ${{ needs.deploy-artifacts.outputs.project-version }}
-      milestone-repo-url: https://repo1.maven.org/maven2
-      release-repo-url: https://repo1.maven.org/maven2
-      artifact-path: org/springframework/security/spring-security-core
-      slack-announcing-id: spring-security-announcing
-      java-version: 25
-    secrets: inherit
-  send-notification:
-    name: Send Notification
-    needs: [ perform-release ]
-    if: ${{ !success() }}
-    runs-on: ubuntu-latest
-    steps:
-      - name: Send Notification
-        uses: spring-io/spring-security-release-tools/.github/actions/send-notification@b92832ecbc7cbe969201e6beafbde0ee400cf095 # v1.0.15
-        with:
-          webhook-url: ${{ secrets.SPRING_SECURITY_CI_GCHAT_WEBHOOK_URL }}

.github/workflows/defer-issues.yml

@@ -1,76 +0,0 @@
-name: Defer Issues
-
-on:
-  workflow_dispatch:
-
-permissions:
-  contents: read
-
-jobs:
-  defer-issues:
-    name: Defer Issues
-    runs-on: ubuntu-latest
-    if: github.repository_owner == 'spring-projects'
-    permissions:
-      issues: write
-    steps:
-    - name: Checkout
-      uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
-    - name: Compute Version
-      id: compute-version
-      uses: spring-io/spring-release-actions/compute-version@a1f321783a0769dd2aea4fad6c2ae2f95a52b885 # 0.0.5
-    - name: Get Today's Release Version
-      id: todays-release
-      uses: spring-io/spring-release-actions/get-todays-release-version@a1f321783a0769dd2aea4fad6c2ae2f95a52b885 # 0.0.5
-      with:
-        snapshot-version: ${{ steps.compute-version.outputs.version }}
-        milestone-repository: ${{ github.repository }}
-        milestone-token: ${{ secrets.GITHUB_TOKEN }}
-    - name: Compute Next Version
-      id: next-version
-      uses: spring-io/spring-release-actions/compute-next-version@a1f321783a0769dd2aea4fad6c2ae2f95a52b885 # 0.0.5
-      with:
-        version: ${{ steps.todays-release.outputs.release-version }}
-    - name: Schedule Next Milestone
-      uses: spring-io/spring-release-actions/schedule-milestone@a1f321783a0769dd2aea4fad6c2ae2f95a52b885 # 0.0.5
-      with:
-        version: ${{ steps.next-version.outputs.version }}
-        version-date: ${{ steps.next-version.outputs.version-date }}
-        repository: ${{ github.repository }}
-        token: ${{ secrets.GITHUB_TOKEN }}
-    - name: Move Open Issues to Next Milestone
-      env:
-        GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        CURRENT_MILESTONE: ${{ steps.todays-release.outputs.release-version }}
-        NEXT_MILESTONE: ${{ steps.next-version.outputs.version }}
-      run: |
-        current_milestone_number=$(gh api repos/${{ github.repository }}/milestones \
-          --jq ".[] | select(.title == \"$CURRENT_MILESTONE\") | .number")
-        if [ -z "$current_milestone_number" ]; then
-          echo "No milestone found for $CURRENT_MILESTONE"
-          exit 0
-        fi
-        next_milestone_number=$(gh api repos/${{ github.repository }}/milestones \
-          --jq ".[] | select(.title == \"$NEXT_MILESTONE\") | .number")
-        if [ -z "$next_milestone_number" ]; then
-          echo "No milestone found for $NEXT_MILESTONE"
-          exit 1
-        fi
-        echo "Moving open issues from milestone '$CURRENT_MILESTONE' (#$current_milestone_number) to '$NEXT_MILESTONE' (#$next_milestone_number)"
-        page=1
-        while true; do
-          issues=$(gh api "repos/${{ github.repository }}/issues?milestone=$current_milestone_number&state=open&per_page=100&page=$page" \
-            --jq '.[].number')
-          if [ -z "$issues" ]; then
-            break
-          fi
-          for issue in $issues; do
-            echo "Moving issue/PR #$issue to milestone $NEXT_MILESTONE"
-            gh api repos/${{ github.repository }}/issues/$issue \
-              --method PATCH \
-              --field milestone=$next_milestone_number \
-              --silent
-          done
-          page=$((page + 1))
-        done
-        echo "Done."

.github/workflows/deploy-docs.yml

@@ -1,33 +0,0 @@
-name: Deploy Docs
-on:
-  push:
-    branches-ignore:
-      - "gh-pages"
-      - "dependabot/**"
-    tags: '**'
-  repository_dispatch:
-    types: request-build-reference # legacy
-  #schedule:
-  #- cron: '0 10 * * *' # Once per day at 10am UTC
-  workflow_dispatch:
-permissions: read-all
-jobs:
-  build:
-    runs-on: ubuntu-latest
-    if: github.repository_owner == 'spring-projects'
-    steps:
-    - name: Checkout
-      uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
-      with:
-        ref: docs-build
-        fetch-depth: 1
-    - name: Dispatch (partial build)
-      if: github.ref_type == 'branch'
-      env:
-        GH_TOKEN: ${{ secrets.GH_ACTIONS_REPO_TOKEN }}
-      run: gh workflow run deploy-docs.yml -r $(git rev-parse --abbrev-ref HEAD) -f build-refname=${{ github.ref_name }}
-    - name: Dispatch (full build)
-      if: github.ref_type == 'tag'
-      env:
-        GH_TOKEN: ${{ secrets.GH_ACTIONS_REPO_TOKEN }}
-      run: gh workflow run deploy-docs.yml -r $(git rev-parse --abbrev-ref HEAD)

.github/workflows/finalize-release.yml

@@ -1,27 +0,0 @@
-name: Finalize Release
-
-on:
-  workflow_dispatch: # Manual trigger
-    inputs:
-      version:
-        description: The Spring Security release to finalize (e.g. 7.0.0-RC2)
-        required: true
-
-env:
-  DEVELOCITY_ACCESS_KEY: ${{ secrets.DEVELOCITY_ACCESS_KEY }}
-
-permissions:
-  contents: read
-
-jobs:
-  perform-release:
-    name: Perform Release
-    uses: spring-io/spring-security-release-tools/.github/workflows/perform-release.yml@b92832ecbc7cbe969201e6beafbde0ee400cf095 # v1.0.15
-    with:
-      should-perform-release: true
-      project-version: ${{ inputs.version }}
-      milestone-repo-url: https://repo1.maven.org/maven2
-      release-repo-url: https://repo1.maven.org/maven2
-      artifact-path: org/springframework/security/spring-security-core
-      slack-announcing-id: spring-security-announcing
-    secrets: inherit

.github/workflows/gradle-wrapper-upgrade-execution.yml

@@ -1,34 +0,0 @@
-name: Execute Gradle Wrapper Upgrade
-
-on:
-  schedule:
-    - cron:  '0 2 * * *' # 2am UTC
-  workflow_dispatch:
-permissions:
-  pull-requests: write
-jobs:
-  upgrade_wrapper:
-    name: Execution
-    if: ${{ github.repository == 'spring-projects/spring-security' }}
-    runs-on: ubuntu-latest
-    steps:
-      - name: Set up Git configuration
-        env:
-          TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: |
-          git config --global url."https://unused-username:${TOKEN}@github.com/".insteadOf "https://github.com/"
-          git config --global user.name 'github-actions[bot]'
-          git config --global user.email 'github-actions[bot]@users.noreply.github.com'
-      - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
-      - name: Set up JDK 25
-        uses: actions/setup-java@1bcf9fb12cf4aa7d266a90ae39939e61372fe520 # v5.4.0
-        with:
-          java-version: '25'
-          distribution: 'temurin'
-      - name: Set up Gradle
-        uses: gradle/setup-gradle@f29f5a9d7b09a7c6b29859002d29d24e1674c884 # v5.0.1
-      - name: Upgrade Wrappers
-        run: ./gradlew clean upgradeGradleWrapperAll --continue -Porg.gradle.java.installations.auto-download=false
-        env:
-          WRAPPER_UPGRADE_GIT_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/milestone-spring-releasetrain.yml

@@ -1,35 +0,0 @@
-name: Check Milestone
-on:
-  milestone:
-    types: [created, opened, edited]
-env:
-  DUE_ON: ${{ github.event.milestone.due_on }}
-  TITLE: ${{ github.event.milestone.title }}
-permissions:
-  contents: read
-jobs:
-  spring-releasetrain-checks:    
-    name: Check DueOn is on a Release Date
-    runs-on: ubuntu-latest
-    if: ${{ github.repository == 'spring-projects/spring-security' }}
-    permissions:
-      contents: none
-    steps:
-    - name: Print Milestone Being Checked
-      run: echo "Validating DueOn '$DUE_ON' for milestone '$TITLE'"
-    - name: Validate DueOn
-      if: env.DUE_ON != ''
-      run: |
-        export TOOL_VERSION=0.1.1
-        wget "https://repo.maven.apache.org/maven2/io/spring/releasetrain/spring-release-train-tools/$TOOL_VERSION/spring-release-train-tools-$TOOL_VERSION.jar"
-        java -cp "spring-release-train-tools-$TOOL_VERSION.jar" io.spring.releasetrain.CheckMilestoneDueOnMain --dueOn "$DUE_ON" --expectedDayOfWeek MONDAY --expectedMondayCount 3
-  send-notification:
-    name: Send Notification
-    needs: [ spring-releasetrain-checks ]
-    if: ${{ failure() || cancelled() }}
-    runs-on: ubuntu-latest
-    steps:
-      - name: Send Notification
-        uses: spring-io/spring-security-release-tools/.github/actions/send-notification@b92832ecbc7cbe969201e6beafbde0ee400cf095 # v1.0.15
-        with:
-          webhook-url: ${{ secrets.SPRING_SECURITY_CI_GCHAT_WEBHOOK_URL }}

.github/workflows/pr-build-workflow.yml

@@ -1,51 +0,0 @@
-name: PR Build
-
-on: pull_request
-
-permissions:
-  contents: read
-
-jobs:
-  build:
-    name: Build
-    runs-on: ubuntu-latest
-    if: ${{ github.repository == 'spring-projects/spring-security' }}
-    steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
-      - name: Set up gradle
-        uses: spring-io/spring-gradle-build-action@c8668747d7c264864c8c7f7026d0d277d14a78dc # v2.0.6
-        with:
-          java-version: '25'
-          distribution: 'temurin'
-      - name: Build with Gradle
-        run: ./gradlew clean build -PskipCheckExpectedBranchVersion --continue --scan
-  generate-docs:
-    name: Generate Docs
-    runs-on: ubuntu-latest
-    if: ${{ github.repository == 'spring-projects/spring-security' }}
-    steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
-      - name: Set up gradle
-        uses: spring-io/spring-gradle-build-action@c8668747d7c264864c8c7f7026d0d277d14a78dc # v2.0.6
-        with:
-          java-version: '25'
-          distribution: 'temurin'
-      - name: Run Antora
-        run: ./gradlew -PbuildSrc.skipTests=true :spring-security-docs:antora
-      - name: Upload Docs
-        id: upload
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
-        with:
-          name: docs
-          path: docs/build/site
-          overwrite: true
-  send-notification:
-    name: Send Notification
-    needs: [ build, generate-docs ]
-    if: ${{ failure() && github.event.pull_request.user.login == 'dependabot[bot]' && github.repository == 'spring-projects/spring-security' }}
-    runs-on: ubuntu-latest
-    steps:
-      - name: Send Notification
-        uses: spring-io/spring-security-release-tools/.github/actions/send-notification@b92832ecbc7cbe969201e6beafbde0ee400cf095 # v1.0.15
-        with:
-          webhook-url: ${{ secrets.SPRING_SECURITY_CI_GCHAT_WEBHOOK_URL }}

.github/workflows/release-scheduler.yml

@@ -1,24 +0,0 @@
-name: Release Scheduler
-on:
-  schedule:
-  - cron: '15 15 * * MON' # Every Monday at 3:15pm UTC
-  workflow_dispatch:
-permissions: read-all
-jobs:
-  dispatch_scheduled_releases:
-    name: Dispatch scheduled releases
-    if: github.repository_owner == 'spring-projects'
-    strategy:
-      matrix:
-        # List of active maintenance branches.
-        branch: [ main, 7.0.x, 6.5.x, 6.4.x, 6.3.x ]
-    runs-on: ubuntu-latest
-    steps:
-    - name: Checkout
-      uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
-      with:
-        fetch-depth: 1
-    - name: Dispatch
-      env:
-        GH_TOKEN: ${{ secrets.GH_ACTIONS_REPO_TOKEN }}
-      run: gh workflow run update-scheduled-release-version.yml -r ${{ matrix.branch }}

.github/workflows/update-antora-ui-spring.yml

@@ -1,37 +0,0 @@
-name: Update Antora UI Spring
-
-on:
-  schedule:
-    - cron: '0 10 * * *' # Once per day at 10am UTC
-  workflow_dispatch:
-
-permissions:
-  pull-requests: write
-  issues: write
-  contents: write
-
-jobs:
-  update-antora-ui-spring:
-    name: Update on Supported Branches
-    if: ${{ github.repository == 'spring-projects/spring-security' }}
-    runs-on: ubuntu-latest
-    strategy:
-      matrix:
-        branch: [ '6.5.x', '7.0.x', 'main' ]
-    steps:
-      - uses: spring-io/spring-doc-actions/update-antora-spring-ui@415e2b11a766ba64799fffb5c97a4f7e17f677cf # v0.0.22
-        name: Update
-        with:
-          docs-branch: ${{ matrix.branch }}
-          token: ${{ secrets.GITHUB_TOKEN }}
-          antora-file-path: 'docs/antora-playbook.yml'
-  update-antora-ui-spring-docs-build:
-    name: Update on docs-build
-    if: ${{ github.repository == 'spring-projects/spring-security' }}
-    runs-on: ubuntu-latest
-    steps:
-      - uses: spring-io/spring-doc-actions/update-antora-spring-ui@415e2b11a766ba64799fffb5c97a4f7e17f677cf # v0.0.22
-        name: Update
-        with:
-          docs-branch: 'docs-build'
-          token: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/update-scheduled-release-version.yml

@@ -1,23 +0,0 @@
-name: Update Scheduled Release Version
-
-on:
-  workflow_dispatch: # Manual trigger only. Triggered by release-scheduler.yml on main.
-
-permissions:
-  contents: read
-
-jobs:
-  update-scheduled-release-version:
-    name: Update Scheduled Release Version
-    uses: spring-io/spring-security-release-tools/.github/workflows/update-scheduled-release-version.yml@b92832ecbc7cbe969201e6beafbde0ee400cf095 # v1.0.15
-    secrets: inherit
-  send-notification:
-    name: Send Notification
-    needs: [ update-scheduled-release-version ]
-    if: ${{ failure() || cancelled() }}
-    runs-on: ubuntu-latest
-    steps:
-      - name: Send Notification
-        uses: spring-io/spring-security-release-tools/.github/actions/send-notification@b92832ecbc7cbe969201e6beafbde0ee400cf095 # v1.0.15
-        with:
-          webhook-url: ${{ secrets.SPRING_SECURITY_CI_GCHAT_WEBHOOK_URL }}

.gitignore

@@ -25,9 +25,6 @@ atlassian-ide-plugin.xml
 s101plugin.state
 .attach_pid*
 .~lock.*#
-.kotlin/
 
 !.idea/checkstyle-idea.xml
 !.idea/externalDependencies.xml
-
-node_modules

.sdkmanrc

@@ -3,4 +3,4 @@
 # See https://sdkman.io/usage#config
 # A summary is to add the following to ~/.sdkman/etc/config
 # sdkman_auto_env=true
-java=25-librca
+java=11.0.14-tem

.vscode/settings.json

@@ -1,3 +0,0 @@
-{
-  "java.gradle.buildServer.enabled": "off"
-}

CONTRIBUTING.adoc

@@ -1,146 +1,232 @@
-= Contributing to Spring Security
+_Have something you'd like to contribute to the framework? We welcome pull requests, but ask that you carefully read this document first to understand how best to submit them; what kind of changes are likely to be accepted; and what to expect from the Spring Security team when evaluating your submission._
 
-First off, thank you for taking the time to contribute! :+1: :tada:
+_Please refer back to this document as a checklist before issuing any pull request; this will save time for everyone!_
 
-== Table of Contents
+= Code of Conduct
 
-* <<code-of-conduct>>
-* <<how-to-contribute>>
-* <<ask-questions>>
-* <<find-an-issue>>
-* <<create-an-issue>>
-* <<issue-lifecycle>>
-* <<submit-a-pull-request>>
-* <<build-from-source>>
-* <<code-style>>
+Please see our https://github.com/spring-projects/.github/blob/main/CODE_OF_CONDUCT.md[code of conduct].
 
-[[code-of-conduct]]
-== Code of Conduct
+= Similar but different
 
-This project is governed by the https://github.com/spring-projects/.github/blob/main/CODE_OF_CONDUCT.md[Spring code of conduct].
-By participating you are expected to uphold this code.
-Please report unacceptable behavior to spring-code-of-conduct@pivotal.io.
+Each Spring module is slightly different from one another in terms of team size, number of issues, etc. Therefore, each project is managed slightly different. You will notice that this document is very similar to the https://github.com/spring-projects/spring-framework/wiki/Contributor-guidelines[Spring Framework Contributor guidelines]. However, there are some subtle differences between the two documents, so please be sure to read this document thoroughly.
 
-[[how-to-contribute]]
-== How to Contribute
+= Importing into IDE
 
-[[ask-questions]]
-=== Ask Questions
+The following provides information on setting up a development environment that can run the sample in https://www.springsource.org/sts[Spring Tool Suite 3.6.0+]. Other IDE's should work using Gradle's IDE support, but have not been tested.
 
-If you have a question, check Stack Overflow using
-https://stackoverflow.com/questions/tagged/spring-security+or+spring-ldap+or+spring-authorization-server+or+spring-session?tab=Newest[this list of tags].
-Find an existing discussion, or start a new one if necessary.
+* IDE Setup
+** Install Spring Tool Suite 3.6.0+
+** You will need the following plugins installed (can be found on the Extensions Page)
+*** Gradle Eclipse
+*** Groovy Eclipse
+* Importing the project into Spring Tool Suite
+** File -> Import… -> Gradle Project
 
-If you believe there is an issue, search through https://github.com/spring-projects/spring-security/issues[existing issues] trying a few different ways to find discussions, past or current, that are related to the issue.
-Reading those discussions helps you to learn about the issue, and helps us to make a decision.
+As of new versions of Spring Tool Suite, you might need to install Groovy Eclipse pointing directly to the updated plugin location. To install Groovy Eclipse on Spring Tool Suite based on Eclipse Oxigen you must do the following steps:
 
-[[find-an-issue]]
-=== Find an Existing Issue
+Help -> Install New Software… -> Add the following URL into _Work with_ field:
+https://dist.springsource.org/snapshot/GRECLIPSE/e4.7/[https://dist.springsource.org/snapshot/GRECLIPSE/e4.7/]
 
-There are many issues in Spring Security with the labels https://github.com/spring-projects/spring-security/issues?q=is%3Aissue+is%3Aopen+label%3A%22status%3A+ideal-for-contribution%22[`ideal-for-contribution`] or https://github.com/spring-projects/spring-security/issues?q=is%3Aissue+is%3Aopen+label%3A%22status%3A+first-timers-only%22[`first-timers-only`] that are a great way to contribute to a discussion or <<submit-a-pull-request,to a PR>>.
-You can volunteer by commenting on these tickets, and we will assign them to you.
+= Understand the basics
 
-[[create-an-issue]]
-=== Create an Issue
+Not sure what a pull request is, or how to submit one? Take a look at GitHub's excellent https://help.github.com/articles/using-pull-requests[help documentation first].
 
-Reporting an issue or making a feature request is a great way to contribute.
-Your feedback and the conversations that result from it provide a continuous flow of ideas.
-However, before creating a ticket, please take the time to <<ask-questions,ask and research>> first.
+= Search GitHub issues; create an issue if necessary
 
-If you create an issue after a discussion on Stack Overflow, please provide a description in the issue instead of simply referring to Stack Overflow.
-The issue tracker is an important place of record for design discussions and should be self-sufficient.
+Is there already an issue that addresses your concern? Do a bit of searching in our https://github.com/spring-projects/spring-security/issues[GitHub issues] to see if you can find something similar. If not, please create a new issue before submitting a pull request unless the change is not a user facing issue.
 
-Once you're ready, create an issue on https://github.com/spring-projects/spring-security/issues[GitHub].
+= Discuss non-trivial contribution ideas with committers
 
-Many issues are caused by subtle behavior, typos, and unintended configuration.
-Creating a https://stackoverflow.com/help/minimal-reproducible-example[Minimal Reproducible Example] (starting with https://start.spring.io for example) of the problem helps the team quickly triage your issue and get to the core of the problem.
+If you're considering anything more than correcting a typo or fixing a minor bug, please discuss it on the https://gitter.im/spring-projects/spring-security[Spring Security Gitter] before submitting a pull request. We're happy to provide guidance but please spend an hour or two researching the subject on your own including searching the forums for prior discussions.
 
-We love contributors, and we may ask you to <<submit-a-pull-request,submit a PR with a fix>>.
+= Sign the Contributor License Agreement
 
-[[issue-lifecycle]]
-=== Issue Lifecycle
+If you have not previously done so, please fill out and submit the https://cla.pivotal.io/sign/spring[Contributor License Agreement].
 
