Fix consistency with Nullability Usage

rwinch · rwinch · commit d7fbf3673a1d · 2026-01-23T10:42:53.000-06:00
Issue gh-18564
diff --git a/config/src/test/java/org/springframework/security/config/web/server/LogoutSpecTests.java b/config/src/test/java/org/springframework/security/config/web/server/LogoutSpecTests.java
@@ -278,7 +278,7 @@ public void multipleLogoutHandlers() {
 
 	private static class InMemorySecurityContextRepository implements ServerSecurityContextRepository {
 
-		@Nullable private SecurityContext savedContext;
+		private @Nullable SecurityContext savedContext;
 
 		@Override
 		public Mono<Void> save(ServerWebExchange exchange, SecurityContext context) {
@@ -291,7 +291,7 @@ public Mono<SecurityContext> load(ServerWebExchange exchange) {
 			return Mono.justOrEmpty(this.savedContext);
 		}
 
-		@Nullable private SecurityContext getSavedContext() {
+		private @Nullable SecurityContext getSavedContext() {
 			return this.savedContext;
 		}
 
diff --git a/core/src/main/java/org/springframework/security/authentication/ott/OneTimeTokenAuthenticationToken.java b/core/src/main/java/org/springframework/security/authentication/ott/OneTimeTokenAuthenticationToken.java
@@ -36,7 +36,7 @@ public class OneTimeTokenAuthenticationToken extends AbstractAuthenticationToken
 	@Serial
 	private static final long serialVersionUID = -8691636031126328365L;
 
-	private @Nullable final Object principal;
+	private final @Nullable Object principal;
 
 	private @Nullable String tokenValue;
 
diff --git a/core/src/main/java/org/springframework/security/authorization/method/MethodInvocationResult.java b/core/src/main/java/org/springframework/security/authorization/method/MethodInvocationResult.java
@@ -32,7 +32,7 @@ public class MethodInvocationResult {
 
 	private final MethodInvocation methodInvocation;
 
-	private @Nullable final Object result;
+	private final @Nullable Object result;
 
 	/**
 	 * Construct a {@link MethodInvocationResult} with the provided parameters
diff --git a/core/src/test/java/org/springframework/security/authorization/AuthorizationAdvisorProxyFactoryTests.java b/core/src/test/java/org/springframework/security/authorization/AuthorizationAdvisorProxyFactoryTests.java
@@ -40,7 +40,6 @@
 
 import org.springframework.aop.Pointcut;
 import org.springframework.core.annotation.AnnotationAwareOrderComparator;
-import org.springframework.lang.NonNull;
 import org.springframework.security.access.AccessDeniedException;
 import org.springframework.security.access.prepost.PreAuthorize;
 import org.springframework.security.authentication.TestAuthentication;
@@ -445,7 +444,7 @@ public String getLastName() {
 		}
 
 		@Override
-		public int compareTo(@NonNull User that) {
+		public int compareTo(User that) {
 			return this.id.compareTo(that.getId());
 		}
 
@@ -455,7 +454,6 @@ static class UserRepository implements Iterable<User> {
 
 		List<User> users = List.of(new User("1", "first", "last"));
 
-		@NonNull
 		@Override
 		public Iterator<User> iterator() {
 			return this.users.iterator();
diff --git a/core/src/test/java/org/springframework/security/authorization/ReactiveAuthorizationAdvisorProxyFactoryTests.java b/core/src/test/java/org/springframework/security/authorization/ReactiveAuthorizationAdvisorProxyFactoryTests.java
@@ -25,7 +25,6 @@
 import reactor.test.StepVerifier;
 
 import org.springframework.aop.Pointcut;
-import org.springframework.lang.NonNull;
 import org.springframework.security.access.AccessDeniedException;
 import org.springframework.security.access.prepost.PreAuthorize;
 import org.springframework.security.authentication.TestAuthentication;
@@ -193,7 +192,7 @@ public Mono<String> getLastName() {
 		}
 
 		@Override
-		public int compareTo(@NonNull User that) {
+		public int compareTo(User that) {
 			return this.id.compareTo(that.getId());
 		}
 
@@ -207,7 +206,6 @@ Flux<User> findAll() {
 			return Flux.fromIterable(this.users);
 		}
 
