[java-shib-shared] branch main updated: IDP-2083 - Treat NonnullElements as the default for collections

Scott Cantor cantor.2 at osu.edu
Tue Apr 25 14:04:34 UTC 2023


This is an automated email from the git hooks/post-receive script.

scantor pushed a commit to branch main
in repository java-shib-shared.

View the commit online:
http://git.shibboleth.net/view/?p=java-shib-shared.git;a=commit;h=ed8844171ce2198e97e4c063aa02deacc27f7845

The following commit(s) were added to refs/heads/main by this push:
     new ed884417 IDP-2083 - Treat NonnullElements as the default for collections
ed884417 is described below

commit ed8844171ce2198e97e4c063aa02deacc27f7845
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Tue Apr 25 10:04:32 2023 -0400

    IDP-2083 - Treat NonnullElements as the default for collections
    
    https://shibboleth.atlassian.net/browse/IDP-2083
    
    Clean up rest of java-shib-shared.
---
 .../shibboleth/shared/cli/AbstractCommandLine.java |  10 +-
 .../shared/cli/AbstractCommandLineArguments.java   |   4 +-
 .../net/shibboleth/shared/cli/package-info.java    |   4 +-
 .../factory/FileCachingHttpClientFactoryBean.java  |  14 +-
 .../InMemoryCachingHttpClientFactoryBean.java      |   5 +-
 .../spring/httpclient/factory/package-info.java    |   3 +
 .../resource/FileBackedHTTPResource.java           |   5 +-
 .../spring/httpclient/resource/HTTPResource.java   |   9 +-
 .../spring/httpclient/resource/package-info.java   |   5 +-
 .../shared/spring/servlet/ChainableFilter.java     |   2 +-
 .../spring/servlet/RequestURLPrefixPredicate.java  |   4 +-
 .../shared/spring/servlet/impl/ChainingFilter.java |   7 +-
 .../spring/servlet/impl/CookieBufferingFilter.java |  10 +-
 .../servlet/impl/DelegatingServletProxy.java       | 567 +++++++++++----------
 .../servlet/impl/DynamicResponseHeaderFilter.java  |  15 +-
 .../servlet/impl/RequestResponseContextFilter.java |   5 +-
 .../servlet/impl/SameSiteCookieHeaderFilter.java   |  12 +-
 .../shared/spring/servlet/impl/package-info.java   |   5 +-
 .../shared/spring/servlet/package-info.java        |   5 +-
 .../httpclient/ContextHandlingHttpClient.java      |  46 +-
 .../httpclient/FileCachingHttpClientBuilder.java   |  23 +-
 .../shared/httpclient/HttpClientBuilder.java       |  61 +--
 .../shared/httpclient/HttpClientSupport.java       |   3 +-
 .../httpclient/LocalAddressProxyRoutePlanner.java  |   7 +-
 .../httpclient/LocalAddressRoutePlanner.java       |   7 +-
 .../httpclient/LocalAddressSystemRoutePlanner.java |   7 +-
 .../shared/httpclient/RequestConnectionClose.java  |  11 +-
 .../shared/httpclient/TLSSocketFactory.java        |  10 +-
 .../shared/httpclient/TLSSocketFactoryBuilder.java |  41 +-
 .../shibboleth/shared/httpclient/package-info.java |   4 +-
 .../shibboleth/shared/net/MediaTypeSupport.java    |  12 +-
 .../net/shibboleth/shared/net/URIComparator.java   |   4 +-
 .../java/net/shibboleth/shared/net/URISupport.java |  50 +-
 .../shibboleth/shared/net/impl/package-info.java   |   4 +-
 .../net/shibboleth/shared/net/package-info.java    |   5 +-
 .../shared/servlet/AbstractConditionalFilter.java  |   4 +
 .../shared/servlet/HttpServletSupport.java         |  20 +-
 .../impl/HttpServletRequestResponseContext.java    |   4 +-
 .../ThreadLocalHttpServletRequestSupplier.java     |  16 +-
 .../ThreadLocalHttpServletResponseSupplier.java    |  16 +-
 .../shared/servlet/impl/package-info.java          |   5 +-
 .../shibboleth/shared/servlet/package-info.java    |   5 +-
 .../factory/PKCS11PrivateKeyFactoryBean.java       |  40 +-
 .../security/factory/PrivateKeyFactoryBean.java    |  11 +-
 .../security/factory/PublicKeyFactoryBean.java     |  14 +-
 .../factory/X509CertificateChainFactoryBean.java   |  15 +-
 .../factory/X509CertificateFactoryBean.java        |  15 +-
 .../spring/security/factory/package-info.java      |   5 +-
 .../security/impl/BasicAccessControlService.java   |   7 +-
 .../impl/BasicKeystoreKeyStrategyTool.java         |   2 +
 .../shared/security/impl/IPRangeAccessControl.java |   5 +-
 .../impl/RandomIdentifierGenerationStrategy.java   |   1 +
 .../shared/security/impl/ScriptedKeyStrategy.java  |   5 +-
 .../impl/SelfSignedCertificateGenerator.java       |   9 +-
 .../Type4UUIDIdentifierGenerationStrategy.java     |   3 +-
 .../shared/security/impl/package-info.java         |   4 +-
 .../shibboleth/shared/security/package-info.java   |   4 +-
 .../shared/service/ReloadableServiceGaugeSet.java  |   5 +-
 .../shared/service/impl/LogbackLoggingService.java |   2 +-
 .../shared/service/impl/package-info.java          |   5 +-
 .../shibboleth/shared/service/package-info.java    |   5 +-
 .../service/reloadable/ProxiedFactoryBean.java     |   2 +-
 .../shared/service/reloadable/package-info.java    |   5 +-
 .../impl/DelegatingAccessControlService.java       |   2 +-
 .../impl/ReloadingAccessControlService.java        |   2 +-
 .../impl/ServiceableAccessControlService.java      |   2 +-
 .../shared/service/security/impl/package-info.java |   5 +-
 .../ApplicationContextServiceableComponent.java    |   7 +-
 .../spring/service/ClassBasedServiceStrategy.java  |   2 +-
 .../spring/service/ReloadableSpringService.java    |  18 +-
 .../service/impl/SpringServiceableComponent.java   |   2 +-
 .../shared/spring/service/impl/package-info.java   |   4 +-
 .../shared/spring/service/package-info.java        |   4 +-
 .../context/DelimiterAwareApplicationContext.java  |   1 +
 .../spring/config/DeprecatedBeanDetector.java      |   3 +-
 .../config/IdentifiableBeanPostProcessor.java      |   4 +-
 .../spring/config/IdentifiedComponentManager.java  |  11 +-
 .../config/RelocatedBeanFactoryPostProcessor.java  |   5 +-
 .../spring/config/StringToDurationConverter.java   |   4 +-
 .../spring/config/StringToPeriodConverter.java     |   6 +-
 .../spring/config/StringToResourceConverter.java   |   2 +-
 .../shared/spring/config/package-info.java         |   5 +-
 ...actPropertiesApplicationContextInitializer.java |   3 +-
 ...ceholderFileSystemXmlWebApplicationContext.java |   4 -
 .../context/DelimiterAwareApplicationContext.java  |   3 +-
 .../FileSystemXmlWebApplicationContext.java        |   1 +
 .../shared/spring/context/package-info.java        |   5 +-
 .../spring/custom/BaseSpringNamespaceHandler.java  |   5 +-
 .../custom/EmbeddedAndSchemaAwareReader.java       |   2 +-
 .../spring/custom/SecondaryNamespaceHandler.java   |   5 +-
 .../shared/spring/custom/package-info.java         |   5 +-
 .../shared/spring/error/package-info.java          |   4 +-
 .../shared/spring/expression/package-info.java     |   5 +-
 .../spring/factory/CombiningListFactoryBean.java   |  14 +-
 .../shared/spring/factory/package-info.java        |   5 +-
 .../spring/resource/ConditionalResource.java       |   1 -
 .../shared/spring/resource/ResourceHelper.java     |   2 +-
 .../shared/spring/resource/package-info.java       |   4 +-
 .../util/AnnotationParameterNameDiscoverer.java    |   6 +-
 .../spring/util/ApplicationContextBuilder.java     |  30 +-
 .../shared/spring/util/SpringSupport.java          |  47 +-
 .../shared/spring/util/package-info.java           |   4 +-
 .../shared/spring/config/StringToResourceTest.java |  13 +-
 .../net/shibboleth/shared/xml/ElementSupport.java  |  19 +
 .../shared/testing/ConstantSupplier.java           |   2 +-
 .../shared/testing/DatabaseTestingSupport.java     |  46 +-
 .../shared/testing/InMemoryDirectory.java          |  37 +-
 .../shared/testing/MockApplicationContext.java     | 107 ++--
 .../shared/testing/MockReloadableService.java      |   2 +-
 .../shared/testing/RepositorySupport.java          |  14 +-
 .../shared/testing/ResourceTestHelper.java         |  20 +-
 .../shared/testing/ShowAutomaticModuleNames.java   |  22 +-
 .../net/shibboleth/shared/testing/TestSupport.java |   4 +-
 .../shibboleth/shared/testing/VelocityEngine.java  |   6 +-
 .../shibboleth/shared/testing/package-info.java    |   3 +
 .../shared/spring/velocity/VelocityConfig.java     |   5 +-
 .../shared/spring/velocity/VelocityConfigurer.java |  17 +-
 .../spring/velocity/VelocityEngineFactory.java     |   5 +-
 .../shared/spring/velocity/VelocityView.java       |  16 +-
 .../shared/spring/velocity/package-info.java       |   4 +-
 .../shibboleth/shared/velocity/package-info.java   |   4 +-
 121 files changed, 988 insertions(+), 822 deletions(-)

diff --git a/shib-cli/src/main/java/net/shibboleth/shared/cli/AbstractCommandLine.java b/shib-cli/src/main/java/net/shibboleth/shared/cli/AbstractCommandLine.java
index b84e9664..61b772c5 100644
--- a/shib-cli/src/main/java/net/shibboleth/shared/cli/AbstractCommandLine.java
+++ b/shib-cli/src/main/java/net/shibboleth/shared/cli/AbstractCommandLine.java
@@ -36,7 +36,6 @@ import org.springframework.core.io.support.ResourcePropertySource;
 
 import com.beust.jcommander.JCommander;
 
-import net.shibboleth.shared.annotation.constraint.NonnullElements;
 import net.shibboleth.shared.annotation.constraint.NotEmpty;
 import net.shibboleth.shared.annotation.constraint.NotLive;
 import net.shibboleth.shared.annotation.constraint.Unmodifiable;
@@ -163,7 +162,7 @@ public abstract class AbstractCommandLine<T extends CommandLineArguments> {
      * 
      * @return the resources
      */
-    @Nonnull @NonnullElements @Unmodifiable @NotLive protected List<Resource> getAdditionalSpringResources() {
+    @Nonnull @Unmodifiable @NotLive protected List<Resource> getAdditionalSpringResources() {
         return CollectionSupport.emptyList();
     }
 
@@ -196,7 +195,12 @@ public abstract class AbstractCommandLine<T extends CommandLineArguments> {
             argObject.validate();
 
         } catch (final Exception e) {
-            error(e.getMessage());
+            final String msg = e.getLocalizedMessage();
+            if (msg != null) {
+                error(msg);
+            } else {
+                error("Exception with no message: " + e.getClass().getName());
+            }
             return RC_INIT;
         }
 
diff --git a/shib-cli/src/main/java/net/shibboleth/shared/cli/AbstractCommandLineArguments.java b/shib-cli/src/main/java/net/shibboleth/shared/cli/AbstractCommandLineArguments.java
index fff1a0e3..a3860999 100644
--- a/shib-cli/src/main/java/net/shibboleth/shared/cli/AbstractCommandLineArguments.java
+++ b/shib-cli/src/main/java/net/shibboleth/shared/cli/AbstractCommandLineArguments.java
@@ -125,7 +125,7 @@ public abstract class AbstractCommandLineArguments implements CommandLineArgumen
     }
     
     /** {@inheritDoc} */
-    @Nonnull @NonnullElements @Unmodifiable @NotLive public List<String> getPropertyFiles() {
+    @Nonnull @Unmodifiable @NotLive public List<String> getPropertyFiles() {
         return propertySources;
     }
     
@@ -134,7 +134,7 @@ public abstract class AbstractCommandLineArguments implements CommandLineArgumen
      * 
      * @return language ranges
      */
-    @Nonnull @NonnullElements @Unmodifiable @NotLive public List<LanguageRange> getLanguageRanges() {
+    @Nonnull @Unmodifiable @NotLive public List<LanguageRange> getLanguageRanges() {
         if (Strings.isNullOrEmpty(languageRanges)) {
             return CollectionSupport.emptyList();
         }
diff --git a/shib-cli/src/main/java/net/shibboleth/shared/cli/package-info.java b/shib-cli/src/main/java/net/shibboleth/shared/cli/package-info.java
index 8265746f..a0529283 100644
--- a/shib-cli/src/main/java/net/shibboleth/shared/cli/package-info.java
+++ b/shib-cli/src/main/java/net/shibboleth/shared/cli/package-info.java
@@ -18,5 +18,7 @@
 /**
  * Command line functionality.
  */
+ at NonnullElements
+package net.shibboleth.shared.cli;
 
-package net.shibboleth.shared.cli;
\ No newline at end of file
+import net.shibboleth.shared.annotation.constraint.NonnullElements;
diff --git a/shib-networking-spring/src/main/java/net/shibboleth/shared/spring/httpclient/factory/FileCachingHttpClientFactoryBean.java b/shib-networking-spring/src/main/java/net/shibboleth/shared/spring/httpclient/factory/FileCachingHttpClientFactoryBean.java
index 6dca47dd..4e10713e 100644
--- a/shib-networking-spring/src/main/java/net/shibboleth/shared/spring/httpclient/factory/FileCachingHttpClientFactoryBean.java
+++ b/shib-networking-spring/src/main/java/net/shibboleth/shared/spring/httpclient/factory/FileCachingHttpClientFactoryBean.java
@@ -17,6 +17,7 @@
 
 package net.shibboleth.shared.spring.httpclient.factory;
 
+import javax.annotation.Nonnull;
 import javax.annotation.Nullable;
 
 import org.apache.hc.client5.http.classic.HttpClient;
@@ -46,27 +47,28 @@ public class FileCachingHttpClientFactoryBean extends FileCachingHttpClientBuild
     }
     
     /** {@inheritDoc} */
-    public Class<HttpClient> getObjectType() {
+    @Nonnull public Class<HttpClient> getObjectType() {
         return HttpClient.class;
     }
     
     /** {@inheritDoc} */
     public void destroy() {
-        if (singletonInstance instanceof DestructableComponent) {
-            ((DestructableComponent) singletonInstance).destroy();
+        if (singletonInstance instanceof DestructableComponent c) {
+            c.destroy();
         }
     }
 
     /** {@inheritDoc} */
-    public HttpClient getObject() throws Exception {
+    @Nonnull public HttpClient getObject() throws Exception {
         if (singletonInstance == null) {
             final HttpClient theBean = buildClient();
-            if (theBean instanceof InitializableComponent) {
-                ((InitializableComponent) theBean).initialize();
+            if (theBean instanceof InitializableComponent c) {
+                c.initialize();
             }
             singletonInstance = theBean;
         }
         
+        assert singletonInstance != null;
         return singletonInstance;
     }
     
diff --git a/shib-networking-spring/src/main/java/net/shibboleth/shared/spring/httpclient/factory/InMemoryCachingHttpClientFactoryBean.java b/shib-networking-spring/src/main/java/net/shibboleth/shared/spring/httpclient/factory/InMemoryCachingHttpClientFactoryBean.java
index 1ff55f7e..2dda68c5 100644
--- a/shib-networking-spring/src/main/java/net/shibboleth/shared/spring/httpclient/factory/InMemoryCachingHttpClientFactoryBean.java
+++ b/shib-networking-spring/src/main/java/net/shibboleth/shared/spring/httpclient/factory/InMemoryCachingHttpClientFactoryBean.java
@@ -17,6 +17,7 @@
 
 package net.shibboleth.shared.spring.httpclient.factory;
 
+import javax.annotation.Nonnull;
 import javax.annotation.Nullable;
 
 import org.apache.hc.client5.http.classic.HttpClient;
@@ -57,12 +58,12 @@ public class InMemoryCachingHttpClientFactoryBean extends InMemoryCachingHttpCli
     }
 
