Release 2.5.4

Explicitly reference the logback.xml file to prevent gretty from configuring the defaults using groovy.

.github/workflows/continuous-integration-workflow.yml

@@ -32,7 +32,7 @@ jobs:
       - name: Setup gradle user name
         run: |
           mkdir -p ~/.gradle
-          echo 'systemProp.user.name=spring-builds' >> ~/.gradle/gradle.properties
+          echo 'systemProp.user.name=spring-builds+github' >> ~/.gradle/gradle.properties
       - name: Cache Gradle packages
         uses: actions/cache@v2
         with:
@@ -57,7 +57,7 @@ jobs:
       - name: Setup gradle user name
         run: |
           mkdir -p ~/.gradle
-          echo 'systemProp.user.name=spring-builds' >> ~/.gradle/gradle.properties
+          echo 'systemProp.user.name=spring-builds+github' >> ~/.gradle/gradle.properties
       - name: Deploy artifacts
         run: |
           export GRADLE_ENTERPRISE_CACHE_USERNAME="$GRADLE_ENTERPRISE_CACHE_USER"
@@ -66,13 +66,13 @@ jobs:
           export VERSION_HEADER=$'Version: GnuPG v2\n\n'
           export ORG_GRADLE_PROJECT_signingKey=${GPG_PRIVATE_KEY#"$VERSION_HEADER"}
           export ORG_GRADLE_PROJECT_signingPassword="$GPG_PASSPHRASE"
-          ./gradlew deployArtifacts -PossrhUsername="$OSSRH_TOKEN_USERNAME" -PossrhPassword="$OSSRH_TOKEN_PASSWORD" -PartifactoryUsername="$ARTIFACTORY_USERNAME" -PartifactoryPassword="$ARTIFACTORY_PASSWORD" --stacktrace --no-parallel
-          ./gradlew finalizeDeployArtifacts -PossrhUsername="$OSSRH_TOKEN_USERNAME" -PossrhPassword="$OSSRH_TOKEN_PASSWORD" -PartifactoryUsername="$ARTIFACTORY_USERNAME" -PartifactoryPassword="$ARTIFACTORY_PASSWORD" --stacktrace --no-parallel
+          ./gradlew deployArtifacts -PossrhTokenUsername="$OSSRH_TOKEN_USERNAME" -PossrhTokenPassword="$OSSRH_TOKEN_PASSWORD" -PartifactoryUsername="$ARTIFACTORY_USERNAME" -PartifactoryPassword="$ARTIFACTORY_PASSWORD" --stacktrace --no-parallel
+          ./gradlew finalizeDeployArtifacts -PossrhTokenUsername="$OSSRH_TOKEN_USERNAME" -PossrhTokenPassword="$OSSRH_TOKEN_PASSWORD" -PartifactoryUsername="$ARTIFACTORY_USERNAME" -PartifactoryPassword="$ARTIFACTORY_PASSWORD" --stacktrace --no-parallel
         env:
-          GPG_PRIVATE_KEY: ${{ secrets.GPG_PRIVATE_KEY_NO_HEADER }}
+          GPG_PRIVATE_KEY: ${{ secrets.GPG_PRIVATE_KEY }}
           GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }}
-          OSSRH_TOKEN_USERNAME: ${{ secrets.OSSRH_TOKEN_USERNAME }}
-          OSSRH_TOKEN_PASSWORD: ${{ secrets.OSSRH_TOKEN_PASSWORD }}
+          OSSRH_TOKEN_USERNAME: ${{ secrets.OSSRH_S01_TOKEN_USERNAME }}
+          OSSRH_TOKEN_PASSWORD: ${{ secrets.OSSRH_S01_TOKEN_PASSWORD }}
           ARTIFACTORY_USERNAME: ${{ secrets.ARTIFACTORY_USERNAME }}
           ARTIFACTORY_PASSWORD: ${{ secrets.ARTIFACTORY_PASSWORD }}
   docs:
@@ -88,7 +88,7 @@ jobs:
       - name: Setup gradle user name
         run: |
           mkdir -p ~/.gradle
-          echo 'systemProp.user.name=spring-builds' >> ~/.gradle/gradle.properties
+          echo 'systemProp.user.name=spring-builds+github' >> ~/.gradle/gradle.properties
       - name: Deploy Docs
         run: |
           export GRADLE_ENTERPRISE_CACHE_USERNAME="$GRADLE_ENTERPRISE_CACHE_USER"

build.gradle

@@ -4,7 +4,7 @@ buildscript {
 		snapshotBuild = version.endsWith('SNAPSHOT')
 		milestoneBuild = !(releaseBuild || snapshotBuild)
 