-		@NonNull
 		@Override
 		public Iterator<User> iterator() {
 			return this.users.iterator();
diff --git a/messaging/src/main/java/org/springframework/security/messaging/util/matcher/PathPatternMessageMatcher.java b/messaging/src/main/java/org/springframework/security/messaging/util/matcher/PathPatternMessageMatcher.java
@@ -18,8 +18,9 @@
 
 import java.util.Collections;
 
+import org.jspecify.annotations.Nullable;
+
 import org.springframework.http.server.PathContainer;
-import org.springframework.lang.Nullable;
 import org.springframework.messaging.Message;
 import org.springframework.messaging.simp.SimpMessageHeaderAccessor;
 import org.springframework.messaging.simp.SimpMessageType;
diff --git a/messaging/src/test/java/org/springframework/security/messaging/handler/invocation/ResolvableMethod.java b/messaging/src/test/java/org/springframework/security/messaging/handler/invocation/ResolvableMethod.java
@@ -46,7 +46,6 @@
 import org.springframework.core.annotation.AnnotatedElementUtils;
 import org.springframework.core.annotation.AnnotationUtils;
 import org.springframework.core.annotation.SynthesizingMethodParameter;
-import org.springframework.lang.Nullable;
 import org.springframework.objenesis.ObjenesisException;
 import org.springframework.objenesis.SpringObjenesis;
 import org.springframework.util.Assert;
@@ -649,7 +648,6 @@ Method getInvokedMethod() {
 		}
 
 		@Override
-		@Nullable
 		public Object intercept(Object object, Method method, Object[] args, MethodProxy proxy) {
 			if (ReflectionUtils.isObjectMethod(method)) {
 				return ReflectionUtils.invokeMethod(method, object, args);
@@ -661,7 +659,6 @@ public Object intercept(Object object, Method method, Object[] args, MethodProxy
 		}
 
 		@Override
-		@Nullable
 		public Object invoke(org.aopalliance.intercept.MethodInvocation inv) throws Throwable {
 			return intercept(inv.getThis(), inv.getMethod(), inv.getArguments(), null);
 		}
diff --git a/rsocket/src/main/java/org/springframework/security/rsocket/core/PayloadSocketAcceptorInterceptor.java b/rsocket/src/main/java/org/springframework/security/rsocket/core/PayloadSocketAcceptorInterceptor.java
@@ -21,8 +21,8 @@
 import io.rsocket.SocketAcceptor;
 import io.rsocket.metadata.WellKnownMimeType;
 import io.rsocket.plugins.SocketAcceptorInterceptor;
+import org.jspecify.annotations.Nullable;
 
-import org.springframework.lang.Nullable;
 import org.springframework.security.rsocket.api.PayloadInterceptor;
 import org.springframework.util.Assert;
 import org.springframework.util.MimeType;
@@ -38,8 +38,7 @@ public class PayloadSocketAcceptorInterceptor implements SocketAcceptorIntercept
 
 	private final List<PayloadInterceptor> interceptors;
 
-	@Nullable
-	private MimeType defaultDataMimeType;
+	private @Nullable MimeType defaultDataMimeType;
 
 	private MimeType defaultMetadataMimeType = MimeTypeUtils
 		.parseMimeType(WellKnownMimeType.MESSAGE_RSOCKET_COMPOSITE_METADATA.getString());
diff --git a/web/src/main/java/org/springframework/security/web/DefaultSecurityFilterChain.java b/web/src/main/java/org/springframework/security/web/DefaultSecurityFilterChain.java
@@ -24,6 +24,7 @@
 import jakarta.servlet.http.HttpServletRequest;
 import org.apache.commons.logging.Log;
 import org.apache.commons.logging.LogFactory;
+import org.jspecify.annotations.NonNull;
 import org.jspecify.annotations.Nullable;
 
 import org.springframework.beans.BeansException;
@@ -33,7 +34,6 @@
 import org.springframework.beans.factory.config.BeanDefinition;
 import org.springframework.beans.factory.config.ConfigurableListableBeanFactory;
 import org.springframework.core.log.LogMessage;
-import org.springframework.lang.NonNull;
 import org.springframework.security.web.util.matcher.RequestMatcher;
 import org.springframework.util.StringUtils;
 
diff --git a/web/src/main/java/org/springframework/security/web/ObservationFilterChainDecorator.java b/web/src/main/java/org/springframework/security/web/ObservationFilterChainDecorator.java
@@ -508,7 +508,7 @@ static final class FilterChainObservationContext extends Observation.Context {
 
 		private final String filterSection;
 