-When an issue is first created, it is flagged `waiting-for-triage` waiting for a team member to triage it.
-Once the issue has been reviewed, the team may ask for further information if needed, and based on the findings, the issue is either assigned a target branch (or no branch if a feature) or is closed with a specific status.
-The target branch is https://spring.io/projects/spring-security#support[the earliest supported branch] where <<choose-a-branch,the change will be applied>>.
+= Create your branch from oldest maintenance branch
 
-When a fix is ready, the issue is closed and may still be re-opened until the fix is released.
-After that the issue will typically no longer be reopened.
-In rare cases if the issue was not at all fixed, the issue may be re-opened.
-In most cases however any follow-up reports will need to be created as new issues with a fresh description.
+Create your topic branch to be submitted as a pull request from the oldest impacted and supported maintenance branch.
+You can find the supported versions by looking at the https://github.com/spring-projects/spring-security/milestones[milestones page].
+Switch to a branch named `<major>.<minor>.x` from the smallest milestone in the format of `<major>.<minor>.<patch>(-<prerelease>)`.
+The spring team will ensure the code gets merged forward into additional branches.
 
-[[build-from-source]]
-=== Build from Source
+= Use short branch names
 
-See https://github.com/spring-projects/spring-security/tree/main#building-from-source[Build from Source] for instructions on how to check out, build, and import the Spring Security source code into your IDE.
+Branches used when submitting pull requests should preferably be named according to GitHub issues, e.g. `gh-1234` or `gh-1234-fix-npe`. Otherwise, use succinct, lower-case, dash (`-`) delimited names, such as `fix-warnings` or `fix-typo`. This is important, because branch names show up in the merge commits that result from accepting pull requests, and should be as expressive and concise as possible.
 
-[[code-style]]
-=== Source Code Style
+= Keep commits focused
 
-The wiki pages https://github.com/spring-projects/spring-framework/wiki/Code-Style[Code Style] and https://github.com/spring-projects/spring-framework/wiki/IntelliJ-IDEA-Editor-Settings[IntelliJ IDEA Editor Settings] define the source file coding standards we use along with some IDEA editor settings we customize.
+Remember each ticket should be focused on a single item of interest since the tickets are used to produce the changelog. Since each commit should be tied to a single GitHub issue, ensure that your commits are focused. For example, do not include an update to a transitive library in your commit unless the GitHub is to update the library. Reviewing your commits is essential before sending a pull request.
 
-Additionally, since Streams are https://github.com/spring-projects/spring-security/issues/7154[much slower] than `for` loops, please use them judiciously.
-The team may ask you to change to a `for` loop if the given code is along a hot path.
+= Mind the whitespace
 
-To format the code as well as check the style, run `./gradlew format && ./gradlew check`.
+Please carefully follow the whitespace and formatting conventions already present in the framework.
 
-[[submit-a-pull-request]]
-=== Submit a Pull Request
+. Tabs, not spaces
+. Unix (LF), not dos (CRLF) line endings
+. Eliminate all trailing whitespace
+. Aim to wrap code at 120 characters, but favor readability over wrapping
+. Preserve existing formatting; i.e. do not reformat code for its own sake
+. Search the codebase using `git grep` and other tools to discover common naming conventions, etc.
+. UTF-8 encoding for Java sources and XML files
 
-We are excited for your pull request! :heart:
+Whitespace management tips
 
-Please do your best to follow these steps.
-Don't worry if you don't get them all correct the first time, we will help you.
+. You can use the https://marketplace.eclipse.org/content/anyedit-tools[AnyEdit Eclipse plugin] to ensure spaces are used and to clean up trailing whitespaces.
+. Use Git's `pre-commit.sample` hook to prevent invalid whitespace from being pushed out. You can enable it by moving `.git/hooks/pre-commit.sample` to `.git/hooks/pre-commit` and ensuring it is executable. For more information on hooks refer to https://git-scm.com/book/en/v2/Customizing-Git-Git-Hooks[https://git-scm.com/book/en/v2/Customizing-Git-Git-Hooks].
+
+= Add Apache license header to all new classes
 
-1. [[sign-cla]] All commits must include a __Signed-off-by__ trailer at the end of each commit message to indicate that the contributor agrees to the Developer Certificate of Origin.
-For additional details, please refer to the blog post https://spring.io/blog/2025/01/06/hello-dco-goodbye-cla-simplifying-contributions-to-spring[Hello DCO, Goodbye CLA: Simplifying Contributions to Spring].
-2. [[create-an-issue-list]] Must you https://github.com/spring-projects/spring-security/issues/new/choose[create an issue] first? No, but it is recommended for features and larger bug fixes. It's easier to discuss with the team first to determine the right fix or enhancement.
-For typos and straightforward bug fixes, starting with a pull request is encouraged.
-Please include a description for context and motivation.
-Note that the team may close your pull request if it's not a fit for the project.
-3. [[choose-a-branch]] Always check out the branch indicated in the milestone and submit pull requests against it (for example, for milestone `5.8.3` use the `5.8.x` branch).
-If there is no milestone, choose `main`.
-Once merged, the fix will be forwarded-ported to applicable branches including `main`.
-4. [[create-a-local-branch]] Create a local branch
-If this is for an issue, consider a branch name with the issue number, like `gh-22276`.
-5. [[write-tests]] Add documentation and JUnit Tests for your changes.
-6. [[update-copyright]] In all files you edited, if the copyright header is of the form 2002-20xx, update the final copyright year to the current year.
-7. [[add-since]] If on `main`, add `@since` JavaDoc attributes to new public APIs that your PR adds
-8. [[change-rnc]] If you are updating the XSD, please instead update the RNC file and then run `./gradlew :spring-security-config:rncToXsd`.
-9. [[format-code]] For each commit, build the code using `./gradlew format && ./gradlew check`.
-This command ensures the code meets most of <<code-style,the style guide>>; a notable exception is import order.
-10. [[commit-atomically]] Choose the granularity of your commits consciously and squash commits that represent
-multiple edits or corrections of the same logical change.
-See https://git-scm.com/book/en/Git-Tools-Rewriting-History[Rewriting History section of Pro Git] for an overview of streamlining the commit history.
-11. [[format-commit-messages]] Format commit messages using 55 characters for the subject line, 72 characters per line
-for the description, followed by the issue fixed, for example, `Closes gh-22276`.
-See the https://git-scm.com/book/en/Distributed-Git-Contributing-to-a-Project#Commit-Guidelines[Commit Guidelines section of Pro Git] for best practices around commit messages, and use `git log` to see some examples.
-Favor imperative tense over present tense (use "Fix" instead of "Fixes"); avoid past tense (use "Fix" instead of "Fixed").
-+
-[indent=0]
 ----
-Address NullPointerException
+/*
+ * Copyright 2002-2020 the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
 
-Closes gh-22276
-----
-[[reference-issue]]
-1. If there is a prior issue, reference the GitHub issue number in the description of the pull request.
-+
-[indent=0]
-----
-Closes gh-22276
+package ...;
 ----
 
-If accepted, your contribution may be heavily modified as needed prior to merging.
-You will likely retain author attribution for your Git commits granted that the bulk of your changes remain intact.
-You may also be asked to rework the submission.
+= Update Apache license header to modified files as necessary
 
-If asked to make corrections, simply push the changes against the same branch, and your pull request will be updated.
-In other words, you do not need to create a new pull request when asked to make changes.
-When it is time to merge, you'll be asked to squash your commits.
+Always check the date range in the license header. For example, if you've modified a file in 2020 whose header still reads
 
-==== Participate in Reviews
+----
+ * Copyright 2002-2012 the original author or authors.
+----
 
-Helping to review pull requests is another great way to contribute.
-Your feedback can help to shape the implementation of new features.
-When reviewing pull requests, however, please refrain from approving or rejecting a PR unless you are a core committer for Spring Security.
+then be sure to update it to the current year appropriately (e.g. 2020)
+
+----
+ * Copyright 2002-2020 the original author or authors.
+----
+
+= Use @since tags for newly-added public API types and methods
+
+Example:
+
+----
+/**
+ * …
+ *
+ * @author First Last
+ * @since 5.4
+ * @see …
+ */
+----
+
+= Submit JUnit test cases for all behavior changes
+
+Search the codebase to find related unit tests and add additional `@Test` methods within.
+
+. Any new tests should end in the name `Tests` (note this is plural). For example, a valid name would be `FilterChainProxyTests`. An invalid name would be `FilterChainProxyTest`.
+. New test methods should not start with test. This is an old JUnit3 convention and is not necessary since the method is annotated with `@Test`.
+
+= Update spring-security-x.y.rnc for schema changes
+
+Update the https://www.relaxng.org[RELAX NG] schema `spring-security-x.y.rnc` instead of `spring-security-x.y.xsd` if you contribute changes to supported XML configuration. The XML schema file can be generated the following Gradle task:
+
+----
+./gradlew :spring-security-config:rncToXsd
+----
+
+Changes to the XML schema will be overwritten by the Gradle build task.
+
+= Squash commits
+
+Use `git rebase --interactive`, `git add --patch` and other tools to "squash" multiple commits into atomic changes. In addition to the man pages for `git`, there are https://git-scm.com/book/en/v2/Git-Tools-Rewriting-History[many resources online] to help you understand how these tools work.
+
+= Use real name in git commits
+
+Please configure Git to use your real first and last name for any commits you intend to submit as pull requests. Make sure the name is properly capitalized as submitted to the https://cla.pivotal.io[Pivotal Contributor License Agreement]:
+
+----
+First Last <user@mail.com>
+----
+
+This helps ensure traceability against the CLA, and also goes a long way to ensuring useful output from tools like Git shortlog and others.
+
+You can configure this globally:
+
+----
+git config --global user.name "First Last"
+git config --global user.email user@example.com
+----
+
+or locally for the current repository by omitting the `--global` flag:
+
+----
+git config user.name "First Last"
+git config user.email user@example.com
+----
+
+= Format commit messages
+
+. Keep the subject line to 50 characters or less if possible
+. Do not end the subject line with a period
+. In the body of the commit message, explain how things worked before this commit, what has changed, and how things work now
+. Include `Closes gh-<issue-number>` at the end if this fixes a GitHub issue
+. Avoid markdown, including back-ticks identifying code
+
+Example:
+
+----
+Short (50 chars or less) summary of changes
+
+More detailed explanatory text, if necessary.  Wrap it to about 72
+characters or so.  In some contexts, the first line is treated as the
+subject of an email and the rest of the text as the body. The blank
+line separating the summary from the body is critical (unless you omit
+the body entirely); tools like rebase can get confused if you run the
+two together.
+
+Further paragraphs come after blank lines.
+
+ - Bullet points are okay, too
+
+ - Typically a hyphen or asterisk is used for the bullet, preceded by a
+   single space, with blank lines in between, but conventions vary here
+
+Closes gh-123
+----
+
+
+= Run all tests prior to submission
+
+----
+./gradlew clean build integrationTest
+----
+
+= Submit your pull request
+
+*Subject line:*
+
+Follow the same conventions for pull request subject lines as mentioned above for commit message subject lines.
+
+*In the body:*
+
+. Explain your use case. What led you to submit this change? Why were existing mechanisms in the framework insufficient? Make a case that this is a general-purpose problem and that yours is a general-purpose solution, etc
+. Add any additional information and ask questions; start a conversation, or continue one from GitHub Issues
+. Mention any GitHub Issues
+. Also mention that you have submitted the CLA as described above
+Note that for pull requests containing a single commit, GitHub will default the subject line and body of the pull request to match the subject line and body of the commit message. This is fine, but please also include the items above in the body of the request.
+
+= Mention your pull request on the associated GitHub issue
+
+Add a comment to the associated GitHub issue(s) linking to your new pull request.
+
+= Expect discussion and rework
+
+The Spring team takes a very conservative approach to accepting contributions to the framework. This is to keep code quality and stability as high as possible, and to keep complexity at a minimum. Your changes, if accepted, may be heavily modified prior to merging. You will retain "Author:" attribution for your Git commits granted that the bulk of your changes remain intact. You may be asked to rework the submission for style (as explained above) and/or substance. Again, we strongly recommend discussing any serious submissions with the Spring Framework team prior to engaging in serious development work.
+
+Note that you can always force push (`git push -f`) reworked / rebased commits against the branch used to submit your pull request. i.e. you do not need to issue a new pull request when asked to make changes.

README.adoc

@@ -1,13 +1,13 @@
 image::https://badges.gitter.im/Join%20Chat.svg[Gitter,link=https://gitter.im/spring-projects/spring-security?utm_source=badge&utm_medium=badge&utm_campaign=pr-badge&utm_content=badge]
 
-image:https://github.com/spring-projects/spring-security/actions/workflows/continuous-integration-workflow.yml/badge.svg?branch=main["Build Status", link="https://github.com/spring-projects/spring-security/actions/workflows/continuous-integration-workflow.yml"]
+image:https://github.com/spring-projects/spring-security/workflows/CI/badge.svg?branch=main["Build Status", link="https://github.com/spring-projects/spring-security/actions?query=workflow%3ACI"]
 
-image:https://img.shields.io/badge/Revved%20up%20by-Develocity-06A0CE?logo=Gradle&labelColor=02303A["Revved up by Develocity", link="https://ge.spring.io/scans?search.rootProjectNames=spring-security"]
+image:https://img.shields.io/badge/Revved%20up%20by-Gradle%20Enterprise-06A0CE?logo=Gradle&labelColor=02303A["Revved up by Gradle Enterprise", link="https://ge.spring.io/scans?search.rootProjectNames=spring-security"]
 
 = Spring Security
 
-Spring Security provides security services for the https://docs.spring.io[Spring IO Platform]. Spring Security 6.0 requires Spring 6.0 as
-a minimum and also requires Java 17.
+Spring Security provides security services for the https://docs.spring.io[Spring IO Platform]. Spring Security 5.0 requires Spring 5.0 as
+a minimum and also requires Java 8.
 
 For a detailed list of features and access to the latest release, please visit https://spring.io/projects[Spring projects].
 
@@ -15,16 +15,14 @@ For a detailed list of features and access to the latest release, please visit h
 Please see our https://github.com/spring-projects/.github/blob/main/CODE_OF_CONDUCT.md[code of conduct]
 
 == Downloading Artifacts
-See https://docs.spring.io/spring-security/reference/getting-spring-security.html[Getting Spring Security] for how to obtain Spring Security.
+See https://docs.spring.io/spring-security/site/docs/current/reference/html5/#getting[Getting Spring Security] for how to obtain Spring Security.
 
 == Documentation
-Be sure to read the https://docs.spring.io/spring-security/reference/[Spring Security Reference].
+Be sure to read the https://docs.spring.io/spring-security/site/docs/current/reference/htmlsingle/[Spring Security Reference].
 Extensive JavaDoc for the Spring Security code is also available in the https://docs.spring.io/spring-security/site/docs/current/api/[Spring Security API Documentation].
 
-You may also want to check out https://docs.spring.io/spring-security/reference/whats-new.html[what's new in the latest release].
-
 == Quick Start
-See https://docs.spring.io/spring-security/reference/servlet/getting-started.html[Hello Spring Security] to get started with a "Hello, World" application.
+See https://docs.spring.io/spring-security/site/docs/current/reference/html5/#servlet-hello[Hello Spring Security] to get started with a "Hello, World" application.
 
 == Building from Source
 Spring Security uses a https://gradle.org[Gradle]-based build system.
@@ -32,9 +30,9 @@ In the instructions below, https://vimeo.com/34436402[`./gradlew`] is invoked fr
 a cross-platform, self-contained bootstrap mechanism for the build.
 
 === Prerequisites
-https://docs.github.com/en/get-started/quickstart/set-up-git[Git] and the https://www.oracle.com/java/technologies/downloads/#java17[JDK17 build].
+https://help.github.com/set-up-git-redirect[Git] and the https://www.oracle.com/technetwork/java/javase/downloads[JDK11 build].
 
-Be sure that your `JAVA_HOME` environment variable points to the `jdk-17` folder extracted from the JDK download.
+Be sure that your `JAVA_HOME` environment variable points to the `jdk-11` folder extracted from the JDK download.
 
 === Check out sources
 [indent=0]
@@ -42,59 +40,27 @@ Be sure that your `JAVA_HOME` environment variable points to the `jdk-17` folder
 git clone git@github.com:spring-projects/spring-security.git
 ----
 
-=== Install all `spring-*.jar` into your local Maven repository.
-
+=== Install all spring-\* jars into your local Maven cache
 [indent=0]
 ----
 ./gradlew publishToMavenLocal
 ----
 
-=== Compile and test; build all JARs, distribution zips, and docs
-
+=== Compile and test; build all jars, distribution zips, and docs
 [indent=0]
 ----
 ./gradlew build
 ----
 
-The reference docs are not currently included in the distribution zip.
-You can build the reference docs for this branch by running the following command:
-
-----
-./gradlew :spring-security-docs:antora
-----
-
-That command publishes the docs site to the `_docs/build/site_` directory.
-The https://github.com/spring-projects/spring-security/tree/docs-build[playbook branch] describes how to build the reference docs in detail.
-
 Discover more commands with `./gradlew tasks`.
-
-=== IDE setup (IntelliJ)
-
-No special steps are needed to open Spring Security in IntelliJ.
-
-=== IDE setup (Eclipse and VS Code)
-
-To work in Eclipse or VS Code, first generate Eclipse metadata so you can import the project into Eclipse or VS Code:
-
-[indent=0]
-----
-./gradlew cleanEclipse eclipse
-----
-
-If you have not built the project yet, run `./gradlew publishToMavenLocal` first so dependencies are resolved.
-
-*VS Code:* Open the repository root as a folder. The repository includes `.vscode/settings.json` which disables automatic Gradle import so that the generated Eclipse metadata (`.classpath`, `.project`) is used. Do not use the Gradle for Java extension to import the project.
-
-*Eclipse:* File → Import → General → Existing Projects into Workspace, then select the repository root.
-
-The build uses a custom Eclipse plugin to work around Gradle dependency cycles that confuse IDE metadata generation. You may see Eclipse warnings about `xml-apis` from some test dependencies; those are excluded in the build and can be ignored.
+See also the https://github.com/spring-projects/spring-framework/wiki/Gradle-build-and-release-FAQ[Gradle build and release FAQ].
 
 == Getting Support
 Check out the https://stackoverflow.com/questions/tagged/spring-security[Spring Security tags on Stack Overflow].
-https://spring.io/support[Commercial support] is available too.
+https://spring.io/services[Commercial support] is available too.
 
 == Contributing
-https://docs.github.com/en/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/creating-a-pull-request[Pull requests] are welcome; see the https://github.com/spring-projects/spring-security/blob/main/CONTRIBUTING.adoc[contributor guidelines] for details.
+https://help.github.com/articles/creating-a-pull-request[Pull requests] are welcome; see the https://github.com/spring-projects/spring-security/blob/main/CONTRIBUTING.adoc[contributor guidelines] for details.
 
 == License
 Spring Security is Open Source software released under the

RELEASE.adoc

@@ -1,266 +1,184 @@
-= Release Process
+= Update Dependencies
 
-The release process for Spring Security is entirely automated via the https://github.com/spring-io/spring-security-release-tools/blob/main/release-plugin/README.adoc[Spring Security Release Plugin] and https://github.com/spring-io/spring-security-release-tools/tree/main/.github/workflows[reusable workflows].
-The following table outlines the steps that are taken by the automation.
-
-WARNING: The `5.8.x` branch does not have all of the improvements from the `6.x.x` branches. See "Status (5.8.x)" for which steps are still manual.
-
-In case of a failure, you can follow the links below to read about each step, which includes instructions for performing the step manually if applicable.
-See <<frequently-asked-questions,FAQ>> for troubleshooting tips.
-
-[cols="1,1,1"]
-|===
-| Step | Status (5.8.x) | Status (6.0.x+)
-
-| <<update-dependencies>>
-| :white_check_mark: automated
-| :white_check_mark: automated
-
-| <<check-all-issues-are-closed>>
-| :white_check_mark: automated
-| :white_check_mark: automated
-
-| <<update-release-version>>
-| :white_check_mark: automated
-| :white_check_mark: automated
-
-| <<tag-release>>
-| :white_check_mark: automated
-| :white_check_mark: automated
-
-| <<push-release-commit>>
-| :white_check_mark: automated
-| :white_check_mark: automated
-
-| <<build-locally>>
-| :white_check_mark: automated
-| :white_check_mark: automated
-
-| <<update-release-notes-on-github>>
-| :white_check_mark: automated
-| :white_check_mark: automated
-
-| <<update-version-on-project-page>>
-| :x: manual
-| :white_check_mark: automated
-
-| <<close-create-milestone,Close milestone>>
-| :x: manual
-| :white_check_mark: automated
-
-| <<announce-release-on-slack>>
-| :white_check_mark: automated
-| :white_check_mark: automated
-
-| <<update-to-next-development-version>>
-| :white_check_mark: automated
-| :white_check_mark: automated
-
-| <<close-create-milestone,Create milestone>>
-| :white_check_mark: automated
-| :white_check_mark: automated
-
-| <<announce-release-on-other-channels>>
-| :x: manual
-| :x: manual
-|===
-
-[#update-dependencies]
-== Update dependencies
-
-Dependency versions are managed in the file xref:./gradle/libs.versions.toml[libs.versions.toml] and are automatically updated by xref:./.github/dependabot.yml[dependabot].
-
-[#check-all-issues-are-closed]
-== Check all issues are closed
-
-The first step of a release is to check if there are any open issues remaining in a milestone.
-
-NOTE: A scheduled release will not proceed if there are any open issues.
-
-TIP: If you need to prevent a release from occurring automatically, the easiest way to block a release is to add an unresolved issue to the milestone.
-
-The https://github.com/spring-io/spring-security-release-tools/blob/main/release-plugin/README.adoc#checkMilestoneHasNoOpenIssues[`checkMilestoneHasOpenIssues`] command will check if there are any open issues for the release.
-Before running the command manually, replace the following values:
-
-* `<next-version>` - Replace with the title of the milestone you are releasing now (i.e. 5.5.0-RC1)
-* `<github-personal-access-token>` - Replace with a https://github.com/settings/tokens[GitHub personal access token] that has a scope of `public_repo`. This is optional since you are unlikely to reach the rate limit for such a simple check.
+Ensure you have no changes in your local repository.
+Change to a new branch.
+For example:
 
 [source,bash]
 ----
-./gradlew checkMilestoneHasOpenIssues -PnextVersion=<next-version> -PgitHubAccessToken=<github-personal-access-token>
+$ git checkout -b 5.5.0-RC1-dependencies
 ----
 
-Alternatively, you can manually check using the https://github.com/spring-projects/spring-security/milestones[milestones] page.
+Review the rules in build.gradle to ensure the rules make sense.
+For example, we should not allow major version updates in a patch release.
+Also ensure that all of the exclusions still make sense.
 
