bugfix(tests): using JUnit's ResourceLock annotation for tests that touch…

.github/workflows/codeql.yml

@@ -60,7 +60,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@a5ac7e51b41094c92402da3b24376905380afc29 # v4.1.6
+        uses: actions/checkout@44c2b7a8a4ea60a981eaca3cf939b5f4305c123b # v4.1.5
 
       - name: Cache local Maven repository
         uses: actions/cache@0c45773b623bea8c8e75f6c82b208c3cf94ea4f9 #v4.0.2
@@ -71,7 +71,7 @@ jobs:
 
       # Initializes the CodeQL tools for scanning.
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@9fdb3e49720b44c48891d036bb502feb25684276 # v3.25.6
+        uses: github/codeql-action/init@cdcdbb579706841c47f7063dda365e292e5cad7a # v2.13.4
         with:
           languages: ${{ matrix.language }}
           # If you wish to specify custom queries, you can do so here or in a config file.
@@ -85,7 +85,7 @@ jobs:
       # Autobuild attempts to build any compiled languages  (C/C++, C#, Go, or Java).
       # If this step fails, then you should remove it and run the build manually (see below)
       - name: Autobuild
-        uses: github/codeql-action/autobuild@9fdb3e49720b44c48891d036bb502feb25684276 # v3.25.6
+        uses: github/codeql-action/autobuild@cdcdbb579706841c47f7063dda365e292e5cad7a # v2.13.4
 
       # ℹ️ Command-line programs to run using the OS shell.
       # 📚 See https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idstepsrun
@@ -98,6 +98,6 @@ jobs:
       #     ./location_of_script_within_repo/buildscript.sh
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@9fdb3e49720b44c48891d036bb502feb25684276 # v3.25.6
+        uses: github/codeql-action/analyze@cdcdbb579706841c47f7063dda365e292e5cad7a # v2.13.4
         with:
           category: "/language:${{matrix.language}}"

.github/workflows/maven.yml

@@ -33,7 +33,7 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@a5ac7e51b41094c92402da3b24376905380afc29 # v4.1.6
+        uses: actions/checkout@44c2b7a8a4ea60a981eaca3cf939b5f4305c123b # v4.1.5
 
       - name: Set up JDK
         uses: actions/setup-java@99b8673ff64fbf99d8d325f52d9a5bdedb8483e9 # v4.2.1
@@ -77,7 +77,7 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@a5ac7e51b41094c92402da3b24376905380afc29 # v4.1.6
+        uses: actions/checkout@44c2b7a8a4ea60a981eaca3cf939b5f4305c123b # v4.1.5
 
       - name: Set up JDK
         uses: actions/setup-java@99b8673ff64fbf99d8d325f52d9a5bdedb8483e9 # v4.2.1

.github/workflows/scorecards.yml

@@ -42,7 +42,7 @@ jobs:
 
     steps:
       - name: "Checkout code"
-        uses: actions/checkout@a5ac7e51b41094c92402da3b24376905380afc29 # tag=v3.0.0
+        uses: actions/checkout@44c2b7a8a4ea60a981eaca3cf939b5f4305c123b # tag=v3.0.0
         with:
           persist-credentials: false
 
@@ -74,6 +74,6 @@ jobs:
 
       # Upload the results to GitHub's code scanning dashboard.
       - name: "Upload to code-scanning"
-        uses: github/codeql-action/upload-sarif@9fdb3e49720b44c48891d036bb502feb25684276 #tag=v2
+        uses: github/codeql-action/upload-sarif@cdcdbb579706841c47f7063dda365e292e5cad7a #tag=v2
         with:
           sarif_file: results.sarif

config/ogdl/src/test/groovy/org/apache/shiro/config/ogdl/CommonsInterpolatorTest.groovy

@@ -20,6 +20,7 @@ package org.apache.shiro.config.ogdl
 
 import org.apache.shiro.config.ogdl.CommonsInterpolator
 import org.junit.jupiter.api.Test
+import org.junit.jupiter.api.parallel.Isolated
 
 import static org.junit.jupiter.api.Assertions.assertEquals
 import static org.junit.jupiter.api.Assertions.assertNull
@@ -28,6 +29,7 @@ import static org.junit.jupiter.api.Assertions.assertNull
  * Tests for {@link org.apache.shiro.config.ogdl.CommonsInterpolator}.
  * @since 1.4
  */
+@Isolated("System property usage")
 class CommonsInterpolatorTest {
 
     @SuppressWarnings("unused")

config/ogdl/src/test/groovy/org/apache/shiro/config/ogdl/ReflectionBuilderTest.groovy