-		@Nullable private String filterName;
+		private @Nullable String filterName;
 
 		private int chainPosition;
 
diff --git a/web/src/main/java/org/springframework/security/web/authentication/AbstractAuthenticationProcessingFilter.java b/web/src/main/java/org/springframework/security/web/authentication/AbstractAuthenticationProcessingFilter.java
@@ -126,7 +126,7 @@ public abstract class AbstractAuthenticationProcessingFilter extends GenericFilt
 	private SecurityContextHolderStrategy securityContextHolderStrategy = SecurityContextHolder
 		.getContextHolderStrategy();
 
-	@Nullable protected ApplicationEventPublisher eventPublisher;
+	protected @Nullable ApplicationEventPublisher eventPublisher;
 
 	protected AuthenticationDetailsSource<HttpServletRequest, ?> authenticationDetailsSource = new WebAuthenticationDetailsSource();
 
diff --git a/web/src/main/java/org/springframework/security/web/authentication/UsernamePasswordAuthenticationFilter.java b/web/src/main/java/org/springframework/security/web/authentication/UsernamePasswordAuthenticationFilter.java
@@ -18,9 +18,9 @@
 
 import jakarta.servlet.http.HttpServletRequest;
 import jakarta.servlet.http.HttpServletResponse;
+import org.jspecify.annotations.Nullable;
 
 import org.springframework.http.HttpMethod;
-import org.springframework.lang.Nullable;
 import org.springframework.security.authentication.AuthenticationManager;
 import org.springframework.security.authentication.AuthenticationServiceException;
 import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
@@ -100,8 +100,7 @@ public Authentication attemptAuthentication(HttpServletRequest request, HttpServ
 	 * @return the password that will be presented in the <code>Authentication</code>
 	 * request token to the <code>AuthenticationManager</code>
 	 */
-	@Nullable
-	protected String obtainPassword(HttpServletRequest request) {
+	protected @Nullable String obtainPassword(HttpServletRequest request) {
 		return request.getParameter(this.passwordParameter);
 	}
 
@@ -112,8 +111,7 @@ protected String obtainPassword(HttpServletRequest request) {
 	 * @return the username that will be presented in the <code>Authentication</code>
 	 * request token to the <code>AuthenticationManager</code>
 	 */
-	@Nullable
-	protected String obtainUsername(HttpServletRequest request) {
+	protected @Nullable String obtainUsername(HttpServletRequest request) {
 		return request.getParameter(this.usernameParameter);
 	}
 
diff --git a/web/src/main/java/org/springframework/security/web/authentication/ott/GenerateOneTimeTokenRequestResolver.java b/web/src/main/java/org/springframework/security/web/authentication/ott/GenerateOneTimeTokenRequestResolver.java
@@ -17,8 +17,8 @@
 package org.springframework.security.web.authentication.ott;
 
 import jakarta.servlet.http.HttpServletRequest;
+import org.jspecify.annotations.Nullable;
 
-import org.springframework.lang.Nullable;
 import org.springframework.security.authentication.ott.GenerateOneTimeTokenRequest;
 
 /**
@@ -35,7 +35,6 @@ public interface GenerateOneTimeTokenRequestResolver {
 	 * @param request {@link HttpServletRequest} to resolve
 	 * @return {@link GenerateOneTimeTokenRequest}
 	 */
-	@Nullable
-	GenerateOneTimeTokenRequest resolve(HttpServletRequest request);
+	@Nullable GenerateOneTimeTokenRequest resolve(HttpServletRequest request);
 
 }
diff --git a/web/src/main/java/org/springframework/security/web/reactive/result/view/CsrfRequestDataValueProcessor.java b/web/src/main/java/org/springframework/security/web/reactive/result/view/CsrfRequestDataValueProcessor.java
@@ -20,7 +20,8 @@
 import java.util.Map;
 import java.util.regex.Pattern;
 
-import org.springframework.lang.NonNull;
+import org.jspecify.annotations.NonNull;
+
 import org.springframework.security.web.server.csrf.CsrfToken;
 import org.springframework.web.reactive.result.view.RequestDataValueProcessor;
 import org.springframework.web.server.ServerWebExchange;
diff --git a/web/src/main/java/org/springframework/security/web/server/ObservationWebFilterChainDecorator.java b/web/src/main/java/org/springframework/security/web/server/ObservationWebFilterChainDecorator.java
@@ -109,9 +109,9 @@ static class ObservationWebFilterChain implements WebFilterChain {
 
 		private final WebHandler handler;
 