-[#update-release-version]
-== Update release version
-
-If all issues for the release are <<check-all-issues-are-closed,closed>>, the version number is automatically updated using the milestone title.
-When performing this step manually, update the version number in `gradle.properties` for the release (for example `5.5.0`) and commit the change using the message "Release x.y.z".
-
-[#tag-release]
-== Tag release
-
-The release will automatically be tagged using the milestone title.
-It is not required to tag manually.
-However, you can perform this step manually by running the following command:
+The following Gradle command will update your dependencies creating a commit for each dependency update.
+The first invocation of the command will take quite a while (~20 minutes depending on internet speed) to run because it is indexing all the versions of all the dependencies.
 
 [source,bash]
 ----
-git tag 5.5.0
+$ ./gradlew updateDependencies
 ----
 
-[#push-release-commit]
-== Push release commit
-
-During a scheduled release, the release commit will automatically be pushed to trigger a build.
-If performing this step manually, you can push the commit and tag and GitHub actions will build and deploy the artifacts with the following command:
+Review the commits to ensure that the updated dependency versions make sense for this release. For example, we should not perform a major version update for a patch release.
 
 [source,bash]
 ----
-git push --atomic origin main 5.5.0
+$ git log
 ----
 
-The build will automatically wait for artifacts to be released to Maven Central.
-You can get notified manually when uploading is complete by running the following:
+If any of the versions don’t make sense, update `build.gradle` to ensure that the version is excluded.
+
+Run all the checks:
 
 [source,bash]
 ----
-./scripts/release/wait-for-done.sh 5.5.0
+$ ./gradlew check
 ----
 
-[#build-locally]
-== Build
+If they don’t work, you can run a git bisect to discover what broke the build.
+Fix any commits that broke the build.
 
-All checks will automatically be performed by the build prior to uploading the artifacts to Maven Central.
-If something goes wrong, you can run the build locally using:
+Check out the original brach:
 
 [source,bash]
 ----
-./gradlew check
+$ git checkout -
 ----
 
-[#update-release-notes-on-github]
-== Update release notes on GitHub
+The following command will update the dependencies again but this time creating a ticket for each update and placing `Closes gh-<number>` in the commit. Replacing the following values:
 
-Once the release has been uploaded to Maven Central, release notes will automatically be generated and a GitHub release will be created.
-To do this manually, you can use the https://github.com/spring-io/spring-security-release-tools/blob/main/release-plugin/README.adoc#generateChangelog[`generateChangelog`] command to generate the release notes by replacing:
-
-* `<next-version>` - Replace with the milestone you are releasing now (i.e. 5.5.0)
+* <github-personal-access-token> - Replace with a https://github.com/settings/tokens[GitHub personal access token] that has a scope of `public_repo`
+* <next-version> - Replace with the title of the milestone you are releasing now (i.e. 5.5.0-RC1)
 
 [source,bash]
 ----
-./gradlew generateChangelog -PnextVersion=<next-version>
+$ ./gradlew updateDependencies -PupdateMode=GITHUB_ISSUE -PgitHubAccessToken=<github-personal-access-token> -PnextVersion=<next-version>
 ----
 
-Then copy the release notes to your clipboard (your mileage may vary with the following command):
+Apply any fixes from your previous branch that were necessary.
+
+= Check All Issues are Closed
+
+The following command will check if there are any open issues for the ticket.
+Before running the command, replace the following values:
+
+* <github-personal-access-token> - Replace with a https://github.com/settings/tokens[GitHub personal access token] that has a scope of `public_repo`. This is optional since you are unlikely to reach the rate limit for such a simple check.
+* <next-version> - Replace with the title of the milestone you are releasing now (i.e. 5.5.0-RC1)
 
 [source,bash]
 ----
-cat build/changelog/release-notes.md | xclip -selection clipboard
+$ ./gradlew gitHubCheckMilestoneHasNoOpenIssues -PgitHubAccessToken=<github-personal-access-token> -PnextVersion=<next-version>
 ----
 
-Finally, create the
-https://github.com/spring-projects/spring-security/releases[release on
-GitHub], associate it with the tag, and paste the generated notes.
+Alternatively, you can manually check using https://github.com/spring-projects/spring-security/milestones
 
-Alternatively, you can run the https://github.com/spring-io/spring-security-release-tools/blob/main/release-plugin/README.adoc#createGitHubRelease[`createGitHubRelease`] command to perform these steps automatically, replacing:
+= Update Release Version
 
-* `<next-version>` - Replace with the milestone you are releasing now (i.e. 5.5.0)
-* `<branch>` - The name of the branch to be tagged (if the release commit has not already been tagged)
-* `<github-personal-access-token>` - Replace with a https://github.com/settings/tokens[GitHub personal access token] that has a scope of `write:org`
+Update the version number in `gradle.properties` for the release, for example `5.5.0-M1`, `5.5.0-RC1`, `5.5.0`
+
+= Update Antora Version
+
+You will need to update the antora.yml version.
+If you are unsure of what the values should be, the following task will instruct you what the expected values are:
 
 [source,bash]
 ----
-./gradlew createGitHubRelease -PnextVersion=<next-version> -Pbranch=<branch> -PcreateRelease=true -PgitHubAccessToken=<github-personal-access-token>
+./gradlew :spring-security-docs:antoraCheckVersion
 ----
 
-[#update-version-on-project-page]
-== Update version on project page
+= Build Locally
 
-The build will automatically update the project versions on https://spring.io/projects/spring-security#learn.
-To do this manually, you can use the https://github.com/spring-io/spring-security-release-tools/blob/main/release-plugin/README.adoc#createSaganRelease[`createSaganRelease`] and https://github.com/spring-io/spring-security-release-tools/blob/main/release-plugin/README.adoc#deleteSaganRelease[`deleteSaganRelease`] commands using the following parameters:
-
-* `<next-version>` - Replace with the milestone you are releasing now (i.e. 5.5.0)
-* `<previous-version>` - Replace with the previous release which will be removed from the listed versions (i.e. 5.5.0-RC1)
-* `<github-personal-access-token>` - Replace with a https://github.com/settings/tokens[GitHub personal access token] that has a scope of `read:org` as https://spring.io/restdocs/index.html#authentication[documented for spring.io api]
+Run the build using
 
 [source,bash]
 ----
-./gradlew createSaganRelease deleteSaganRelease -PnextVersion=<next-version> -PpreviousVersion=<previous-version> -PgitHubAccessToken=<github-personal-access-token>
+$ ./gradlew check
 ----
 
-Alternatively, you can log into Contentful and update the versions manually on the Spring Security project page.
+= Push the Release Commit
 
-[#close-create-milestone]
-== Close / Create milestone
+Push the commit and GitHub actions will build and deploy the artifacts
+If you are pushing to Maven Central, then you can get notified when it’s uploaded by running the following:
 
-The release milestone will be automatically closed once the release is complete.
-To proceed manually, perform the following steps:
+[source,bash]
+----
+$ ./scripts/release/wait-for-done.sh 5.5.0
+----
 
-1. Visit https://github.com/spring-projects/spring-security/milestones[GitHub
-Milestones] and create a new milestone for the next release version
-2. Move any open issues from the existing milestone you just released to the new milestone
-3. Close the milestone for the release
+= Announce the release on Slack
 
-NOTE: Remember that scheduled releases <<check-all-issues-are-closed,will not proceed>> if there are still open issues in the milestone.
-
-[#announce-release-on-slack]
-== Announce release on Slack
-
-The release will automatically be announced on Slack.
-If proceeding manually, announce the release on Slack in the channel https://pivotal.slack.com/messages/spring-release[#spring-release], including the keyword `+spring-security-announcing+` in the message.
+* Announce via Slack on
+https://pivotal.slack.com/messages/spring-release[#spring-release],
+including the keyword `+spring-security-announcing+` in the message.
 Something like:
 
 ....
-spring-security-announcing `5.5.0` is available now
+spring-security-announcing 5.5.0 is available.
 ....
 
-[#update-to-next-development-version]
-== Update to next development version
+= Tag the release
 
-After the release is complete and artifacts have been uploaded to Maven Central, the build will automatically update to the next development version, commit and push.
-If proceeding manually, update the version in `gradle.properties` to the next `+SNAPSHOT+` version with the commit message "Next development version" and then push.
+* Tag the release and then push the tag
 
-[#announce-release-on-other-channels]
-== Announce release on other channels
+....
+git tag 5.4.0-RC1
+git push origin 5.4.0-RC1
+....
 
-* Create a blog post on Contentful
-* Tweet from https://twitter.com/springsecurity[@SpringSecurity]
+== 7. Update to Next Development Version
 
-[[frequently-asked-questions]]
-== Frequently Asked Questions
+* Update `gradle.properties` version to next `+SNAPSHOT+` version, update antora.yml, and then push
 
-*When should I update dependencies manually?* Dependencies should be updated at the latest the end of the week prior to the release. This is usually the Friday following the 2nd Monday of the month (counting from the first week with a Monday). When in doubt, check the https://github.com/spring-projects/spring-security/milestones[milestones] page for release due dates.
+== 8. Update version on project page
 
-*When do scheduled releases occur?* Automated releases are scheduled to occur at *3:15 PM UTC* on the *3rd Monday of the month* (counting from the first week with a Monday).
+The following command will update https://spring.io/projects/spring-security#learn with the new release version using the following parameters
 
-[NOTE]
-The scheduled release process currently runs every Monday but only releases when a release is due. See the performed checks below for more information.
+<github-personal-access-token> - Replace with a https://github.com/settings/tokens[GitHub personal access token] that has a scope of `read:org` as https://spring.io/restdocs/index.html#authentication[documented for spring.io api]
+<next-version> - Replace with the milestone you are releasing now (i.e. 5.5.0-RC1)
+<previous-version> - Replace with the previous release which will be removed from the listed versions (i.e. 5.5.0-M3)
 
-The automated release process occurs on the following branches:
+[source,bash]
+----
+$ ./gradlew saganCreateRelease saganDeleteRelease -PgitHubAccessToken=<github-personal-access-token> -PnextVersion=<next-version> -PpreviousVersion=<previous-version>
+----
 
-* `main`
-* `6.2.x`
-* `6.1.x`
-* `6.0.x` (commercial only)
-* `5.8.x`
 
-For each of the above branches, the automated process performs the following checks before proceeding with the release:
 
-1. _Check if the milestone is due today._ This check compares the current (SNAPSHOT) version of the branch with available milestones and chooses the first match (sorted alphabetically). If the due date on the matched milestone is *not* today, the process stops.
-2. _Check if all issues are closed._ This check uses the milestone from the previous step and looks for open issues. If any open issues are found, the process stops.
+== 9. Update Release Notes on GitHub
 
-[IMPORTANT]
-You should ensure all issues are closed or moved to another milestone prior to a scheduled release.
+Generate the Release Notes replacing:
 
-If the above checks pass, the version number is updated (in `gradle.properties`) and a commit is pushed to trigger the CI process.
+* <next-version> - Replace with the milestone you are releasing now (i.e. 5.5.0-RC1)
 
-*How do I trigger a release manually?* You can trigger a release manually in two ways:
+----
+$ ./gradlew generateChangelog -PnextVersion=<next-version>
+----
 
-1. Trigger a release for a particular branch via https://github.com/spring-projects/spring-security/actions/workflows/update-scheduled-release-version.yml[`update-scheduled-release-version.yml`] on the desired branch. The above checks are performed for that branch, and the release will proceed if all checks pass. _This is the recommended way to trigger a release that did not pass the above checks during a regularly scheduled release._
-2. Trigger releases for all branches via https://github.com/spring-projects/spring-security/actions/workflows/release-scheduler.yml[`release-scheduler.yml`] on the `main` branch. The above checks are performed for each branch, and only releases that pass all checks will proceed.
+* Copy the release notes to your clipboard (your mileage may vary with
+the following command)
+
+....
+cat build/changelog/release-notes.md | xclip -selection clipboard
+....
+
+* Create the
+https://github.com/spring-projects/spring-security/releases[release on
+GitHub], associate it with the tag, and paste the generated notes
+
+== 10. Close / Create Milestone
+
+* In
+https://github.com/spring-projects/spring-security/milestones[GitHub
+Milestones], create a new milestone for the next release version
+* Move any open issues from the existing milestone you just released to
+the new milestone
+* Close the milestone for the release.
+
+== 11. Announce the release on other channels
+
+* Create a https://spring.io/admin/blog[Blog]
+* Tweet from [@SpringSecurity](https://twitter.com/springsecurity)
 
-*When should additional manual steps be performed?* All other automated steps listed above occur during the normal CI process. Additional manual steps can be performed at any time once the builds pass and releases are finished.
 
-*What if something goes wrong?* If the normal CI process fails, you can retry by re-running the failed jobs with the "Re-run failed jobs" option in GitHub Actions. If changes are required, you should revert the "Release x.y.z" commit, delete the tag, and proceed manually.

access/spring-security-access.gradle

@@ -1,54 +0,0 @@
-plugins {
-	id 'compile-warnings-error'
-	id 'javadoc-warnings-error'
-}
-
-apply plugin: 'io.spring.convention.spring-module'
-
-dependencies {
-	management platform(project(":spring-security-dependencies"))
-	api project(':spring-security-crypto')
-	api project(':spring-security-core')
-	api 'org.springframework:spring-aop'
-	api 'org.springframework:spring-beans'
-	api 'org.springframework:spring-context'
-	api 'org.springframework:spring-core'
-	api 'org.springframework:spring-expression'
-	api 'io.micrometer:micrometer-observation'
-
-	optional project(':spring-security-acl')
-	optional project(':spring-security-messaging')
-	optional project(':spring-security-web')
-	optional 'org.springframework:spring-websocket'
-	optional 'com.fasterxml.jackson.core:jackson-databind'
-	optional 'io.micrometer:context-propagation'
-	optional 'io.projectreactor:reactor-core'
-	optional 'jakarta.annotation:jakarta.annotation-api'
-	optional 'org.aspectj:aspectjrt'
-	optional 'org.springframework:spring-jdbc'
-	optional 'org.springframework:spring-tx'
-	optional 'org.jetbrains.kotlinx:kotlinx-coroutines-reactor'
-
-	provided 'jakarta.servlet:jakarta.servlet-api'
-
-	testImplementation project(path : ':spring-security-web', configuration : 'tests')
-	testImplementation 'commons-collections:commons-collections'
-	testImplementation 'io.projectreactor:reactor-test'
-	testImplementation "org.assertj:assertj-core"
-	testImplementation "org.junit.jupiter:junit-jupiter-api"
-	testImplementation "org.junit.jupiter:junit-jupiter-params"
-	testImplementation "org.junit.jupiter:junit-jupiter-engine"
-	testImplementation "org.mockito:mockito-core"
-	testImplementation "org.mockito:mockito-junit-jupiter"
-	testImplementation "org.springframework:spring-core-test"
-	testImplementation "org.springframework:spring-test"
-	testImplementation 'org.skyscreamer:jsonassert'
-	testImplementation 'org.springframework:spring-test'
-	testImplementation 'org.jetbrains.kotlin:kotlin-reflect'
-	testImplementation 'org.jetbrains.kotlin:kotlin-stdlib-jdk8'
-	testImplementation 'io.mockk:mockk'
-
-	testRuntimeOnly 'org.hsqldb:hsqldb'
-	testRuntimeOnly 'org.junit.platform:junit-platform-launcher'
-}
-

access/src/main/java/org/springframework/security/access/SecurityConfig.java

@@ -1,90 +0,0 @@
-/*
- * Copyright 2004, 2005, 2006 Acegi Technology Pty Limited
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *      https://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.springframework.security.access;
-
-import java.io.Serial;
-import java.util.ArrayList;
-import java.util.List;
-
-import org.jspecify.annotations.Nullable;
-
-import org.springframework.security.authorization.AuthorizationManager;
-import org.springframework.security.core.annotation.SecurityAnnotationScanner;
-import org.springframework.util.Assert;
-import org.springframework.util.StringUtils;
-
-/**
- * Stores a {@link ConfigAttribute} as a <code>String</code>.
- *
- * @author Ben Alex
- * @deprecated In modern Spring Security APIs, each API manages its own configuration
- * context. As such there is no direct replacement for this interface. In the case of
- * method security, please see {@link SecurityAnnotationScanner} and
- * {@link AuthorizationManager}. In the case of channel security, please see
- * {@code HttpsRedirectFilter}. In the case of web security, please see
- * {@link AuthorizationManager}.
- */
-@Deprecated
-public class SecurityConfig implements ConfigAttribute {
-
-	@Serial
-	private static final long serialVersionUID = -7138084564199804304L;
-
-	private final String attrib;
-
-	public SecurityConfig(String config) {
-		Assert.hasText(config, "You must provide a configuration attribute");
-		this.attrib = config;
-	}
-
-	@Override
-	public boolean equals(@Nullable Object obj) {
-		if (obj instanceof ConfigAttribute attr) {
-			return this.attrib.equals(attr.getAttribute());
-		}
-		return false;
-	}
-
-	@Override
-	public String getAttribute() {
-		return this.attrib;
-	}
-
-	@Override
-	public int hashCode() {
-		return this.attrib.hashCode();
-	}
-
-	@Override
-	public String toString() {
-		return this.attrib;
-	}
-
-	public static List<ConfigAttribute> createListFromCommaDelimitedString(String access) {
-		return createList(StringUtils.commaDelimitedListToStringArray(access));
-	}
-
-	public static List<ConfigAttribute> createList(String... attributeNames) {
-		Assert.notNull(attributeNames, "You must supply an array of attribute names");
-		List<ConfigAttribute> attributes = new ArrayList<>(attributeNames.length);
-		for (String attribute : attributeNames) {
-			attributes.add(new SecurityConfig(attribute.trim()));
-		}
-		return attributes;
-	}
-
-}

access/src/main/java/org/springframework/security/access/event/package-info.java

@@ -1,23 +0,0 @@
-/*
- * Copyright 2004-present the original author or authors.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *      https://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-/**
- * Authorization event and listener classes.
- */
-@NullMarked
-package org.springframework.security.access.event;
-
-import org.jspecify.annotations.NullMarked;

access/src/main/java/org/springframework/security/access/intercept/aopalliance/package-info.java

@@ -1,24 +0,0 @@
-/*
- * Copyright 2004-present the original author or authors.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *      https://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-/**
- * Enforces security for AOP Alliance <code>MethodInvocation</code>s, such as via Spring
- * AOP.
- */
-@NullMarked
-package org.springframework.security.access.intercept.aopalliance;
-
-import org.jspecify.annotations.NullMarked;

access/src/main/java/org/springframework/security/access/intercept/aspectj/package-info.java

@@ -1,24 +0,0 @@
-/*
- * Copyright 2004-present the original author or authors.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *      https://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-/**
- * Enforces security for AspectJ <code>JointPoint</code>s, delegating secure object
- * callbacks to the calling aspect.
- */
-@NullMarked
-package org.springframework.security.access.intercept.aspectj;
-
-import org.jspecify.annotations.NullMarked;

access/src/main/java/org/springframework/security/access/intercept/package-info.java

@@ -1,39 +0,0 @@
-/*
- * Copyright 2004-present the original author or authors.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *      https://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-/**
- * Abstract level security interception classes which are responsible for enforcing the
- * configured security constraints for a secure object.
- * <p>
- * A <i>secure object</i> is a term frequently used throughout the security system. It
- * does <b>not</b> refer to a business object that is being secured, but instead refers to
- * some infrastructure object that can have security facilities provided for it by Spring
- * Security. For example, one secure object would be <code>MethodInvocation</code>, whilst
- * another would be HTTP {@code org.springframework.security.web.FilterInvocation}. Note
- * these are infrastructure objects and their design allows them to represent a large
- * variety of actual resources that might need to be secured, such as business objects or
- * HTTP request URLs.
- * <p>
- * Each secure object typically has its own interceptor package. Each package usually
- * includes a concrete security interceptor (which subclasses
- * {@link org.springframework.security.access.intercept.AbstractSecurityInterceptor}) and
- * an appropriate {@link org.springframework.security.access.SecurityMetadataSource} for
- * the type of resources the secure object represents.
- */
-@NullMarked
-package org.springframework.security.access.intercept;
-
-import org.jspecify.annotations.NullMarked;

access/src/main/java/org/springframework/security/access/method/MethodSecurityMetadataSource.java