@@ -26,6 +26,7 @@ import org.apache.shiro.config.ConfigurationException
 import org.apache.shiro.config.Ini
 import org.apache.shiro.config.ogdl.event.BeanEvent
 import org.junit.jupiter.api.Test
+import org.junit.jupiter.api.parallel.Isolated
 
 import java.util.concurrent.ConcurrentHashMap
 
@@ -36,6 +37,7 @@ import static org.hamcrest.Matchers.*
 /**
  * Unit tests for the {@link org.apache.shiro.config.ogdl.ReflectionBuilder} implementation.
  */
+@Isolated
 @SuppressWarnings("GrMethodMayBeStatic")
 class ReflectionBuilderTest {
 

core/src/test/groovy/org/apache/shiro/authc/credential/DefaultPasswordServiceTest.groovy

@@ -29,6 +29,7 @@ import org.apache.shiro.crypto.hash.format.Shiro1CryptFormat
 import org.junit.jupiter.api.DisplayName
 import org.junit.jupiter.api.Test
 import org.junit.jupiter.api.function.Executable
+import org.junit.jupiter.api.parallel.Isolated
 
 import static org.easymock.EasyMock.*
 import static org.junit.jupiter.api.Assertions.*
@@ -38,6 +39,7 @@ import static org.junit.jupiter.api.Assertions.*
  *
  * @since 1.2
  */
+@Isolated
 class DefaultPasswordServiceTest {
 
     @Test

core/src/test/java/org/apache/shiro/authc/AbstractAuthenticatorTest.java

@@ -25,6 +25,7 @@
 import org.junit.jupiter.api.BeforeAll;
 import org.junit.jupiter.api.BeforeEach;
 import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.parallel.Isolated;
 
 import java.net.URI;
 
@@ -40,6 +41,7 @@
 /**
  * @since 0.1
  */
+@Isolated
 public class AbstractAuthenticatorTest {
 
     static ListAppender listAppender;

core/src/test/java/org/apache/shiro/mgt/DefaultSecurityManagerTest.java

@@ -34,9 +34,11 @@
 import org.junit.jupiter.api.AfterEach;
 import org.junit.jupiter.api.BeforeEach;
 import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.parallel.ResourceLock;
 
 import java.io.Serializable;
 
+import static org.apache.shiro.test.AbstractShiroTest.GLOBAL_SECURITY_MANAGER_RESOURCE;
 import static org.junit.jupiter.api.Assertions.assertNotEquals;
 import static org.junit.jupiter.api.Assertions.assertTrue;
 import static org.junit.jupiter.api.Assertions.assertEquals;
@@ -47,6 +49,7 @@
 /**
  * @since 0.2
  */
+@ResourceLock(GLOBAL_SECURITY_MANAGER_RESOURCE)
 public class DefaultSecurityManagerTest extends AbstractSecurityManagerTest {
 
     DefaultSecurityManager sm;

core/src/test/java/org/apache/shiro/mgt/VMSingletonDefaultSecurityManagerTest.java

@@ -28,14 +28,17 @@
 import org.junit.jupiter.api.AfterEach;
 import org.junit.jupiter.api.BeforeEach;
 import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.parallel.ResourceLock;
 
+import static org.apache.shiro.test.AbstractShiroTest.GLOBAL_SECURITY_MANAGER_RESOURCE;
 import static org.junit.jupiter.api.Assertions.assertEquals;
 import static org.junit.jupiter.api.Assertions.assertTrue;
 
 
 /**
  * @since May 8, 2008 12:26:23 AM
  */
+@ResourceLock(GLOBAL_SECURITY_MANAGER_RESOURCE)
 public class VMSingletonDefaultSecurityManagerTest {
 
     @BeforeEach

core/src/test/java/org/apache/shiro/realm/activedirectory/ActiveDirectoryRealmTest.java

@@ -43,6 +43,7 @@
 import org.junit.jupiter.api.AfterEach;
 import org.junit.jupiter.api.BeforeEach;
 import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.parallel.ResourceLock;
 
 import javax.naming.NamingEnumeration;
 import javax.naming.NamingException;
@@ -52,6 +53,7 @@
 import java.util.HashSet;
 import java.util.Set;
 
+import static org.apache.shiro.test.AbstractShiroTest.GLOBAL_SECURITY_MANAGER_RESOURCE;
 import static org.easymock.EasyMock.anyObject;
 import static org.easymock.EasyMock.anyString;
 import static org.easymock.EasyMock.capture;
@@ -75,6 +77,7 @@
  * This version was intended to mimic my current usage scenario in an effort to debug upgrade issues which were not related
  * to LDAP connectivity.
  */
+@ResourceLock(GLOBAL_SECURITY_MANAGER_RESOURCE)
 public class ActiveDirectoryRealmTest {
 
     private static final String USERNAME = "testuser";

core/src/test/java/org/apache/shiro/realm/jdbc/JDBCRealmTest.java

@@ -37,6 +37,7 @@
 import org.junit.jupiter.api.BeforeEach;
 import org.junit.jupiter.api.Test;
 import org.junit.jupiter.api.TestInfo;
+import org.junit.jupiter.api.parallel.ResourceLock;
 
 import javax.sql.DataSource;
 