-		@Nullable private final ObservationWebFilter currentFilter;
+		private final @Nullable ObservationWebFilter currentFilter;
 
-		@Nullable private final ObservationWebFilterChain chain;
+		private final @Nullable ObservationWebFilterChain chain;
 
 		/**
 		 * Public constructor with the list of filters and the target handler to use.
diff --git a/web/src/main/java/org/springframework/security/web/server/authentication/ServerX509AuthenticationConverter.java b/web/src/main/java/org/springframework/security/web/server/authentication/ServerX509AuthenticationConverter.java
@@ -20,10 +20,10 @@
 
 import org.apache.commons.logging.Log;
 import org.apache.commons.logging.LogFactory;
+import org.jspecify.annotations.NonNull;
 import reactor.core.publisher.Mono;
 
 import org.springframework.http.server.reactive.SslInfo;
-import org.springframework.lang.NonNull;
 import org.springframework.security.core.Authentication;
 import org.springframework.security.web.authentication.preauth.PreAuthenticatedAuthenticationToken;
 import org.springframework.security.web.authentication.preauth.x509.X509PrincipalExtractor;
diff --git a/web/src/main/java/org/springframework/security/web/server/authentication/SwitchUserWebFilter.java b/web/src/main/java/org/springframework/security/web/server/authentication/SwitchUserWebFilter.java
@@ -23,12 +23,12 @@
 
 import org.apache.commons.logging.Log;
 import org.apache.commons.logging.LogFactory;
+import org.jspecify.annotations.NonNull;
+import org.jspecify.annotations.Nullable;
 import reactor.core.publisher.Mono;
 
 import org.springframework.core.log.LogMessage;
 import org.springframework.http.HttpMethod;
-import org.springframework.lang.NonNull;
-import org.springframework.lang.Nullable;
 import org.springframework.security.authentication.AccountStatusUserDetailsChecker;
 import org.springframework.security.authentication.AuthenticationCredentialsNotFoundException;
 import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
@@ -217,8 +217,8 @@ protected Mono<Authentication> exitSwitchUser(WebFilterExchange webFilterExchang
 		return exchange.getRequest().getQueryParams().getFirst(SPRING_SECURITY_SWITCH_USERNAME_KEY);
 	}
 
-	@NonNull
-	private Mono<Authentication> attemptSwitchUser(Authentication currentAuthentication, @Nullable String userName) {
+	private @NonNull Mono<Authentication> attemptSwitchUser(Authentication currentAuthentication,
+			@Nullable String userName) {
 		Assert.notNull(userName, "The userName can not be null.");
 		this.logger.debug(LogMessage.format("Attempting to switch to user [%s]", userName));
 		return this.userDetailsService.findByUsername(userName)
@@ -227,8 +227,7 @@ private Mono<Authentication> attemptSwitchUser(Authentication currentAuthenticat
 			.map((userDetails) -> createSwitchUserToken(userDetails, currentAuthentication));
 	}
 
-	@NonNull
-	private Authentication attemptExitUser(Authentication currentAuthentication) {
+	private @NonNull Authentication attemptExitUser(Authentication currentAuthentication) {
 		Optional<Authentication> sourceAuthentication = extractSourceAuthentication(currentAuthentication);
 		if (sourceAuthentication.isEmpty()) {
 			this.logger.debug("Failed to find original user");
diff --git a/web/src/main/java/org/springframework/security/web/servlet/util/matcher/PathPatternRequestMatcher.java b/web/src/main/java/org/springframework/security/web/servlet/util/matcher/PathPatternRequestMatcher.java
@@ -19,11 +19,11 @@
 import java.util.Objects;
 
 import jakarta.servlet.http.HttpServletRequest;
+import org.jspecify.annotations.Nullable;
 
 import org.springframework.http.HttpMethod;
 import org.springframework.http.server.PathContainer;
 import org.springframework.http.server.RequestPath;
-import org.springframework.lang.Nullable;
 import org.springframework.security.web.access.intercept.RequestAuthorizationContext;
 import org.springframework.security.web.util.matcher.AnyRequestMatcher;
 import org.springframework.security.web.util.matcher.RequestMatcher;
diff --git a/web/src/main/java/org/springframework/security/web/util/matcher/DispatcherTypeRequestMatcher.java b/web/src/main/java/org/springframework/security/web/util/matcher/DispatcherTypeRequestMatcher.java
@@ -18,9 +18,9 @@
 
 import jakarta.servlet.DispatcherType;
 import jakarta.servlet.http.HttpServletRequest;
+import org.jspecify.annotations.Nullable;
 
 import org.springframework.http.HttpMethod;
-import org.springframework.lang.Nullable;
 import org.springframework.util.StringUtils;
 