@@ -1,44 +0,0 @@
-/*
- * Copyright 2004, 2005, 2006 Acegi Technology Pty Limited
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *      https://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.springframework.security.access.method;
-
-import java.lang.reflect.Method;
-import java.util.Collection;
-
-import org.jspecify.annotations.Nullable;
-
-import org.springframework.security.access.ConfigAttribute;
-import org.springframework.security.access.SecurityMetadataSource;
-import org.springframework.security.authorization.AuthorizationManager;
-
-/**
- * Interface for <code>SecurityMetadataSource</code> implementations that are designed to
- * perform lookups keyed on <code>Method</code>s.
- *
- * @author Ben Alex
- * @see org.springframework.security.authorization.method.PreAuthorizeAuthorizationManager
- * @see org.springframework.security.authorization.method.PostAuthorizeAuthorizationManager
- * @deprecated Use the {@code use-authorization-manager} attribute for
- * {@code <method-security>} and {@code <intercept-methods>} instead or use
- * annotation-based or {@link AuthorizationManager}-based authorization
- */
-@Deprecated
-public interface MethodSecurityMetadataSource extends SecurityMetadataSource {
-
-	Collection<ConfigAttribute> getAttributes(Method method, @Nullable Class<?> targetClass);
-
-}

access/src/main/java/org/springframework/security/access/method/package-info.java

@@ -1,24 +0,0 @@
-/*
- * Copyright 2004-present the original author or authors.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *      https://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-/**
- * Provides {@code SecurityMetadataSource} implementations for securing Java method
- * invocations via different AOP libraries.
- */
-@NullMarked
-package org.springframework.security.access.method;
-
-import org.jspecify.annotations.NullMarked;

access/src/main/java/org/springframework/security/access/prepost/PrePostInvocationAttributeFactory.java

@@ -1,40 +0,0 @@
-/*
- * Copyright 2004-present the original author or authors.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *      https://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.springframework.security.access.prepost;
-
-import org.jspecify.annotations.Nullable;
-
-import org.springframework.aop.framework.AopInfrastructureBean;
-import org.springframework.security.authorization.AuthorizationManager;
-
-/**
- * @author Luke Taylor
- * @since 3.0
- * @see org.springframework.security.authorization.method.AuthorizationManagerBeforeMethodInterceptor
- * @see org.springframework.security.authorization.method.AuthorizationManagerAfterMethodInterceptor
- * @deprecated Use delegation with {@link AuthorizationManager}
- */
-@Deprecated
-public interface PrePostInvocationAttributeFactory extends AopInfrastructureBean {
-
-	PreInvocationAttribute createPreInvocationAttribute(@Nullable String preFilterAttribute,
-			@Nullable String filterObject, @Nullable String preAuthorizeAttribute);
-
-	PostInvocationAttribute createPostInvocationAttribute(@Nullable String postFilterAttribute,
-			@Nullable String postAuthorizeAttribute);
-
-}

access/src/main/java/org/springframework/security/access/vote/package-info.java

@@ -1,23 +0,0 @@
-/*
- * Copyright 2004-present the original author or authors.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *      https://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-/**
- * Implements a vote-based approach to authorization decisions.
- */
-@NullMarked
-package org.springframework.security.access.vote;
-
-import org.jspecify.annotations.NullMarked;

access/src/main/java/org/springframework/security/acls/afterinvocation/package-info.java

@@ -1,21 +0,0 @@
-/*
- * Copyright 2004-present the original author or authors.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *      https://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-/**
- * After-invocation providers for collection and array filtering. Consider using a
- * {@code PostFilter} annotation in preference.
- */
-package org.springframework.security.acls.afterinvocation;

access/src/main/java/org/springframework/security/web/access/channel/package-info.java

@@ -1,25 +0,0 @@
-/*
- * Copyright 2004-present the original author or authors.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *      https://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-/**
- * Classes that ensure web requests are received over required transport channels.
- * <p>
- * Most commonly used to enforce that requests are submitted over HTTP or HTTPS.
- */
-@NullMarked
-package org.springframework.security.web.access.channel;
-
-import org.jspecify.annotations.NullMarked;

access/src/main/java/org/springframework/security/web/access/expression/DefaultWebSecurityExpressionHandler.java

@@ -1,96 +0,0 @@
-/*
- * Copyright 2004-present the original author or authors.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *      https://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.springframework.security.web.access.expression;
-
-import org.jspecify.annotations.Nullable;
-
-import org.springframework.security.access.expression.AbstractSecurityExpressionHandler;
-import org.springframework.security.access.expression.SecurityExpressionHandler;
-import org.springframework.security.access.expression.SecurityExpressionOperations;
-import org.springframework.security.authentication.AuthenticationTrustResolver;
-import org.springframework.security.authentication.AuthenticationTrustResolverImpl;
-import org.springframework.security.authorization.AuthorizationManagerFactory;
-import org.springframework.security.core.Authentication;
-import org.springframework.security.web.FilterInvocation;
-
-/**
- * @author Luke Taylor
- * @author Eddú Meléndez
- * @author Steve Riesenberg
- * @since 3.0
- */
-public class DefaultWebSecurityExpressionHandler extends AbstractSecurityExpressionHandler<FilterInvocation>
-		implements SecurityExpressionHandler<FilterInvocation> {
-
-	private static final String DEFAULT_ROLE_PREFIX = "ROLE_";
-
-	private String defaultRolePrefix = DEFAULT_ROLE_PREFIX;
-
-	@Override
-	@SuppressWarnings("deprecation")
-	protected SecurityExpressionOperations createSecurityExpressionRoot(@Nullable Authentication authentication,
-			FilterInvocation fi) {
-		FilterInvocationExpressionRoot root = new FilterInvocationExpressionRoot(() -> authentication, fi);
-		root.setAuthorizationManagerFactory(getAuthorizationManagerFactory());
-		root.setPermissionEvaluator(getPermissionEvaluator());
-		if (!DEFAULT_ROLE_PREFIX.equals(this.defaultRolePrefix)) {
-			// Ensure SecurityExpressionRoot can strip the custom role prefix
-			root.setDefaultRolePrefix(this.defaultRolePrefix);
-		}
-		return root;
-	}
-
-	/**
-	 * Sets the {@link AuthenticationTrustResolver} to be used. The default is
-	 * {@link AuthenticationTrustResolverImpl}.
-	 * @param trustResolver the {@link AuthenticationTrustResolver} to use. Cannot be
-	 * null.
-	 * @deprecated Use
-	 * {@link #setAuthorizationManagerFactory(AuthorizationManagerFactory)} instead
-	 */
-	@Deprecated(since = "7.0")
-	public void setTrustResolver(AuthenticationTrustResolver trustResolver) {
-		getDefaultAuthorizationManagerFactory().setTrustResolver(trustResolver);
-	}
-
-	/**
-	 * <p>
-	 * Sets the default prefix to be added to
-	 * {@link org.springframework.security.access.expression.SecurityExpressionRoot#hasAnyRole(String...)}
-	 * or
-	 * {@link org.springframework.security.access.expression.SecurityExpressionRoot#hasRole(String)}.
-	 * For example, if hasRole("ADMIN") or hasRole("ROLE_ADMIN") is passed in, then the
-	 * role ROLE_ADMIN will be used when the defaultRolePrefix is "ROLE_" (default).
-	 * </p>
-	 *
-	 * <p>
-	 * If null or empty, then no default role prefix is used.
-	 * </p>
-	 * @param defaultRolePrefix the default prefix to add to roles. Default "ROLE_".
-	 * @deprecated Use
-	 * {@link #setAuthorizationManagerFactory(AuthorizationManagerFactory)} instead
-	 */
-	@Deprecated(since = "7.0")
-	public void setDefaultRolePrefix(@Nullable String defaultRolePrefix) {
-		if (defaultRolePrefix == null) {
-			defaultRolePrefix = "";
-		}
-		getDefaultAuthorizationManagerFactory().setRolePrefix(defaultRolePrefix);
-		this.defaultRolePrefix = defaultRolePrefix;
-	}
-
-}

access/src/main/java/org/springframework/security/web/access/intercept/FilterInvocationSecurityMetadataSource.java

@@ -1,39 +0,0 @@
-/*
- * Copyright 2004, 2005, 2006 Acegi Technology Pty Limited
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *      https://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.springframework.security.web.access.intercept;
-
-import org.springframework.security.access.SecurityMetadataSource;
-import org.springframework.security.authorization.AuthorizationManager;
-import org.springframework.security.core.annotation.SecurityAnnotationScanner;
-import org.springframework.security.web.FilterInvocation;
-
-/**
- * Marker interface for <code>SecurityMetadataSource</code> implementations that are
- * designed to perform lookups keyed on {@link FilterInvocation}s.
- *
- * @author Ben Alex
- * @deprecated In modern Spring Security APIs, each API manages its own configuration
- * context. As such there is no direct replacement for this interface. In the case of
- * method security, please see {@link SecurityAnnotationScanner} and
- * {@link AuthorizationManager}. In the case of channel security, please see
- * {@code HttpsRedirectFilter}. In the case of web security, please see
- * {@link AuthorizationManager}.
- */
-@Deprecated
-public interface FilterInvocationSecurityMetadataSource extends SecurityMetadataSource {
-
-}

access/src/test/java/org/springframework/security/access/ITargetObject.java

@@ -1,36 +0,0 @@
-/*
- * Copyright 2004, 2005, 2006 Acegi Technology Pty Limited
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *      https://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.springframework.security.access;
-
-/**
- * Represents the interface of a secured object.
- *
- * @author Ben Alex
- */
-public interface ITargetObject {
-
-	Integer computeHashCode(String input);
-
-	int countLength(String input);
-
-	String makeLowerCase(String input);
-
-	String makeUpperCase(String input);
-
-	String publicMakeLowerCase(String input);
-
-}

access/src/test/java/org/springframework/security/access/OtherTargetObject.java

@@ -1,53 +0,0 @@
-/*
- * Copyright 2004, 2005, 2006 Acegi Technology Pty Limited
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *      https://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.springframework.security.access;
-
-/**
- * Simply extends {@link TargetObject} so we have a different object to put configuration
- * attributes against.
- * <P>
- * There is no different behaviour. We have to define each method so that
- * <code>Class.getMethod(methodName, args)</code> returns a <code>Method</code>
- * referencing this class rather than the parent class.
- * </p>
- * <P>
- * We need to implement <code>ITargetObject</code> again because the
- * <code>MethodDefinitionAttributes</code> only locates attributes on interfaces
- * explicitly defined by the intercepted class (not the interfaces defined by its parent
- * class or classes).
- * </p>
- *
- * @author Ben Alex
- */
-public class OtherTargetObject extends TargetObject implements ITargetObject {
-
-	@Override
-	public String makeLowerCase(String input) {
-		return super.makeLowerCase(input);
-	}
-
-	@Override
-	public String makeUpperCase(String input) {
-		return super.makeUpperCase(input);
-	}
-
-	@Override
-	public String publicMakeLowerCase(String input) {
-		return super.publicMakeLowerCase(input);
-	}
-
-}

access/src/test/java/org/springframework/security/access/TargetObject.java

@@ -1,81 +0,0 @@
-/*
- * Copyright 2004, 2005, 2006 Acegi Technology Pty Limited
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *      https://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.springframework.security.access;
-
-import org.springframework.security.core.Authentication;
-import org.springframework.security.core.context.SecurityContextHolder;
-
-/**
- * Represents a secured object.
- *
- * @author Ben Alex
- */
-public class TargetObject implements ITargetObject {
-
-	@Override
-	public Integer computeHashCode(String input) {
-		return input.hashCode();
-	}
-
-	@Override
-	public int countLength(String input) {
-		return input.length();
-	}
-
-	/**
-	 * Returns the lowercase string, followed by security environment information.
-	 * @param input the message to make lowercase
-	 * @return the lowercase message, a space, the <code>Authentication</code> class that
-	 * was on the <code>SecurityContext</code> at the time of method invocation, and a
-	 * boolean indicating if the <code>Authentication</code> object is authenticated or
-	 * not
-	 */
-	@Override
-	public String makeLowerCase(String input) {
-		Authentication auth = SecurityContextHolder.getContext().getAuthentication();
-		if (auth == null) {
-			return input.toLowerCase() + " Authentication empty";
-		}
-		else {
-			return input.toLowerCase() + " " + auth.getClass().getName() + " " + auth.isAuthenticated();
-		}
-	}
-
-	/**
-	 * Returns the uppercase string, followed by security environment information.
-	 * @param input the message to make uppercase
-	 * @return the uppercase message, a space, the <code>Authentication</code> class that
-	 * was on the <code>SecurityContext</code> at the time of method invocation, and a
-	 * boolean indicating if the <code>Authentication</code> object is authenticated or
-	 * not
-	 */
-	@Override
-	public String makeUpperCase(String input) {
-		Authentication auth = SecurityContextHolder.getContext().getAuthentication();
-		return input.toUpperCase() + " " + auth.getClass().getName() + " " + auth.isAuthenticated();
-	}
-
-	/**
-	 * Delegates through to the {@link #makeLowerCase(String)} method.
-	 * @param input the message to be made lower-case
-	 */
-	@Override
-	public String publicMakeLowerCase(String input) {
-		return this.makeLowerCase(input);
-	}
-
-}

access/src/test/java/org/springframework/security/access/annotation/BusinessService.java

@@ -1,69 +0,0 @@
-/*
- * Copyright 2004, 2005, 2006 Acegi Technology Pty Limited
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *      https://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.springframework.security.access.annotation;
-
-import java.io.Serializable;
-import java.util.List;
-
-import jakarta.annotation.security.PermitAll;
-import jakarta.annotation.security.RolesAllowed;
-
-import org.springframework.security.access.prepost.PreAuthorize;
-
-/**
- */
-@Secured({ "ROLE_USER" })
-@PermitAll
-public interface BusinessService extends Serializable {
-
-	@Secured({ "ROLE_ADMIN" })
-	@RolesAllowed({ "ROLE_ADMIN" })
-	@PreAuthorize("hasRole('ROLE_ADMIN')")
-	void someAdminMethod();
-
-	@Secured({ "ROLE_USER", "ROLE_ADMIN" })
-	@RolesAllowed({ "ROLE_USER", "ROLE_ADMIN" })
-	void someUserAndAdminMethod();
-
-	@Secured({ "ROLE_USER" })
-	@RolesAllowed({ "ROLE_USER" })
-	void someUserMethod1();
-
-	@Secured({ "ROLE_USER" })
-	@RolesAllowed({ "ROLE_USER" })
-	void someUserMethod2();
-
-	@RolesAllowed({ "USER" })
-	void rolesAllowedUser();
-
-	int someOther(String s);
-
-	int someOther(int input);
-
-	List<?> methodReturningAList(List<?> someList);
-
-	Object[] methodReturningAnArray(Object[] someArray);
-
-	List<?> methodReturningAList(String userName, String extraParam);
-
-	@RequireAdminRole
-	@RequireUserRole
-	default void repeatedAnnotations() {
-
-	}
-
-}

access/src/test/java/org/springframework/security/access/annotation/BusinessServiceImpl.java

@@ -1,81 +0,0 @@
-/*
- * Copyright 2004-present the original author or authors.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *      https://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.springframework.security.access.annotation;
-
-import java.util.ArrayList;
-import java.util.List;
-
-/**
- * @author Joe Scalise
- */
-@SuppressWarnings("serial")
-public class BusinessServiceImpl<E extends Entity> implements BusinessService {
-
-	@Override
-	@Secured({ "ROLE_USER" })
-	public void someUserMethod1() {
-	}
-
-	@Override
-	@Secured({ "ROLE_USER" })
-	public void someUserMethod2() {
-	}
-
-	@Override
-	@Secured({ "ROLE_USER", "ROLE_ADMIN" })
-	public void someUserAndAdminMethod() {
-	}
-
-	@Override
-	@Secured({ "ROLE_ADMIN" })
-	public void someAdminMethod() {
-	}
-
-	public E someUserMethod3(final E entity) {
-		return entity;
-	}
-
-	@Override
-	public int someOther(String s) {
-		return 0;
-	}
-
-	@Override
-	public int someOther(int input) {
-		return input;
-	}
-
-	@Override
-	public List<?> methodReturningAList(List<?> someList) {
-		return someList;
-	}
-
-	@Override
-	public List<Object> methodReturningAList(String userName, String arg2) {
-		return new ArrayList<>();
-	}
-
-	@Override
-	public Object[] methodReturningAnArray(Object[] someArray) {
-		return null;
-	}
-
-	@Override
-	public void rolesAllowedUser() {
-	}
-
-}

access/src/test/java/org/springframework/security/access/annotation/Entity.java

@@ -1,30 +0,0 @@
-/*
- * Copyright 2004-present the original author or authors.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *      https://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.springframework.security.access.annotation;
-
-/**
- * Class to act as a superclass for annotations testing.
- *
- * @author Ben Alex
- *
- */
-public class Entity {
-
-	public Entity(String someParameter) {
-	}
-
-}

access/src/test/java/org/springframework/security/access/annotation/RequireAdminRole.java

@@ -1,32 +0,0 @@
-/*
- * Copyright 2004-present the original author or authors.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *      https://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.springframework.security.access.annotation;
-
-import java.lang.annotation.Retention;
-import java.lang.annotation.RetentionPolicy;
-
-import jakarta.annotation.security.RolesAllowed;
-
-import org.springframework.security.access.prepost.PreAuthorize;
-
-@Retention(RetentionPolicy.RUNTIME)
-@PreAuthorize("hasRole('ADMIN')")
-@RolesAllowed("ADMIN")
-@Secured("ADMIN")
-public @interface RequireAdminRole {
-
-}

access/src/test/java/org/springframework/security/access/annotation/RequireUserRole.java

@@ -1,32 +0,0 @@
-/*
- * Copyright 2004-present the original author or authors.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *      https://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.springframework.security.access.annotation;
-
-import java.lang.annotation.Retention;
-import java.lang.annotation.RetentionPolicy;
-
-import jakarta.annotation.security.RolesAllowed;
-
-import org.springframework.security.access.prepost.PreAuthorize;
-
-@Retention(RetentionPolicy.RUNTIME)
-@PreAuthorize("hasRole('USER')")
-@RolesAllowed("USER")
-@Secured("USER")
-public @interface RequireUserRole {
-
-}

access/src/test/java/org/springframework/security/access/intercept/method/MockMethodInvocation.java

@@ -1,75 +0,0 @@
-/*
- * Copyright 2004-present the original author or authors.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *      https://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.springframework.security.access.intercept.method;
-
-import java.lang.reflect.AccessibleObject;
-import java.lang.reflect.Method;
-
-import org.aopalliance.intercept.MethodInvocation;
-
-@SuppressWarnings("unchecked")
-public class MockMethodInvocation implements MethodInvocation {
-
-	private Method method;
-
-	private Object targetObject;
-
-	private Object[] arguments = new Object[0];
-
-	public MockMethodInvocation(Object targetObject, Class clazz, String methodName, Class[] parameterTypes,
-			Object[] arguments) throws NoSuchMethodException {
-		this(targetObject, clazz, methodName, parameterTypes);
-		this.arguments = arguments;
-	}
-
-	public MockMethodInvocation(Object targetObject, Class clazz, String methodName, Class... parameterTypes)
-			throws NoSuchMethodException {
-		this(targetObject, clazz.getMethod(methodName, parameterTypes));
-		this.targetObject = targetObject;
-	}
-
-	public MockMethodInvocation(Object targetObject, Method method) {
-		this.targetObject = targetObject;
-		this.method = method;
-	}
-
-	@Override
-	public Object[] getArguments() {
-		return this.arguments;
-	}
-
-	@Override
-	public Method getMethod() {
-		return this.method;
-	}
-
-	@Override
-	public AccessibleObject getStaticPart() {
-		return null;
-	}
-
-	@Override
-	public Object getThis() {
-		return this.targetObject;
-	}
-
-	@Override
-	public Object proceed() {
-		return null;
-	}
-
-}

access/src/test/java/org/springframework/security/access/prepost/PostInvocationAdviceProviderTests.java