     /** {@inheritDoc} */
-    public Class<HttpClient> getObjectType() {
+    @Nonnull public Class<HttpClient> getObjectType() {
         return HttpClient.class;
     }
     
     /** {@inheritDoc} */
-    public synchronized HttpClient getObject() throws Exception {
+    @Nonnull public synchronized HttpClient getObject() throws Exception {
         if (isSingleton()) {
             if (singletonInstance != null) {
                 return singletonInstance;
diff --git a/shib-networking-spring/src/main/java/net/shibboleth/shared/spring/httpclient/factory/package-info.java b/shib-networking-spring/src/main/java/net/shibboleth/shared/spring/httpclient/factory/package-info.java
index 5dd9d72b..7707178a 100644
--- a/shib-networking-spring/src/main/java/net/shibboleth/shared/spring/httpclient/factory/package-info.java
+++ b/shib-networking-spring/src/main/java/net/shibboleth/shared/spring/httpclient/factory/package-info.java
@@ -18,4 +18,7 @@
 /**
  * Factory beans for HttpClient objects.
  */
+ at NonnullElements
 package net.shibboleth.shared.spring.httpclient.factory;
+
+import net.shibboleth.shared.annotation.constraint.NonnullElements;
diff --git a/shib-networking-spring/src/main/java/net/shibboleth/shared/spring/httpclient/resource/FileBackedHTTPResource.java b/shib-networking-spring/src/main/java/net/shibboleth/shared/spring/httpclient/resource/FileBackedHTTPResource.java
index bbb605e8..91089188 100644
--- a/shib-networking-spring/src/main/java/net/shibboleth/shared/spring/httpclient/resource/FileBackedHTTPResource.java
+++ b/shib-networking-spring/src/main/java/net/shibboleth/shared/spring/httpclient/resource/FileBackedHTTPResource.java
@@ -80,7 +80,7 @@ public class FileBackedHTTPResource extends HTTPResource {
      * @param url URL to the remote data
      * @throws IOException if the URL was badly formed
      */
-    public FileBackedHTTPResource(@Nonnull  @ParameterName(name="backingFile") final String backingFile, 
+    public FileBackedHTTPResource(@Nonnull @ParameterName(name="backingFile") final String backingFile, 
             @Nonnull @ParameterName(name="client") final HttpClient client,
             @Nonnull  @ParameterName(name="url") final URL url)
             throws IOException {
@@ -98,7 +98,7 @@ public class FileBackedHTTPResource extends HTTPResource {
      * @throws IOException if an error happens. If the backing file might have been corrupted we delete it.
      */
 
-    @Nonnull protected InputStream saveAndClone(final InputStream input) throws IOException {
+    @Nonnull protected InputStream saveAndClone(@Nonnull final InputStream input) throws IOException {
         try (final FileOutputStream out = new FileOutputStream(backingResource.getFile())) {
             log.debug("{}: Copying file.", getDescription());
             ByteStreams.copy(input, out);
@@ -193,5 +193,4 @@ public class FileBackedHTTPResource extends HTTPResource {
         return result;
     }
     
-    
 }
\ No newline at end of file
diff --git a/shib-networking-spring/src/main/java/net/shibboleth/shared/spring/httpclient/resource/HTTPResource.java b/shib-networking-spring/src/main/java/net/shibboleth/shared/spring/httpclient/resource/HTTPResource.java
index 5726a7d6..1a256727 100644
--- a/shib-networking-spring/src/main/java/net/shibboleth/shared/spring/httpclient/resource/HTTPResource.java
+++ b/shib-networking-spring/src/main/java/net/shibboleth/shared/spring/httpclient/resource/HTTPResource.java
@@ -133,7 +133,7 @@ public class HTTPResource extends AbstractIdentifiedInitializableComponent imple
      * http://hc.apache.org/httpcomponents-client-ga/tutorial/html/caching.html
      * @param context the context of the request
      */
-    protected void reportCachingStatus(final HttpCacheContext context) {
+    protected void reportCachingStatus(@Nonnull final HttpCacheContext context) {
         final CacheResponseStatus responseStatus = context.getCacheResponseStatus();
         if (null == responseStatus) {
             log.debug("Non caching client provided");
@@ -262,7 +262,7 @@ public class HTTPResource extends AbstractIdentifiedInitializableComponent imple
      * 
      * @throws IOException thrown if there is a problem contacting the resource
      */
-    protected HttpResponse getResourceHeaders() throws IOException {
+    @Nonnull protected HttpResponse getResourceHeaders() throws IOException {
         final HttpUriRequest httpRequest = new HttpGet(resourceURL.toExternalForm());
 
         ClassicHttpResponse httpResponse = null;
@@ -300,10 +300,9 @@ public class HTTPResource extends AbstractIdentifiedInitializableComponent imple
      * @throws IOException from lower levels.
      */
     @Nullable protected String getResponseHeader(final String what) throws IOException {
-        final HttpResponse response;
 
         log.debug("Attempting to fetch remote resource as '{}'", resourceURL);
-        response = getResourceHeaders();
+        final HttpResponse response = getResourceHeaders();
         final int httpStatusCode = response.getCode();
 
         if (httpStatusCode != HttpStatus.SC_OK) {
@@ -404,4 +403,4 @@ public class HTTPResource extends AbstractIdentifiedInitializableComponent imple
         }
     }
 
-}
+}
\ No newline at end of file
diff --git a/shib-networking-spring/src/main/java/net/shibboleth/shared/spring/httpclient/resource/package-info.java b/shib-networking-spring/src/main/java/net/shibboleth/shared/spring/httpclient/resource/package-info.java
index 8a2c0ebd..45f0271b 100644
--- a/shib-networking-spring/src/main/java/net/shibboleth/shared/spring/httpclient/resource/package-info.java
+++ b/shib-networking-spring/src/main/java/net/shibboleth/shared/spring/httpclient/resource/package-info.java
@@ -18,4 +18,7 @@
 /**
  * Spring resource classes supporting HttpClient access.
  */
-package net.shibboleth.shared.spring.httpclient.resource;
\ No newline at end of file
+ at NonnullElements
+package net.shibboleth.shared.spring.httpclient.resource;
+
+import net.shibboleth.shared.annotation.constraint.NonnullElements;
diff --git a/shib-networking-spring/src/main/java/net/shibboleth/shared/spring/servlet/ChainableFilter.java b/shib-networking-spring/src/main/java/net/shibboleth/shared/spring/servlet/ChainableFilter.java
index 37a213d7..702b552a 100644
--- a/shib-networking-spring/src/main/java/net/shibboleth/shared/spring/servlet/ChainableFilter.java
+++ b/shib-networking-spring/src/main/java/net/shibboleth/shared/spring/servlet/ChainableFilter.java
@@ -29,7 +29,7 @@ public interface ChainableFilter extends Filter, Ordered {
     /**
      * An abstraction for modeling filter order.
      */
-    public enum FilterOrder {
+    enum FilterOrder {
     
         /** Run as early as possible. */
         EARLIEST(Integer.MIN_VALUE),
diff --git a/shib-networking-spring/src/main/java/net/shibboleth/shared/spring/servlet/RequestURLPrefixPredicate.java b/shib-networking-spring/src/main/java/net/shibboleth/shared/spring/servlet/RequestURLPrefixPredicate.java
index e6293d3e..94f8b47e 100644
--- a/shib-networking-spring/src/main/java/net/shibboleth/shared/spring/servlet/RequestURLPrefixPredicate.java
+++ b/shib-networking-spring/src/main/java/net/shibboleth/shared/spring/servlet/RequestURLPrefixPredicate.java
@@ -57,8 +57,8 @@ public class RequestURLPrefixPredicate implements Predicate<ServletRequest> {
     /** {@inheritDoc} */
     public boolean test(@Nullable final ServletRequest input) {
 
-        if (input instanceof HttpServletRequest) {
-            final String uri = ((HttpServletRequest) input).getRequestURI();
+        if (input instanceof HttpServletRequest req) {
+            final String uri = req.getRequestURI();
             for (final URLPrefix p : matchingPrefixes) {
                 if (uri.startsWith(input.getServletContext().getContextPath() +  p.getValue())) {
                     return true;
diff --git a/shib-networking-spring/src/main/java/net/shibboleth/shared/spring/servlet/impl/ChainingFilter.java b/shib-networking-spring/src/main/java/net/shibboleth/shared/spring/servlet/impl/ChainingFilter.java
index ff4ba25a..7b1a118b 100644
--- a/shib-networking-spring/src/main/java/net/shibboleth/shared/spring/servlet/impl/ChainingFilter.java
+++ b/shib-networking-spring/src/main/java/net/shibboleth/shared/spring/servlet/impl/ChainingFilter.java
@@ -33,7 +33,6 @@ import jakarta.servlet.FilterConfig;
 import jakarta.servlet.ServletException;
 import jakarta.servlet.ServletRequest;
 import jakarta.servlet.ServletResponse;
-import net.shibboleth.shared.annotation.constraint.NonnullElements;
 import net.shibboleth.shared.servlet.AbstractConditionalFilter;
 import net.shibboleth.shared.spring.servlet.ChainableFilter;
 
@@ -48,7 +47,7 @@ import net.shibboleth.shared.spring.servlet.ChainableFilter;
 public class ChainingFilter implements Filter {
 
     /** Embedded chain. */
-    @Nullable @NonnullElements List<ChainableFilter> filters;
+    @Nullable private List<ChainableFilter> filters;
     
     /**
      * Constructor.
@@ -56,7 +55,7 @@ public class ChainingFilter implements Filter {
      * @param filterChain auto-wired chain of filters to run
      */
     @Autowired
-    public ChainingFilter(@Nullable @NonnullElements Collection<ChainableFilter> filterChain) {
+    public ChainingFilter(@Nullable final Collection<ChainableFilter> filterChain) {
         if (filterChain != null) {
             filters = List.copyOf(filterChain);
         } else {
@@ -98,7 +97,7 @@ public class ChainingFilter implements Filter {
          * @param outer outer filter chain
          */
         public Chain(@Nonnull final FilterChain outer) {
-            assert(filters != null);
+            assert filters != null ;
             iterator = filters.iterator();
             outerChain = outer;
         }
diff --git a/shib-networking-spring/src/main/java/net/shibboleth/shared/spring/servlet/impl/CookieBufferingFilter.java b/shib-networking-spring/src/main/java/net/shibboleth/shared/spring/servlet/impl/CookieBufferingFilter.java
index d9182b51..17f10023 100644
--- a/shib-networking-spring/src/main/java/net/shibboleth/shared/spring/servlet/impl/CookieBufferingFilter.java
+++ b/shib-networking-spring/src/main/java/net/shibboleth/shared/spring/servlet/impl/CookieBufferingFilter.java
@@ -36,7 +36,6 @@ import jakarta.servlet.http.HttpServletRequest;
 import jakarta.servlet.http.HttpServletResponse;
 import jakarta.servlet.http.HttpServletResponseWrapper;
 import net.shibboleth.shared.annotation.constraint.Live;
-import net.shibboleth.shared.annotation.constraint.NonnullElements;
 import net.shibboleth.shared.servlet.AbstractConditionalFilter;
 import net.shibboleth.shared.spring.servlet.ChainableFilter;
 
@@ -61,9 +60,8 @@ public class CookieBufferingFilter extends AbstractConditionalFilter implements
 
     /** {@inheritDoc} */
     @Override
-    protected void runFilter(final ServletRequest request, final ServletResponse response, final FilterChain chain)
-            throws IOException,
-            ServletException {
+    protected void runFilter(@Nonnull final ServletRequest request, @Nonnull final ServletResponse response,
+            @Nonnull final FilterChain chain) throws IOException, ServletException {
 
         if (!(request instanceof HttpServletRequest)) {
             throw new ServletException("Request is not an instance of HttpServletRequest");
@@ -83,7 +81,7 @@ public class CookieBufferingFilter extends AbstractConditionalFilter implements
     private class CookieBufferingHttpServletResponseProxy extends HttpServletResponseWrapper {
 
         /** Map of delayed cookie additions. */
-        @Nonnull @NonnullElements private Map<String,Cookie> cookieMap;
+        @Nonnull private Map<String,Cookie> cookieMap;
         
         /**
          * Constructor.
@@ -107,7 +105,7 @@ public class CookieBufferingFilter extends AbstractConditionalFilter implements
          * 
          * @return map of cookies to be set
          */
-        @Nonnull @NonnullElements @Live protected Map<String,Cookie> getCookies() {
+        @Nonnull @Live protected Map<String,Cookie> getCookies() {
             return cookieMap;
         }
 
diff --git a/shib-networking-spring/src/main/java/net/shibboleth/shared/spring/servlet/impl/DelegatingServletProxy.java b/shib-networking-spring/src/main/java/net/shibboleth/shared/spring/servlet/impl/DelegatingServletProxy.java
index 825f6d60..d472c7f1 100644
--- a/shib-networking-spring/src/main/java/net/shibboleth/shared/spring/servlet/impl/DelegatingServletProxy.java
+++ b/shib-networking-spring/src/main/java/net/shibboleth/shared/spring/servlet/impl/DelegatingServletProxy.java
@@ -48,303 +48,304 @@ import org.springframework.web.filter.DelegatingFilterProxy;
  */
 public class DelegatingServletProxy extends GenericServlet {
 
-	/** For serialization. */
-	private static final long serialVersionUID = 5470308159110258401L;
+    /** For serialization. */
+    private static final long serialVersionUID = 5470308159110258401L;
 
     /** The name of the ServletContext attribute which should be used to retrieve the
      * {@link WebApplicationContext} from which to load the delegate {@link Servlet} bean.
      */
     @Nullable @NotEmpty private String contextAttribute;
 
-	/** The application context from which the target filter will be retrieved. */
-	@Nullable private WebApplicationContext webApplicationContext;
+    /** The application context from which the target filter will be retrieved. */
+    @Nullable private WebApplicationContext webApplicationContext;
 
-	/** The name of the target bean in the Spring application context. */
-	@Nullable @NotEmpty private String targetBeanName;
+    /** The name of the target bean in the Spring application context. */
+    @Nullable @NotEmpty private String targetBeanName;
 
-	/** Whether to invoke the Servlet lifecycle methods on the target bean. */
-	private boolean targetFilterLifecycle;
+    /** Whether to invoke the Servlet lifecycle methods on the target bean. */
+    private boolean targetFilterLifecycle;
 