@@ -47,6 +48,7 @@
 import java.util.HashMap;
 import java.util.Optional;
 
+import static org.apache.shiro.test.AbstractShiroTest.GLOBAL_SECURITY_MANAGER_RESOURCE;
 import static org.junit.jupiter.api.Assertions.assertFalse;
 import static org.junit.jupiter.api.Assertions.assertTrue;
 import static org.junit.jupiter.api.Assertions.fail;
@@ -55,6 +57,7 @@
 /**
  * Test case for JDBCRealm.
  */
+@ResourceLock(GLOBAL_SECURITY_MANAGER_RESOURCE)
 public class JDBCRealmTest {
 
     protected DefaultSecurityManager securityManager;

core/src/test/java/org/apache/shiro/session/mgt/DefaultSessionManagerTest.java

@@ -30,9 +30,11 @@
 import org.junit.jupiter.api.AfterEach;
 import org.junit.jupiter.api.BeforeEach;
 import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.parallel.ResourceLock;
 
 import java.util.UUID;
 
+import static org.apache.shiro.test.AbstractShiroTest.GLOBAL_SECURITY_MANAGER_RESOURCE;
 import static org.easymock.EasyMock.createMock;
 import static org.easymock.EasyMock.eq;
 import static org.easymock.EasyMock.expect;
@@ -48,6 +50,7 @@
 /**
  * Unit test for the {@link DefaultSessionManager DefaultSessionManager} implementation.
  */
+@ResourceLock(GLOBAL_SECURITY_MANAGER_RESOURCE)
 public class DefaultSessionManagerTest {
 
     DefaultSessionManager sm;

core/src/test/java/org/apache/shiro/test/AbstractShiroTest.java

@@ -33,6 +33,10 @@
  * @since 1.2
  */
 public abstract class AbstractShiroTest {
+    /**
+     * The resource name of the global SecurityManager instance used in the test environment
+     */
+    public static final String GLOBAL_SECURITY_MANAGER_RESOURCE = "globalSecurityManager";
 
     private static ThreadState subjectThreadState;
 

core/src/test/java/org/apache/shiro/test/ExampleShiroIntegrationTest.java

@@ -23,12 +23,15 @@
 import org.junit.jupiter.api.AfterEach;
 import org.junit.jupiter.api.BeforeAll;
 import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.parallel.ResourceLock;
+import static org.apache.shiro.test.AbstractShiroTest.GLOBAL_SECURITY_MANAGER_RESOURCE;
 
 /**
  * Simple example test class to be used to show how one might write Shiro-compatible unit tests.
  *
  * @since 1.2
  */
+@ResourceLock(GLOBAL_SECURITY_MANAGER_RESOURCE)
 public class ExampleShiroIntegrationTest extends AbstractShiroTest {
 
     @BeforeAll

core/src/test/java/org/apache/shiro/test/ExampleShiroUnitTest.java

@@ -21,7 +21,9 @@
 import org.apache.shiro.subject.Subject;
 import org.junit.jupiter.api.AfterEach;
 import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.parallel.ResourceLock;
 
+import static org.apache.shiro.test.AbstractShiroTest.GLOBAL_SECURITY_MANAGER_RESOURCE;
 import static org.easymock.EasyMock.createNiceMock;
 import static org.easymock.EasyMock.expect;
 
@@ -30,6 +32,7 @@
  *
  * @since 1.2
  */
+@ResourceLock(GLOBAL_SECURITY_MANAGER_RESOURCE)
 public class ExampleShiroUnitTest extends AbstractShiroTest {
 
     @Test

integration-tests/jakarta-ee/pom.xml

@@ -349,7 +349,7 @@
             <plugin>
                 <groupId>org.codehaus.mojo</groupId>
                 <artifactId>exec-maven-plugin</artifactId>
-                <version>3.3.0</version>
+                <version>3.2.0</version>
                 <configuration>
                     <executable>${project.build.directory}/dependency/payara5/bin/${asadmin.cmd}</executable>
                     <skip>${payara.start.skip}</skip>

integration-tests/jaxrs/tests/src/main/java/org/apache/shiro/testing/jaxrs/tests/AbstractShiroJaxRsIT.java

@@ -58,7 +58,7 @@ public void testGetUsersUnauthenticated() {
         final Response usersResponse = usersTarget.request(MediaType.APPLICATION_JSON_TYPE)
                 .buildGet()
                 .invoke();
-        assertEquals(Status.UNAUTHORIZED.getStatusCode(), usersResponse.getStatus());
+        assertEquals(Status.FORBIDDEN.getStatusCode(), usersResponse.getStatus());
     }
 