@@ -1,60 +0,0 @@
-/*
- * Copyright 2004-present the original author or authors.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *      https://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.springframework.security.access.prepost;
-
-import org.aopalliance.intercept.MethodInvocation;
-import org.junit.jupiter.api.BeforeEach;
-import org.junit.jupiter.api.Test;
-import org.junit.jupiter.api.extension.ExtendWith;
-import org.mockito.Mock;
-import org.mockito.junit.jupiter.MockitoExtension;
-
-import org.springframework.aop.ProxyMethodInvocation;
-import org.springframework.security.access.intercept.aspectj.MethodInvocationAdapter;
-
-import static org.assertj.core.api.Assertions.assertThat;
-
-@ExtendWith(MockitoExtension.class)
-@SuppressWarnings("deprecation")
-public class PostInvocationAdviceProviderTests {
-
-	@Mock
-	private PostInvocationAuthorizationAdvice authorizationAdvice;
-
-	private PostInvocationAdviceProvider postInvocationAdviceProvider;
-
-	@BeforeEach
-	public void setUp() {
-		this.postInvocationAdviceProvider = new PostInvocationAdviceProvider(this.authorizationAdvice);
-	}
-
-	@Test
-	public void supportsMethodInvocation() {
-		assertThat(this.postInvocationAdviceProvider.supports(MethodInvocation.class)).isTrue();
-	}
-
-	@Test
-	public void supportsProxyMethodInvocation() {
-		assertThat(this.postInvocationAdviceProvider.supports(ProxyMethodInvocation.class)).isTrue();
-	}
-
-	@Test
-	public void supportsMethodInvocationAdapter() {
-		assertThat(this.postInvocationAdviceProvider.supports(MethodInvocationAdapter.class)).isTrue();
-	}
-
-}

access/src/test/java/org/springframework/security/web/access/DefaultWebInvocationPrivilegeEvaluatorTests.java

@@ -1,126 +0,0 @@
-/*
- * Copyright 2004-present the original author or authors.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *      https://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.springframework.security.web.access;
-
-import org.assertj.core.api.Assertions;
-import org.junit.jupiter.api.BeforeEach;
-import org.junit.jupiter.api.Test;
-import org.mockito.ArgumentCaptor;
-import org.mockito.ArgumentMatchers;
-import org.mockito.BDDMockito;
-import org.mockito.Mockito;
-
-import org.springframework.context.ApplicationEventPublisher;
-import org.springframework.mock.web.MockServletContext;
-import org.springframework.security.access.AccessDecisionManager;
-import org.springframework.security.access.AccessDeniedException;
-import org.springframework.security.access.intercept.RunAsManager;
-import org.springframework.security.authentication.AuthenticationManager;
-import org.springframework.security.authentication.TestingAuthenticationToken;
-import org.springframework.security.core.Authentication;
-import org.springframework.security.core.context.SecurityContextHolder;
-import org.springframework.security.web.FilterInvocation;
-import org.springframework.security.web.access.intercept.FilterInvocationSecurityMetadataSource;
-import org.springframework.security.web.access.intercept.FilterSecurityInterceptor;
-
-/**
- * Tests
- * {@link org.springframework.security.web.access.DefaultWebInvocationPrivilegeEvaluator}.
- *
- * @author Ben Alex
- */
-@SuppressWarnings("deprecation")
-public class DefaultWebInvocationPrivilegeEvaluatorTests {
-
-	private AccessDecisionManager adm;
-
-	private FilterInvocationSecurityMetadataSource ods;
-
-	private RunAsManager ram;
-
-	private FilterSecurityInterceptor interceptor;
-
-	@BeforeEach
-	public final void setUp() {
-		this.interceptor = new FilterSecurityInterceptor();
-		this.ods = Mockito.mock(FilterInvocationSecurityMetadataSource.class);
-		this.adm = Mockito.mock(AccessDecisionManager.class);
-		this.ram = Mockito.mock(RunAsManager.class);
-		this.interceptor.setAuthenticationManager(Mockito.mock(AuthenticationManager.class));
-		this.interceptor.setSecurityMetadataSource(this.ods);
-		this.interceptor.setAccessDecisionManager(this.adm);
-		this.interceptor.setRunAsManager(this.ram);
-		this.interceptor.setApplicationEventPublisher(Mockito.mock(ApplicationEventPublisher.class));
-		SecurityContextHolder.clearContext();
-	}
-
-	@Test
-	public void permitsAccessIfNoMatchingAttributesAndPublicInvocationsAllowed() {
-		DefaultWebInvocationPrivilegeEvaluator wipe = new DefaultWebInvocationPrivilegeEvaluator(this.interceptor);
-		BDDMockito.given(this.ods.getAttributes(ArgumentMatchers.any())).willReturn(null);
-		Assertions.assertThat(wipe.isAllowed("/context", "/foo/index.jsp", "GET", Mockito.mock(Authentication.class)))
-			.isTrue();
-	}
-
-	@Test
-	public void deniesAccessIfNoMatchingAttributesAndPublicInvocationsNotAllowed() {
-		DefaultWebInvocationPrivilegeEvaluator wipe = new DefaultWebInvocationPrivilegeEvaluator(this.interceptor);
-		BDDMockito.given(this.ods.getAttributes(ArgumentMatchers.any())).willReturn(null);
-		this.interceptor.setRejectPublicInvocations(true);
-		Assertions.assertThat(wipe.isAllowed("/context", "/foo/index.jsp", "GET", Mockito.mock(Authentication.class)))
-			.isFalse();
-	}
-
-	@Test
-	public void deniesAccessIfAuthenticationIsNull() {
-		DefaultWebInvocationPrivilegeEvaluator wipe = new DefaultWebInvocationPrivilegeEvaluator(this.interceptor);
-		Assertions.assertThat(wipe.isAllowed("/foo/index.jsp", null)).isFalse();
-	}
-
-	@Test
-	public void allowsAccessIfAccessDecisionManagerDoes() {
-		Authentication token = new TestingAuthenticationToken("test", "Password", "MOCK_INDEX");
-		DefaultWebInvocationPrivilegeEvaluator wipe = new DefaultWebInvocationPrivilegeEvaluator(this.interceptor);
-		Assertions.assertThat(wipe.isAllowed("/foo/index.jsp", token)).isTrue();
-	}
-
-	@SuppressWarnings("unchecked")
-	@Test
-	public void deniesAccessIfAccessDecisionManagerDoes() {
-		Authentication token = new TestingAuthenticationToken("test", "Password", "MOCK_INDEX");
-		DefaultWebInvocationPrivilegeEvaluator wipe = new DefaultWebInvocationPrivilegeEvaluator(this.interceptor);
-		BDDMockito.willThrow(new AccessDeniedException(""))
-			.given(this.adm)
-			.decide(ArgumentMatchers.any(Authentication.class), ArgumentMatchers.any(), ArgumentMatchers.anyList());
-		Assertions.assertThat(wipe.isAllowed("/foo/index.jsp", token)).isFalse();
-	}
-
-	@Test
-	public void isAllowedWhenServletContextIsSetThenPassedFilterInvocationHasServletContext() {
-		Authentication token = new TestingAuthenticationToken("test", "Password", "MOCK_INDEX");
-		MockServletContext servletContext = new MockServletContext();
-		ArgumentCaptor<FilterInvocation> filterInvocationArgumentCaptor = ArgumentCaptor
-			.forClass(FilterInvocation.class);
-		DefaultWebInvocationPrivilegeEvaluator wipe = new DefaultWebInvocationPrivilegeEvaluator(this.interceptor);
-		wipe.setServletContext(servletContext);
-		wipe.isAllowed("/foo/index.jsp", token);
-		Mockito.verify(this.adm)
-			.decide(ArgumentMatchers.eq(token), filterInvocationArgumentCaptor.capture(), ArgumentMatchers.any());
-		Assertions.assertThat(filterInvocationArgumentCaptor.getValue().getRequest().getServletContext()).isNotNull();
-	}
-
-}

acl/spring-security-acl.gradle

@@ -1,9 +1,3 @@
-plugins {
-	id 'compile-warnings-error'
-	id 'javadoc-warnings-error'
-	id 'security-nullability'
-}
-
 apply plugin: 'io.spring.convention.spring-module'
 
 dependencies {
@@ -15,6 +9,8 @@ dependencies {
 	api 'org.springframework:spring-jdbc'
 	api 'org.springframework:spring-tx'
 
+	optional 'net.sf.ehcache:ehcache'
+
 	testImplementation "org.assertj:assertj-core"
 	testImplementation "org.junit.jupiter:junit-jupiter-api"
 	testImplementation "org.junit.jupiter:junit-jupiter-params"
@@ -26,5 +22,4 @@ dependencies {
 	testImplementation "org.springframework:spring-test"
 
 	testRuntimeOnly 'org.hsqldb:hsqldb'
-	testRuntimeOnly 'org.junit.platform:junit-platform-launcher'
 }

acl/src/main/java/org/springframework/security/acls/AclEntryVoter.java

@@ -71,7 +71,7 @@ import org.springframework.util.StringUtils;
  * <tt>AclEntryVoter</tt>:
  * <ul>
  * <li>Process domain object class <code>BankAccount</code>, configuration attribute
- * <code>VOTE_ACL_BANK_ACCOUNT_READ</code>, require permission
+ * <code>VOTE_ACL_BANK_ACCONT_READ</code>, require permission
  * <code>BasePermission.READ</code></li>
  * <li>Process domain object class <code>BankAccount</code>, configuration attribute
  * <code>VOTE_ACL_BANK_ACCOUNT_WRITE</code>, require permission list
@@ -96,11 +96,7 @@ import org.springframework.util.StringUtils;
  * All comparisons and prefixes are case sensitive.
  *
  * @author Ben Alex
- * @deprecated please use {@link AclPermissionEvaluator} instead. Spring Method Security
- * annotations may also prove useful, for example
- * {@code @PreAuthorize("hasPermission(#id, ObjectsReturnType.class, read)")}
  */
-@Deprecated
 public class AclEntryVoter extends AbstractAclVoter {
 
 	private static final Log logger = LogFactory.getLog(AclEntryVoter.class);

acl/src/main/java/org/springframework/security/acls/AclPermissionCacheOptimizer.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2004-present the original author or authors.
+ * Copyright 2002-2016 the original author or authors.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.

acl/src/main/java/org/springframework/security/acls/AclPermissionEvaluator.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2004-present the original author or authors.
+ * Copyright 2002-2016 the original author or authors.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -23,7 +23,6 @@ import java.util.Locale;
 
 import org.apache.commons.logging.Log;
 import org.apache.commons.logging.LogFactory;
-import org.jspecify.annotations.Nullable;
 
 import org.springframework.core.log.LogMessage;
 import org.springframework.security.access.PermissionEvaluator;
@@ -45,7 +44,7 @@ import org.springframework.security.core.Authentication;
 /**
  * Used by Spring Security's expression-based access control implementation to evaluate
  * permissions for a particular object using the ACL module. Similar in behaviour to
- * <code> org.springframework.security.acls.AclEntryVoter AclEntryVoter </code>
+ * {@link org.springframework.security.acls.AclEntryVoter AclEntryVoter}.
  *
  * @author Luke Taylor
  * @since 3.0
@@ -74,7 +73,7 @@ public class AclPermissionEvaluator implements PermissionEvaluator {
 	 * be overridden using a null check in the expression itself).
 	 */
 	@Override
-	public boolean hasPermission(Authentication authentication, @Nullable Object domainObject, Object permission) {
+	public boolean hasPermission(Authentication authentication, Object domainObject, Object permission) {
 		if (domainObject == null) {
 			return false;
 		}
@@ -119,7 +118,8 @@ public class AclPermissionEvaluator implements PermissionEvaluator {
 		if (permission instanceof Permission[]) {
 			return Arrays.asList((Permission[]) permission);
 		}
-		if (permission instanceof String permString) {
+		if (permission instanceof String) {
+			String permString = (String) permission;
 			Permission p = buildPermission(permString);
 			if (p != null) {
 				return Arrays.asList(p);

acl/src/main/java/org/springframework/security/acls/afterinvocation/AbstractAclProvider.java

@@ -20,7 +20,6 @@ import java.util.List;
 
 import org.springframework.security.access.AfterInvocationProvider;
 import org.springframework.security.access.ConfigAttribute;
-import org.springframework.security.acls.AclPermissionEvaluator;
 import org.springframework.security.acls.domain.ObjectIdentityRetrievalStrategyImpl;
 import org.springframework.security.acls.domain.SidRetrievalStrategyImpl;
 import org.springframework.security.acls.model.Acl;
@@ -40,11 +39,7 @@ import org.springframework.util.ObjectUtils;
  * services.
  *
  * @author Ben Alex
- * @deprecated please use {@link AclPermissionEvaluator} instead. Spring Method Security
- * annotations may also prove useful, for example
- * {@code @PostAuthorize("hasPermission(filterObject, read)")}
  */
-@Deprecated
 public abstract class AbstractAclProvider implements AfterInvocationProvider {
 
 	protected final AclService aclService;

acl/src/main/java/org/springframework/security/acls/afterinvocation/AclEntryAfterInvocationCollectionFilteringProvider.java

@@ -26,7 +26,6 @@ import org.springframework.core.log.LogMessage;
 import org.springframework.security.access.AccessDeniedException;
 import org.springframework.security.access.AuthorizationServiceException;
 import org.springframework.security.access.ConfigAttribute;
-import org.springframework.security.acls.AclPermissionEvaluator;
 import org.springframework.security.acls.model.AclService;
 import org.springframework.security.acls.model.Permission;
 import org.springframework.security.core.Authentication;
@@ -63,11 +62,7 @@ import org.springframework.security.core.Authentication;
  *
  * @author Ben Alex
  * @author Paulo Neves
- * @deprecated please use {@link AclPermissionEvaluator} instead. Spring Method Security
- * annotations may also prove useful, for example
- * {@code @PostFilter("hasPermission(filterObject, read)")}
  */
-@Deprecated
 public class AclEntryAfterInvocationCollectionFilteringProvider extends AbstractAclProvider {
 
 	protected static final Log logger = LogFactory.getLog(AclEntryAfterInvocationCollectionFilteringProvider.class);
@@ -111,7 +106,6 @@ public class AclEntryAfterInvocationCollectionFilteringProvider extends Abstract
 		return returnedObject;
 	}
 
-	@SuppressWarnings({ "unchecked", "rawtypes" })
 	private Filterer getFilterer(Object returnedObject) {
 		if (returnedObject instanceof Collection) {
 			return new CollectionFilterer((Collection) returnedObject);

acl/src/main/java/org/springframework/security/acls/afterinvocation/AclEntryAfterInvocationProvider.java

@@ -27,7 +27,6 @@ import org.springframework.context.MessageSourceAware;
 import org.springframework.context.support.MessageSourceAccessor;
 import org.springframework.security.access.AccessDeniedException;
 import org.springframework.security.access.ConfigAttribute;
-import org.springframework.security.acls.AclPermissionEvaluator;
 import org.springframework.security.acls.model.AclService;
 import org.springframework.security.acls.model.Permission;
 import org.springframework.security.core.Authentication;
@@ -60,12 +59,7 @@ import org.springframework.security.core.SpringSecurityMessageSource;
  * granted and <code>null</code> will be returned.
  * <p>
  * All comparisons and prefixes are case sensitive.
- *
- * @deprecated please use {@link AclPermissionEvaluator} instead. Spring Method Security
- * annotations may also prove useful, for example
- * {@code @PostAuthorize("hasPermission(filterObject, read)")}
  */
-@Deprecated
 public class AclEntryAfterInvocationProvider extends AbstractAclProvider implements MessageSourceAware {
 
 	protected static final Log logger = LogFactory.getLog(AclEntryAfterInvocationProvider.class);

acl/src/main/java/org/springframework/security/acls/afterinvocation/ArrayFilterer.java

@@ -32,9 +32,7 @@ import org.springframework.core.log.LogMessage;
  *
  * @author Ben Alex
  * @author Paulo Neves
- * @deprecated please see {@code PostFilter}
  */
-@Deprecated
 class ArrayFilterer<T> implements Filterer<T> {
 
 	protected static final Log logger = LogFactory.getLog(ArrayFilterer.class);

acl/src/main/java/org/springframework/security/acls/afterinvocation/CollectionFilterer.java

@@ -31,9 +31,7 @@ import org.springframework.core.log.LogMessage;
  *
  * @author Ben Alex
  * @author Paulo Neves
- * @deprecated please see {@code PostFilter}
  */
-@Deprecated
 class CollectionFilterer<T> implements Filterer<T> {
 
 	protected static final Log logger = LogFactory.getLog(CollectionFilterer.class);

acl/src/main/java/org/springframework/security/acls/afterinvocation/Filterer.java

@@ -23,9 +23,7 @@ import java.util.Iterator;
  *
  * @author Ben Alex
  * @author Paulo Neves
- * @deprecated please use {@code PreFilter} and {@code @PostFilter} instead
  */
-@Deprecated
 interface Filterer<T> extends Iterable<T> {
 
 	/**

acl/src/main/java/org/springframework/security/acls/afterinvocation/package-info.java

@@ -0,0 +1,21 @@
+/*
+ * Copyright 2002-2016 the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+/**
+ * After-invocation providers for collection and array filtering. Consider using a
+ * {@code PostFilter} annotation in preference.
+ */
+package org.springframework.security.acls.afterinvocation;

acl/src/main/java/org/springframework/security/acls/aot/hint/AclRuntimeHints.java

@@ -1,79 +0,0 @@
-/*
- * Copyright 2004-present the original author or authors.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *      https://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.springframework.security.acls.aot.hint;
-
-import java.util.stream.Stream;
-
-import org.jspecify.annotations.Nullable;
-
-import org.springframework.aot.hint.MemberCategory;
-import org.springframework.aot.hint.RuntimeHints;
-import org.springframework.aot.hint.RuntimeHintsRegistrar;
-import org.springframework.aot.hint.TypeReference;
-import org.springframework.core.io.ClassPathResource;
-import org.springframework.core.io.Resource;
-import org.springframework.security.acls.domain.AclImpl;
-import org.springframework.security.acls.domain.AuditLogger;
-import org.springframework.security.acls.domain.BasePermission;
-import org.springframework.security.acls.domain.GrantedAuthoritySid;
-import org.springframework.security.acls.domain.ObjectIdentityImpl;
-import org.springframework.security.acls.domain.PrincipalSid;
-import org.springframework.security.acls.model.AccessControlEntry;
-import org.springframework.security.acls.model.Acl;
-import org.springframework.security.acls.model.AuditableAccessControlEntry;
-import org.springframework.security.acls.model.ObjectIdentity;
-import org.springframework.security.acls.model.Sid;
-
-/**
- * {@link RuntimeHintsRegistrar} for ACL (Access Control List) classes.
- *
- * @author Josh Long
- */
-class AclRuntimeHints implements RuntimeHintsRegistrar {
-
-	@Override
-	public void registerHints(RuntimeHints hints, @Nullable ClassLoader classLoader) {
-		registerAclDomainHints(hints);
-		registerJdbcSchemaHints(hints);
-	}
-
-	private void registerAclDomainHints(RuntimeHints hints) {
-		// Register core ACL domain types
-		Stream
-			.of(Acl.class, AccessControlEntry.class, AuditableAccessControlEntry.class, ObjectIdentity.class, Sid.class,
-					AclImpl.class, AccessControlEntry.class, AuditLogger.class, ObjectIdentityImpl.class,
-					PrincipalSid.class, GrantedAuthoritySid.class, BasePermission.class)
-			.forEach((c) -> hints.reflection()
-				.registerType(TypeReference.of(c),
-						(builder) -> builder.withMembers(MemberCategory.INVOKE_DECLARED_CONSTRUCTORS,
-								MemberCategory.INVOKE_DECLARED_METHODS, MemberCategory.ACCESS_DECLARED_FIELDS)));
-
-	}
-
-	private void registerJdbcSchemaHints(RuntimeHints hints) {
-		String[] sqlFiles = new String[] { "createAclSchema.sql", "createAclSchemaMySQL.sql",
-				"createAclSchemaOracle.sql", "createAclSchemaPostgres.sql", "createAclSchemaSqlServer.sql",
-				"createAclSchemaWithAclClassIdType.sql", "select.sql" };
-		for (String sqlFile : sqlFiles) {
-			Resource sqlResource = new ClassPathResource(sqlFile);
-			if (sqlResource.exists()) {
-				hints.resources().registerResource(sqlResource);
-			}
-		}
-	}
-
-}

acl/src/main/java/org/springframework/security/acls/aot/hint/package-info.java

@@ -1,23 +0,0 @@
-/*
- * Copyright 2004-present the original author or authors.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *      https://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-/**
- * AOT and native image hint support for ACLs.
- */
-@NullMarked
-package org.springframework.security.acls.aot.hint;
-
-import org.jspecify.annotations.NullMarked;

acl/src/main/java/org/springframework/security/acls/domain/AbstractPermission.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2004-present the original author or authors.
+ * Copyright 2002-2016 the original author or authors.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -16,8 +16,6 @@
 
 package org.springframework.security.acls.domain;
 
-import org.jspecify.annotations.Nullable;
-
 import org.springframework.security.acls.model.Permission;
 
 /**
@@ -54,13 +52,14 @@ public abstract class AbstractPermission implements Permission {
 	}
 
 	@Override
-	public final boolean equals(@Nullable Object obj) {
+	public final boolean equals(Object obj) {
 		if (obj == null) {
 			return false;
 		}
-		if (!(obj instanceof Permission other)) {
+		if (!(obj instanceof Permission)) {
 			return false;
 		}
+		Permission other = (Permission) obj;
 		return (this.mask == other.getMask());
 	}
 

acl/src/main/java/org/springframework/security/acls/domain/AccessControlEntryImpl.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2004-present the original author or authors.
+ * Copyright 2002-2016 the original author or authors.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -18,8 +18,6 @@ package org.springframework.security.acls.domain;
 
 import java.io.Serializable;
 