 /**
@@ -36,8 +36,7 @@ public class DispatcherTypeRequestMatcher implements RequestMatcher {
 
 	private final DispatcherType dispatcherType;
 
-	@Nullable
-	private final HttpMethod httpMethod;
+	private final @Nullable HttpMethod httpMethod;
 
 	/**
 	 * Creates an instance which matches requests with the provided {@link DispatcherType}
diff --git a/web/src/test/java/org/springframework/security/web/servlet/MockServletContext.java b/web/src/test/java/org/springframework/security/web/servlet/MockServletContext.java
@@ -28,7 +28,6 @@
 import jakarta.servlet.ServletRegistration;
 import jakarta.servlet.ServletSecurityElement;
 
-import org.springframework.lang.NonNull;
 import org.springframework.web.servlet.DispatcherServlet;
 
 public class MockServletContext extends org.springframework.mock.web.MockServletContext {
@@ -41,15 +40,13 @@ public static MockServletContext mvc() {
 		return servletContext;
 	}
 
-	@NonNull
 	@Override
-	public ServletRegistration.Dynamic addServlet(@NonNull String servletName, Class<? extends Servlet> clazz) {
+	public ServletRegistration.Dynamic addServlet(String servletName, Class<? extends Servlet> clazz) {
 		ServletRegistration.Dynamic dynamic = new MockServletRegistration(servletName, clazz);
 		this.registrations.put(servletName, dynamic);
 		return dynamic;
 	}
 
-	@NonNull
 	@Override
 	public Map<String, ? extends ServletRegistration> getServletRegistrations() {
 		return this.registrations;

Original file line number	Diff line number	Diff line change
`@@ -278,7 +278,7 @@ public void multipleLogoutHandlers() {`
`278`	`278`
`279`	`279`	`private static class InMemorySecurityContextRepository implements ServerSecurityContextRepository {`
`280`	`280`
`281`		`- @Nullable private SecurityContext savedContext;`
	`281`	`+ private @Nullable SecurityContext savedContext;`
`282`	`282`
`283`	`283`	`@Override`
`284`	`284`	`public Mono<Void> save(ServerWebExchange exchange, SecurityContext context) {`
`@@ -291,7 +291,7 @@ public Mono<SecurityContext> load(ServerWebExchange exchange) {`
`291`	`291`	`return Mono.justOrEmpty(this.savedContext);`
`292`	`292`	`}`
`293`	`293`
`294`		`- @Nullable private SecurityContext getSavedContext() {`
	`294`	`+ private @Nullable SecurityContext getSavedContext() {`
`295`	`295`	`return this.savedContext;`
`296`	`296`	`}`
`297`	`297`
Original file line number	Diff line number	Diff line change
`@@ -25,7 +25,6 @@`
`25`	`25`	`import reactor.test.StepVerifier;`
`26`	`26`
`27`	`27`	`import org.springframework.aop.Pointcut;`
`28`		`-import org.springframework.lang.NonNull;`
`29`	`28`	`import org.springframework.security.access.AccessDeniedException;`
`30`	`29`	`import org.springframework.security.access.prepost.PreAuthorize;`
`31`	`30`	`import org.springframework.security.authentication.TestAuthentication;`
`@@ -193,7 +192,7 @@ public Mono<String> getLastName() {`
`193`	`192`	`}`
`194`	`193`
`195`	`194`	`@Override`
`196`		`- public int compareTo(@NonNull User that) {`
	`195`	`+ public int compareTo(User that) {`
`197`	`196`	`return this.id.compareTo(that.getId());`
`198`	`197`	`}`
`199`	`198`
`@@ -207,7 +206,6 @@ Flux<User> findAll() {`
`207`	`206`	`return Flux.fromIterable(this.users);`
`208`	`207`	`}`
`209`	`208`
`210`		`- @NonNull`
`211`	`209`	`@Override`
`212`	`210`	`public Iterator<User> iterator() {`
`213`	`211`	`return this.users.iterator();`