-		springBootVersion = '2.4.7'
+		springBootVersion = '2.5.7'
 	}
 
 	repositories {
@@ -22,7 +22,7 @@ buildscript {
 	}
 
 	dependencies {
-		classpath 'io.spring.gradle:spring-build-conventions:0.0.37'
+		classpath 'io.spring.gradle:spring-build-conventions:0.0.38'
 		classpath "org.springframework.boot:spring-boot-gradle-plugin:$springBootVersion"
 	}
 }

gradle.properties

@@ -1,3 +1,3 @@
 org.gradle.jvmargs=-Xmx2g -XX:MaxMetaspaceSize=512m -XX:+HeapDumpOnOutOfMemoryError -Dfile.encoding=UTF-8
 org.gradle.parallel=true
-version=2.5.3
+version=2.5.4

gradle/dependency-management.gradle

@@ -1,10 +1,10 @@
 dependencyManagement {
 	imports {
-		mavenBom 'io.projectreactor:reactor-bom:2020.0.12'
+		mavenBom 'io.projectreactor:reactor-bom:2020.0.14'
 		mavenBom 'org.junit:junit-bom:5.7.2'
-		mavenBom 'org.springframework:spring-framework-bom:5.3.11'
-		mavenBom 'org.springframework.data:spring-data-bom:2021.0.6'
-		mavenBom 'org.springframework.security:spring-security-bom:5.5.3'
+		mavenBom 'org.springframework:spring-framework-bom:5.3.14'
+		mavenBom 'org.springframework.data:spring-data-bom:2021.0.7'
+		mavenBom 'org.springframework.security:spring-security-bom:5.5.4'
 		mavenBom 'org.testcontainers:testcontainers-bom:1.15.3'
 	}
 
@@ -25,7 +25,7 @@ dependencyManagement {
 		dependency 'javax.annotation:javax.annotation-api:1.3.2'
 		dependency 'javax.servlet:javax.servlet-api:4.0.1'
 		dependency 'junit:junit:4.13.2'
-		dependency 'mysql:mysql-connector-java:8.0.26'
+		dependency 'mysql:mysql-connector-java:8.0.27'
 		dependency 'org.apache.derby:derby:10.14.2.0'
 		dependency 'org.assertj:assertj-core:3.19.0'
 		dependency 'org.hsqldb:hsqldb:2.5.2'

spring-session-data-redis/src/integration-test/java/org/springframework/session/data/redis/AbstractRedisITests.java

@@ -29,7 +29,7 @@ import org.springframework.data.redis.connection.lettuce.LettuceConnectionFactor
  */
 public abstract class AbstractRedisITests {
 
-	private static final String DOCKER_IMAGE = "redis:5.0.10";
+	private static final String DOCKER_IMAGE = "redis:5.0.14";
 
 	protected static class BaseConfig {
 

spring-session-data-redis/src/integration-test/java/org/springframework/session/data/redis/RedisIndexedSessionRepositoryITests.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2014-2020 the original author or authors.
+ * Copyright 2014-2021 the original author or authors.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -473,6 +473,60 @@ class RedisIndexedSessionRepositoryITests extends AbstractRedisITests {
 		assertThat(findByPrincipalName.keySet()).containsOnly(toSave.getId());
 	}
 