-import org.jspecify.annotations.Nullable;
-
 import org.springframework.security.acls.model.AccessControlEntry;
 import org.springframework.security.acls.model.Acl;
 import org.springframework.security.acls.model.AuditableAccessControlEntry;
@@ -38,7 +36,7 @@ public class AccessControlEntryImpl implements AccessControlEntry, AuditableAcce
 
 	private Permission permission;
 
-	private final @Nullable Serializable id;
+	private final Serializable id;
 
 	private final Sid sid;
 
@@ -48,7 +46,7 @@ public class AccessControlEntryImpl implements AccessControlEntry, AuditableAcce
 
 	private final boolean granting;
 
-	public AccessControlEntryImpl(@Nullable Serializable id, Acl acl, Sid sid, Permission permission, boolean granting,
+	public AccessControlEntryImpl(Serializable id, Acl acl, Sid sid, Permission permission, boolean granting,
 			boolean auditSuccess, boolean auditFailure) {
 		Assert.notNull(acl, "Acl required");
 		Assert.notNull(sid, "Sid required");
@@ -63,7 +61,7 @@ public class AccessControlEntryImpl implements AccessControlEntry, AuditableAcce
 	}
 
 	@Override
-	public boolean equals(@Nullable Object arg0) {
+	public boolean equals(Object arg0) {
 		if (!(arg0 instanceof AccessControlEntryImpl)) {
 			return false;
 		}
@@ -135,7 +133,7 @@ public class AccessControlEntryImpl implements AccessControlEntry, AuditableAcce
 	}
 
 	@Override
-	public @Nullable Serializable getId() {
+	public Serializable getId() {
 		return this.id;
 	}
 

acl/src/main/java/org/springframework/security/acls/domain/AclAuthorizationStrategy.java

@@ -20,7 +20,7 @@ import org.springframework.security.acls.model.Acl;
 
 /**
  * Strategy used by {@link AclImpl} to determine whether a principal is permitted to call
- * administrative methods on the <code>AclImpl</code>.
+ * adminstrative methods on the <code>AclImpl</code>.
  *
  * @author Ben Alex
  */

acl/src/main/java/org/springframework/security/acls/domain/AclAuthorizationStrategyImpl.java

@@ -17,22 +17,17 @@
 package org.springframework.security.acls.domain;
 
 import java.util.Arrays;
-import java.util.Collection;
 import java.util.List;
 import java.util.Set;
 
 import org.springframework.security.access.AccessDeniedException;
-import org.springframework.security.access.hierarchicalroles.NullRoleHierarchy;
-import org.springframework.security.access.hierarchicalroles.RoleHierarchy;
 import org.springframework.security.acls.model.Acl;
 import org.springframework.security.acls.model.Sid;
 import org.springframework.security.acls.model.SidRetrievalStrategy;
 import org.springframework.security.core.Authentication;
 import org.springframework.security.core.GrantedAuthority;
 import org.springframework.security.core.authority.AuthorityUtils;
-import org.springframework.security.core.context.SecurityContext;
 import org.springframework.security.core.context.SecurityContextHolder;
-import org.springframework.security.core.context.SecurityContextHolderStrategy;
 import org.springframework.util.Assert;
 
 /**
@@ -51,9 +46,6 @@ import org.springframework.util.Assert;
  */
 public class AclAuthorizationStrategyImpl implements AclAuthorizationStrategy {
 
-	private SecurityContextHolderStrategy securityContextHolderStrategy = SecurityContextHolder
-		.getContextHolderStrategy();
-
 	private final GrantedAuthority gaGeneralChanges;
 
 	private final GrantedAuthority gaModifyAuditing;
@@ -62,8 +54,6 @@ public class AclAuthorizationStrategyImpl implements AclAuthorizationStrategy {
 
 	private SidRetrievalStrategy sidRetrievalStrategy = new SidRetrievalStrategyImpl();
 
-	private RoleHierarchy roleHierarchy = new NullRoleHierarchy();
-
 	/**
 	 * Constructor. The only mandatory parameter relates to the system-wide
 	 * {@link GrantedAuthority} instances that can be held to always permit ACL changes.
@@ -91,26 +81,23 @@ public class AclAuthorizationStrategyImpl implements AclAuthorizationStrategy {
 
 	@Override
 	public void securityCheck(Acl acl, int changeType) {
-		SecurityContext context = this.securityContextHolderStrategy.getContext();
-		if ((context == null) || (context.getAuthentication() == null)
-				|| !context.getAuthentication().isAuthenticated()) {
+		if ((SecurityContextHolder.getContext() == null)
+				|| (SecurityContextHolder.getContext().getAuthentication() == null)
+				|| !SecurityContextHolder.getContext().getAuthentication().isAuthenticated()) {
 			throw new AccessDeniedException("Authenticated principal required to operate with ACLs");
 		}
-		Authentication authentication = context.getAuthentication();
+		Authentication authentication = SecurityContextHolder.getContext().getAuthentication();
 		// Check if authorized by virtue of ACL ownership
 		Sid currentUser = createCurrentUser(authentication);
-		Sid owner = acl.getOwner();
-		if (owner != null && currentUser.equals(owner)
+		if (currentUser.equals(acl.getOwner())
 				&& ((changeType == CHANGE_GENERAL) || (changeType == CHANGE_OWNERSHIP))) {
 			return;
 		}
 
 		// Iterate this principal's authorities to determine right
-		Collection<? extends GrantedAuthority> reachableGrantedAuthorities = this.roleHierarchy
-			.getReachableGrantedAuthorities(authentication.getAuthorities());
-		Set<String> authorities = AuthorityUtils.authorityListToSet(reachableGrantedAuthorities);
-		if (owner instanceof GrantedAuthoritySid
-				&& authorities.contains(((GrantedAuthoritySid) owner).getGrantedAuthority())) {
+		Set<String> authorities = AuthorityUtils.authorityListToSet(authentication.getAuthorities());
+		if (acl.getOwner() instanceof GrantedAuthoritySid
+				&& authorities.contains(((GrantedAuthoritySid) acl.getOwner()).getGrantedAuthority())) {
 			return;
 		}
 
@@ -159,25 +146,4 @@ public class AclAuthorizationStrategyImpl implements AclAuthorizationStrategy {
 		this.sidRetrievalStrategy = sidRetrievalStrategy;
 	}
 
-	/**
-	 * Sets the {@link SecurityContextHolderStrategy} to use. The default action is to use
-	 * the {@link SecurityContextHolderStrategy} stored in {@link SecurityContextHolder}.
-	 *
-	 * @since 5.8
-	 */
-	public void setSecurityContextHolderStrategy(SecurityContextHolderStrategy securityContextHolderStrategy) {
-		Assert.notNull(securityContextHolderStrategy, "securityContextHolderStrategy cannot be null");
-		this.securityContextHolderStrategy = securityContextHolderStrategy;
-	}
-
-	/**
-	 * Sets the {@link RoleHierarchy} to use. The default is to use a
-	 * {@link NullRoleHierarchy}
-	 * @since 6.4
-	 */
-	public void setRoleHierarchy(RoleHierarchy roleHierarchy) {
-		Assert.notNull(roleHierarchy, "roleHierarchy cannot be null");
-		this.roleHierarchy = roleHierarchy;
-	}
-
 }

acl/src/main/java/org/springframework/security/acls/domain/AclImpl.java

@@ -20,8 +20,6 @@ import java.io.Serializable;
 import java.util.ArrayList;
 import java.util.List;
 
-import org.jspecify.annotations.Nullable;
-
 import org.springframework.security.acls.model.AccessControlEntry;
 import org.springframework.security.acls.model.Acl;
 import org.springframework.security.acls.model.AuditableAcl;
@@ -43,7 +41,7 @@ import org.springframework.util.ObjectUtils;
  */
 public class AclImpl implements Acl, MutableAcl, AuditableAcl, OwnershipAcl {
 
-	private @Nullable Acl parentAcl;
+	private Acl parentAcl;
 
 	private transient AclAuthorizationStrategy aclAuthorizationStrategy;
 
@@ -56,10 +54,10 @@ public class AclImpl implements Acl, MutableAcl, AuditableAcl, OwnershipAcl {
 	private Serializable id;
 
 	// OwnershipAcl
-	private @Nullable Sid owner;
+	private Sid owner;
 
 	// includes all SIDs the WHERE clause covered, even if there was no ACE for a SID
-	private @Nullable List<Sid> loadedSids = null;
+	private List<Sid> loadedSids = null;
 
 	private boolean entriesInheriting = true;
 
@@ -99,8 +97,8 @@ public class AclImpl implements Acl, MutableAcl, AuditableAcl, OwnershipAcl {
 	 * @param owner the owner (required)
 	 */
 	public AclImpl(ObjectIdentity objectIdentity, Serializable id, AclAuthorizationStrategy aclAuthorizationStrategy,
-			PermissionGrantingStrategy grantingStrategy, @Nullable Acl parentAcl, @Nullable List<Sid> loadedSids,
-			boolean entriesInheriting, Sid owner) {
+			PermissionGrantingStrategy grantingStrategy, Acl parentAcl, List<Sid> loadedSids, boolean entriesInheriting,
+			Sid owner) {
 		Assert.notNull(objectIdentity, "Object Identity required");
 		Assert.notNull(id, "Id required");
 		Assert.notNull(aclAuthorizationStrategy, "AclAuthorizationStrategy required");
@@ -119,7 +117,7 @@ public class AclImpl implements Acl, MutableAcl, AuditableAcl, OwnershipAcl {
 	 * Private no-argument constructor for use by reflection-based persistence tools along
 	 * with field-level access.
 	 */
-	@SuppressWarnings({ "unused", "NullAway.Init" })
+	@SuppressWarnings("unused")
 	private AclImpl() {
 	}
 
@@ -201,10 +199,10 @@ public class AclImpl implements Acl, MutableAcl, AuditableAcl, OwnershipAcl {
 	}
 
 	@Override
-	public boolean isSidLoaded(@Nullable List<Sid> sids) {
+	public boolean isSidLoaded(List<Sid> sids) {
 		// If loadedSides is null, this indicates all SIDs were loaded
 		// Also return true if the caller didn't specify a SID to find
-		if ((this.loadedSids == null) || (sids == null) || sids.isEmpty()) {
+		if ((this.loadedSids == null) || (sids == null) || (sids.size() == 0)) {
 			return true;
 		}
 
@@ -240,19 +238,19 @@ public class AclImpl implements Acl, MutableAcl, AuditableAcl, OwnershipAcl {
 	}
 
 	@Override
-	public @Nullable Sid getOwner() {
+	public Sid getOwner() {
 		return this.owner;
 	}
 
 	@Override
-	public void setParent(@Nullable Acl newParent) {
+	public void setParent(Acl newParent) {
 		this.aclAuthorizationStrategy.securityCheck(this, AclAuthorizationStrategy.CHANGE_GENERAL);
 		Assert.isTrue(newParent == null || !newParent.equals(this), "Cannot be the parent of yourself");
 		this.parentAcl = newParent;
 	}
 
 	@Override
-	public @Nullable Acl getParentAcl() {
+	public Acl getParentAcl() {
 		return this.parentAcl;
 	}
 
@@ -278,7 +276,7 @@ public class AclImpl implements Acl, MutableAcl, AuditableAcl, OwnershipAcl {
 	}
 
 	@Override
-	public boolean equals(@Nullable Object obj) {
+	public boolean equals(Object obj) {
 		if (obj == this) {
 			return true;
 		}

acl/src/main/java/org/springframework/security/acls/domain/DefaultPermissionFactory.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2004-present the original author or authors.
+ * Copyright 2002-2018 the original author or authors.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -140,7 +140,7 @@ public class DefaultPermissionFactory implements PermissionFactory {
 
 	@Override
 	public List<Permission> buildFromNames(List<String> names) {
-		if ((names == null) || names.isEmpty()) {
+		if ((names == null) || (names.size() == 0)) {
 			return Collections.emptyList();
 		}
 		List<Permission> permissions = new ArrayList<>(names.size());

acl/src/main/java/org/springframework/security/acls/domain/DefaultPermissionGrantingStrategy.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2004-present the original author or authors.
+ * Copyright 2002-2018 the original author or authors.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.

acl/src/main/java/org/springframework/security/acls/domain/EhCacheBasedAclCache.java

@@ -0,0 +1,141 @@
+/*
+ * Copyright 2004, 2005, 2006 Acegi Technology Pty Limited
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.springframework.security.acls.domain;
+
+import java.io.Serializable;
+
+import net.sf.ehcache.CacheException;
+import net.sf.ehcache.Ehcache;
+import net.sf.ehcache.Element;
+
+import org.springframework.security.acls.model.AclCache;
+import org.springframework.security.acls.model.MutableAcl;
+import org.springframework.security.acls.model.ObjectIdentity;
+import org.springframework.security.acls.model.PermissionGrantingStrategy;
+import org.springframework.security.util.FieldUtils;
+import org.springframework.util.Assert;
+
+/**
+ * Simple implementation of {@link AclCache} that delegates to EH-CACHE.
+ * <p>
+ * Designed to handle the transient fields in {@link AclImpl}. Note that this
+ * implementation assumes all {@link AclImpl} instances share the same
+ * {@link PermissionGrantingStrategy} and {@link AclAuthorizationStrategy} instances.
+ *
+ * @author Ben Alex
+ * @deprecated since 5.6. In favor of JCache based implementations
+ */
+@Deprecated
+public class EhCacheBasedAclCache implements AclCache {
+
+	private final Ehcache cache;
+
+	private PermissionGrantingStrategy permissionGrantingStrategy;
+
+	private AclAuthorizationStrategy aclAuthorizationStrategy;
+
+	public EhCacheBasedAclCache(Ehcache cache, PermissionGrantingStrategy permissionGrantingStrategy,
+			AclAuthorizationStrategy aclAuthorizationStrategy) {
+		Assert.notNull(cache, "Cache required");
+		Assert.notNull(permissionGrantingStrategy, "PermissionGrantingStrategy required");
+		Assert.notNull(aclAuthorizationStrategy, "AclAuthorizationStrategy required");
+		this.cache = cache;
+		this.permissionGrantingStrategy = permissionGrantingStrategy;
+		this.aclAuthorizationStrategy = aclAuthorizationStrategy;
+	}
+
+	@Override
+	public void evictFromCache(Serializable pk) {
+		Assert.notNull(pk, "Primary key (identifier) required");
+		MutableAcl acl = getFromCache(pk);
+		if (acl != null) {
+			this.cache.remove(acl.getId());
+			this.cache.remove(acl.getObjectIdentity());
+		}
+	}
+
+	@Override
+	public void evictFromCache(ObjectIdentity objectIdentity) {
+		Assert.notNull(objectIdentity, "ObjectIdentity required");
+		MutableAcl acl = getFromCache(objectIdentity);
+		if (acl != null) {
+			this.cache.remove(acl.getId());
+			this.cache.remove(acl.getObjectIdentity());
+		}
+	}
+
+	@Override
+	public MutableAcl getFromCache(ObjectIdentity objectIdentity) {
+		Assert.notNull(objectIdentity, "ObjectIdentity required");
+		try {
+			Element element = this.cache.get(objectIdentity);
+			return (element != null) ? initializeTransientFields((MutableAcl) element.getValue()) : null;
+		}
+		catch (CacheException ex) {
+			return null;
+		}
+	}
+
+	@Override
+	public MutableAcl getFromCache(Serializable pk) {
+		Assert.notNull(pk, "Primary key (identifier) required");
+		try {
+			Element element = this.cache.get(pk);
+			return (element != null) ? initializeTransientFields((MutableAcl) element.getValue()) : null;
+		}
+		catch (CacheException ex) {
+			return null;
+		}
+	}
+
+	@Override
+	public void putInCache(MutableAcl acl) {
+		Assert.notNull(acl, "Acl required");
+		Assert.notNull(acl.getObjectIdentity(), "ObjectIdentity required");
+		Assert.notNull(acl.getId(), "ID required");
+		if (this.aclAuthorizationStrategy == null) {
+			if (acl instanceof AclImpl) {
+				this.aclAuthorizationStrategy = (AclAuthorizationStrategy) FieldUtils
+						.getProtectedFieldValue("aclAuthorizationStrategy", acl);
+				this.permissionGrantingStrategy = (PermissionGrantingStrategy) FieldUtils
+						.getProtectedFieldValue("permissionGrantingStrategy", acl);
+			}
+		}
+		if ((acl.getParentAcl() != null) && (acl.getParentAcl() instanceof MutableAcl)) {
+			putInCache((MutableAcl) acl.getParentAcl());
+		}
+		this.cache.put(new Element(acl.getObjectIdentity(), acl));
+		this.cache.put(new Element(acl.getId(), acl));
+	}
+
+	private MutableAcl initializeTransientFields(MutableAcl value) {
+		if (value instanceof AclImpl) {
+			FieldUtils.setProtectedFieldValue("aclAuthorizationStrategy", value, this.aclAuthorizationStrategy);
+			FieldUtils.setProtectedFieldValue("permissionGrantingStrategy", value, this.permissionGrantingStrategy);
+		}
+		if (value.getParentAcl() != null) {
+			initializeTransientFields((MutableAcl) value.getParentAcl());
+		}
+		return value;
+	}
+
+	@Override
+	public void clearCache() {
+		this.cache.removeAll();
+	}
+
+}

acl/src/main/java/org/springframework/security/acls/domain/GrantedAuthoritySid.java

@@ -16,8 +16,6 @@
 
 package org.springframework.security.acls.domain;
 
-import org.jspecify.annotations.Nullable;
-
 import org.springframework.security.acls.model.Sid;
 import org.springframework.security.core.GrantedAuthority;
 import org.springframework.util.Assert;
@@ -44,12 +42,12 @@ public class GrantedAuthoritySid implements Sid {
 	public GrantedAuthoritySid(GrantedAuthority grantedAuthority) {
 		Assert.notNull(grantedAuthority, "GrantedAuthority required");
 		Assert.notNull(grantedAuthority.getAuthority(),
-				"This Sid is only compatible with GrantedAuthority that provide a non-null getAuthority()");
+				"This Sid is only compatible with GrantedAuthoritys that provide a non-null getAuthority()");
 		this.grantedAuthority = grantedAuthority.getAuthority();
 	}
 
 	@Override
-	public boolean equals(@Nullable Object object) {
+	public boolean equals(Object object) {
 		if ((object == null) || !(object instanceof GrantedAuthoritySid)) {
 			return false;
 		}

acl/src/main/java/org/springframework/security/acls/domain/ObjectIdentityImpl.java

@@ -19,8 +19,6 @@ package org.springframework.security.acls.domain;
 import java.io.Serializable;
 import java.lang.reflect.Method;
 
-import org.jspecify.annotations.Nullable;
-
 import org.springframework.security.acls.model.ObjectIdentity;
 import org.springframework.util.Assert;
 import org.springframework.util.ClassUtils;
@@ -99,7 +97,7 @@ public class ObjectIdentityImpl implements ObjectIdentity {
 	 * @return <code>true</code> if the presented object matches this object
 	 */
 	@Override
-	public boolean equals(@Nullable Object obj) {
+	public boolean equals(Object obj) {
 		if (obj == null || !(obj instanceof ObjectIdentityImpl)) {
 			return false;
 		}

acl/src/main/java/org/springframework/security/acls/domain/PermissionFactory.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2004-present the original author or authors.
+ * Copyright 2002-2016 the original author or authors.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.

acl/src/main/java/org/springframework/security/acls/domain/PrincipalSid.java

@@ -16,8 +16,6 @@
 
 package org.springframework.security.acls.domain;
 
-import org.jspecify.annotations.Nullable;
-
 import org.springframework.security.acls.model.Sid;
 import org.springframework.security.core.Authentication;
 import org.springframework.util.Assert;
@@ -48,7 +46,7 @@ public class PrincipalSid implements Sid {
 	}
 
 	@Override
-	public boolean equals(@Nullable Object object) {
+	public boolean equals(Object object) {
 		if ((object == null) || !(object instanceof PrincipalSid)) {
 			return false;
 		}

acl/src/main/java/org/springframework/security/acls/domain/SidRetrievalStrategyImpl.java

@@ -54,7 +54,7 @@ public class SidRetrievalStrategyImpl implements SidRetrievalStrategy {
 	@Override
 	public List<Sid> getSids(Authentication authentication) {
 		Collection<? extends GrantedAuthority> authorities = this.roleHierarchy
-			.getReachableGrantedAuthorities(authentication.getAuthorities());
+				.getReachableGrantedAuthorities(authentication.getAuthorities());
 		List<Sid> sids = new ArrayList<>(authorities.size() + 1);
 		sids.add(new PrincipalSid(authentication));
 		for (GrantedAuthority authority : authorities) {

acl/src/main/java/org/springframework/security/acls/domain/SpringCacheBasedAclCache.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2004-present the original author or authors.
+ * Copyright 2002-2013 the original author or authors.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -18,8 +18,6 @@ package org.springframework.security.acls.domain;
 
 import java.io.Serializable;
 
-import org.jspecify.annotations.Nullable;
-
 import org.springframework.cache.Cache;
 import org.springframework.security.acls.model.AclCache;
 import org.springframework.security.acls.model.MutableAcl;
@@ -80,13 +78,13 @@ public class SpringCacheBasedAclCache implements AclCache {
 	}
 
 	@Override
-	public @Nullable MutableAcl getFromCache(ObjectIdentity objectIdentity) {
+	public MutableAcl getFromCache(ObjectIdentity objectIdentity) {
 		Assert.notNull(objectIdentity, "ObjectIdentity required");
 		return getFromCache((Object) objectIdentity);
 	}
 