-	/** The {@code HttpServlet} instance that this proxy will delegate to and
+    /** The {@code HttpServlet} instance that this proxy will delegate to and
      * manage the lifecycle for.
      */
-	@Nullable private volatile Servlet delegate;
-
-	/** Object used to syncrhonize access where needed. */
-	@Nonnull private Object delegateMonitor;
-
-	/**
-	 * Constructor for traditional use in {@code web.xml}.
-	 */
-	public DelegatingServletProxy() {
-	    delegateMonitor = new Object();
-	}
-
-	/**
-	 * Constructor using the given {@link Servlet} delegate.
-	 * 
-	 * <p>Bypasses entirely the need for interacting with a Spring application context,
-	 * specifying the {@linkplain #setTargetBeanName target bean name}, etc.</p>
-	 * 
-	 * <p>For use with instance-based registration of filters.</p>
-	 * 
-	 * @param del the {@code HttpServlet} instance that this proxy will delegate to and
-	 * manage the lifecycle for
-	 */
-	public DelegatingServletProxy(@Nonnull final Servlet del) {
-	    delegateMonitor = new Object();
-		delegate = Constraint.isNotNull(del, "Delegate servlet cannot be null");
-	}
-
-	/**
-	 * Constructor that will retrieve the named target
-	 * bean from the Spring {@code WebApplicationContext} found in the {@code ServletContext}
-	 * (either the 'root' application context or the context named by
-	 * {@link #setContextAttribute}).
-	 * 
-	 * <p>For use with instance-based registration of filters.</p>
-	 * 
-	 * <p>The target bean must implement the standard {@link Servlet} interface.</p>
-	 * 
-	 * @param targetBeanName name of the target servlet bean to look up in the Spring
-	 * application context
-	 */
-	public DelegatingServletProxy(@Nonnull @NotEmpty final String targetBeanName) {
-		this(targetBeanName, null);
-	}
-
-	/**
-	 * Constructor that will retrieve the named target bean from the given Spring {@code WebApplicationContext}.
-	 * 
-	 * <p>For use with instance-based registration of filters.</p>
-	 * 
-	 * <p>The target bean must implement the standard {@link Servlet} interface.</p>
-	 * 
-	 * <p>The given {@code WebApplicationContext} may or may not be refreshed when passed
-	 * in. If it has not, and if the context implements {@link ConfigurableApplicationContext},
-	 * a {@link ConfigurableApplicationContext#refresh() refresh()} will be attempted before
-	 * retrieving the named target bean.</p>
-	 * 
-	 * @param targetBeanName name of the target filter bean in the Spring application context
-	 * @param wac the application context from which the target filter will be retrieved;
-	 *     if {@code null}, an application context will be looked up from {@code ServletContext}
-	 *     as a fallback
-	 */
-	public DelegatingServletProxy(@Nonnull @NotEmpty final String targetBeanName, @Nullable final WebApplicationContext wac) {
-	    delegateMonitor = new Object();
-	    
-		setTargetBeanName(targetBeanName);
-		webApplicationContext = wac;
-	}
-
-	/**
-	 * Set the name of the ServletContext attribute which should be used to retrieve the
-	 * {@link WebApplicationContext} from which to load the delegate {@link Servlet} bean.
-	 * 
-	 * @param name of attribute
-	 */
-	public void setContextAttribute(@Nullable @NotEmpty String name) {
-		contextAttribute = StringSupport.trimOrNull(name);
-	}
-
-	/**
-	 * Return the name of the ServletContext attribute which should be used to retrieve the
-	 * {@link WebApplicationContext} from which to load the delegate {@link Servlet} bean.
-	 * 
-	 * @return name of attribute
-	 */
-	@Nullable @NotEmpty public String getContextAttribute() {
-		return contextAttribute;
-	}
-
-	/**
-	 * Set the name of the target bean in the Spring application context.
-	 * 
-	 * <p>The target bean must implement the standard {@link Servlet} interface.</p>
-	 * 
-	 * <p>By default, the {@code servlet-name} as specified for the
-	 * DelegatingFilterProxy in {@code web.xml} will be used.</p>
-	 * 
-	 * @param name bean name
-	 */
-	public void setTargetBeanName(@Nullable @NotEmpty String name) {
-		targetBeanName = StringSupport.trimOrNull(name);
-	}
-
-	/**
-	 * Return the name of the target bean in the Spring application context.
-	 * 
-	 * @return bean name
-	 */
-	@Nullable @NotEmpty protected String getTargetBeanName() {
-		return targetBeanName;
-	}
-
-	/**
-	 * Set whether to invoke the {@link Servlet#init(jakarta.servlet.ServletConfig)} and
-	 * {@link Servlet#destroy()} lifecycle methods on the target bean.
-	 * 
-	 * <p>Default is "false"; target beans usually rely on the Spring application
-	 * context for managing their lifecycle. Setting this flag to "true" means
-	 * that the servlet container will control the lifecycle of the target
-	 * bean, with this proxy delegating the corresponding calls.</p>
-	 * 
-	 * @param flag flag to set
-	 */
-	public void setTargetFilterLifecycle(final boolean flag) {
-		targetFilterLifecycle = flag;
-	}
-
-	/**
-	 * Return whether to invoke the Servlet lifecycle methods on the target bean.
-	 * 
-	 * @return whether to invoke the Servlet lifecycle methods on the target bean
-	 */
-	protected boolean isTargetFilterLifecycle() {
-		return targetFilterLifecycle;
-	}
-
-	/** {@inheritDoc} */
-	@Override
-	public void init() throws ServletException {
-		synchronized (delegateMonitor) {
-			if (delegate == null) {
-				// If no target bean name specified, use servlet name.
-				if (targetBeanName == null) {
-					targetBeanName = getServletName();
-				}
-				
-				// Fetch Spring root application context and initialize the delegate early,
-				// if possible. If the root application context will be started after this
-				// filter proxy, we'll have to resort to lazy initialization.
-				final WebApplicationContext wac = findWebApplicationContext();
-				if (wac != null) {
-					delegate = initDelegate(wac);
-				}
-			}
-		}
-	}
+    @Nullable private volatile Servlet delegate;
+
+    /** Object used to syncrhonize access where needed. */
+    @Nonnull private Object delegateMonitor;
+
+    /**
+     * Constructor for traditional use in {@code web.xml}.
+     */
+    public DelegatingServletProxy() {
+        delegateMonitor = new Object();
+    }
+
+    /**
+     * Constructor using the given {@link Servlet} delegate.
+     * 
+     * <p>Bypasses entirely the need for interacting with a Spring application context,
+     * specifying the {@linkplain #setTargetBeanName target bean name}, etc.</p>
+     * 
+     * <p>For use with instance-based registration of filters.</p>
+     * 
+     * @param del the {@code HttpServlet} instance that this proxy will delegate to and
+     * manage the lifecycle for
+     */
+    public DelegatingServletProxy(@Nonnull final Servlet del) {
+        delegateMonitor = new Object();
+        delegate = Constraint.isNotNull(del, "Delegate servlet cannot be null");
+    }
+
+    /**
+     * Constructor that will retrieve the named target
+     * bean from the Spring {@code WebApplicationContext} found in the {@code ServletContext}
+     * (either the 'root' application context or the context named by
+     * {@link #setContextAttribute}).
+     * 
+     * <p>For use with instance-based registration of filters.</p>
+     * 
+     * <p>The target bean must implement the standard {@link Servlet} interface.</p>
+     * 
+     * @param targetBeanName name of the target servlet bean to look up in the Spring
+     * application context
+     */
+    public DelegatingServletProxy(@Nonnull @NotEmpty final String targetBeanName) {
+        this(targetBeanName, null);
+    }
+
+    /**
+     * Constructor that will retrieve the named target bean from the given Spring {@code WebApplicationContext}.
+     * 
+     * <p>For use with instance-based registration of filters.</p>
+     * 
+     * <p>The target bean must implement the standard {@link Servlet} interface.</p>
+     * 
+     * <p>The given {@code WebApplicationContext} may or may not be refreshed when passed
+     * in. If it has not, and if the context implements {@link ConfigurableApplicationContext},
+     * a {@link ConfigurableApplicationContext#refresh() refresh()} will be attempted before
+     * retrieving the named target bean.</p>
+     * 
+     * @param targetBeanName name of the target filter bean in the Spring application context
+     * @param wac the application context from which the target filter will be retrieved;
+     *     if {@code null}, an application context will be looked up from {@code ServletContext}
+     *     as a fallback
+     */
+    public DelegatingServletProxy(@Nonnull @NotEmpty final String targetBeanName,
+            @Nullable final WebApplicationContext wac) {
+        delegateMonitor = new Object();
+        
+        setTargetBeanName(targetBeanName);
+        webApplicationContext = wac;
+    }
+
+    /**
+     * Set the name of the ServletContext attribute which should be used to retrieve the
+     * {@link WebApplicationContext} from which to load the delegate {@link Servlet} bean.
+     * 
+     * @param name of attribute
+     */
+    public void setContextAttribute(@Nullable @NotEmpty final String name) {
+        contextAttribute = StringSupport.trimOrNull(name);
+    }
+
+    /**
+     * Return the name of the ServletContext attribute which should be used to retrieve the
+     * {@link WebApplicationContext} from which to load the delegate {@link Servlet} bean.
+     * 
+     * @return name of attribute
+     */
+    @Nullable @NotEmpty public String getContextAttribute() {
+        return contextAttribute;
+    }
+
+    /**
+     * Set the name of the target bean in the Spring application context.
+     * 
+     * <p>The target bean must implement the standard {@link Servlet} interface.</p>
+     * 
+     * <p>By default, the {@code servlet-name} as specified for the
+     * DelegatingFilterProxy in {@code web.xml} will be used.</p>
+     * 
+     * @param name bean name
+     */
+    public void setTargetBeanName(@Nullable @NotEmpty final String name) {
+        targetBeanName = StringSupport.trimOrNull(name);
+    }
+
+    /**
+     * Return the name of the target bean in the Spring application context.
+     * 
+     * @return bean name
+     */
+    @Nullable @NotEmpty protected String getTargetBeanName() {
+        return targetBeanName;
+    }
+
+    /**
+     * Set whether to invoke the {@link Servlet#init(jakarta.servlet.ServletConfig)} and
+     * {@link Servlet#destroy()} lifecycle methods on the target bean.
+     * 
+     * <p>Default is "false"; target beans usually rely on the Spring application
+     * context for managing their lifecycle. Setting this flag to "true" means
+     * that the servlet container will control the lifecycle of the target
+     * bean, with this proxy delegating the corresponding calls.</p>
+     * 
+     * @param flag flag to set
+     */
+    public void setTargetFilterLifecycle(final boolean flag) {
+        targetFilterLifecycle = flag;
+    }
+
+    /**
+     * Return whether to invoke the Servlet lifecycle methods on the target bean.
+     * 
+     * @return whether to invoke the Servlet lifecycle methods on the target bean
+     */
+    protected boolean isTargetFilterLifecycle() {
+        return targetFilterLifecycle;
+    }
 
     /** {@inheritDoc} */
-	@Override
-	public void service(ServletRequest request, ServletResponse response)
-			throws ServletException, IOException {
-
-		// Lazily initialize the delegate if necessary.
-		Servlet delegateToUse = delegate;
-		if (delegateToUse == null) {
-			synchronized (delegateMonitor) {
-				delegateToUse = delegate;
-				if (delegateToUse == null) {
-					final WebApplicationContext wac = findWebApplicationContext();
-					if (wac == null) {
-						throw new IllegalStateException("No WebApplicationContext found: " +
-								"no ContextLoaderListener or DispatcherServlet registered?");
-					}
-					delegateToUse = initDelegate(wac);
-				}
-				delegate = delegateToUse;
-			}
-		}
-
-		// Let the delegate perform the actual service operation.
-		invokeDelegate(delegateToUse, request, response);
-	}
+    @Override
+    public void init() throws ServletException {
+        synchronized (delegateMonitor) {
+            if (delegate == null) {
+                // If no target bean name specified, use servlet name.
+                if (targetBeanName == null) {
+                    targetBeanName = getServletName();
+                }
+                
+                // Fetch Spring root application context and initialize the delegate early,
+                // if possible. If the root application context will be started after this
+                // filter proxy, we'll have to resort to lazy initialization.
+                final WebApplicationContext wac = findWebApplicationContext();
+                if (wac != null) {
+                    delegate = initDelegate(wac);
+                }
+            }
+        }
+    }
 
     /** {@inheritDoc} */
-	@Override
-	public void destroy() {
-		final Servlet delegateToUse = delegate;
-		if (delegateToUse != null) {
-			destroyDelegate(delegateToUse);
-		}
-	}
-
-
-	/**
-	 * Return the {@link WebApplicationContext} passed in at construction time, if available.
-	 * 
-	 * <p>Otherwise, attempt to retrieve a {@link WebApplicationContext} from the
-	 * {@link ServletContext} attribute with the {@linkplain #setContextAttribute
-	 * configured name} if set. Otherwise look up a {@link WebApplicationContext} under
-	 * the well-known "root" application context attribute.</p>
-	 * 
-	 * <p>The {@link WebApplicationContext} must have already been loaded and stored in the
-	 * {@link ServletContext} before this filter gets initialized (or invoked).</p>
-	 * 
-	 * <p>Subclasses may override this method to provide a different
-	 * {@link WebApplicationContext} retrieval strategy.</p>
-	 * 
-	 * @return the {@link WebApplicationContext} for this proxy, or {@code null} if not found
-	 */
-	@Nullable protected WebApplicationContext findWebApplicationContext() {
-		if (webApplicationContext != null) {
-			// The user has injected a context at construction time -> use it...
-			if (webApplicationContext instanceof ConfigurableApplicationContext cac && !cac.isActive()) {
-				// The context has not yet been refreshed -> do so before returning it...
-				cac.refresh();
-			}
-			return webApplicationContext;
-		}
-		final String attrName = getContextAttribute();
-		if (attrName != null) {
-			return WebApplicationContextUtils.getWebApplicationContext(getServletContext(), attrName);
-		}
-		else {
-			return WebApplicationContextUtils.findWebApplicationContext(getServletContext());
-		}
-	}
-
-	/**
-	 * Initialize the Servlet delegate, defined as a bean in the given Spring application context.
-	 * 
-	 * <p>The default implementation fetches the bean from the application context
-	 * and calls the standard {@code Servlet.init} method on it, passing
-	 * in the ServletConfig of this Servlet proxy.</p>
-	 * 
-	 * @param wac the root application context
-	 * 
-	 * @return the initialized delegate Filter
-	 * 
-	 * @throws ServletException if thrown by the servlet or if no bean name can be found
-	 */
-	protected Servlet initDelegate(@Nonnull final WebApplicationContext wac) throws ServletException {
-		final String targetBeanName = getTargetBeanName();
-		if (targetBeanName == null) {
-		    throw new ServletException("No target bean name set.");
-		}
-		final Servlet delegate = wac.getBean(targetBeanName, Servlet.class);
-		if (isTargetFilterLifecycle()) {
-			delegate.init(getServletConfig());
-		}
-		return delegate;
-	}
-
-	/**
-	 * Actually invoke the delegate Servlet with the given request and response.
-	 * 
-	 * @param delegate the delegate Servlet
-	 * @param request the current request
-	 * @param response the current response
-	 * 
-	 * @throws ServletException if thrown by the Servlet
-	 * @throws IOException if thrown by the Servlet
-	 */
-	protected void invokeDelegate(@Nonnull final Servlet delegate, @Nonnull final ServletRequest request,
-	        @Nonnull final ServletResponse response) throws ServletException, IOException {
-
-		delegate.service(request, response);
-	}
-
-	/**
-	 * Destroy the Servlet delegate.
-	 * 
-	 * @param delegate the Servlet delegate
-	 */
-	protected void destroyDelegate(@Nonnull final Servlet delegate) {
-		if (isTargetFilterLifecycle()) {
-			delegate.destroy();
-		}
-	}
+    @Override
+    public void service(final ServletRequest request, final ServletResponse response)
+            throws ServletException, IOException {
+
+        // Lazily initialize the delegate if necessary.
+        Servlet delegateToUse = delegate;
+        if (delegateToUse == null) {
+            synchronized (delegateMonitor) {
+                delegateToUse = delegate;
+                if (delegateToUse == null) {
+                    final WebApplicationContext wac = findWebApplicationContext();
+                    if (wac == null) {
+                        throw new IllegalStateException("No WebApplicationContext found: " +
+                                "no ContextLoaderListener or DispatcherServlet registered?");
+                    }
+                    delegateToUse = initDelegate(wac);
+                }
+                delegate = delegateToUse;
+            }
+        }
+
+        // Let the delegate perform the actual service operation.
+        invokeDelegate(delegateToUse, request, response);
+    }
+
+    /** {@inheritDoc} */
+    @Override
+    public void destroy() {
+        final Servlet delegateToUse = delegate;
+        if (delegateToUse != null) {
+            destroyDelegate(delegateToUse);
+        }
+    }
+
+
+    /**
+     * Return the {@link WebApplicationContext} passed in at construction time, if available.
+     * 
+     * <p>Otherwise, attempt to retrieve a {@link WebApplicationContext} from the
+     * {@link ServletContext} attribute with the {@linkplain #setContextAttribute
+     * configured name} if set. Otherwise look up a {@link WebApplicationContext} under
+     * the well-known "root" application context attribute.</p>
+     * 
+     * <p>The {@link WebApplicationContext} must have already been loaded and stored in the
+     * {@link ServletContext} before this filter gets initialized (or invoked).</p>
+     * 
+     * <p>Subclasses may override this method to provide a different
+     * {@link WebApplicationContext} retrieval strategy.</p>
+     * 
+     * @return the {@link WebApplicationContext} for this proxy, or {@code null} if not found
+     */
+    @Nullable protected WebApplicationContext findWebApplicationContext() {
+        if (webApplicationContext != null) {
+            // The user has injected a context at construction time -> use it...
+            if (webApplicationContext instanceof ConfigurableApplicationContext cac && !cac.isActive()) {
+                // The context has not yet been refreshed -> do so before returning it...
+                cac.refresh();
+            }
+            return webApplicationContext;
+        }
+        final String attrName = getContextAttribute();
+        if (attrName != null) {
+            return WebApplicationContextUtils.getWebApplicationContext(getServletContext(), attrName);
+        }
+        else {
+            return WebApplicationContextUtils.findWebApplicationContext(getServletContext());
+        }
+    }
+
+    /**
+     * Initialize the Servlet delegate, defined as a bean in the given Spring application context.
+     * 
+     * <p>The default implementation fetches the bean from the application context
+     * and calls the standard {@code Servlet.init} method on it, passing
+     * in the ServletConfig of this Servlet proxy.</p>
+     * 
+     * @param wac the root application context
+     * 
+     * @return the initialized delegate Filter
+     * 
+     * @throws ServletException if thrown by the servlet or if no bean name can be found
+     */
+    @Nonnull protected Servlet initDelegate(@Nonnull final WebApplicationContext wac) throws ServletException {
+        final String targetBean = getTargetBeanName();
+        if (targetBean == null) {
+            throw new ServletException("No target bean name set.");
+        }
+        final Servlet del = wac.getBean(targetBean, Servlet.class);
+        if (isTargetFilterLifecycle()) {
+            del.init(getServletConfig());
+        }
+        return del;
+    }
+
+    /**
+     * Actually invoke the delegate Servlet with the given request and response.
+     * 
+     * @param del the delegate Servlet
+     * @param request the current request
+     * @param response the current response
+     * 
+     * @throws ServletException if thrown by the Servlet
+     * @throws IOException if thrown by the Servlet
+     */
+    protected void invokeDelegate(@Nonnull final Servlet del, @Nonnull final ServletRequest request,
+            @Nonnull final ServletResponse response) throws ServletException, IOException {
+
+        del.service(request, response);
+    }
+
+    /**
+     * Destroy the Servlet delegate.
+     * 
+     * @param del the Servlet delegate
+     */
+    protected void destroyDelegate(@Nonnull final Servlet del) {
+        if (isTargetFilterLifecycle()) {
+            del.destroy();
+        }
+    }
 