+	@Test // gh-1791
+	void changeSessionIdWhenSessionExpiresThenRemovesAllPrincipalIndexIds() {
+		RedisSession toSave = this.repository.createSession();
+		toSave.setAttribute(SPRING_SECURITY_CONTEXT, this.context);
+
+		this.repository.save(toSave);
+		String usernameSessionKey = "RedisIndexedSessionRepositoryITests:index:" + INDEX_NAME + ":" + getSecurityName();
+
+		RedisSession findById = this.repository.findById(toSave.getId());
+		String originalFindById = findById.getId();
+
+		assertThat(this.redis.boundSetOps(usernameSessionKey).members()).contains(originalFindById);
+
+		String changeSessionId = findById.changeSessionId();
+		findById.setAttribute(SPRING_SECURITY_CONTEXT, this.context);
+
+		this.repository.save(findById);
+
+		assertThat(this.redis.boundSetOps(usernameSessionKey).members()).contains(changeSessionId);
+
+		String body = "RedisIndexedSessionRepositoryITests:sessions:expires:" + changeSessionId;
+		String channel = "__keyevent@0__:expired";
+		DefaultMessage message = new DefaultMessage(channel.getBytes(StandardCharsets.UTF_8),
+				body.getBytes(StandardCharsets.UTF_8));
+		byte[] pattern = new byte[] {};
+		this.repository.onMessage(message, pattern);
+
+		assertThat(this.redis.boundSetOps(usernameSessionKey).members()).isEmpty();
+	}
+
+	@Test
+	void changeSessionIdWhenPrincipalNameChangesThenNewPrincipalMapsToNewSessionId() {
+		String principalName = "findByChangedPrincipalName" + UUID.randomUUID();
+		String principalNameChanged = "findByChangedPrincipalName" + UUID.randomUUID();
+		RedisSession toSave = this.repository.createSession();
+		toSave.setAttribute(INDEX_NAME, principalName);
+
+		this.repository.save(toSave);
+
+		RedisSession findById = this.repository.findById(toSave.getId());
+		String changeSessionId = findById.changeSessionId();
+		findById.setAttribute(INDEX_NAME, principalNameChanged);
+		this.repository.save(findById);
+
+		Map<String, RedisSession> findByPrincipalName = this.repository.findByIndexNameAndIndexValue(INDEX_NAME,
+				principalName);
+		assertThat(findByPrincipalName).isEmpty();
+
+		findByPrincipalName = this.repository.findByIndexNameAndIndexValue(INDEX_NAME, principalNameChanged);
+
+		assertThat(findByPrincipalName).hasSize(1);
+		assertThat(findByPrincipalName.keySet()).containsOnly(changeSessionId);
+	}
+
 	@Test
 	void changeSessionIdWhenOnlyChangeId() {
 		String attrName = "changeSessionId";

spring-session-data-redis/src/main/java/org/springframework/session/data/redis/RedisIndexedSessionRepository.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2014-2020 the original author or authors.
+ * Copyright 2014-2021 the original author or authors.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -858,6 +858,11 @@ public class RedisIndexedSessionRepository
 				catch (NonTransientDataAccessException ex) {
 					handleErrNoSuchKeyError(ex);
 				}
+				String originalPrincipalRedisKey = getPrincipalKey(this.originalPrincipalName);
+				RedisIndexedSessionRepository.this.sessionRedisOperations.boundSetOps(originalPrincipalRedisKey)
+						.remove(this.originalSessionId);
+				RedisIndexedSessionRepository.this.sessionRedisOperations.boundSetOps(originalPrincipalRedisKey)
+						.add(sessionId);
 			}
 			this.originalSessionId = sessionId;
 		}

spring-session-hazelcast/hazelcast4/hazelcast4.gradle

@@ -31,7 +31,7 @@ artifacts {
 
 dependencies {
     compile project(':spring-session-core')
-    optional "com.hazelcast:hazelcast:4.2.2"
+    optional "com.hazelcast:hazelcast:4.2.3"
     compile "org.springframework:spring-context"
     compile "javax.annotation:javax.annotation-api"
 