 	@Override
-	public @Nullable MutableAcl getFromCache(Serializable pk) {
+	public MutableAcl getFromCache(Serializable pk) {
 		Assert.notNull(pk, "Primary key (identifier) required");
 		return getFromCache((Object) pk);
 	}
@@ -103,16 +101,12 @@ public class SpringCacheBasedAclCache implements AclCache {
 		this.cache.put(acl.getId(), acl);
 	}
 
-	private @Nullable MutableAcl getFromCache(Object key) {
+	private MutableAcl getFromCache(Object key) {
 		Cache.ValueWrapper element = this.cache.get(key);
 		if (element == null) {
 			return null;
 		}
-		Object value = element.get();
-		if (value == null) {
-			return null;
-		}
-		return initializeTransientFields((MutableAcl) value);
+		return initializeTransientFields((MutableAcl) element.get());
 	}
 
 	private MutableAcl initializeTransientFields(MutableAcl value) {

acl/src/main/java/org/springframework/security/acls/domain/package-info.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2004-present the original author or authors.
+ * Copyright 2002-2016 the original author or authors.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -17,7 +17,4 @@
 /**
  * Basic implementation of access control lists (ACLs) interfaces.
  */
-@NullMarked
 package org.springframework.security.acls.domain;
-
-import org.jspecify.annotations.NullMarked;

acl/src/main/java/org/springframework/security/acls/jdbc/AclClassIdUtils.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2004-present the original author or authors.
+ * Copyright 2002-2018 the original author or authors.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -23,7 +23,6 @@ import java.util.UUID;
 
 import org.apache.commons.logging.Log;
 import org.apache.commons.logging.LogFactory;
-import org.jspecify.annotations.Nullable;
 
 import org.springframework.core.convert.ConversionFailedException;
 import org.springframework.core.convert.ConversionService;
@@ -68,10 +67,10 @@ class AclClassIdUtils {
 	 * @return The identifier in the appropriate target Java type. Typically Long or UUID.
 	 * @throws SQLException
 	 */
-	@Nullable Serializable identifierFrom(Serializable identifier, ResultSet resultSet) throws SQLException {
-		Class<? extends Serializable> classIdType = classIdTypeFrom(resultSet);
-		if (isString(identifier) && classIdType != null && canConvertFromStringTo(classIdType)) {
-			return convertFromStringTo((String) identifier, classIdType);
+	Serializable identifierFrom(Serializable identifier, ResultSet resultSet) throws SQLException {
+		if (isString(identifier) && hasValidClassIdType(resultSet)
+				&& canConvertFromStringTo(classIdTypeFrom(resultSet))) {
+			return convertFromStringTo((String) identifier, classIdTypeFrom(resultSet));
 		}
 		// Assume it should be a Long type
 		return convertToLong(identifier);
@@ -87,38 +86,28 @@ class AclClassIdUtils {
 		}
 	}
 
-	private @Nullable Class<? extends Serializable> classIdTypeFrom(ResultSet resultSet) throws SQLException {
-		try {
-			return classIdTypeFrom(resultSet.getString(DEFAULT_CLASS_ID_TYPE_COLUMN_NAME));
-		}
-		catch (SQLException ex) {
-			log.debug("Unable to obtain the class id type", ex);
-			return null;
-		}
+	private <T extends Serializable> Class<T> classIdTypeFrom(ResultSet resultSet) throws SQLException {
+		return classIdTypeFrom(resultSet.getString(DEFAULT_CLASS_ID_TYPE_COLUMN_NAME));
 	}
 
-	private @Nullable Class<? extends Serializable> classIdTypeFrom(String className) {
+	private <T extends Serializable> Class<T> classIdTypeFrom(String className) {
 		if (className == null) {
 			return null;
 		}
 		try {
-			return Class.forName(className).asSubclass(Serializable.class);
+			return (Class) Class.forName(className);
 		}
 		catch (ClassNotFoundException ex) {
 			log.debug("Unable to find class id type on classpath", ex);
 			return null;
 		}
-		catch (ClassCastException ex) {
-			log.debug("Class id type is not a Serializable type", ex);
-			return null;
-		}
 	}
 
 	private <T> boolean canConvertFromStringTo(Class<T> targetType) {
 		return this.conversionService.canConvert(String.class, targetType);
 	}
 
-	private <T extends Serializable> @Nullable T convertFromStringTo(String identifier, Class<T> targetType) {
+	private <T extends Serializable> T convertFromStringTo(String identifier, Class<T> targetType) {
 		return this.conversionService.convert(identifier, targetType);
 	}
 
@@ -132,7 +121,7 @@ class AclClassIdUtils {
 	 * exception occurred
 	 * @throws IllegalArgumentException if targetType is null
 	 */
-	private @Nullable Long convertToLong(Serializable identifier) {
+	private Long convertToLong(Serializable identifier) {
 		if (this.conversionService.canConvert(identifier.getClass(), Long.class)) {
 			return this.conversionService.convert(identifier, Long.class);
 		}
@@ -151,10 +140,10 @@ class AclClassIdUtils {
 	private static class StringToLongConverter implements Converter<String, Long> {
 
 		@Override
-		public Long convert(@Nullable String identifierAsString) {
+		public Long convert(String identifierAsString) {
 			if (identifierAsString == null) {
 				throw new ConversionFailedException(TypeDescriptor.valueOf(String.class),
-						TypeDescriptor.valueOf(Long.class), identifierAsString, new NullPointerException());
+						TypeDescriptor.valueOf(Long.class), null, null);
 
 			}
 			return Long.parseLong(identifierAsString);
@@ -165,10 +154,10 @@ class AclClassIdUtils {
 	private static class StringToUUIDConverter implements Converter<String, UUID> {
 
 		@Override
-		public UUID convert(@Nullable String identifierAsString) {
+		public UUID convert(String identifierAsString) {
 			if (identifierAsString == null) {
 				throw new ConversionFailedException(TypeDescriptor.valueOf(String.class),
-						TypeDescriptor.valueOf(UUID.class), identifierAsString, new NullPointerException());
+						TypeDescriptor.valueOf(UUID.class), null, null);
 
 			}
 			return UUID.fromString(identifierAsString);

acl/src/main/java/org/springframework/security/acls/jdbc/BasicLookupStrategy.java

@@ -31,8 +31,6 @@ import java.util.Set;
 
 import javax.sql.DataSource;
 
-import org.jspecify.annotations.Nullable;
-
 import org.springframework.core.convert.ConversionException;
 import org.springframework.core.convert.ConversionService;
 import org.springframework.jdbc.core.JdbcTemplate;
@@ -44,7 +42,7 @@ import org.springframework.security.acls.domain.AuditLogger;
 import org.springframework.security.acls.domain.DefaultPermissionFactory;
 import org.springframework.security.acls.domain.DefaultPermissionGrantingStrategy;
 import org.springframework.security.acls.domain.GrantedAuthoritySid;
-import org.springframework.security.acls.domain.ObjectIdentityRetrievalStrategyImpl;
+import org.springframework.security.acls.domain.ObjectIdentityImpl;
 import org.springframework.security.acls.domain.PermissionFactory;
 import org.springframework.security.acls.domain.PrincipalSid;
 import org.springframework.security.acls.model.AccessControlEntry;
@@ -53,7 +51,6 @@ import org.springframework.security.acls.model.AclCache;
 import org.springframework.security.acls.model.MutableAcl;
 import org.springframework.security.acls.model.NotFoundException;
 import org.springframework.security.acls.model.ObjectIdentity;
-import org.springframework.security.acls.model.ObjectIdentityGenerator;
 import org.springframework.security.acls.model.Permission;
 import org.springframework.security.acls.model.PermissionGrantingStrategy;
 import org.springframework.security.acls.model.Sid;
@@ -67,11 +64,10 @@ import org.springframework.util.Assert;
  * NB: This implementation does attempt to provide reasonably optimised lookups - within
  * the constraints of a normalised database and standard ANSI SQL features. If you are
  * willing to sacrifice either of these constraints (e.g. use a particular database
- * feature such as hierarchical queries or materialized views, or reduce normalisation)
- * you are likely to achieve better performance. In such situations you will need to
- * provide your own custom <code>LookupStrategy</code>. This class does not support
- * subclassing, as it is likely to change in future releases and therefore subclassing is
- * unsupported.
+ * feature such as hierarchical queries or materalized views, or reduce normalisation) you
+ * are likely to achieve better performance. In such situations you will need to provide
+ * your own custom <code>LookupStrategy</code>. This class does not support subclassing,
+ * as it is likely to change in future releases and therefore subclassing is unsupported.
  * <p>
  * There are two SQL queries executed, one in the <tt>lookupPrimaryKeys</tt> method and
  * one in <tt>lookupObjectIdentities</tt>. These are built from the same select and "order
@@ -113,8 +109,6 @@ public class BasicLookupStrategy implements LookupStrategy {
 
 	private final AclAuthorizationStrategy aclAuthorizationStrategy;
 
-	private ObjectIdentityGenerator objectIdentityGenerator;
-
 	private PermissionFactory permissionFactory = new DefaultPermissionFactory();
 
 	private final AclCache aclCache;
@@ -168,7 +162,6 @@ public class BasicLookupStrategy implements LookupStrategy {
 		this.aclCache = aclCache;
 		this.aclAuthorizationStrategy = aclAuthorizationStrategy;
 		this.grantingStrategy = grantingStrategy;
-		this.objectIdentityGenerator = new ObjectIdentityRetrievalStrategyImpl();
 		this.aclClassIdUtils = new AclClassIdUtils();
 		this.fieldAces.setAccessible(true);
 		this.fieldAcl.setAccessible(true);
@@ -226,8 +219,7 @@ public class BasicLookupStrategy implements LookupStrategy {
 	 * @param findNow Long-based primary keys to retrieve
 	 * @param sids
 	 */
-	private void lookupPrimaryKeys(final Map<Serializable, Acl> acls, final Set<Long> findNow,
-			final @Nullable List<Sid> sids) {
+	private void lookupPrimaryKeys(final Map<Serializable, Acl> acls, final Set<Long> findNow, final List<Sid> sids) {
 		Assert.notNull(acls, "ACLs are required");
 		Assert.notEmpty(findNow, "Items to find now required");
 		String sql = computeRepeatingSql(this.lookupPrimaryKeysWhereClause, findNow.size());
@@ -267,7 +259,7 @@ public class BasicLookupStrategy implements LookupStrategy {
 	 * automatically create entries if required)
 	 */
 	@Override
-	public final Map<ObjectIdentity, Acl> readAclsById(List<ObjectIdentity> objects, @Nullable List<Sid> sids) {
+	public final Map<ObjectIdentity, Acl> readAclsById(List<ObjectIdentity> objects, List<Sid> sids) {
 		Assert.isTrue(this.batchSize >= 1, "BatchSize must be >= 1");
 		Assert.notEmpty(objects, "Objects to lookup required");
 		// Map<ObjectIdentity,Acl>
@@ -326,7 +318,7 @@ public class BasicLookupStrategy implements LookupStrategy {
 	 * properly-configured parent ACLs.
 	 */
 	private Map<ObjectIdentity, Acl> lookupObjectIdentities(final Collection<ObjectIdentity> objectIdentities,
-			@Nullable List<Sid> sids) {
+			List<Sid> sids) {
 		Assert.notEmpty(objectIdentities, "Must provide identities to lookup");
 
 		// contains Acls with StubAclParents
@@ -402,10 +394,8 @@ public class BasicLookupStrategy implements LookupStrategy {
 		}
 
 		// Now we have the parent (if there is one), create the true AclImpl
-		Sid owner = inputAcl.getOwner();
-		Assert.isTrue(owner != null, "Owner is required");
 		AclImpl result = new AclImpl(inputAcl.getObjectIdentity(), inputAcl.getId(), this.aclAuthorizationStrategy,
-				this.grantingStrategy, parent, null, inputAcl.isEntriesInheriting(), owner);
+				this.grantingStrategy, parent, null, inputAcl.isEntriesInheriting(), inputAcl.getOwner());
 
 		// Copy the "aces" from the input to the destination
 
@@ -498,11 +488,6 @@ public class BasicLookupStrategy implements LookupStrategy {
 		}
 	}
 
-	public final void setObjectIdentityGenerator(ObjectIdentityGenerator objectIdentityGenerator) {
-		Assert.notNull(objectIdentityGenerator, "objectIdentityGenerator cannot be null");
-		this.objectIdentityGenerator = objectIdentityGenerator;
-	}
-
 	public final void setConversionService(ConversionService conversionService) {
 		this.aclClassIdUtils = new AclClassIdUtils(conversionService);
 	}
@@ -511,9 +496,9 @@ public class BasicLookupStrategy implements LookupStrategy {
 
 		private final Map<Serializable, Acl> acls;
 
-		private final @Nullable List<Sid> sids;
+		private final List<Sid> sids;
 
-		ProcessResultSet(Map<Serializable, Acl> acls, @Nullable List<Sid> sids) {
+		ProcessResultSet(Map<Serializable, Acl> acls, List<Sid> sids) {
 			Assert.notNull(acls, "ACLs cannot be null");
 			this.acls = acls;
 			this.sids = sids; // can be null
@@ -584,11 +569,7 @@ public class BasicLookupStrategy implements LookupStrategy {
 				// target id type, e.g. UUID.
 				Serializable identifier = (Serializable) rs.getObject("object_id_identity");
 				identifier = BasicLookupStrategy.this.aclClassIdUtils.identifierFrom(identifier, rs);
-				if (identifier == null) {
-					throw new IllegalStateException("Identifier cannot be null");
-				}
-				ObjectIdentity objectIdentity = BasicLookupStrategy.this.objectIdentityGenerator
-					.createObjectIdentity(identifier, rs.getString("class"));
+				ObjectIdentity objectIdentity = new ObjectIdentityImpl(rs.getString("class"), identifier);
 
 				Acl parentAcl = null;
 				long parentAclId = rs.getLong("parent_object");
@@ -678,7 +659,7 @@ public class BasicLookupStrategy implements LookupStrategy {
 		}
 
 		@Override
-		public boolean isSidLoaded(@Nullable List<Sid> sids) {
+		public boolean isSidLoaded(List<Sid> sids) {
 			throw new UnsupportedOperationException("Stub only");
 		}
 

acl/src/main/java/org/springframework/security/acls/jdbc/JdbcAclService.java

@@ -27,17 +27,15 @@ import javax.sql.DataSource;
 
 import org.apache.commons.logging.Log;
 import org.apache.commons.logging.LogFactory;
-import org.jspecify.annotations.Nullable;
 
 import org.springframework.core.convert.ConversionService;
 import org.springframework.jdbc.core.JdbcOperations;
 import org.springframework.jdbc.core.JdbcTemplate;
-import org.springframework.security.acls.domain.ObjectIdentityRetrievalStrategyImpl;
+import org.springframework.security.acls.domain.ObjectIdentityImpl;
 import org.springframework.security.acls.model.Acl;
 import org.springframework.security.acls.model.AclService;
 import org.springframework.security.acls.model.NotFoundException;
 import org.springframework.security.acls.model.ObjectIdentity;
-import org.springframework.security.acls.model.ObjectIdentityGenerator;
 import org.springframework.security.acls.model.Sid;
 import org.springframework.util.Assert;
 
@@ -83,8 +81,6 @@ public class JdbcAclService implements AclService {
 
 	private AclClassIdUtils aclClassIdUtils;
 
-	private ObjectIdentityGenerator objectIdentityGenerator;
-
 	public JdbcAclService(DataSource dataSource, LookupStrategy lookupStrategy) {
 		this(new JdbcTemplate(dataSource), lookupStrategy);
 	}
@@ -95,14 +91,13 @@ public class JdbcAclService implements AclService {
 		this.jdbcOperations = jdbcOperations;
 		this.lookupStrategy = lookupStrategy;
 		this.aclClassIdUtils = new AclClassIdUtils();
-		this.objectIdentityGenerator = new ObjectIdentityRetrievalStrategyImpl();
 	}
 
 	@Override
-	public @Nullable List<ObjectIdentity> findChildren(ObjectIdentity parentIdentity) {
+	public List<ObjectIdentity> findChildren(ObjectIdentity parentIdentity) {
 		Object[] args = { parentIdentity.getIdentifier().toString(), parentIdentity.getType() };
-		List<ObjectIdentity> objects = this.jdbcOperations.query(this.findChildrenSql,
-				(rs, rowNum) -> mapObjectIdentityRow(rs), args);
+		List<ObjectIdentity> objects = this.jdbcOperations.query(this.findChildrenSql, args,
+				(rs, rowNum) -> mapObjectIdentityRow(rs));
 		return (!objects.isEmpty()) ? objects : null;
 	}
 
@@ -110,14 +105,11 @@ public class JdbcAclService implements AclService {
 		String javaType = rs.getString("class");
 		Serializable identifier = (Serializable) rs.getObject("obj_id");
 		identifier = this.aclClassIdUtils.identifierFrom(identifier, rs);
-		if (identifier == null) {
-			throw new IllegalStateException("Identifier cannot be null");
-		}
-		return this.objectIdentityGenerator.createObjectIdentity(identifier, javaType);
+		return new ObjectIdentityImpl(javaType, identifier);
 	}
 
 	@Override
-	public Acl readAclById(ObjectIdentity object, @Nullable List<Sid> sids) throws NotFoundException {
+	public Acl readAclById(ObjectIdentity object, List<Sid> sids) throws NotFoundException {
 		Map<ObjectIdentity, Acl> map = readAclsById(Collections.singletonList(object), sids);
 		Assert.isTrue(map.containsKey(object),
 				() -> "There should have been an Acl entry for ObjectIdentity " + object);
@@ -135,7 +127,7 @@ public class JdbcAclService implements AclService {
 	}
 
 	@Override
-	public Map<ObjectIdentity, Acl> readAclsById(List<ObjectIdentity> objects, @Nullable List<Sid> sids)
+	public Map<ObjectIdentity, Acl> readAclsById(List<ObjectIdentity> objects, List<Sid> sids)
 			throws NotFoundException {
 		Map<ObjectIdentity, Acl> result = this.lookupStrategy.readAclsById(objects, sids);
 		// Check every requested object identity was found (throw NotFoundException if
@@ -164,7 +156,7 @@ public class JdbcAclService implements AclService {
 				this.findChildrenSql = DEFAULT_SELECT_ACL_WITH_PARENT_SQL_WITH_CLASS_ID_TYPE;
 			}
 			else {
-				log.debug("Find children statement has already been overridden, so not overriding the default");
+				log.debug("Find children statement has already been overridden, so not overridding the default");
 			}
 		}
 	}
@@ -173,11 +165,6 @@ public class JdbcAclService implements AclService {
 		this.aclClassIdUtils = new AclClassIdUtils(conversionService);
 	}
 
-	public void setObjectIdentityGenerator(ObjectIdentityGenerator objectIdentityGenerator) {
-		Assert.notNull(objectIdentityGenerator, "objectIdentityGenerator cannot be null");
-		this.objectIdentityGenerator = objectIdentityGenerator;
-	}
-
 	protected boolean isAclClassIdSupported() {
 		return this.aclClassIdSupported;
 	}

acl/src/main/java/org/springframework/security/acls/jdbc/JdbcMutableAclService.java

@@ -22,8 +22,6 @@ import java.util.List;
 
 import javax.sql.DataSource;
 
-import org.jspecify.annotations.Nullable;
-
 import org.springframework.dao.DataAccessException;
 import org.springframework.jdbc.core.BatchPreparedStatementSetter;
 import org.springframework.security.acls.domain.AccessControlEntryImpl;
@@ -42,7 +40,6 @@ import org.springframework.security.acls.model.ObjectIdentity;
 import org.springframework.security.acls.model.Sid;
 import org.springframework.security.core.Authentication;
 import org.springframework.security.core.context.SecurityContextHolder;
-import org.springframework.security.core.context.SecurityContextHolderStrategy;
 import org.springframework.transaction.support.TransactionSynchronizationManager;
 import org.springframework.util.Assert;
 
@@ -52,7 +49,7 @@ import org.springframework.util.Assert;
  * The default settings are for HSQLDB. If you are using a different database you will
  * probably need to set the {@link #setSidIdentityQuery(String) sidIdentityQuery} and
  * {@link #setClassIdentityQuery(String) classIdentityQuery} properties appropriately. The
- * other queries, SQL inserts and updates can also be customized to accommodate schema
+ * other queries, SQL inserts and updates can also be customized to accomodate schema
  * variations, but must produce results consistent with those expected by the defaults.
  * <p>
  * See the appendix of the Spring Security reference manual for more information on the
@@ -67,9 +64,6 @@ public class JdbcMutableAclService extends JdbcAclService implements MutableAclS
 
 	private static final String DEFAULT_INSERT_INTO_ACL_CLASS_WITH_ID = "insert into acl_class (class, class_id_type) values (?, ?)";
 
-	private SecurityContextHolderStrategy securityContextHolderStrategy = SecurityContextHolder
-		.getContextHolderStrategy();
-
 	private boolean foreignKeysInDatabase = true;
 
 	private final AclCache aclCache;
@@ -121,8 +115,7 @@ public class JdbcMutableAclService extends JdbcAclService implements MutableAclS
 
