@rwinch Thanks for the review! Changing the generic type of MessageSecurityExpressionRoot to Message<T> is a breaking change. Please confirm if that's something we want to do here and I will work on this and the other changes from your review.

@sjohnr

@rwinch Thanks for the review! Changing the generic type of MessageSecurityExpressionRoot to Message<T> is a breaking change. Please confirm if that's something we want to do here and I will work on this and the other changes from your review.

I think that this can work if we update the constructor too. For example:

public class MessageSecurityExpressionRoot<T> extends SecurityExpressionRoot {
	public final Message<T> message;
	public MessageSecurityExpressionRoot(Authentication authentication, Message<T> message) {
	 ...
	public MessageSecurityExpressionRoot(Supplier<Authentication> authentication, Message<T> message) {
	 ...

Then this will compile:

Message<?> message = ...
MessageSecurityExpressionRoot root = new MessageSecurityExpressionRoot<>(authentication, message);

@rwinch I've working through the changes and it's looking really good. The only thing I'm noticing is that a few packages are missing nullability defaults.

• org.springframework.security.web.access.expression has a package-info.java but no @NullMarked. Is this intended or perhaps it should be addressed separately?
• org.springframework.security.messaging.access.expression is missing package-info.java along with all the other packages in spring-security-messaging.

As it stands now, classes in these packages show as having inconsistent nullability. These show up as IntelliJ inspections for me, similar to our conversation a few weeks ago. I think adding @NullMarked at the package level will address this, but if omitting that was intentional, let me know. I've added @NullMarked at the class level to show where these issues are but I will revert that after you review.

We've only added nullability for crypto and core so feel free to leave as is. We'll get the rest of the module in a different ticket commit.