Fix compile warnings for spring-security-config by 023-dev · Pull Request #18596 · spring-projects/spring-security

023-dev · 2026-01-26T19:01:37Z

This PR removes all compiler warnings from the spring-security-config module and applies the compile-warnings-error plugin to prevent future warnings.

Changes

Java Changes

OAuth2ResourceServerConfigurer.java: Replaced deprecated SpringOpaqueTokenIntrospector constructor with the new Builder pattern introduced in Spring Security 6.5
- Changed from: new SpringOpaqueTokenIntrospector(introspectionUri, clientId, clientSecret)
- Changed to: SpringOpaqueTokenIntrospector.withIntrospectionUri(...).clientId(...).clientSecret(...).build()

Kotlin Changes

AuthorizeHttpRequestsDsl.kt:
- Replaced Object::class.java with Any::class.java (Kotlin best practice)
- Changed resolveRolePrefix() and resolveRoleHierarchy() return types to nullable to fix "condition always true" warnings
HeadersDsl.kt: Added @Suppress("DEPRECATION") for deprecated HpkpConfig usage (class itself is deprecated)
HttpSecurityDsl.kt: Added @Suppress("DEPRECATION") for deprecated requiresChannel() method
RequiresChannelDsl.kt: Added @file:Suppress("DEPRECATION") for deprecated channel security classes
X509Dsl.kt: Added @Suppress("DEPRECATION") for deprecated subjectPrincipalRegex property
HttpPublicKeyPinningDsl.kt: Added @file:Suppress("DEPRECATION") for deprecated HPKP classes
SessionFixationDsl.kt: Removed unnecessary null case in when expression

Build Configuration

spring-security-config.gradle: Applied compile-warnings-error plugin to fail build on warnings

Testing

All existing tests continue to pass
The functionality remains unchanged; only deprecated API usage was updated
Build now fails on new warnings, ensuring code quality

Related Issues

Closes gh-18419

rwinch · 2026-01-26T21:20:39Z

Thank you. Unfortunately, the build fails with the changes. Can you please update the pull request to resolve the errors?

023-dev · 2026-01-27T06:45:41Z

@rwinch
Thanks for the heads-up! I’ll fix the build issues and update the pull request.

023-dev · 2026-01-27T08:15:02Z

@rwinch
I’ve fixed the build issues and pushed the updates.
The workflow should be ready once approved by a maintainer. Thanks!

rwinch · 2026-02-02T17:51:17Z

@023-dev It appears that that the build is still failing. Would you mind taking a look at it? You can check the build using the same steps in the linked CI.

023-dev · 2026-02-04T18:47:34Z

@rwinch

Thank you for the feedback, and I apologize for missing the previous build failure.
I have fixed the issue and pushed the updates.
The tests, including the full build for spring-security-config, are passing locally now.

rwinch

Thanks. I've provided feedback inline

rwinch · 2026-02-19T19:50:44Z

buildSrc/src/main/groovy/compile-warnings-error.gradle

 }

-tasks.withType(KotlinCompile) {
-    kotlinOptions.allWarningsAsErrors = true


Why was this removed? I think that we still need to fail if there are kotlin warnings.

Thanks for the feedback! I've restored kotlinOptions.allWarningsAsErrors = true in the Gradle configuration.

rwinch · 2026-02-19T19:52:28Z

config/src/main/kotlin/org/springframework/security/config/annotation/web/HeadersDsl.kt

 * @property defaultsDisabled whether all of the default headers should be included in the response
 */
 @SecurityMarker
+@Suppress("DEPRECATION")


We cannot add suppress deprecation here because the HeadersDsl is not also deprecated. Instead add it to the specific parts that are using deprecations and ensure that the method that uses them is also deprecated.

Done. I've removed the class-level @Suppress("DEPRECATION") from HeadersDsl
and moved it specifically to the deprecated fields (hpkp, featurePolicyDirectives) and their respective setter methods.

rwinch · 2026-02-19T19:55:43Z

config/src/test/java/org/springframework/security/SerializationSamples.java

 		Authentication authentication = TestAuthentication.authenticated(user);
 		SecurityContext securityContext = new SecurityContextImpl(authentication);

+		instancioByClassName.put(OneTimeTokenAuthenticationToken.class, () -> {


I think that since this is a test, we should leave this alone and suppress the warning

Good point. I've reverted the changes to the test setup and instead added @SuppressWarnings("removal") directly to the Instancio.of(OneTimeTokenAuthenticationToken.class) initialization to suppress the deprecation warning.