@@ -42,7 +42,7 @@ dependencies {
     testRuntime "org.junit.jupiter:junit-jupiter-engine"
 
     integrationTestCompile "org.testcontainers:testcontainers"
-    integrationTestCompile "com.hazelcast:hazelcast:4.2.2"
+    integrationTestCompile "com.hazelcast:hazelcast:4.2.3"
     integrationTestCompile project(":spring-session-hazelcast")
 }
 

spring-session-samples/gradle/dependency-management.gradle

@@ -1,10 +1,10 @@
 dependencyManagement {
 	imports {
-		mavenBom 'com.fasterxml.jackson:jackson-bom:2.12.5'
+		mavenBom 'com.fasterxml.jackson:jackson-bom:2.12.6'
 	}
 
 	dependencies {
-		dependency 'ch.qos.logback:logback-classic:1.2.6'
+		dependency 'ch.qos.logback:logback-classic:1.2.9'
 		dependency 'com.maxmind.geoip2:geoip2:2.15.0'
 		dependency 'javax.servlet.jsp.jstl:javax.servlet.jsp.jstl-api:1.2.2'
 		dependency 'javax.servlet.jsp:javax.servlet.jsp-api:2.3.3'

spring-session-samples/spring-session-sample-boot-findbyusername/src/integration-test/java/sample/FindByUsernameTests.java

@@ -46,7 +46,7 @@ import org.springframework.test.web.servlet.htmlunit.webdriver.MockMvcHtmlUnitDr
 @SpringBootTest(webEnvironment = WebEnvironment.MOCK)
 class FindByUsernameTests {
 
-	private static final String DOCKER_IMAGE = "redis:5.0.10";
+	private static final String DOCKER_IMAGE = "redis:5.0.14";
 
 	@Autowired
 	private MockMvc mockMvc;

spring-session-samples/spring-session-sample-boot-hazelcast4/spring-session-sample-boot-hazelcast4.gradle

@@ -7,7 +7,7 @@ dependencies {
 	compile "org.springframework.boot:spring-boot-starter-actuator"
 	compile "org.springframework.boot:spring-boot-starter-thymeleaf"
 	compile "org.springframework.boot:spring-boot-starter-security"
-	compile "com.hazelcast:hazelcast:4.2.2"
+	compile "com.hazelcast:hazelcast:4.2.3"
 	compile "nz.net.ultraq.thymeleaf:thymeleaf-layout-dialect"
 	compile "org.webjars:bootstrap"
 	compile "org.webjars:html5shiv"

spring-session-samples/spring-session-sample-boot-redis-json/src/integration-test/java/sample/HttpRedisJsonTest.java

@@ -50,7 +50,7 @@ import static org.assertj.core.api.Assertions.assertThat;
 @AutoConfigureMockMvc
 class HttpRedisJsonTest {
 
-	private static final String DOCKER_IMAGE = "redis:5.0.10";
+	private static final String DOCKER_IMAGE = "redis:5.0.14";
 
 	@Autowired
 	private MockMvc mockMvc;

spring-session-samples/spring-session-sample-boot-redis-json/src/integration-test/java/sample/RedisSerializerTest.java

@@ -39,7 +39,7 @@ import static org.assertj.core.api.Assertions.assertThat;
 @SpringBootTest
 class RedisSerializerTest {
 
-	private static final String DOCKER_IMAGE = "redis:5.0.10";
+	private static final String DOCKER_IMAGE = "redis:5.0.14";
 
 	@SpringSessionRedisOperations
 	private RedisTemplate<Object, Object> sessionRedisTemplate;

spring-session-samples/spring-session-sample-boot-redis-simple/src/integration-test/java/sample/BootTests.java

@@ -41,7 +41,7 @@ import org.springframework.test.web.servlet.htmlunit.webdriver.MockMvcHtmlUnitDr
 @SpringBootTest(webEnvironment = WebEnvironment.MOCK)
 class BootTests {
 
-	private static final String DOCKER_IMAGE = "redis:5.0.10";
+	private static final String DOCKER_IMAGE = "redis:5.0.14";
 
 	@Autowired
 	private MockMvc mockMvc;

spring-session-samples/spring-session-sample-boot-redis/src/integration-test/java/sample/BootTests.java

@@ -45,7 +45,7 @@ import org.springframework.test.web.servlet.htmlunit.webdriver.MockMvcHtmlUnitDr
 @SpringBootTest(webEnvironment = WebEnvironment.MOCK)
 class BootTests {
 
-	private static final String DOCKER_IMAGE = "redis:5.0.10";
+	private static final String DOCKER_IMAGE = "redis:5.0.14";
 