 }
\ No newline at end of file
diff --git a/shib-networking-spring/src/main/java/net/shibboleth/shared/spring/servlet/impl/DynamicResponseHeaderFilter.java b/shib-networking-spring/src/main/java/net/shibboleth/shared/spring/servlet/impl/DynamicResponseHeaderFilter.java
index f233d9e9..66147c08 100644
--- a/shib-networking-spring/src/main/java/net/shibboleth/shared/spring/servlet/impl/DynamicResponseHeaderFilter.java
+++ b/shib-networking-spring/src/main/java/net/shibboleth/shared/spring/servlet/impl/DynamicResponseHeaderFilter.java
@@ -37,7 +37,6 @@ import jakarta.servlet.ServletResponse;
 import jakarta.servlet.http.HttpServletRequest;
 import jakarta.servlet.http.HttpServletResponse;
 import jakarta.servlet.http.HttpServletResponseWrapper;
-import net.shibboleth.shared.annotation.constraint.NonnullElements;
 import net.shibboleth.shared.collection.CollectionSupport;
 import net.shibboleth.shared.collection.Pair;
 import net.shibboleth.shared.primitive.StringSupport;
@@ -52,11 +51,10 @@ import net.shibboleth.shared.spring.servlet.ChainableFilter;
 public class DynamicResponseHeaderFilter extends AbstractConditionalFilter implements ChainableFilter {
     
     /** Statically defined headers to return. */
-    @Nonnull @NonnullElements private Map<String,String> headers;
+    @Nonnull private Map<String,String> headers;
 
     /** Callbacks to add headers dynamically. */
-    @Nonnull @NonnullElements
-    private Collection<Function<Pair<HttpServletRequest,HttpServletResponse>,Boolean>> callbacks;
+    @Nonnull private Collection<Function<Pair<HttpServletRequest,HttpServletResponse>,Boolean>> callbacks;
     
     /** Constructor. */
     public DynamicResponseHeaderFilter() {
@@ -69,7 +67,7 @@ public class DynamicResponseHeaderFilter extends AbstractConditionalFilter imple
      * 
      * @param map   header map
      */
-    public void setHeaders(@Nullable @NonnullElements final Map<String,String> map) {
+    public void setHeaders(@Nullable final Map<String,String> map) {
         if (map != null) {
             headers = new HashMap<>(map.size());
             for (final Map.Entry<String,String> entry : map.entrySet()) {
@@ -89,8 +87,8 @@ public class DynamicResponseHeaderFilter extends AbstractConditionalFilter imple
      * 
      * @param theCallbacks callback collection
      */
-    public void setCallbacks(@Nullable @NonnullElements
-            final Collection<Function<Pair<HttpServletRequest,HttpServletResponse>,Boolean>> theCallbacks) {
+    public void setCallbacks(
+            @Nullable final Collection<Function<Pair<HttpServletRequest,HttpServletResponse>,Boolean>> theCallbacks) {
         if (theCallbacks != null) {
             callbacks = CollectionSupport.copyToList(theCallbacks);
         } else {
@@ -113,7 +111,8 @@ public class DynamicResponseHeaderFilter extends AbstractConditionalFilter imple
 
     /** {@inheritDoc} */
     @Override
-    protected void runFilter(final @Nonnull ServletRequest request, final @Nonnull ServletResponse response, final @Nonnull FilterChain chain)
+    protected void runFilter(@Nonnull final ServletRequest request, at Nonnull final ServletResponse response,
+            @Nonnull final FilterChain chain)
             throws IOException,
             ServletException {
         
diff --git a/shib-networking-spring/src/main/java/net/shibboleth/shared/spring/servlet/impl/RequestResponseContextFilter.java b/shib-networking-spring/src/main/java/net/shibboleth/shared/spring/servlet/impl/RequestResponseContextFilter.java
index 93edfacb..5bfa8a40 100644
--- a/shib-networking-spring/src/main/java/net/shibboleth/shared/spring/servlet/impl/RequestResponseContextFilter.java
+++ b/shib-networking-spring/src/main/java/net/shibboleth/shared/spring/servlet/impl/RequestResponseContextFilter.java
@@ -56,9 +56,8 @@ public class RequestResponseContextFilter extends AbstractConditionalFilter impl
 
     /** {@inheritDoc} */
     @Override
-    protected void runFilter(@Nonnull final ServletRequest request, @Nonnull final ServletResponse response, @Nonnull final FilterChain chain)
-            throws IOException,
-            ServletException {
+    protected void runFilter(@Nonnull final ServletRequest request, @Nonnull final ServletResponse response,
+            @Nonnull final FilterChain chain) throws IOException, ServletException {
 
         if (!(request instanceof HttpServletRequest)) {
             throw new ServletException("Request is not an instance of HttpServletRequest");
diff --git a/shib-networking-spring/src/main/java/net/shibboleth/shared/spring/servlet/impl/SameSiteCookieHeaderFilter.java b/shib-networking-spring/src/main/java/net/shibboleth/shared/spring/servlet/impl/SameSiteCookieHeaderFilter.java
index 06dae16f..0c35ade8 100644
--- a/shib-networking-spring/src/main/java/net/shibboleth/shared/spring/servlet/impl/SameSiteCookieHeaderFilter.java
+++ b/shib-networking-spring/src/main/java/net/shibboleth/shared/spring/servlet/impl/SameSiteCookieHeaderFilter.java
@@ -41,7 +41,6 @@ import jakarta.servlet.ServletRequest;
 import jakarta.servlet.ServletResponse;
 import jakarta.servlet.http.HttpServletResponse;
 import jakarta.servlet.http.HttpServletResponseWrapper;
-import net.shibboleth.shared.annotation.constraint.NonnullElements;
 import net.shibboleth.shared.annotation.constraint.NotEmpty;
 import net.shibboleth.shared.collection.CollectionSupport;
 import net.shibboleth.shared.logic.Constraint;
@@ -113,7 +112,7 @@ public class SameSiteCookieHeaderFilter extends AbstractConditionalFilter implem
          * 
          * @return Returns the value.
          */
-        public String getValue() {
+        @Nonnull public String getValue() {
             return value;
         }
         
@@ -123,7 +122,7 @@ public class SameSiteCookieHeaderFilter extends AbstractConditionalFilter implem
     @Nullable private SameSiteValue defaultValue;
     
     /** Map of cookie name to same-site attribute value.*/
-    @Nonnull @NonnullElements private Map<String,SameSiteValue> sameSiteCookies;
+    @Nonnull private Map<String,SameSiteValue> sameSiteCookies;
     
     /** Constructor. */
     public SameSiteCookieHeaderFilter() {
@@ -149,7 +148,7 @@ public class SameSiteCookieHeaderFilter extends AbstractConditionalFilter implem
      * 
      * @param map the map of same-site attribute values to cookie names.
      */
-    public void setSameSiteCookies(@Nullable @NonnullElements final Map<SameSiteValue,List<String>> map) {
+    public void setSameSiteCookies(@Nullable final Map<SameSiteValue,List<String>> map) {
         if (map != null) {
             sameSiteCookies = new HashMap<>(4);
             for (final Map.Entry<SameSiteValue,List<String>> entry : map.entrySet()) {
@@ -187,8 +186,8 @@ public class SameSiteCookieHeaderFilter extends AbstractConditionalFilter implem
 
     /** {@inheritDoc} */
     @Override
-    protected void runFilter(final @Nonnull ServletRequest request, final @Nonnull ServletResponse response, final @Nonnull FilterChain chain)
-            throws IOException, ServletException {
+    protected void runFilter(@Nonnull final ServletRequest request, @Nonnull final ServletResponse response,
+            @Nonnull final FilterChain chain) throws IOException, ServletException {
 
         if (!(response instanceof HttpServletResponse)) {
             throw new ServletException("Response is not an instance of HttpServletResponse");
@@ -268,6 +267,7 @@ public class SameSiteCookieHeaderFilter extends AbstractConditionalFilter implem
                 if (StringSupport.trimOrNull(cookieHeader)==null) {
                     continue;
                 }
+                assert cookieHeader != null;
                 
                 List<HttpCookie> parsedCookies = null;
                 try {
diff --git a/shib-networking-spring/src/main/java/net/shibboleth/shared/spring/servlet/impl/package-info.java b/shib-networking-spring/src/main/java/net/shibboleth/shared/spring/servlet/impl/package-info.java
index 2f01a21a..ad7ad158 100644
--- a/shib-networking-spring/src/main/java/net/shibboleth/shared/spring/servlet/impl/package-info.java
+++ b/shib-networking-spring/src/main/java/net/shibboleth/shared/spring/servlet/impl/package-info.java
@@ -18,4 +18,7 @@
 /**
  * Spring-aware implementation classes related to Java Servlet and Filter behavior.
  */
-package net.shibboleth.shared.spring.servlet.impl;
\ No newline at end of file
+ at NonnullElements
+package net.shibboleth.shared.spring.servlet.impl;
+
+import net.shibboleth.shared.annotation.constraint.NonnullElements;
diff --git a/shib-networking-spring/src/main/java/net/shibboleth/shared/spring/servlet/package-info.java b/shib-networking-spring/src/main/java/net/shibboleth/shared/spring/servlet/package-info.java
index e7931cec..d0a85672 100644
--- a/shib-networking-spring/src/main/java/net/shibboleth/shared/spring/servlet/package-info.java
+++ b/shib-networking-spring/src/main/java/net/shibboleth/shared/spring/servlet/package-info.java
@@ -18,4 +18,7 @@
 /**
  * Spring-aware APIs relating to Java Servlets, Filters, etc.
  */
-package net.shibboleth.shared.spring.servlet;
\ No newline at end of file
+ at NonnullElements
+package net.shibboleth.shared.spring.servlet;
+
+import net.shibboleth.shared.annotation.constraint.NonnullElements;
diff --git a/shib-networking/src/main/java/net/shibboleth/shared/httpclient/ContextHandlingHttpClient.java b/shib-networking/src/main/java/net/shibboleth/shared/httpclient/ContextHandlingHttpClient.java
index aa4354c5..74a95e2c 100644
--- a/shib-networking/src/main/java/net/shibboleth/shared/httpclient/ContextHandlingHttpClient.java
+++ b/shib-networking/src/main/java/net/shibboleth/shared/httpclient/ContextHandlingHttpClient.java
@@ -68,7 +68,7 @@ import net.shibboleth.shared.primitive.LoggerFactory;
 class ContextHandlingHttpClient extends AbstractHttpClient {
     
     /** Logger. */
-    private Logger log = LoggerFactory.getLogger(ContextHandlingHttpClient.class);
+    @Nonnull private Logger log = LoggerFactory.getLogger(ContextHandlingHttpClient.class);
     
     /** The wrapped client instance. */
     @Nonnull private HttpClient httpClient;
@@ -153,27 +153,22 @@ class ContextHandlingHttpClient extends AbstractHttpClient {
         final List<Throwable> errors = new LazyList<>();
 
         for (final HttpClientContextHandler handler : handlers) {
-            if (handler != null) {
-                try {
-                    log.trace("Invoking static handler invokeBefore: {}", handler.getClass().getName());
-                    handler.invokeBefore(context, request);
-                } catch (final Throwable t) {
-                    log.warn("Static handler invokeBefore threw: {}", handler.getClass().getName(), t);
-                    errors.add(t);
-                }
+            try {
+                log.trace("Invoking static handler invokeBefore: {}", handler.getClass().getName());
+                handler.invokeBefore(context, request);
+            } catch (final Throwable t) {
+                log.warn("Static handler invokeBefore threw: {}", handler.getClass().getName(), t);
+                errors.add(t);
             }
         }
 
-        for (final HttpClientContextHandler handler 
-                : HttpClientSupport.getDynamicContextHandlerList(context)) {
-            if (handler != null) {
-                try {
-                    log.trace("Invoking dynamic handler invokeBefore: {}", handler.getClass().getName());
-                    handler.invokeBefore(context, request);
-                } catch (final Throwable t) {
-                    log.warn("Dynamic handler invokeBefore threw: {}", handler.getClass().getName(), t);
-                    errors.add(t);
-                }
+        for (final HttpClientContextHandler handler : HttpClientSupport.getDynamicContextHandlerList(context)) {
+            try {
+                log.trace("Invoking dynamic handler invokeBefore: {}", handler.getClass().getName());
+                handler.invokeBefore(context, request);
+            } catch (final Throwable t) {
+                log.warn("Dynamic handler invokeBefore threw: {}", handler.getClass().getName(), t);
+                errors.add(t);
             }
         }
         
@@ -198,7 +193,7 @@ class ContextHandlingHttpClient extends AbstractHttpClient {
      *                     here as well.
      */
     private void invokeAfter(@Nonnull final ClassicHttpRequest request, @Nonnull final HttpClientContext context, 
-            final Throwable priorError) throws IOException {
+            @Nullable final Throwable priorError) throws IOException {
         log.trace("In invokeAfter");
         
         final List<Throwable> errors = new LazyList<>();
@@ -243,8 +238,8 @@ class ContextHandlingHttpClient extends AbstractHttpClient {
      * 
      * @return the single exception to be propagated out, will be null if no errors present
      */
-    private IOException processHandlerErrors(final String stage, final List<Throwable> errors) {
-        if (errors == null || errors.isEmpty()) {
+    @Nullable private IOException processHandlerErrors(final String stage, @Nonnull final List<Throwable> errors) {
+        if (errors.isEmpty()) {
             return null;
         }
         
@@ -278,7 +273,8 @@ class ContextHandlingHttpClient extends AbstractHttpClient {
      *                     is a type of unchecked error (RuntimeException or Error) that will be propagated out
      *                     here as well. 
      */
-    private void processErrorsForInvokeAfter(final IOException invokeAfterException, final Throwable priorError)
+    private void processErrorsForInvokeAfter(@Nullable final IOException invokeAfterException,
+            @Nullable final Throwable priorError)
             throws IOException {
         
         if (priorError != null) {
@@ -306,6 +302,4 @@ class ContextHandlingHttpClient extends AbstractHttpClient {
         }
     }
 
-
-
-}
+}
\ No newline at end of file
diff --git a/shib-networking/src/main/java/net/shibboleth/shared/httpclient/FileCachingHttpClientBuilder.java b/shib-networking/src/main/java/net/shibboleth/shared/httpclient/FileCachingHttpClientBuilder.java
index bf1ca821..29c90b00 100644
--- a/shib-networking/src/main/java/net/shibboleth/shared/httpclient/FileCachingHttpClientBuilder.java
+++ b/shib-networking/src/main/java/net/shibboleth/shared/httpclient/FileCachingHttpClientBuilder.java
@@ -40,6 +40,7 @@ import org.apache.hc.core5.io.CloseMode;
 import org.apache.hc.core5.io.ModalCloseable;
 import org.slf4j.Logger;
 