     @SuppressWarnings({"checkstyle:MagicNumber"})

pom.xml

@@ -91,7 +91,7 @@
         <commons.collection.version>3.2.2</commons.collection.version>
         <commons.configuration2.version>2.10.1</commons.configuration2.version>
         <commons.lang3.version>3.14.0</commons.lang3.version>
-        <commons.logging.version>1.3.2</commons.logging.version>
+        <commons.logging.version>1.3.1</commons.logging.version>
         <commons.text.version>1.8</commons.text.version>
         <!-- Don't change this version without also changing the shiro-ehcache and shiro-features
              modules' OSGi metadata: -->
@@ -110,7 +110,7 @@
         <quartz.docs.version>2.3.0</quartz.docs.version>
         <slf4j.version>2.0.13</slf4j.version>
         <log4j.version>2.23.1</log4j.version>
-        <spring.version>5.3.36</spring.version>
+        <spring.version>5.3.34</spring.version>
         <spring-boot.version>2.7.18</spring-boot.version>
         <guice.version>4.2.3</guice.version>
         <jaxrs.api.version>2.1.6</jaxrs.api.version>
@@ -119,8 +119,8 @@
 
         <!-- Test 3rd-party dependencies: -->
         <easymock.version>5.2.0</easymock.version>
-        <mockito.version>5.12.0</mockito.version>
-        <bytebuddy.version>1.14.16</bytebuddy.version>
+        <mockito.version>5.11.0</mockito.version>
+        <bytebuddy.version>1.14.15</bytebuddy.version>
         <gmaven.version>3.0.2</gmaven.version>
         <groovy.version>4.0.21</groovy.version>
         <junit.version>5.10.2</junit.version>
@@ -278,6 +278,12 @@
                         <enableProcessChecker>native</enableProcessChecker>
                         <trimStackTrace>false</trimStackTrace>
                         <redirectTestOutputToFile>true</redirectTestOutputToFile>
+                        <properties>
+                            <configurationParameters>
+                                junit.jupiter.execution.parallel.enabled = true
+                                junit.jupiter.execution.parallel.mode.default = concurrent
+                            </configurationParameters>
+                        </properties>
                     </configuration>
                 </plugin>
                 <plugin>
@@ -305,6 +311,8 @@
                             <link>https://docs.spring.io/spring/docs/${spring.version}/javadoc-api/</link>
                             <link>https://docs.spring.io/spring-boot/docs/${spring-boot.version}/api/</link>
                             <link>https://junit.org/junit5/docs/${junit.version}/api/</link>
+                            <link>https://easymock.org/api/</link>
+                            <link>https://javadoc.io/doc/org.mockito/mockito-core/${mockito.version}/org/mockito/Mockito.html</link>
                             <link>https://www.quartz-scheduler.org/api/${quartz.docs.version}/</link>
                         </links>
                     </configuration>
@@ -381,7 +389,7 @@
                 <plugin>
                     <groupId>org.codehaus.mojo</groupId>
                     <artifactId>build-helper-maven-plugin</artifactId>
-                    <version>3.6.0</version>
+                    <version>3.5.0</version>
                 </plugin>
                 <plugin>
                     <groupId>org.jacoco</groupId>
@@ -391,7 +399,7 @@
                 <plugin>
                     <groupId>com.mycila</groupId>
                     <artifactId>license-maven-plugin</artifactId>
-                    <version>4.5</version>
+                    <version>4.4</version>
                     <configuration>
                         <aggregate>true</aggregate>
                         <header>${root.dir}/src/license/header.txt</header>
@@ -425,7 +433,7 @@
                 <plugin>
                     <groupId>org.owasp</groupId>
                     <artifactId>dependency-check-maven</artifactId>
-                    <version>9.2.0</version>
+                    <version>9.1.0</version>
                 </plugin>
                 <plugin>
                     <groupId>com.github.siom79.japicmp</groupId>

samples/quickstart-guice/pom.xml

@@ -38,7 +38,7 @@
             <plugin>
                 <groupId>org.codehaus.mojo</groupId>
                 <artifactId>exec-maven-plugin</artifactId>
-                <version>3.3.0</version>
+                <version>3.2.0</version>
                 <executions>
                     <execution>
                         <goals>

samples/quickstart/pom.xml

@@ -40,7 +40,7 @@
             <plugin>
                 <groupId>org.codehaus.mojo</groupId>
                 <artifactId>exec-maven-plugin</artifactId>
-                <version>3.3.0</version>
+                <version>3.2.0</version>
                 <executions>
                     <execution>
                         <goals>