 	@Autowired
 	private MockMvc mockMvc;

spring-session-samples/spring-session-sample-boot-webflux-custom-cookie/src/integration-test/java/sample/AttributeTests.java

@@ -45,7 +45,7 @@ import static org.assertj.core.api.Assertions.assertThat;
 @SpringBootTest(webEnvironment = WebEnvironment.RANDOM_PORT)
 class AttributeTests {
 
-	private static final String DOCKER_IMAGE = "redis:5.0.9";
+	private static final String DOCKER_IMAGE = "redis:5.0.14";
 
 	@LocalServerPort
 	private int port;

spring-session-samples/spring-session-sample-boot-webflux/src/integration-test/java/sample/AttributeTests.java

@@ -47,7 +47,7 @@ import static org.assertj.core.api.Assertions.assertThat;
 @SpringBootTest(webEnvironment = WebEnvironment.RANDOM_PORT)
 class AttributeTests {
 
-	private static final String DOCKER_IMAGE = "redis:5.0.10";
+	private static final String DOCKER_IMAGE = "redis:5.0.14";
 
 	@LocalServerPort
 	private int port;

spring-session-samples/spring-session-sample-boot-websocket/src/integration-test/java/sample/ApplicationTests.java

@@ -52,7 +52,7 @@ import static org.assertj.core.api.Assertions.assertThatExceptionOfType;
 @SpringBootTest(webEnvironment = WebEnvironment.RANDOM_PORT)
 class ApplicationTests {
 
-	private static final String DOCKER_IMAGE = "redis:5.0.10";
+	private static final String DOCKER_IMAGE = "redis:5.0.14";
 
 	@Value("${local.server.port}")
 	private String port;

spring-session-samples/spring-session-sample-boot-websocket/src/main/resources/application.properties

@@ -1,2 +1,3 @@
 #server.servlet.session.timeout=1m
 spring.h2.console.enabled=true
+spring.jpa.defer-datasource-initialization=true

spring-session-samples/spring-session-sample-javaconfig-custom-cookie/spring-session-sample-javaconfig-custom-cookie.gradle

@@ -21,4 +21,5 @@ dependencies {
 
 gretty {
 	jvmArgs = ['-Dspring.profiles.active=embedded-redis']
+	logbackConfigFile = "src/main/resources/logback.xml"
 }

spring-session-samples/spring-session-sample-javaconfig-custom-cookie/src/main/java/sample/EmbeddedRedisConfig.java

@@ -28,7 +28,7 @@ import org.springframework.data.redis.connection.lettuce.LettuceConnectionFactor
 @Profile("embedded-redis")
 public class EmbeddedRedisConfig {
 
-	private static final String DOCKER_IMAGE = "redis:5.0.10";
+	private static final String DOCKER_IMAGE = "redis:5.0.14";
 
 	@Bean
 	public GenericContainer redisContainer() {

spring-session-samples/spring-session-sample-javaconfig-hazelcast/spring-session-sample-javaconfig-hazelcast.gradle

@@ -21,3 +21,7 @@ dependencies {
 
 	integrationTestCompile seleniumDependencies
 }
+
+gretty {
+	logbackConfigFile = "src/main/resources/logback.xml"
+}

spring-session-samples/spring-session-sample-javaconfig-jdbc/spring-session-sample-javaconfig-jdbc.gradle

@@ -17,3 +17,7 @@ dependencies {
 
 	integrationTestCompile seleniumDependencies
 }
+
+gretty {
+	logbackConfigFile = "src/main/resources/logback.xml"
+}

spring-session-samples/spring-session-sample-javaconfig-redis/spring-session-sample-javaconfig-redis.gradle

@@ -21,4 +21,5 @@ dependencies {
 
 gretty {
 	jvmArgs = ['-Dspring.profiles.active=embedded-redis']
+	logbackConfigFile = "src/main/resources/logback.xml"
 }

spring-session-samples/spring-session-sample-javaconfig-redis/src/main/java/sample/EmbeddedRedisConfig.java