 		// Need to retrieve the current principal, in order to know who "owns" this ACL
 		// (can be changed later on)
-		Authentication auth = this.securityContextHolderStrategy.getContext().getAuthentication();
-		Assert.isTrue(auth != null, "Authentication required");
+		Authentication auth = SecurityContextHolder.getContext().getAuthentication();
 		PrincipalSid sid = new PrincipalSid(auth);
 
 		// Create the acl_object_identity row
@@ -158,12 +151,9 @@ public class JdbcMutableAclService extends JdbcAclService implements MutableAclS
 				Assert.isTrue(entry_ instanceof AccessControlEntryImpl, "Unknown ACE class");
 				AccessControlEntryImpl entry = (AccessControlEntryImpl) entry_;
 
-				Assert.state(acl.getId() != null, "ACL ID cannot be null");
 				stmt.setLong(1, (Long) acl.getId());
 				stmt.setInt(2, i);
-				Long sidPrimaryKey = createOrRetrieveSidPrimaryKey(entry.getSid(), true);
-				Assert.state(sidPrimaryKey != null, "SID primary key cannot be null");
-				stmt.setLong(3, sidPrimaryKey);
+				stmt.setLong(3, createOrRetrieveSidPrimaryKey(entry.getSid(), true));
 				stmt.setInt(4, entry.getPermission().getMask());
 				stmt.setBoolean(5, entry.isGranting());
 				stmt.setBoolean(6, entry.isAuditSuccess());
@@ -195,14 +185,12 @@ public class JdbcMutableAclService extends JdbcAclService implements MutableAclS
 	 * @param allowCreate true if creation is permitted if not found
 	 * @return the primary key or null if not found
 	 */
-	protected @Nullable Long createOrRetrieveClassPrimaryKey(String type, boolean allowCreate, Class idType) {
-		List<@Nullable Long> classIds = this.jdbcOperations.queryForList(this.selectClassPrimaryKey, Long.class, type);
+	protected Long createOrRetrieveClassPrimaryKey(String type, boolean allowCreate, Class idType) {
+		List<Long> classIds = this.jdbcOperations.queryForList(this.selectClassPrimaryKey, new Object[] { type },
+				Long.class);
 
 		if (!classIds.isEmpty()) {
-			Long result = classIds.get(0);
-			if (result != null) {
-				return result;
-			}
+			return classIds.get(0);
 		}
 
 		if (allowCreate) {
@@ -213,9 +201,7 @@ public class JdbcMutableAclService extends JdbcAclService implements MutableAclS
 				this.jdbcOperations.update(this.insertClass, type, idType.getCanonicalName());
 			}
 			Assert.isTrue(TransactionSynchronizationManager.isSynchronizationActive(), "Transaction must be running");
-			Long result = this.jdbcOperations.queryForObject(this.classIdentityQuery, Long.class);
-			Assert.state(result != null, "Failed to retrieve class primary key");
-			return result;
+			return this.jdbcOperations.queryForObject(this.classIdentityQuery, Long.class);
 		}
 
 		return null;
@@ -230,7 +216,7 @@ public class JdbcMutableAclService extends JdbcAclService implements MutableAclS
 	 * @throws IllegalArgumentException if the <tt>Sid</tt> is not a recognized
 	 * implementation.
 	 */
-	protected @Nullable Long createOrRetrieveSidPrimaryKey(Sid sid, boolean allowCreate) {
+	protected Long createOrRetrieveSidPrimaryKey(Sid sid, boolean allowCreate) {
 		Assert.notNull(sid, "Sid required");
 		if (sid instanceof PrincipalSid) {
 			String sidName = ((PrincipalSid) sid).getPrincipal();
@@ -251,22 +237,16 @@ public class JdbcMutableAclService extends JdbcAclService implements MutableAclS
 	 * @param allowCreate true if creation is permitted if not found
 	 * @return the primary key or null if not found
 	 */
-	protected @Nullable Long createOrRetrieveSidPrimaryKey(String sidName, boolean sidIsPrincipal,
-			boolean allowCreate) {
-		List<@Nullable Long> sidIds = this.jdbcOperations.queryForList(this.selectSidPrimaryKey, Long.class,
-				sidIsPrincipal, sidName);
+	protected Long createOrRetrieveSidPrimaryKey(String sidName, boolean sidIsPrincipal, boolean allowCreate) {
+		List<Long> sidIds = this.jdbcOperations.queryForList(this.selectSidPrimaryKey,
+				new Object[] { sidIsPrincipal, sidName }, Long.class);
 		if (!sidIds.isEmpty()) {
-			Long result = sidIds.get(0);
-			if (result != null) {
-				return result;
-			}
+			return sidIds.get(0);
 		}
 		if (allowCreate) {
 			this.jdbcOperations.update(this.insertSid, sidIsPrincipal, sidName);
 			Assert.isTrue(TransactionSynchronizationManager.isSynchronizationActive(), "Transaction must be running");
-			Long result = this.jdbcOperations.queryForObject(this.sidIdentityQuery, Long.class);
-			Assert.state(result != null, "Failed to retrieve sid primary key");
-			return result;
+			return this.jdbcOperations.queryForObject(this.sidIdentityQuery, Long.class);
 		}
 		return null;
 	}
@@ -296,9 +276,6 @@ public class JdbcMutableAclService extends JdbcAclService implements MutableAclS
 		}
 
 		Long oidPrimaryKey = retrieveObjectIdentityPrimaryKey(objectIdentity);
-		if (oidPrimaryKey == null) {
-			throw new NotFoundException("Object identity not found: " + objectIdentity);
-		}
 
 		// Delete this ACL's ACEs in the acl_entry table
 		deleteEntries(oidPrimaryKey);
@@ -339,11 +316,10 @@ public class JdbcMutableAclService extends JdbcAclService implements MutableAclS
 	 * @param oid to find
 	 * @return the object identity or null if not found
 	 */
-	protected @Nullable Long retrieveObjectIdentityPrimaryKey(ObjectIdentity oid) {
+	protected Long retrieveObjectIdentityPrimaryKey(ObjectIdentity oid) {
 		try {
-			Long result = this.jdbcOperations.queryForObject(this.selectObjectIdentityPrimaryKey, Long.class,
-					oid.getType(), oid.getIdentifier().toString());
-			return result;
+			return this.jdbcOperations.queryForObject(this.selectObjectIdentityPrimaryKey, Long.class, oid.getType(),
+					oid.getIdentifier().toString());
 		}
 		catch (DataAccessException notFound) {
 			return null;
@@ -361,11 +337,7 @@ public class JdbcMutableAclService extends JdbcAclService implements MutableAclS
 		Assert.notNull(acl.getId(), "Object Identity doesn't provide an identifier");
 
 		// Delete this ACL's ACEs in the acl_entry table
-		Long oidPrimaryKey = retrieveObjectIdentityPrimaryKey(acl.getObjectIdentity());
-		if (oidPrimaryKey == null) {
-			throw new NotFoundException("Object identity not found for ACL: " + acl.getObjectIdentity());
-		}
-		deleteEntries(oidPrimaryKey);
+		deleteEntries(retrieveObjectIdentityPrimaryKey(acl.getObjectIdentity()));
 
 		// Create this ACL's ACEs in the acl_entry table
 		createEntries(acl);
@@ -496,20 +468,9 @@ public class JdbcMutableAclService extends JdbcAclService implements MutableAclS
 				this.insertClass = DEFAULT_INSERT_INTO_ACL_CLASS_WITH_ID;
 			}
 			else {
-				log.debug("Insert class statement has already been overridden, so not overriding the default");
+				log.debug("Insert class statement has already been overridden, so not overridding the default");
 			}
 		}
 	}
 
-	/**
-	 * Sets the {@link SecurityContextHolderStrategy} to use. The default action is to use
-	 * the {@link SecurityContextHolderStrategy} stored in {@link SecurityContextHolder}.
-	 *
-	 * @since 5.8
-	 */
-	public void setSecurityContextHolderStrategy(SecurityContextHolderStrategy securityContextHolderStrategy) {
-		Assert.notNull(securityContextHolderStrategy, "securityContextHolderStrategy cannot be null");
-		this.securityContextHolderStrategy = securityContextHolderStrategy;
-	}
-
 }

acl/src/main/java/org/springframework/security/acls/jdbc/LookupStrategy.java

@@ -19,8 +19,6 @@ package org.springframework.security.acls.jdbc;
 import java.util.List;
 import java.util.Map;
 
-import org.jspecify.annotations.Nullable;
-
 import org.springframework.security.acls.model.Acl;
 import org.springframework.security.acls.model.NotFoundException;
 import org.springframework.security.acls.model.ObjectIdentity;
@@ -44,6 +42,6 @@ public interface LookupStrategy {
 	 * {@link NotFoundException}, as a chain of {@link LookupStrategy}s may be used to
 	 * automatically create entries if required)
 	 */
-	Map<ObjectIdentity, Acl> readAclsById(List<ObjectIdentity> objects, @Nullable List<Sid> sids);
+	Map<ObjectIdentity, Acl> readAclsById(List<ObjectIdentity> objects, List<Sid> sids);
 
 }

acl/src/main/java/org/springframework/security/acls/jdbc/package-info.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2004-present the original author or authors.
+ * Copyright 2002-2016 the original author or authors.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -17,7 +17,4 @@
 /**
  * JDBC-based persistence of ACL information
  */
-@NullMarked
 package org.springframework.security.acls.jdbc;
-
-import org.jspecify.annotations.NullMarked;

acl/src/main/java/org/springframework/security/acls/model/AccessControlEntry.java

@@ -18,8 +18,6 @@ package org.springframework.security.acls.model;
 
 import java.io.Serializable;
 
-import org.jspecify.annotations.Nullable;
-
 /**
  * Represents an individual permission assignment within an {@link Acl}.
  *
@@ -38,7 +36,7 @@ public interface AccessControlEntry extends Serializable {
 	 * Obtains an identifier that represents this ACE.
 	 * @return the identifier, or <code>null</code> if unsaved
 	 */
-	@Nullable Serializable getId();
+	Serializable getId();
 
 	Permission getPermission();
 

acl/src/main/java/org/springframework/security/acls/model/Acl.java

@@ -19,8 +19,6 @@ package org.springframework.security.acls.model;
 import java.io.Serializable;
 import java.util.List;
 
-import org.jspecify.annotations.Nullable;
-
 /**
  * Represents an access control list (ACL) for a domain object.
  *
@@ -84,7 +82,7 @@ public interface Acl extends Serializable {
 	 * @return the owner (may be <tt>null</tt> if the implementation does not use
 	 * ownership concepts)
 	 */
-	@Nullable Sid getOwner();
+	Sid getOwner();
 
 	/**
 	 * A domain object may have a parent for the purpose of ACL inheritance. If there is a
@@ -105,7 +103,7 @@ public interface Acl extends Serializable {
 	 * @return the parent <tt>Acl</tt> (may be <tt>null</tt> if this <tt>Acl</tt> does not
 	 * have a parent)
 	 */
-	@Nullable Acl getParentAcl();
+	Acl getParentAcl();
 
 	/**
 	 * Indicates whether the ACL entries from the {@link #getParentAcl()} should flow down
@@ -191,6 +189,6 @@ public interface Acl extends Serializable {
 	 * @return <tt>true</tt> if every passed <tt>Sid</tt> is represented by this
 	 * <tt>Acl</tt> instance
 	 */
-	boolean isSidLoaded(@Nullable List<Sid> sids);
+	boolean isSidLoaded(List<Sid> sids);
 
 }

acl/src/main/java/org/springframework/security/acls/model/AclCache.java

@@ -18,8 +18,6 @@ package org.springframework.security.acls.model;
 
 import java.io.Serializable;
 
-import org.jspecify.annotations.Nullable;
-
 import org.springframework.security.acls.jdbc.JdbcAclService;
 
 /**
@@ -33,9 +31,9 @@ public interface AclCache {
 
 	void evictFromCache(ObjectIdentity objectIdentity);
 
-	@Nullable MutableAcl getFromCache(ObjectIdentity objectIdentity);
+	MutableAcl getFromCache(ObjectIdentity objectIdentity);
 
-	@Nullable MutableAcl getFromCache(Serializable pk);
+	MutableAcl getFromCache(Serializable pk);
 
 	void putInCache(MutableAcl acl);
 

acl/src/main/java/org/springframework/security/acls/model/AclDataAccessException.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2004-present the original author or authors.
+ * Copyright 2002-2016 the original author or authors.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.

acl/src/main/java/org/springframework/security/acls/model/AclService.java

@@ -19,8 +19,6 @@ package org.springframework.security.acls.model;
 import java.util.List;
 import java.util.Map;
 
-import org.jspecify.annotations.Nullable;
-
 /**
  * Provides retrieval of {@link Acl} instances.
  *
@@ -34,7 +32,7 @@ public interface AclService {
 	 * @param parentIdentity to locate children of
 	 * @return the children (or <tt>null</tt> if none were found)
 	 */
-	@Nullable List<ObjectIdentity> findChildren(ObjectIdentity parentIdentity);
+	List<ObjectIdentity> findChildren(ObjectIdentity parentIdentity);
 
 	/**
 	 * Same as {@link #readAclsById(List)} except it returns only a single Acl.
@@ -61,7 +59,7 @@ public interface AclService {
 	 * @throws NotFoundException if an {@link Acl} was not found for the requested
 	 * {@link ObjectIdentity}
 	 */
-	Acl readAclById(ObjectIdentity object, @Nullable List<Sid> sids) throws NotFoundException;
+	Acl readAclById(ObjectIdentity object, List<Sid> sids) throws NotFoundException;
 
 	/**
 	 * Obtains all the <tt>Acl</tt>s that apply for the passed <tt>Object</tt>s.
@@ -100,7 +98,6 @@ public interface AclService {
 	 * @throws NotFoundException if an {@link Acl} was not found for each requested
 	 * {@link ObjectIdentity}
 	 */
-	Map<ObjectIdentity, Acl> readAclsById(List<ObjectIdentity> objects, @Nullable List<Sid> sids)
-			throws NotFoundException;
+	Map<ObjectIdentity, Acl> readAclsById(List<ObjectIdentity> objects, List<Sid> sids) throws NotFoundException;
 
 }

acl/src/main/java/org/springframework/security/acls/model/ObjectIdentity.java

@@ -18,8 +18,6 @@ package org.springframework.security.acls.model;
 
 import java.io.Serializable;
 
-import org.jspecify.annotations.Nullable;
-
 /**
  * Represents the identity of an individual domain object instance.
  *
@@ -42,7 +40,7 @@ public interface ObjectIdentity extends Serializable {
 	 * @see Object#equals(Object)
 	 */
 	@Override
-	boolean equals(@Nullable Object obj);
+	boolean equals(Object obj);
 
 	/**
 	 * Obtains the actual identifier. This identifier must not be reused to represent

acl/src/main/java/org/springframework/security/acls/model/ObjectIdentityGenerator.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2004-present the original author or authors.
+ * Copyright 2002-2016 the original author or authors.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.

acl/src/main/java/org/springframework/security/acls/model/PermissionGrantingStrategy.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2004-present the original author or authors.
+ * Copyright 2002-2016 the original author or authors.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.

acl/src/main/java/org/springframework/security/acls/model/Sid.java

@@ -18,8 +18,6 @@ package org.springframework.security.acls.model;
 
 import java.io.Serializable;
 
-import org.jspecify.annotations.Nullable;
-
 /**
  * A security identity recognised by the ACL system.
  *
@@ -42,7 +40,7 @@ public interface Sid extends Serializable {
 	 * @return <code>true</code> if the objects are equal, <code>false</code> otherwise
 	 */
 	@Override
-	boolean equals(@Nullable Object obj);
+	boolean equals(Object obj);
 
 	/**
 	 * Refer to the <code>java.lang.Object</code> documentation for the interface

acl/src/main/java/org/springframework/security/acls/model/package-info.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2004-present the original author or authors.
+ * Copyright 2002-2016 the original author or authors.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -18,7 +18,4 @@
  * Interfaces and shared classes to manage access control lists (ACLs) for domain object
  * instances.
  */
-@NullMarked
 package org.springframework.security.acls.model;
-
-import org.jspecify.annotations.NullMarked;

acl/src/main/java/org/springframework/security/acls/package-info.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2004-present the original author or authors.
+ * Copyright 2002-2016 the original author or authors.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -24,7 +24,4 @@
  * older and more verbose attribute/voter/after-invocation approach from versions before
  * Spring Security 3.0.
  */
-@NullMarked
 package org.springframework.security.acls;
-
-import org.jspecify.annotations.NullMarked;

acl/src/main/resources/META-INF/spring/aot.factories

@@ -1,2 +0,0 @@
-org.springframework.aot.hint.RuntimeHintsRegistrar=\
-org.springframework.security.acls.aot.hint.AclRuntimeHints

acl/src/test/java/org/springframework/security/acls/AclFormattingUtilsTests.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2004-present the original author or authors.
+ * Copyright 2002-2016 the original author or authors.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -37,7 +37,7 @@ public class AclFormattingUtilsTests {
 		assertThatIllegalArgumentException().isThrownBy(() -> AclFormattingUtils.demergePatterns(null, "SOME STRING"));
 		assertThatIllegalArgumentException().isThrownBy(() -> AclFormattingUtils.demergePatterns("SOME STRING", null));
 		assertThatIllegalArgumentException()
-			.isThrownBy(() -> AclFormattingUtils.demergePatterns("SOME STRING", "LONGER SOME STRING"));
+				.isThrownBy(() -> AclFormattingUtils.demergePatterns("SOME STRING", "LONGER SOME STRING"));
 		assertThatNoException().isThrownBy(() -> AclFormattingUtils.demergePatterns("SOME STRING", "SAME LENGTH"));
 	}
 
@@ -46,7 +46,7 @@ public class AclFormattingUtilsTests {
 		String original = "...........................A...R";
 		String removeBits = "...............................R";
 		assertThat(AclFormattingUtils.demergePatterns(original, removeBits))
-			.isEqualTo("...........................A....");
+				.isEqualTo("...........................A....");
 		assertThat(AclFormattingUtils.demergePatterns("ABCDEF", "......")).isEqualTo("ABCDEF");
 		assertThat(AclFormattingUtils.demergePatterns("ABCDEF", "GHIJKL")).isEqualTo("......");
 	}
@@ -56,7 +56,7 @@ public class AclFormattingUtilsTests {
 		assertThatIllegalArgumentException().isThrownBy(() -> AclFormattingUtils.mergePatterns(null, "SOME STRING"));
 		assertThatIllegalArgumentException().isThrownBy(() -> AclFormattingUtils.mergePatterns("SOME STRING", null));
 		assertThatIllegalArgumentException()
-			.isThrownBy(() -> AclFormattingUtils.mergePatterns("SOME STRING", "LONGER SOME STRING"));
+				.isThrownBy(() -> AclFormattingUtils.mergePatterns("SOME STRING", "LONGER SOME STRING"));
 		assertThatNoException().isThrownBy(() -> AclFormattingUtils.mergePatterns("SOME STRING", "SAME LENGTH"));
 	}
 
@@ -73,9 +73,9 @@ public class AclFormattingUtilsTests {
 	public final void testBinaryPrints() {
 		assertThat(AclFormattingUtils.printBinary(15)).isEqualTo("............................****");
 		assertThatIllegalArgumentException()
-			.isThrownBy(() -> AclFormattingUtils.printBinary(15, Permission.RESERVED_ON));
+				.isThrownBy(() -> AclFormattingUtils.printBinary(15, Permission.RESERVED_ON));
 		assertThatIllegalArgumentException()
-			.isThrownBy(() -> AclFormattingUtils.printBinary(15, Permission.RESERVED_OFF));
+				.isThrownBy(() -> AclFormattingUtils.printBinary(15, Permission.RESERVED_OFF));
 		assertThat(AclFormattingUtils.printBinary(15, 'x')).isEqualTo("............................xxxx");
 	}
 

acl/src/test/java/org/springframework/security/acls/AclPermissionCacheOptimizerTests.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2004-present the original author or authors.
+ * Copyright 2002-2016 the original author or authors.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -34,7 +34,7 @@ import static org.mockito.ArgumentMatchers.eq;
 import static org.mockito.BDDMockito.given;
 import static org.mockito.Mockito.mock;
 import static org.mockito.Mockito.verify;
-import static org.mockito.Mockito.verifyNoMoreInteractions;
+import static org.mockito.Mockito.verifyZeroInteractions;
 
 /**
  * @author Luke Taylor
@@ -68,7 +68,7 @@ public class AclPermissionCacheOptimizerTests {
 		pco.setObjectIdentityRetrievalStrategy(oids);
 		pco.setSidRetrievalStrategy(sids);
 		pco.cachePermissionsFor(mock(Authentication.class), Collections.emptyList());
-		verifyNoMoreInteractions(service, sids, oids);
+		verifyZeroInteractions(service, sids, oids);
 	}
 
 }

acl/src/test/java/org/springframework/security/acls/AclPermissionEvaluatorTests.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2004-present the original author or authors.
+ * Copyright 2002-2018 the original author or authors.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.

acl/src/test/java/org/springframework/security/acls/TargetObject.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2004-present the original author or authors.
+ * Copyright 2002-2016 the original author or authors.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.

acl/src/test/java/org/springframework/security/acls/TargetObjectWithUUID.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2004-present the original author or authors.
+ * Copyright 2002-2017 the original author or authors.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.