Skip to content

Improve serialVersionUID check in tests#18474

Closed
johnycho wants to merge 3 commits intospring-projects:mainfrom
johnycho:fix-17729
Closed

Improve serialVersionUID check in tests#18474
johnycho wants to merge 3 commits intospring-projects:mainfrom
johnycho:fix-17729

Conversation

@johnycho
Copy link
Copy Markdown
Contributor

@johnycho johnycho commented Jan 10, 2026

Fixes gh-17729

Description

The allSerializableClassesShouldHaveSerialVersionOrSuppressWarnings test logic had two issues that caused it to pass incorrectly (false positives):

1. Logic Error

It permitted classes to pass if the annotation was null (suppressWarnings == null).
Since @SuppressWarnings has RetentionPolicy.SOURCE, it is not visible at runtime via reflection, causing getAnnotation to always return null. Consequently, the test was skipping validation for all classes.

2. Typo

It checked for "Serial" (case-sensitive) instead of "serial".

Fix

This PR updates the validation logic to:

  • Correct the value to "serial".
  • Enforce a strict check by ensuring the class is ignored only if the annotation is explicitly present (non-null) and contains the correct value.

Verification

To demonstrate the fix, I temporarily removed serialVersionUID from a class (e.g., SimpleGrantedAuthority) and ran the test.

State Screenshot Result
Before Fix Before fix screenshot PASSED (False Positive) ❌
The test incorrectly passed even though serialVersionUID was missing, because the verification logic was broken.
After Fix After fix screenshot FAILED (Correct Behavior) ✅
The test now correctly detects the missing serialVersionUID and fails, enforcing the strict check as intended.

Note

This change fixes the test logic to be correct. However, due to the RetentionPolicy.SOURCE limitation of @SuppressWarnings, this strict check might cause the test to fail for classes that rely on @SuppressWarnings("serial") without a serialVersionUID. This reveals that the previous test was not actually verifying those classes.

@spring-projects-issues spring-projects-issues added the status: waiting-for-triage An issue we've not yet triaged label Jan 10, 2026
@jzheaux jzheaux self-assigned this Mar 30, 2026
@jzheaux jzheaux added in: core An issue in spring-security-core type: bug A general bug and removed status: waiting-for-triage An issue we've not yet triaged labels Mar 30, 2026
@jzheaux jzheaux changed the base branch from main to 6.5.x March 30, 2026 20:26
@jzheaux jzheaux added this to the 6.5.10 milestone Mar 30, 2026
johnycho and others added 3 commits March 30, 2026 17:29
Signed-off-by: johnycho <shunnn215@gmail.com>
Signed-off-by: Josh Cummings <3627351+jzheaux@users.noreply.github.com>
Signed-off-by: Josh Cummings <3627351+jzheaux@users.noreply.github.com>
@jzheaux jzheaux changed the base branch from 6.5.x to main March 30, 2026 23:30
@jzheaux
Copy link
Copy Markdown
Contributor

jzheaux commented Mar 31, 2026

@johnycho, good catch! This has been merged into 6.5.x in 1a130fc, I also added a polish to look for @SuppressWarnings on the source files in acabacb.

Together, these found a number of classes that needed updating. These were added in 08fca57 for 6.5.x, d4678c8 for 7.0.x, and 5b8d818 for main.

@jzheaux jzheaux closed this Mar 31, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

in: core An issue in spring-security-core type: bug A general bug

Projects

None yet

Development

Successfully merging this pull request may close these issues.

allSerializableClassesShouldHaveSerialVersionOrSuppressWarnings should correctly check for SuppressWarnings

3 participants