+import net.shibboleth.shared.annotation.constraint.NonnullAfterInit;
 import net.shibboleth.shared.annotation.constraint.NotEmpty;
 import net.shibboleth.shared.component.AbstractInitializableComponent;
 import net.shibboleth.shared.component.ComponentInitializationException;
@@ -94,7 +95,7 @@ public class FileCachingHttpClientBuilder extends HttpClientBuilder {
      * Directory in which cached content will be stored. Default:
      * <code>System.getProperty("java.io.tmpdir") + File.separator + "wwwcache"</code>
      */
-    private File cacheDir;
+    @Nonnull private File cacheDir;
 
     /** The maximum number of cached responses. Default: 100 */
     private int maxCacheEntries;
@@ -252,7 +253,7 @@ public class FileCachingHttpClientBuilder extends HttpClientBuilder {
     }
 
     /** {@inheritDoc} */
-    public synchronized HttpClient buildClient() throws Exception {
+    @Nonnull public synchronized HttpClient buildClient() throws Exception {
         final HttpClient client = super.buildClient();
         final ManagedHttpCacheStorage tempStorage = managedStorage;
         // Null this out so we don't keep a reference, inhibiting garbage collection.
@@ -269,13 +270,13 @@ public class FileCachingHttpClientBuilder extends HttpClientBuilder {
             implements InitializableComponent, DestructableComponent {
         
         /** Logger. */
-        private Logger log = LoggerFactory.getLogger(StorageManagingHttpClient.class);
+        @Nonnull private Logger log = LoggerFactory.getLogger(StorageManagingHttpClient.class);
         
         /** The wrapped HttpClient instance. */
-        private HttpClient httpClient;
+        @NonnullAfterInit private HttpClient httpClient;
         
         /** The cache storage instance to manage. */
-        private ManagedHttpCacheStorage storage;
+        @NonnullAfterInit private ManagedHttpCacheStorage storage;
         
         /** Interval of the scheduled maintenance task. */
         private long maintenanceTaskInterval;
@@ -287,10 +288,10 @@ public class FileCachingHttpClientBuilder extends HttpClientBuilder {
         private boolean destroyed;
         
         /** Scheduled task timer. */
-        private Timer timer;
+        @NonnullAfterInit private Timer timer;
         
         /** The scheduled storage maintenance task. */
-        private TimerTask maintenanceTask;
+        @NonnullAfterInit private TimerTask maintenanceTask;
         
         /**
          * Constructor.
@@ -348,19 +349,16 @@ public class FileCachingHttpClientBuilder extends HttpClientBuilder {
         }
 
         /** {@inheritDoc} */
-        @Override
         public boolean isInitialized() {
             return initialized;
         }
 
         /** {@inheritDoc} */
-        @Override
         public boolean isDestroyed() {
             return destroyed;
         }
 
         /** {@inheritDoc} */
-        @Override
         public void initialize() throws ComponentInitializationException {
             timer = new Timer(TimerSupport.getTimerName(this), true);
             maintenanceTask = new StorageMaintenanceTask(storage);
@@ -383,7 +381,6 @@ public class FileCachingHttpClientBuilder extends HttpClientBuilder {
                 log.warn("Error invoking ManagedHttpCacheStorage shutdown()", t);
             }
             storage = null;
-            
             httpClient = null;
             
             destroyed = true;
@@ -397,10 +394,10 @@ public class FileCachingHttpClientBuilder extends HttpClientBuilder {
     private static class StorageMaintenanceTask extends TimerTask {
         
         /** Logger. */
-        private Logger log = LoggerFactory.getLogger(StorageMaintenanceTask.class);
+        @Nonnull private Logger log = LoggerFactory.getLogger(StorageMaintenanceTask.class);
         
         /** The managed cache storage instance. */
-        private ManagedHttpCacheStorage storage;
+        @Nonnull private final ManagedHttpCacheStorage storage;
         
         /**
          * Constructor.
diff --git a/shib-networking/src/main/java/net/shibboleth/shared/httpclient/HttpClientBuilder.java b/shib-networking/src/main/java/net/shibboleth/shared/httpclient/HttpClientBuilder.java
index ea1a3fea..f3acda89 100644
--- a/shib-networking/src/main/java/net/shibboleth/shared/httpclient/HttpClientBuilder.java
+++ b/shib-networking/src/main/java/net/shibboleth/shared/httpclient/HttpClientBuilder.java
@@ -52,7 +52,6 @@ import org.apache.hc.core5.http.io.HttpConnectionFactory;
 import org.apache.hc.core5.util.TimeValue;
 import org.apache.hc.core5.util.Timeout;
 
-import net.shibboleth.shared.annotation.constraint.NonnullElements;
 import net.shibboleth.shared.annotation.constraint.NotLive;
 import net.shibboleth.shared.annotation.constraint.Unmodifiable;
 import net.shibboleth.shared.collection.CollectionSupport;
@@ -96,7 +95,7 @@ import net.shibboleth.shared.primitive.StringSupport;
 public class HttpClientBuilder {
 
     /** Local IP address used when establishing connections. Default value: system default local address */
-    private InetAddress socketLocalAddress;
+    @Nullable private InetAddress socketLocalAddress;
 
     /** Maximum period inactivity between two consecutive data packets. Default value: (60 seconds) */
     @Nonnull private Duration socketTimeout;
@@ -195,25 +194,25 @@ public class HttpClientBuilder {
     private boolean evictIdleConnections;
 
     /** Max idle time allowed for an idle connection before it is evicted. */
-    private Duration connectionMaxIdleTime;
+    @Nonnull private Duration connectionMaxIdleTime;
 
     /** List of request interceptors to add first. */
-    @Nonnull @NonnullElements @Unmodifiable @NotLive private List<HttpRequestInterceptor> requestInterceptorsFirst;
+    @Nonnull @Unmodifiable @NotLive private List<HttpRequestInterceptor> requestInterceptorsFirst;
 
     /** List of request interceptors to add last. */
-    @Nonnull @NonnullElements @Unmodifiable @NotLive private List<HttpRequestInterceptor> requestInterceptorsLast;
+    @Nonnull @Unmodifiable @NotLive private List<HttpRequestInterceptor> requestInterceptorsLast;
 
     /** List of response interceptors to add first. */
-    @Nonnull @NonnullElements @Unmodifiable @NotLive private List<HttpResponseInterceptor> responseInterceptorsFirst;
+    @Nonnull @Unmodifiable @NotLive private List<HttpResponseInterceptor> responseInterceptorsFirst;
 
     /** List of response interceptors to add last. */
-    @Nonnull @NonnullElements @Unmodifiable @NotLive private List<HttpResponseInterceptor> responseInterceptorsLast;
+    @Nonnull @Unmodifiable @NotLive private List<HttpResponseInterceptor> responseInterceptorsLast;
     
     /** List of static context handlers. */
-    @Nonnull @NonnullElements @Unmodifiable @NotLive private List<HttpClientContextHandler> staticContextHandlers;
+    @Nonnull @Unmodifiable @NotLive private List<HttpClientContextHandler> staticContextHandlers;
 
     /** The Apache HttpClientBuilder 4.3+ instance over which to layer this builder. */
-    private org.apache.hc.client5.http.impl.classic.HttpClientBuilder apacheBuilder;
+    @Nonnull private final org.apache.hc.client5.http.impl.classic.HttpClientBuilder apacheBuilder;
 
     /** Constructor. */
     public HttpClientBuilder() {
@@ -903,7 +902,7 @@ public class HttpClientBuilder {
      * 
      * @return max idle time
      */
-    @Nonnull  Duration getConnectionMaxIdleTime() {
+    @Nonnull Duration getConnectionMaxIdleTime() {
         return connectionMaxIdleTime;
     }
 
@@ -924,8 +923,7 @@ public class HttpClientBuilder {
      * 
      * @return the list of interceptors
      */
-    @Nonnull @NonnullElements @NotLive @Unmodifiable
-    public List<HttpRequestInterceptor> getFirstRequestInterceptors() {
+    @Nonnull @NotLive @Unmodifiable public List<HttpRequestInterceptor> getFirstRequestInterceptors() {
         return requestInterceptorsFirst;
     }
     
@@ -934,8 +932,7 @@ public class HttpClientBuilder {
      * 
      * @param interceptors the list of interceptors, may be null
      */
-    public void setFirstRequestInterceptors(
-            @Nullable @NonnullElements final List<HttpRequestInterceptor> interceptors) {
+    public void setFirstRequestInterceptors(@Nullable final List<HttpRequestInterceptor> interceptors) {
         if (interceptors != null) {
             requestInterceptorsFirst = CollectionSupport.copyToList(interceptors);
         } else {
@@ -948,8 +945,7 @@ public class HttpClientBuilder {
      * 
      * @return the list of interceptors
      */
-    @Nonnull @NonnullElements @NotLive @Unmodifiable
-    public List<HttpRequestInterceptor> getLastRequestInterceptors() {
+    @Nonnull @NotLive @Unmodifiable public List<HttpRequestInterceptor> getLastRequestInterceptors() {
         return requestInterceptorsLast;
     }
 
@@ -958,7 +954,7 @@ public class HttpClientBuilder {
      * 
      * @param interceptors the list of interceptors, may be null
      */
-    public void setLastRequestInterceptors(@Nullable @NonnullElements final List<HttpRequestInterceptor> interceptors) {
+    public void setLastRequestInterceptors(@Nullable final List<HttpRequestInterceptor> interceptors) {
         if (interceptors != null) {
             requestInterceptorsLast = CollectionSupport.copyToList(interceptors);
         } else {
@@ -971,8 +967,7 @@ public class HttpClientBuilder {
      * 
      * @return the list of interceptors
      */
-    @Nonnull @NonnullElements @NotLive @Unmodifiable
-    public List<HttpResponseInterceptor> getFirstResponseInterceptors() {
+    @Nonnull @NotLive @Unmodifiable public List<HttpResponseInterceptor> getFirstResponseInterceptors() {
         return responseInterceptorsFirst;
     }
 
@@ -981,8 +976,7 @@ public class HttpClientBuilder {
      * 
      * @param interceptors the list of interceptors, may be null
      */
-    public void setFirstResponseInterceptors(
-            @Nullable @NonnullElements final List<HttpResponseInterceptor> interceptors) {
+    public void setFirstResponseInterceptors(@Nullable final List<HttpResponseInterceptor> interceptors) {
         if (interceptors != null) {
             responseInterceptorsFirst = CollectionSupport.copyToList(interceptors);
         } else {
@@ -995,8 +989,7 @@ public class HttpClientBuilder {
      * 
      * @return the list of interceptors
      */
-    @Nonnull @NonnullElements @NotLive @Unmodifiable
-    public List<HttpResponseInterceptor> getLastResponseInterceptors() {
+    @Nonnull @NotLive @Unmodifiable public List<HttpResponseInterceptor> getLastResponseInterceptors() {
         return responseInterceptorsLast;
     }
 
@@ -1005,8 +998,7 @@ public class HttpClientBuilder {
      * 
      * @param interceptors the list of interceptors, may be null
      */
-    public void setLastResponseInterceptors(
-            @Nullable @NonnullElements final List<HttpResponseInterceptor> interceptors) {
+    public void setLastResponseInterceptors(@Nullable final List<HttpResponseInterceptor> interceptors) {
         if (interceptors != null) {
             responseInterceptorsLast = CollectionSupport.copyToList(interceptors);
         } else {
@@ -1019,8 +1011,7 @@ public class HttpClientBuilder {
      * 
      * @return the list of handlers
      */
-    @Nonnull @NonnullElements @NotLive @Unmodifiable
-    public List<HttpClientContextHandler> getStaticContextHandlers() {
+    @Nonnull @NotLive @Unmodifiable public List<HttpClientContextHandler> getStaticContextHandlers() {
         return staticContextHandlers;
     }
 
@@ -1029,7 +1020,7 @@ public class HttpClientBuilder {
      * 
      * @param handlers the list of handlers, may be null
      */
-    public void setStaticContextHandlers(@Nullable @NonnullElements final List<HttpClientContextHandler> handlers) {
+    public void setStaticContextHandlers(@Nullable final List<HttpClientContextHandler> handlers) {
         if (handlers != null) {
             staticContextHandlers = CollectionSupport.copyToList(handlers);
         } else {
@@ -1044,7 +1035,7 @@ public class HttpClientBuilder {
      * 
      * @throws Exception if there is any problem building the new client instance
      */
-    public HttpClient buildClient() throws Exception {
+    @Nonnull public HttpClient buildClient() throws Exception {
         decorateApacheBuilder();
         return new ContextHandlingHttpClient(getApacheBuilder().build(), getStaticContextHandlers());
     }
@@ -1129,7 +1120,8 @@ public class HttpClientBuilder {
      * 
      * @param builder the Apache HttpClientBuilder
      */
-    protected void handleFluentProperties(org.apache.hc.client5.http.impl.classic.HttpClientBuilder builder ) {
+    protected void handleFluentProperties(
+            @Nonnull final org.apache.hc.client5.http.impl.classic.HttpClientBuilder builder ) {
         // These boolean, interceptor, and eviction properties can otherwise only be supplied
         // to the Apache builder via a fluent-style API.
         
@@ -1197,7 +1189,8 @@ public class HttpClientBuilder {
         final RequestConfig.Builder requestConfigBuilder = RequestConfig.custom();
 
         if (!connectionRequestTimeout.isNegative()) {
-            requestConfigBuilder.setConnectionRequestTimeout(Timeout.ofMilliseconds(connectionRequestTimeout.toMillis()));
+            requestConfigBuilder.setConnectionRequestTimeout(
+                    Timeout.ofMilliseconds(connectionRequestTimeout.toMillis()));
         }
 
         if (!responseTimeout.isNegative()) {
@@ -1246,8 +1239,8 @@ public class HttpClientBuilder {
      * 
      * @return the default connection config instance
      */
-    protected ConnectionConfig buildDefaultConnectionConfig() {
-        ConnectionConfig.Builder builder = ConnectionConfig.custom();
+    @Nonnull protected ConnectionConfig buildDefaultConnectionConfig() {
+        final ConnectionConfig.Builder builder = ConnectionConfig.custom();
         if (!connectionTimeout.isNegative()) {
             builder.setConnectTimeout(Timeout.ofMilliseconds(connectionTimeout.toMillis()));
         }
@@ -1269,7 +1262,7 @@ public class HttpClientBuilder {
      * @return the connection factory instance
      */
     @Nonnull protected HttpConnectionFactory<ManagedHttpClientConnection> buildConnectionFactory() {
-        ManagedHttpClientConnectionFactory.Builder builder = ManagedHttpClientConnectionFactory.builder();
+        final ManagedHttpClientConnectionFactory.Builder builder = ManagedHttpClientConnectionFactory.builder();
 
         builder.http1Config(Http1Config.custom()
                 .setBufferSize(socketBufferSize)
diff --git a/shib-networking/src/main/java/net/shibboleth/shared/httpclient/HttpClientSupport.java b/shib-networking/src/main/java/net/shibboleth/shared/httpclient/HttpClientSupport.java
index 947ae822..711f20d1 100644
--- a/shib-networking/src/main/java/net/shibboleth/shared/httpclient/HttpClientSupport.java
+++ b/shib-networking/src/main/java/net/shibboleth/shared/httpclient/HttpClientSupport.java
@@ -44,6 +44,7 @@ import org.apache.hc.core5.http.ParseException;
 import org.apache.hc.core5.util.CharArrayBuffer;
 import org.slf4j.Logger;
 
+import net.shibboleth.shared.annotation.constraint.Live;
 import net.shibboleth.shared.annotation.constraint.NotEmpty;
 import net.shibboleth.shared.collection.CollectionSupport;
 import net.shibboleth.shared.logic.Constraint;
@@ -147,7 +148,7 @@ public final class HttpClientSupport {
      * @param context the client context
      * @return the handler list
      */
-    @Nonnull public static List<HttpClientContextHandler> getDynamicContextHandlerList(
+    @Nonnull @Live public static List<HttpClientContextHandler> getDynamicContextHandlerList(
             @Nonnull final HttpClientContext context) {
         Constraint.isNotNull(context, "HttpClientContext was null");
         @SuppressWarnings("unchecked")
diff --git a/shib-networking/src/main/java/net/shibboleth/shared/httpclient/LocalAddressProxyRoutePlanner.java b/shib-networking/src/main/java/net/shibboleth/shared/httpclient/LocalAddressProxyRoutePlanner.java
index 1082aeec..2dc3eeb0 100644
--- a/shib-networking/src/main/java/net/shibboleth/shared/httpclient/LocalAddressProxyRoutePlanner.java
+++ b/shib-networking/src/main/java/net/shibboleth/shared/httpclient/LocalAddressProxyRoutePlanner.java
@@ -34,7 +34,7 @@ import org.apache.hc.core5.http.protocol.HttpContext;
 public class LocalAddressProxyRoutePlanner extends DefaultProxyRoutePlanner {
     