@@ -28,7 +28,7 @@ import org.springframework.data.redis.connection.lettuce.LettuceConnectionFactor
 @Profile("embedded-redis")
 public class EmbeddedRedisConfig {
 
-	private static final String DOCKER_IMAGE = "redis:5.0.10";
+	private static final String DOCKER_IMAGE = "redis:5.0.14";
 
 	@Bean
 	public GenericContainer redisContainer() {

spring-session-samples/spring-session-sample-javaconfig-rest/spring-session-sample-javaconfig-rest.gradle

@@ -23,4 +23,5 @@ dependencies {
 gretty {
 	jvmArgs = ['-Dspring.profiles.active=embedded-redis']
 	servletContainer = 'tomcat9'
+	logbackConfigFile = "src/main/resources/logback.xml"
 }

spring-session-samples/spring-session-sample-javaconfig-rest/src/integration-test/java/rest/RestMockMvcTests.java

@@ -53,7 +53,7 @@ import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.
 @WebAppConfiguration
 class RestMockMvcTests {
 
-	private static final String DOCKER_IMAGE = "redis:5.0.10";
+	private static final String DOCKER_IMAGE = "redis:5.0.14";
 
 	@Autowired
 	private SessionRepositoryFilter<? extends Session> sessionRepositoryFilter;

spring-session-samples/spring-session-sample-javaconfig-rest/src/main/java/sample/EmbeddedRedisConfig.java

@@ -28,7 +28,7 @@ import org.springframework.data.redis.connection.lettuce.LettuceConnectionFactor
 @Profile("embedded-redis")
 public class EmbeddedRedisConfig {
 
-	private static final String DOCKER_IMAGE = "redis:5.0.10";
+	private static final String DOCKER_IMAGE = "redis:5.0.14";
 
 	@Bean
 	public GenericContainer redisContainer() {

spring-session-samples/spring-session-sample-javaconfig-security/spring-session-sample-javaconfig-security.gradle

@@ -25,4 +25,5 @@ dependencies {
 
 gretty {
 	jvmArgs = ['-Dspring.profiles.active=embedded-redis']
+	logbackConfigFile = "src/main/resources/logback.xml"
 }

spring-session-samples/spring-session-sample-javaconfig-security/src/main/java/sample/EmbeddedRedisConfig.java

@@ -28,7 +28,7 @@ import org.springframework.data.redis.connection.lettuce.LettuceConnectionFactor
 @Profile("embedded-redis")
 public class EmbeddedRedisConfig {
 
-	private static final String DOCKER_IMAGE = "redis:5.0.10";
+	private static final String DOCKER_IMAGE = "redis:5.0.14";
 
 	@Bean
 	public GenericContainer redisContainer() {

spring-session-samples/spring-session-sample-misc-hazelcast/spring-session-sample-misc-hazelcast.gradle

@@ -16,3 +16,7 @@ dependencies {
 
 	integrationTestCompile seleniumDependencies
 }
+
+gretty {
+	logbackConfigFile = "src/main/resources/logback.xml"
+}

spring-session-samples/spring-session-sample-xml-jdbc/spring-session-sample-xml-jdbc.gradle

@@ -17,3 +17,7 @@ dependencies {
 
 	integrationTestCompile seleniumDependencies
 }
+
+gretty {
+	logbackConfigFile = "src/main/resources/logback.xml"
+}

spring-session-samples/spring-session-sample-xml-redis/spring-session-sample-xml-redis.gradle

@@ -21,4 +21,5 @@ dependencies {
 
 gretty {
 	jvmArgs = ['-Dspring.profiles.active=embedded-redis']
+	logbackConfigFile = "src/main/resources/logback.xml"
 }

spring-session-samples/spring-session-sample-xml-redis/src/main/java/sample/EmbeddedRedisConfig.java

@@ -28,7 +28,7 @@ import org.springframework.data.redis.connection.lettuce.LettuceConnectionFactor
 @Profile("embedded-redis")
 public class EmbeddedRedisConfig {
 
-	private static final String DOCKER_IMAGE = "redis:5.0.10";
+	private static final String DOCKER_IMAGE = "redis:5.0.14";
 
 	@Bean
 	public GenericContainer redisContainer() {