Signed-off-by: 023-dev <0_2_3@naver.com>

rwinch · 2026-02-28T03:54:06Z

Thanks for the Pull Request! This is now merged into main 😄

023-dev · 2026-02-28T04:57:41Z

Thank you for the review and merge!
Really appreciate it 🙌

spring-projects-issues added the status: waiting-for-triage An issue we've not yet triaged label Jan 26, 2026

rwinch added this to the 7.1.0-M2 milestone Jan 26, 2026

rwinch added in: build An issue in the build type: enhancement A general enhancement and removed status: waiting-for-triage An issue we've not yet triaged labels Jan 26, 2026

rwinch self-assigned this Jan 26, 2026

rwinch added status: waiting-for-feedback We need additional information before we can continue in: config An issue in spring-security-config labels Jan 26, 2026

rwinch changed the title ~~Remove compiler warnings for spring-security-config~~ Fix compiler warnings for spring-security-config Jan 26, 2026

rwinch changed the title ~~Fix compiler warnings for spring-security-config~~ Fix compile warnings for spring-security-config Jan 26, 2026

spring-projects-issues added status: feedback-provided Feedback has been provided and removed status: waiting-for-feedback We need additional information before we can continue labels Jan 27, 2026

023-dev force-pushed the gh-18419 branch 2 times, most recently from 9034986 to 05becb5 Compare January 27, 2026 07:59

rwinch removed the status: feedback-provided Feedback has been provided label Feb 2, 2026

rwinch enabled auto-merge (rebase) February 2, 2026 17:34

rwinch added the status: waiting-for-feedback We need additional information before we can continue label Feb 3, 2026

auto-merge was automatically disabled February 3, 2026 12:30
Head branch was pushed to by a user without write access

spring-projects-issues added status: feedback-provided Feedback has been provided and removed status: waiting-for-feedback We need additional information before we can continue labels Feb 4, 2026

023-dev force-pushed the gh-18419 branch from b69a4ef to 2d212dc Compare February 4, 2026 18:53

jgrandja modified the milestones: 7.1.0-M2, 7.1.0-M3 Feb 13, 2026

rwinch requested changes Feb 19, 2026

View reviewed changes

rwinch removed the status: feedback-provided Feedback has been provided label Feb 19, 2026

rwinch added the status: waiting-for-feedback We need additional information before we can continue label Feb 19, 2026

Remove compiler warnings for spring-security-config

cade0c9

Signed-off-by: 023-dev <0_2_3@naver.com>

rwinch force-pushed the gh-18419 branch from 341a6b4 to cade0c9 Compare February 28, 2026 03:10

rwinch merged commit b9f974b into spring-projects:main Feb 28, 2026
7 checks passed

rwinch removed the status: waiting-for-feedback We need additional information before we can continue label Feb 28, 2026

Conversation

023-dev commented Jan 26, 2026

Changes

Java Changes

Kotlin Changes

Build Configuration

Testing

Related Issues

Uh oh!

rwinch commented Jan 26, 2026

Uh oh!

023-dev commented Jan 27, 2026

Uh oh!

023-dev commented Jan 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

rwinch commented Feb 2, 2026

Uh oh!

023-dev commented Feb 4, 2026

Uh oh!

rwinch left a comment

Choose a reason for hiding this comment

Uh oh!

rwinch Feb 19, 2026

Choose a reason for hiding this comment

Uh oh!

023-dev Feb 24, 2026

Choose a reason for hiding this comment

Uh oh!

rwinch Feb 19, 2026

Choose a reason for hiding this comment

Uh oh!

023-dev Feb 24, 2026

Choose a reason for hiding this comment

Uh oh!

rwinch Feb 19, 2026

Choose a reason for hiding this comment

Uh oh!

023-dev Feb 24, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

rwinch commented Feb 28, 2026

Uh oh!

023-dev commented Feb 28, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

023-dev commented Jan 27, 2026 •

edited

Loading