     /** The local address. */
-    @Nullable InetAddress address;
+    @Nullable private final InetAddress address;
 
     /**
      * Constructor.
@@ -51,8 +51,9 @@ public class LocalAddressProxyRoutePlanner extends DefaultProxyRoutePlanner {
     
     /** {@inheritDoc} */
     @Override
-    protected InetAddress determineLocalAddress(HttpHost firstHop, HttpContext context) throws HttpException {
+    @Nullable protected InetAddress determineLocalAddress(final HttpHost firstHop, final HttpContext context)
+            throws HttpException {
         return address;
     }
 
-}
+}
\ No newline at end of file
diff --git a/shib-networking/src/main/java/net/shibboleth/shared/httpclient/LocalAddressRoutePlanner.java b/shib-networking/src/main/java/net/shibboleth/shared/httpclient/LocalAddressRoutePlanner.java
index 63e36fa9..02c4f504 100644
--- a/shib-networking/src/main/java/net/shibboleth/shared/httpclient/LocalAddressRoutePlanner.java
+++ b/shib-networking/src/main/java/net/shibboleth/shared/httpclient/LocalAddressRoutePlanner.java
@@ -33,7 +33,7 @@ import org.apache.hc.core5.http.protocol.HttpContext;
 public class LocalAddressRoutePlanner extends DefaultRoutePlanner {
     
     /** The local address. */
-    @Nullable InetAddress address;
+    @Nullable private final InetAddress address;
 
     /**
      * Constructor.
@@ -49,8 +49,9 @@ public class LocalAddressRoutePlanner extends DefaultRoutePlanner {
 
     /** {@inheritDoc} */
     @Override
-    protected InetAddress determineLocalAddress(HttpHost firstHop, HttpContext context) throws HttpException {
+    @Nullable protected InetAddress determineLocalAddress(final HttpHost firstHop, final HttpContext context)
+            throws HttpException {
         return address;
     }
 
-}
+}
\ No newline at end of file
diff --git a/shib-networking/src/main/java/net/shibboleth/shared/httpclient/LocalAddressSystemRoutePlanner.java b/shib-networking/src/main/java/net/shibboleth/shared/httpclient/LocalAddressSystemRoutePlanner.java
index 5b985ee9..a6599ea8 100644
--- a/shib-networking/src/main/java/net/shibboleth/shared/httpclient/LocalAddressSystemRoutePlanner.java
+++ b/shib-networking/src/main/java/net/shibboleth/shared/httpclient/LocalAddressSystemRoutePlanner.java
@@ -34,7 +34,7 @@ import org.apache.hc.core5.http.protocol.HttpContext;
 public class LocalAddressSystemRoutePlanner extends SystemDefaultRoutePlanner {
     
     /** The local address. */
-    @Nullable InetAddress address;
+    @Nullable private final InetAddress address;
 
     /**
      * Constructor.
@@ -51,8 +51,9 @@ public class LocalAddressSystemRoutePlanner extends SystemDefaultRoutePlanner {
     
     /** {@inheritDoc} */
     @Override
-    protected InetAddress determineLocalAddress(HttpHost firstHop, HttpContext context) throws HttpException {
+    @Nullable protected InetAddress determineLocalAddress(final HttpHost firstHop, final HttpContext context)
+            throws HttpException {
         return address;
     }
 
-}
+}
\ No newline at end of file
diff --git a/shib-networking/src/main/java/net/shibboleth/shared/httpclient/RequestConnectionClose.java b/shib-networking/src/main/java/net/shibboleth/shared/httpclient/RequestConnectionClose.java
index 190b6f4c..32917b13 100644
--- a/shib-networking/src/main/java/net/shibboleth/shared/httpclient/RequestConnectionClose.java
+++ b/shib-networking/src/main/java/net/shibboleth/shared/httpclient/RequestConnectionClose.java
@@ -49,18 +49,19 @@ import net.shibboleth.shared.primitive.LoggerFactory;
 public class RequestConnectionClose implements HttpRequestInterceptor {
     
     /** Logger. */
-    @Nonnull static final Logger log = LoggerFactory.getLogger(RequestConnectionClose.class);
+    @Nonnull static final Logger LOG = LoggerFactory.getLogger(RequestConnectionClose.class);
 
     /** {@inheritDoc} */
-    public void process(final HttpRequest request, EntityDetails entity, final HttpContext context)
+    public void process(final HttpRequest request, final EntityDetails entity, final HttpContext context)
             throws HttpException, IOException {
-        log.trace("Saw negotiated protocol version: {}", context.getProtocolVersion());
+        LOG.trace("Saw negotiated protocol version: {}", context.getProtocolVersion());
         if (HttpVersion.HTTP_1_1.lessEquals(context.getProtocolVersion())) {
-            log.trace("Adding request header '{}: {}'", HttpHeaders.CONNECTION, HeaderElements.CLOSE);
+            LOG.trace("Adding request header '{}: {}'", HttpHeaders.CONNECTION, HeaderElements.CLOSE);
             request.addHeader(HttpHeaders.CONNECTION, HeaderElements.CLOSE);
         } else {
-            log.warn("Negotiated protocol did not match condition, skipping add of request header '{}: {}', "
+            LOG.warn("Negotiated protocol did not match condition, skipping add of request header '{}: {}', "
                     + "may cause issues related to pooling", HttpHeaders.CONNECTION, HeaderElements.CLOSE);
         }
     }
+
 }
\ No newline at end of file
diff --git a/shib-networking/src/main/java/net/shibboleth/shared/httpclient/TLSSocketFactory.java b/shib-networking/src/main/java/net/shibboleth/shared/httpclient/TLSSocketFactory.java
index f1f3871e..86a23741 100644
--- a/shib-networking/src/main/java/net/shibboleth/shared/httpclient/TLSSocketFactory.java
+++ b/shib-networking/src/main/java/net/shibboleth/shared/httpclient/TLSSocketFactory.java
@@ -104,10 +104,10 @@ public class TLSSocketFactory implements LayeredConnectionSocketFactory {
     @Nonnull private final HostnameVerifier hostnameVerifier;
     
     /** Factory-wide supported protocols. */
-    private final String[] supportedProtocols;
+    @Nullable private final String[] supportedProtocols;
     
     /** Factory-wide supported cipher suites. */
-    private final String[] supportedCipherSuites;
+    @Nullable private final String[] supportedCipherSuites;
 
     /**
      * Constructor.
@@ -241,7 +241,7 @@ public class TLSSocketFactory implements LayeredConnectionSocketFactory {
     // Checkstyle: ParameterNumber OFF
     /** {@inheritDoc} */
     public Socket connectSocket(
-            TimeValue connectTimeout,
+            final TimeValue connectTimeout,
             final Socket socket,
             final HttpHost host,
             final InetSocketAddress remoteAddress,
@@ -258,7 +258,7 @@ public class TLSSocketFactory implements LayeredConnectionSocketFactory {
             sock.bind(localAddress);
         }
         try {
-            int connectTimeoutMillis = connectTimeout.toMillisecondsIntBound();
+            final int connectTimeoutMillis = connectTimeout.toMillisecondsIntBound();
             if (connectTimeoutMillis > 0 && sock.getSoTimeout() == 0) {
                 sock.setSoTimeout(connectTimeoutMillis);
             }
@@ -333,7 +333,7 @@ public class TLSSocketFactory implements LayeredConnectionSocketFactory {
      * 
      * @param socket the SSLSocket instance
      */
-    private void logSocketInfo(final SSLSocket socket) {
+    private void logSocketInfo(@Nonnull final SSLSocket socket) {
         final SSLSession session = socket.getSession();
         if (log.isDebugEnabled()) {
             log.debug("Connected to: {}", socket.getRemoteSocketAddress());
diff --git a/shib-networking/src/main/java/net/shibboleth/shared/httpclient/TLSSocketFactoryBuilder.java b/shib-networking/src/main/java/net/shibboleth/shared/httpclient/TLSSocketFactoryBuilder.java
index 0668a584..2b2226d5 100644
--- a/shib-networking/src/main/java/net/shibboleth/shared/httpclient/TLSSocketFactoryBuilder.java
+++ b/shib-networking/src/main/java/net/shibboleth/shared/httpclient/TLSSocketFactoryBuilder.java
@@ -32,6 +32,7 @@ import javax.net.ssl.KeyManager;
 import javax.net.ssl.SSLContext;
 import javax.net.ssl.TrustManager;
 
+import net.shibboleth.shared.annotation.constraint.NotEmpty;
 import net.shibboleth.shared.primitive.StringSupport;
 
 /**
@@ -41,35 +42,35 @@ import net.shibboleth.shared.primitive.StringSupport;
 public class TLSSocketFactoryBuilder {
     
     /** The default protocol used when obtaining the SSLContxt instance. */
-    private static final String DEFAULT_CONTEXT_PROTOCOL = "TLS";
+    @Nonnull @NotEmpty private static final String DEFAULT_CONTEXT_PROTOCOL = "TLS";
     
     /** The default hostname verifier used by the socket factory. */
-    private static final HostnameVerifier DEFAULT_HOSTNAME_VERIFIER = 
+    @Nonnull private static final HostnameVerifier DEFAULT_HOSTNAME_VERIFIER = 
             TLSSocketFactory.STRICT_HOSTNAME_VERIFIER;
     
     /** The protocol used when obtaining the SSLContext instance. */
-    private String sslContextProtocol;
+    @Nullable private String sslContextProtocol;
     
     /** The JCA provider used when obtaining the SSLContext instance. */
-    private String sslContextProvider;
+    @Nullable private String sslContextProvider;
     
     /** The list of KeyManagers used when initializing the SSLContext instance. */
-    private List<KeyManager> keyManagers;
+    @Nullable private List<KeyManager> keyManagers;
     
     /** The list of TrustManagers used when initializing the SSLContext instance. */
-    private List<TrustManager> trustManagers;
+    @Nullable private List<TrustManager> trustManagers;
     
     /** The SecureRandom instance used when initializing the SSLContext instance. */
-    private SecureRandom secureRandom;
+    @Nullable private SecureRandom secureRandom;
     
     /** The hostname verifier used by the socket factory. */
-    private HostnameVerifier hostnameVerifier;
+    @Nullable private HostnameVerifier hostnameVerifier;
     
     /** The SSL/TLS protocols enabled on sockets produced by the socket factory. */
-    private List<String> enabledProtocols;
+    @Nullable private List<String> enabledProtocols;
     
     /** The SSL/TLS cipher suites enabled on sockets produced the socket factory. */
-    private List<String> enabledCipherSuites;
+    @Nullable private List<String> enabledCipherSuites;
     
     /**
      * Get the protocol specifier used when obtaining an instance of {@link SSLContext}
@@ -93,7 +94,7 @@ public class TLSSocketFactoryBuilder {
      * 
      * @return this builder instance
      */
-    public TLSSocketFactoryBuilder setSSLContextProtocol(@Nullable final String protocol) {
+    @Nonnull public TLSSocketFactoryBuilder setSSLContextProtocol(@Nullable final String protocol) {
         sslContextProtocol = StringSupport.trimOrNull(protocol);
         return this;
     }
@@ -116,7 +117,7 @@ public class TLSSocketFactoryBuilder {
      * 
      * @return this builder instance
      */
-    public TLSSocketFactoryBuilder setSSLContextProvider(@Nullable final String provider) {
+    @Nonnull public TLSSocketFactoryBuilder setSSLContextProvider(@Nullable final String provider) {
         sslContextProvider = StringSupport.trimOrNull(provider);
         return this;
     }
@@ -139,12 +140,12 @@ public class TLSSocketFactoryBuilder {
      * 
      * @return this builder instance
      */
-    public TLSSocketFactoryBuilder setKeyManagers(@Nullable final List<KeyManager> managers) {
+    @Nonnull public TLSSocketFactoryBuilder setKeyManagers(@Nullable final List<KeyManager> managers) {
         if (managers == null) {
             keyManagers = null;
         } else {
             keyManagers = managers.stream().filter(m -> m != null).collect(Collectors.toList());
-            if (keyManagers.isEmpty()) {
+            if (keyManagers != null && keyManagers.isEmpty()) {
                 keyManagers = null;
             }
         }
@@ -169,12 +170,12 @@ public class TLSSocketFactoryBuilder {
      * 
      * @return this builder instance
      */
-    public TLSSocketFactoryBuilder setTrustManagers(@Nullable final List<TrustManager> managers) {
+    @Nonnull public TLSSocketFactoryBuilder setTrustManagers(@Nullable final List<TrustManager> managers) {
         if (managers == null) {
             trustManagers = null;
         } else {
             trustManagers = managers.stream().filter(m -> m != null).collect(Collectors.toList());
-            if (trustManagers.isEmpty()) {
+            if (trustManagers != null && trustManagers.isEmpty()) {
                 trustManagers = null;
             }
         }
@@ -199,7 +200,7 @@ public class TLSSocketFactoryBuilder {
      * 
      * @return this builder instance
      */
-    public TLSSocketFactoryBuilder setSecureRandom(@Nullable final SecureRandom random) {
+    @Nonnull public TLSSocketFactoryBuilder setSecureRandom(@Nullable final SecureRandom random) {
         secureRandom = random;
         return this;
     }
@@ -224,7 +225,7 @@ public class TLSSocketFactoryBuilder {
      * 
      * @return this builder instance
      */
-    public TLSSocketFactoryBuilder setHostnameVerifier(@Nullable final HostnameVerifier verifier) {
+    @Nonnull public TLSSocketFactoryBuilder setHostnameVerifier(@Nullable final HostnameVerifier verifier) {
         hostnameVerifier = verifier;
         return this;
     }
@@ -245,7 +246,7 @@ public class TLSSocketFactoryBuilder {
      * 
      * @return this builder instance
      */
-    public TLSSocketFactoryBuilder setEnabledProtocols(@Nullable final List<String> protocols) {
+    @Nonnull public TLSSocketFactoryBuilder setEnabledProtocols(@Nullable final List<String> protocols) {
         enabledProtocols = new ArrayList<>(StringSupport.normalizeStringCollection(protocols));
         if (enabledProtocols.isEmpty()) {
             enabledProtocols = null;
@@ -269,7 +270,7 @@ public class TLSSocketFactoryBuilder {
      * 
      * @return this builder instance
      */
-    public TLSSocketFactoryBuilder setEnabledCipherSuites(@Nullable final List<String> cipherSuites) {
+    @Nonnull public TLSSocketFactoryBuilder setEnabledCipherSuites(@Nullable final List<String> cipherSuites) {
         enabledCipherSuites = new ArrayList<>(StringSupport.normalizeStringCollection(cipherSuites));
         if (enabledCipherSuites.isEmpty()) {
             enabledCipherSuites = null;
diff --git a/shib-networking/src/main/java/net/shibboleth/shared/httpclient/package-info.java b/shib-networking/src/main/java/net/shibboleth/shared/httpclient/package-info.java
index 6591f393..50eccc87 100644
--- a/shib-networking/src/main/java/net/shibboleth/shared/httpclient/package-info.java
+++ b/shib-networking/src/main/java/net/shibboleth/shared/httpclient/package-info.java
@@ -16,5 +16,7 @@
  */
 
 /** Classes for working with Apache HttpClient. */
+ at NonnullElements
+package net.shibboleth.shared.httpclient;
 
-package net.shibboleth.shared.httpclient;
\ No newline at end of file
+import net.shibboleth.shared.annotation.constraint.NonnullElements;
diff --git a/shib-networking/src/main/java/net/shibboleth/shared/net/MediaTypeSupport.java b/shib-networking/src/main/java/net/shibboleth/shared/net/MediaTypeSupport.java
index eb0a828a..0e3414e1 100644
--- a/shib-networking/src/main/java/net/shibboleth/shared/net/MediaTypeSupport.java
+++ b/shib-networking/src/main/java/net/shibboleth/shared/net/MediaTypeSupport.java
@@ -20,6 +20,9 @@ package net.shibboleth.shared.net;
 import java.util.Set;
 import java.util.function.Function;
 
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
+
 import com.google.common.net.MediaType;
 
 import net.shibboleth.shared.net.impl.StripMediaTypeParametersFunction;
@@ -31,7 +34,7 @@ import net.shibboleth.shared.primitive.StringSupport;
 public final class MediaTypeSupport {
     
     /** Function to strip MediaType parameters. */
-    private static final Function<MediaType,MediaType> STRIP_PARAMS = new StripMediaTypeParametersFunction();
+    @Nonnull private static final Function<MediaType,MediaType> STRIP_PARAMS = new StripMediaTypeParametersFunction();
     
     /** * Constructor. */
     private MediaTypeSupport() {}
@@ -63,8 +66,9 @@ public final class MediaTypeSupport {
      * @param isOneOfStrategy flag for the strategy used in the validation (see above for details)
      * @return true if the content type is valid, false if not
      */
-    public static boolean validateContentType(final String contentType, final Set<MediaType> validTypes, 
-            final boolean noContentTypeIsValid, final boolean isOneOfStrategy) {
+    public static boolean validateContentType(@Nullable final String contentType,
+            @Nonnull final Set<MediaType> validTypes, final boolean noContentTypeIsValid,
+            final boolean isOneOfStrategy) {
         
         final String contentTypeValue = StringSupport.trimOrNull(contentType);
         if (contentTypeValue != null) {
@@ -85,4 +89,4 @@ public final class MediaTypeSupport {
         return noContentTypeIsValid;
     }
 
-}
+}
\ No newline at end of file
diff --git a/shib-networking/src/main/java/net/shibboleth/shared/net/URIComparator.java b/shib-networking/src/main/java/net/shibboleth/shared/net/URIComparator.java
index 21887b2a..d2300789 100644
--- a/shib-networking/src/main/java/net/shibboleth/shared/net/URIComparator.java
+++ b/shib-networking/src/main/java/net/shibboleth/shared/net/URIComparator.java
@@ -35,6 +35,6 @@ public interface URIComparator {
      * 
      * @throws URIException if the URI's can not be successfully evaluated
      */
-    public boolean compare(@Nullable final String uri1, @Nullable final String uri2) throws URIException;
+    boolean compare(@Nullable final String uri1, @Nullable final String uri2) throws URIException;
 
-}
+}
\ No newline at end of file
diff --git a/shib-networking/src/main/java/net/shibboleth/shared/net/URISupport.java b/shib-networking/src/main/java/net/shibboleth/shared/net/URISupport.java
index 264d94a2..7ee04319 100644
--- a/shib-networking/src/main/java/net/shibboleth/shared/net/URISupport.java
+++ b/shib-networking/src/main/java/net/shibboleth/shared/net/URISupport.java
@@ -23,6 +23,7 @@ import java.net.URISyntaxException;
 import java.net.URLDecoder;
 import java.net.URLEncoder;
 import java.util.ArrayList;
+import java.util.Collections;
 import java.util.HashMap;
 import java.util.List;
 import java.util.Map;
@@ -30,6 +31,10 @@ import java.util.Map;
 import javax.annotation.Nonnull;
 import javax.annotation.Nullable;
 
+import net.shibboleth.shared.annotation.constraint.Live;
+import net.shibboleth.shared.annotation.constraint.NotLive;
+import net.shibboleth.shared.annotation.constraint.NullableElements;
+import net.shibboleth.shared.annotation.constraint.Unmodifiable;
 import net.shibboleth.shared.collection.CollectionSupport;
 import net.shibboleth.shared.collection.LazyList;
 import net.shibboleth.shared.collection.Pair;
@@ -50,7 +55,7 @@ public final class URISupport {
      * 
      * @return new URI built from the prototype URI and the given fragment
      */
-    public static URI setFragment(final URI prototype, final String fragment) {
+    @Nonnull public static URI setFragment(@Nonnull final URI prototype, @Nullable final String fragment) {
         try {
             return new URI(prototype.getScheme(), prototype.getUserInfo(), prototype.getHost(), prototype.getPort(),
                     prototype.getPath(), prototype.getQuery(), trimOrNullFragment(fragment));
@@ -67,7 +72,7 @@ public final class URISupport {
      * 
      * @return new URI built from the prototype URI and the given host
      */
-    public static URI setHost(final URI prototype, final String host) {
+    @Nonnull public static URI setHost(@Nonnull final URI prototype, @Nullable final String host) {
         try {
             return new URI(prototype.getScheme(), prototype.getUserInfo(), StringSupport.trimOrNull(host),
                     prototype.getPort(), prototype.getPath(), prototype.getQuery(), prototype.getFragment());
@@ -84,7 +89,7 @@ public final class URISupport {
      * 
      * @return new URI built from the prototype URI and the given path
      */
-    public static URI setPath(final URI prototype, final String path) {
+    @Nonnull public static URI setPath(@Nonnull final URI prototype, @Nullable final String path) {
         try {
             return new URI(prototype.getScheme(), prototype.getUserInfo(), prototype.getHost(), prototype.getPort(),
                     trimOrNullPath(path), prototype.getQuery(), prototype.getFragment());
@@ -101,7 +106,7 @@ public final class URISupport {
      * 
      * @return new URI built from the prototype URI and the given port
      */
-    public static URI setPort(final URI prototype, final int port) {
+    @Nonnull public static URI setPort(@Nonnull final URI prototype, final int port) {
         try {
             return new URI(prototype.getScheme(), prototype.getUserInfo(), prototype.getHost(), port,
                     prototype.getPath(), prototype.getQuery(), prototype.getFragment());
@@ -126,7 +131,7 @@ public final class URISupport {
      * 
      * @return new URI built from the prototype URI and the given query
      */
-    public static URI setQuery(final URI prototype, final String query) {
+    @Nonnull public static URI setQuery(@Nonnull final URI prototype, @Nullable final String query) {
         try {
             return new URI(prototype.getScheme(), prototype.getUserInfo(), prototype.getHost(), prototype.getPort(),
                     prototype.getPath(), trimOrNullQuery(query), prototype.getFragment());
@@ -146,12 +151,16 @@ public final class URISupport {
      * For an alternative way of manipulating URL's see {@link URLBuilder}.
      * </p>
      * 
+     * <p>Note that while the input may not contain null elements, its actual elements may themselves
+     * contain null values (the second half of the pair).</p>
+     * 
      * @param prototype prototype URI that provides information other than the query
      * @param parameters query parameters for the new URI
      * 
      * @return new URI built from the prototype URI and the given query
      */
-    public static URI setQuery(final URI prototype, final List<Pair<String, String>> parameters) {
+    @Nonnull public static URI setQuery(@Nonnull final URI prototype,
+            @Nullable final List<Pair<String, String>> parameters) {
         try {
             return new URI(prototype.getScheme(), prototype.getUserInfo(), prototype.getHost(), prototype.getPort(),
                     prototype.getPath(), buildQuery(parameters), prototype.getFragment());
@@ -168,7 +177,7 @@ public final class URISupport {
      * 
      * @return new URI built from the prototype URI and the given scheme
      */
-    public static URI setScheme(final URI prototype, final String scheme) {
+    @Nonnull public static URI setScheme(@Nonnull final URI prototype, @Nullable final String scheme) {
         try {
             return new URI(StringSupport.trimOrNull(scheme), prototype.getUserInfo(), prototype.getHost(),
                     prototype.getPort(), prototype.getPath(), prototype.getQuery(), prototype.getFragment());
@@ -189,7 +198,7 @@ public final class URISupport {
      * @return a suitable URI
      * @throws URISyntaxException if the URI contructor fails
      */
-    public static URI fileURIFromAbsolutePath(final String path) throws URISyntaxException {
+    @Nonnull public static URI fileURIFromAbsolutePath(@Nonnull final String path) throws URISyntaxException {
         final StringBuilder uriPath = new StringBuilder(path.length()+8);
         
         uriPath.append("file://");
@@ -204,11 +213,14 @@ public final class URISupport {
     /**
      * Builds an RFC-3968 encoded URL query component from a collection of parameters.
      * 
-     * @param parameters collection of parameters from which to build the URL query component, may be null or empty
+     * <p>Note that while the input may not contain null elements, its actual elements may themselves
+     * contain null values (the second half of the pair).</p>
+     * 
+     * @param parameters collection of parameters from which to build the URL query component
      * 
      * @return RFC-3968 encoded URL query or null if the parameter collection was null or empty
      */
-    public static String buildQuery(final List<Pair<String, String>> parameters) {
+    @Nullable public static String buildQuery(@Nullable final List<Pair<String, String>> parameters) {
         if (parameters == null || parameters.size() == 0) {
             return null;
         }
@@ -239,7 +251,8 @@ public final class URISupport {
      * 
      * @return a non-null map of query parameter name-> value. Keys will be non-null. Values may be null.
      */
-    @Nonnull public static Map<String,String> buildQueryMap(@Nullable final List<Pair<String, String>> parameters) {
+    @Nonnull @NullableElements @Unmodifiable @NotLive public static Map<String,String> buildQueryMap(
+            @Nullable @NullableElements final List<Pair<String, String>> parameters) {
         if (parameters == null || parameters.size() == 0) {
             return CollectionSupport.emptyMap();
         }
@@ -251,7 +264,8 @@ public final class URISupport {
             }
         }
         
-        return map;
+        // Allow for null values.
+        return Collections.unmodifiableMap(map);
     }
 
     /**
@@ -294,7 +308,7 @@ public final class URISupport {
      * 
      * @return the parameters from the query string, never null
      */
-    public static List<Pair<String, String>> parseQueryString(final String queryString) {
+    @Nonnull @Live public static List<Pair<String, String>> parseQueryString(final String queryString) {
         final String trimmedQuery = trimOrNullQuery(queryString);
         if (trimmedQuery == null) {
             return new LazyList<>();
@@ -323,7 +337,7 @@ public final class URISupport {
      * 
      * @return the trimmed path or null
      */
-    public static String trimOrNullPath(final String path) {
+    @Nullable public static String trimOrNullPath(@Nullable final String path) {
         String trimmedPath = StringSupport.trimOrNull(path);
         if (trimmedPath == null) {
             return null;
@@ -348,7 +362,7 @@ public final class URISupport {
      * 
      * @return the trimmed query or null
      */
-    public static String trimOrNullQuery(final String query) {
+    @Nullable public static String trimOrNullQuery(@Nullable final String query) {
         String trimmedQuery = StringSupport.trimOrNull(query);
         if (trimmedQuery == null) {
             return null;
@@ -373,7 +387,7 @@ public final class URISupport {
      * 
      * @return the trimmed fragment or null
      */
-    public static String trimOrNullFragment(final String fragment) {
+    @Nullable public static String trimOrNullFragment(@Nullable final String fragment) {
         String trimmedFragment = StringSupport.trimOrNull(fragment);
         if (trimmedFragment == null) {
             return null;
@@ -392,7 +406,7 @@ public final class URISupport {
      * @param value the string to decode
      * @return the decoded string
      */
-    public static String doURLDecode(final String value) {
+    @Nullable public static String doURLDecode(@Nullable final String value) {
         if (value == null) {
             return null;
         }
@@ -419,7 +433,7 @@ public final class URISupport {
      * @deprecated
      */
     @Deprecated
-    public static String doURLEncode(final String value) {
+    @Nullable public static String doURLEncode(@Nullable final String value) {
         if (value == null) {
             return null;
         }
diff --git a/shib-networking/src/main/java/net/shibboleth/shared/net/impl/package-info.java b/shib-networking/src/main/java/net/shibboleth/shared/net/impl/package-info.java
index acb43a5c..ef2843ca 100644
--- a/shib-networking/src/main/java/net/shibboleth/shared/net/impl/package-info.java
+++ b/shib-networking/src/main/java/net/shibboleth/shared/net/impl/package-info.java
@@ -16,5 +16,7 @@
  */
 
 /** Implementation classes for working with HTTP URLs and the protocol. */
+ at NonnullElements
+package net.shibboleth.shared.net.impl;
 
-package net.shibboleth.shared.net.impl;
\ No newline at end of file
+import net.shibboleth.shared.annotation.constraint.NonnullElements;
diff --git a/shib-networking/src/main/java/net/shibboleth/shared/net/package-info.java b/shib-networking/src/main/java/net/shibboleth/shared/net/package-info.java
index 1d012f96..54f8533b 100644
--- a/shib-networking/src/main/java/net/shibboleth/shared/net/package-info.java
+++ b/shib-networking/src/main/java/net/shibboleth/shared/net/package-info.java
@@ -18,4 +18,7 @@
 /**
  * Shared networking APIs and classes.
  */
-package net.shibboleth.shared.net;
\ No newline at end of file
+ at NonnullElements
+package net.shibboleth.shared.net;
+
+import net.shibboleth.shared.annotation.constraint.NonnullElements;
diff --git a/shib-networking/src/main/java/net/shibboleth/shared/servlet/AbstractConditionalFilter.java b/shib-networking/src/main/java/net/shibboleth/shared/servlet/AbstractConditionalFilter.java
index 2561ca85..d7e988c9 100644
--- a/shib-networking/src/main/java/net/shibboleth/shared/servlet/AbstractConditionalFilter.java
+++ b/shib-networking/src/main/java/net/shibboleth/shared/servlet/AbstractConditionalFilter.java
@@ -78,6 +78,10 @@ public abstract class AbstractConditionalFilter implements Filter {
     public void doFilter(final ServletRequest request, final ServletResponse response, final FilterChain chain)
             throws IOException, ServletException {
         
+        assert request != null;
+        assert response != null;
+        assert chain != null;
+        
         if (activationCondition.test(request)) {
             runFilter(request, response, chain);
             return;
diff --git a/shib-networking/src/main/java/net/shibboleth/shared/servlet/HttpServletSupport.java b/shib-networking/src/main/java/net/shibboleth/shared/servlet/HttpServletSupport.java
index 79dc147c..53ea9682 100644
--- a/shib-networking/src/main/java/net/shibboleth/shared/servlet/HttpServletSupport.java
+++ b/shib-networking/src/main/java/net/shibboleth/shared/servlet/HttpServletSupport.java
@@ -33,6 +33,7 @@ import jakarta.servlet.ServletRequest;
 import jakarta.servlet.http.HttpServletRequest;
 import jakarta.servlet.http.HttpServletResponse;
 import net.shibboleth.shared.annotation.constraint.NonnullElements;
+import net.shibboleth.shared.annotation.constraint.NotLive;
 import net.shibboleth.shared.annotation.constraint.Unmodifiable;
 import net.shibboleth.shared.collection.CollectionSupport;
 import net.shibboleth.shared.net.MediaTypeSupport;
@@ -43,7 +44,7 @@ import net.shibboleth.shared.primitive.StringSupport;
 public final class HttpServletSupport {
 
     /** Log. */
-    private static final Logger LOG = LoggerFactory.getLogger(HttpServletSupport.class);
+    @Nonnull private static final Logger LOG = LoggerFactory.getLogger(HttpServletSupport.class);
 
     /** Constructor. */
     private HttpServletSupport() {
@@ -86,7 +87,7 @@ public final class HttpServletSupport {
      * 
      * @return constructed URI
      */
-    public static String getRequestPathWithoutContext(@Nonnull final HttpServletRequest request) {
+    @Nonnull public static String getRequestPathWithoutContext(@Nonnull final HttpServletRequest request) {
         final String servletPath = request.getServletPath();
 
         if (request.getPathInfo() == null) {
@@ -104,7 +105,7 @@ public final class HttpServletSupport {
      * 
      * @return URL that was requested to generate this request
      */
-    public static URI getFullRequestURI(@Nonnull final HttpServletRequest request) {
+    @Nonnull public static URI getFullRequestURI(@Nonnull final HttpServletRequest request) {
         final StringBuffer requestUrl = request.getRequestURL();
 
         final String encodedQuery = StringSupport.trimOrNull(request.getQueryString());
@@ -150,13 +151,16 @@ public final class HttpServletSupport {
                 noContentTypeIsValid, isOneOfStrategy);
     }
     
-    /** Return the {@link LanguageRange} associated with this request.  This
+    /** 
+     * Return the {@link LanguageRange} associated with this request.  This
      * is more up to date than {@link HttpServletRequest#getLocales()}.
+     * 
      * @param request the request to process
-     * @return The range.
+     * 
+     * @return The range
      */
-    @Nonnull @NonnullElements @Unmodifiable
-    public static List<LanguageRange> getLanguageRange(@Nonnull final HttpServletRequest request) {
+    @Nonnull @Unmodifiable @NotLive public static List<LanguageRange> getLanguageRange(
+            @Nonnull final HttpServletRequest request) {
         
         final String languages = StringSupport.trimOrNull(request.getHeader("Accept-Language"));
         if (languages != null) {
@@ -190,4 +194,4 @@ public final class HttpServletSupport {
         return addr;
     }
     
-}
+}
\ No newline at end of file
diff --git a/shib-networking/src/main/java/net/shibboleth/shared/servlet/impl/HttpServletRequestResponseContext.java b/shib-networking/src/main/java/net/shibboleth/shared/servlet/impl/HttpServletRequestResponseContext.java
index 60bccef1..409825bb 100644
--- a/shib-networking/src/main/java/net/shibboleth/shared/servlet/impl/HttpServletRequestResponseContext.java
+++ b/shib-networking/src/main/java/net/shibboleth/shared/servlet/impl/HttpServletRequestResponseContext.java
@@ -35,10 +35,10 @@ import net.shibboleth.shared.logic.Constraint;
 public final class HttpServletRequestResponseContext {
 
     /** ThreadLocal storage for request. */
-    private static ThreadLocal<HttpServletRequest> currentRequest = new ThreadLocal<>();
+    @Nonnull private static final ThreadLocal<HttpServletRequest> currentRequest = new ThreadLocal<>();
 
     /** ThreadLocal storage for response. */
-    private static ThreadLocal<HttpServletResponse> currentResponse = new ThreadLocal<>();
+    @Nonnull private static final ThreadLocal<HttpServletResponse> currentResponse = new ThreadLocal<>();
 
     /** Constructor. */
     private HttpServletRequestResponseContext() {
diff --git a/shib-networking/src/main/java/net/shibboleth/shared/servlet/impl/ThreadLocalHttpServletRequestSupplier.java b/shib-networking/src/main/java/net/shibboleth/shared/servlet/impl/ThreadLocalHttpServletRequestSupplier.java
index 895d372c..bff45eb9 100644
--- a/shib-networking/src/main/java/net/shibboleth/shared/servlet/impl/ThreadLocalHttpServletRequestSupplier.java
+++ b/shib-networking/src/main/java/net/shibboleth/shared/servlet/impl/ThreadLocalHttpServletRequestSupplier.java
@@ -20,12 +20,12 @@ package net.shibboleth.shared.servlet.impl;
 import javax.annotation.Nonnull;
 
 import jakarta.servlet.http.HttpServletRequest;
-import net.shibboleth.shared.logic.Constraint;
 import net.shibboleth.shared.primitive.NonnullSupplier;
 
 /**
  * An implementation of {@link NonnullSupplier} which looks up the current thread-local
- * servlet request obtained from {@link HttpServletRequestResponseContext}.
+ * servlet request obtained from {@link HttpServletRequestResponseContext}, raising an
+ * {@link IllegalStateException} if null.
  */
 public class ThreadLocalHttpServletRequestSupplier implements NonnullSupplier<HttpServletRequest> {
 
@@ -36,9 +36,13 @@ public class ThreadLocalHttpServletRequestSupplier implements NonnullSupplier<Ht
      * @return the current request
      */
     @Nonnull public HttpServletRequest get() {
-        final HttpServletRequest req = Constraint.isNotNull(HttpServletRequestResponseContext.getRequest(),
-                "Current HttpServletRequest has not been loaded via HttpServletRequestResponseContext");
-        assert req != null;
+        final HttpServletRequest req = HttpServletRequestResponseContext.getRequest();
+        if (req == null) {
+            throw new IllegalStateException(
+                    "Current HttpServletRequest has not been loaded via HttpServletRequestResponseContext");
+        }
+        
         return req;
     }
-}
+
+}
\ No newline at end of file
diff --git a/shib-networking/src/main/java/net/shibboleth/shared/servlet/impl/ThreadLocalHttpServletResponseSupplier.java b/shib-networking/src/main/java/net/shibboleth/shared/servlet/impl/ThreadLocalHttpServletResponseSupplier.java
index 736236cd..2b39b868 100644
--- a/shib-networking/src/main/java/net/shibboleth/shared/servlet/impl/ThreadLocalHttpServletResponseSupplier.java
+++ b/shib-networking/src/main/java/net/shibboleth/shared/servlet/impl/ThreadLocalHttpServletResponseSupplier.java
@@ -20,12 +20,12 @@ package net.shibboleth.shared.servlet.impl;
 import javax.annotation.Nonnull;
 
 import jakarta.servlet.http.HttpServletResponse;
-import net.shibboleth.shared.logic.Constraint;
 import net.shibboleth.shared.primitive.NonnullSupplier;
 
 /**
  * An implementation of {@link NonnullSupplier} which looks up the current thread-local
- * servlet response obtained from {@link HttpServletRequestResponseContext}.
+ * servlet response obtained from {@link HttpServletRequestResponseContext}, raising an
+ * {@link IllegalStateException} if null.
  */
 public class ThreadLocalHttpServletResponseSupplier implements NonnullSupplier<HttpServletResponse> {
 
@@ -36,9 +36,13 @@ public class ThreadLocalHttpServletResponseSupplier implements NonnullSupplier<H
      * @return the current response
      */
     @Nonnull public HttpServletResponse get() {
-        final HttpServletResponse response = Constraint.isNotNull(HttpServletRequestResponseContext.getResponse(),
-                "Current HttpServletResponse has not been loaded via HttpServletRequestResponseContext");
-        assert response!=null;
+        final HttpServletResponse response = HttpServletRequestResponseContext.getResponse();
+        if (response == null) {
+            throw new IllegalStateException(
+                    "Current HttpServletResponse has not been loaded via HttpServletRequestResponseContext");
+        }
+        
         return response;
     }
-}
+
+}
\ No newline at end of file
diff --git a/shib-networking/src/main/java/net/shibboleth/shared/servlet/impl/package-info.java b/shib-networking/src/main/java/net/shibboleth/shared/servlet/impl/package-info.java
index 868a1bb7..52a236ee 100644
--- a/shib-networking/src/main/java/net/shibboleth/shared/servlet/impl/package-info.java
+++ b/shib-networking/src/main/java/net/shibboleth/shared/servlet/impl/package-info.java
@@ -18,4 +18,7 @@
 /**
  * Java Servlet specification implementation classes.
  */
-package net.shibboleth.shared.servlet.impl;
\ No newline at end of file
+ at NonnullElements
+package net.shibboleth.shared.servlet.impl;
+
+import net.shibboleth.shared.annotation.constraint.NonnullElements;
diff --git a/shib-networking/src/main/java/net/shibboleth/shared/servlet/package-info.java b/shib-networking/src/main/java/net/shibboleth/shared/servlet/package-info.java
index 0d9e7aae..83c713d9 100644
--- a/shib-networking/src/main/java/net/shibboleth/shared/servlet/package-info.java
+++ b/shib-networking/src/main/java/net/shibboleth/shared/servlet/package-info.java
@@ -18,4 +18,7 @@
 /**
  * Java servlet specification APIs.
  */
-package net.shibboleth.shared.servlet;
\ No newline at end of file
+ at NonnullElements
+package net.shibboleth.shared.servlet;
+
+import net.shibboleth.shared.annotation.constraint.NonnullElements;
diff --git a/shib-security-spring/src/main/java/net/shibboleth/shared/spring/security/factory/PKCS11PrivateKeyFactoryBean.java b/shib-security-spring/src/main/java/net/shibboleth/shared/spring/security/factory/PKCS11PrivateKeyFactoryBean.java
index bd774b70..0b2036cc 100644
--- a/shib-security-spring/src/main/java/net/shibboleth/shared/spring/security/factory/PKCS11PrivateKeyFactoryBean.java
+++ b/shib-security-spring/src/main/java/net/shibboleth/shared/spring/security/factory/PKCS11PrivateKeyFactoryBean.java
@@ -26,10 +26,12 @@ import java.security.Provider;
 import java.security.Security;
 
 import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
 
 import org.slf4j.Logger;
 import org.springframework.beans.factory.FactoryBean;
 
+import net.shibboleth.shared.annotation.constraint.NotEmpty;
 import net.shibboleth.shared.primitive.LoggerFactory;
 
 /**
@@ -40,32 +42,32 @@ import net.shibboleth.shared.primitive.LoggerFactory;
 public class PKCS11PrivateKeyFactoryBean implements FactoryBean<PrivateKey> {
 
     /** The name for the base PKCS#11 provider. */
-    private static final String UNCONFIGURED_PROVIDER_NAME = "SunPKCS11";
+    @Nonnull @NotEmpty private static final String UNCONFIGURED_PROVIDER_NAME = "SunPKCS11";
 
     /** Singleton {@link Provider} for all instances of this factory. */
-    private static Provider provider;
+    @Nullable private static Provider provider;
 
     /** Class logger. */
     @Nonnull private final Logger log = LoggerFactory.getLogger(PKCS11PrivateKeyFactoryBean.class);
 
     /** PKCS#11 provider parameter string. */
-    private String pkcs11Config;
+    @Nullable private String pkcs11Config;
 
     /** Alias for the private key. */
-    private String keyAlias;
+    @Nullable private String keyAlias;
 
     /** Password for the private key. */
-    private String keyPassword;
+    @Nullable private String keyPassword;
 
     /** The singleton instance of the private key produced by this factory. */
-    private PrivateKey key;
+    @Nullable private PrivateKey key;
 
     /**
      * Returns the PKCS#11 configuration.
      * 
      * @return returns the PKCS#11 configuration.
      */
-    public String getPkcs11Config() {
+    @Nullable public String getPkcs11Config() {
         return pkcs11Config;
     }
 
@@ -74,7 +76,7 @@ public class PKCS11PrivateKeyFactoryBean implements FactoryBean<PrivateKey> {
      * 
      * @param config the PKCS#11 configuration to use
      */
-    public void setPkcs11Config(@Nonnull final String config) {
+    public void setPkcs11Config(@Nullable final String config) {
         pkcs11Config = config;
     }
 
@@ -83,7 +85,7 @@ public class PKCS11PrivateKeyFactoryBean implements FactoryBean<PrivateKey> {
      * 
      * @return returns the key alias in use
      */
-    public String getKeyAlias() {
+    @Nullable public String getKeyAlias() {
         return keyAlias;
     }
 
@@ -92,7 +94,7 @@ public class PKCS11PrivateKeyFactoryBean implements FactoryBean<PrivateKey> {
      * 
      * @param alias the key alias to use
      */
-    public void setKeyAlias(final String alias) {
+    public void setKeyAlias(@Nullable final String alias) {
         keyAlias = alias;
     }
 
@@ -101,7 +103,7 @@ public class PKCS11PrivateKeyFactoryBean implements FactoryBean<PrivateKey> {
      * 
      * @return returns the key password in use
      */
-    public String getKeyPassword() {
+    @Nullable public String getKeyPassword() {
         return keyPassword;
     }
 
@@ -110,7 +112,7 @@ public class PKCS11PrivateKeyFactoryBean implements FactoryBean<PrivateKey> {
      * 
      * @param password the key password to use
      */
-    public void setKeyPassword(@Nonnull final String password) {
+    public void setKeyPassword(@Nullable final String password) {
         keyPassword = password;
     }
 
@@ -122,7 +124,7 @@ public class PKCS11PrivateKeyFactoryBean implements FactoryBean<PrivateKey> {
      * @return the singleton {@link Provider}
      * @throws Exception if something goes wrong building the {@link Provider}
      */
-    private Provider getProvider() throws Exception {
+    @Nonnull private Provider getProvider() throws Exception {
         if (provider == null) {
             final var baseProvider = Security.getProvider(UNCONFIGURED_PROVIDER_NAME);
             if (baseProvider == null) {
@@ -131,6 +133,7 @@ public class PKCS11PrivateKeyFactoryBean implements FactoryBean<PrivateKey> {
             provider = baseProvider.configure(pkcs11Config);
             Security.addProvider(provider);
         }
+        assert provider != null;
         return provider;
     }
 
@@ -140,19 +143,23 @@ public class PKCS11PrivateKeyFactoryBean implements FactoryBean<PrivateKey> {
      * @return the {@link KeyStore}
      * @throws Exception if something goes wrong building the keystore
      */
-    private KeyStore getKeyStore() throws Exception {
+    @Nonnull private KeyStore getKeyStore() throws Exception {
         final KeyStore keystore = KeyStore.getInstance("PKCS11", getProvider());
 
         log.debug("Initializing PKCS11 keystore");
-        keystore.load(null, keyPassword.toCharArray());
+        keystore.load(null, keyPassword != null ? keyPassword.toCharArray() : null);
         return keystore;
     }
 
     @Override
-    public PrivateKey getObject() throws Exception {
+    @Nonnull public PrivateKey getObject() throws Exception {
         if (key == null) {
+            if (keyPassword == null) {
+                throw new GeneralSecurityException("Key password was null");
+            }
             final KeyStore keystore = getKeyStore();
 
+            assert keyPassword != null;
             final KeyStore.Entry keyEntry = keystore.getEntry(keyAlias,
                     new KeyStore.PasswordProtection(keyPassword.toCharArray()));
             if (keyEntry == null) {
@@ -167,6 +174,7 @@ public class PKCS11PrivateKeyFactoryBean implements FactoryBean<PrivateKey> {
             }
         }
 
+        assert key != null;
         return key;
     }
 
diff --git a/shib-security-spring/src/main/java/net/shibboleth/shared/spring/security/factory/PrivateKeyFactoryBean.java b/shib-security-spring/src/main/java/net/shibboleth/shared/spring/security/factory/PrivateKeyFactoryBean.java
index 96f9a8a3..217eb899 100644
--- a/shib-security-spring/src/main/java/net/shibboleth/shared/spring/security/factory/PrivateKeyFactoryBean.java
+++ b/shib-security-spring/src/main/java/net/shibboleth/shared/spring/security/factory/PrivateKeyFactoryBean.java
@@ -23,7 +23,6 @@ import java.security.PrivateKey;
 import javax.annotation.Nonnull;
 import javax.annotation.Nullable;
 
-import net.shibboleth.shared.logic.Constraint;
 import net.shibboleth.shared.primitive.StringSupport;
 
 import org.cryptacular.util.KeyPairUtil;
@@ -39,7 +38,7 @@ import org.springframework.core.io.Resource;
 public class PrivateKeyFactoryBean implements FactoryBean<PrivateKey> {
 
     /** Private key resource. */
-    private Resource resource;
+    @Nullable private Resource resource;
 
     /** Password for the private key. */
     private String keyPass;
@@ -52,8 +51,8 @@ public class PrivateKeyFactoryBean implements FactoryBean<PrivateKey> {
      * 
      * @param res private key resource, never <code>null</code>
      */
-    public void setResource(@Nonnull final Resource res) {
-        resource = Constraint.isNotNull(res, "Private key resource can not be null");
+    public void setResource(@Nullable final Resource res) {
+        resource = res;
     }
 
     /**
@@ -72,7 +71,8 @@ public class PrivateKeyFactoryBean implements FactoryBean<PrivateKey> {
                 throw new BeanCreationException("Private key resource must be provided in order to use this factory.");
             }
 
-            try (InputStream is = resource.getInputStream()) {
+            assert resource != null;
+            try (final InputStream is = resource.getInputStream()) {
                 if (keyPass == null) {
                     key = KeyPairUtil.readPrivateKey(is);
                 } else {
@@ -93,4 +93,5 @@ public class PrivateKeyFactoryBean implements FactoryBean<PrivateKey> {
     @Override public boolean isSingleton() {
         return true;
     }
+
 }
\ No newline at end of file
diff --git a/shib-security-spring/src/main/java/net/shibboleth/shared/spring/security/factory/PublicKeyFactoryBean.java b/shib-security-spring/src/main/java/net/shibboleth/shared/spring/security/factory/PublicKeyFactoryBean.java
index de41710e..75dcb5e3 100644
--- a/shib-security-spring/src/main/java/net/shibboleth/shared/spring/security/factory/PublicKeyFactoryBean.java
+++ b/shib-security-spring/src/main/java/net/shibboleth/shared/spring/security/factory/PublicKeyFactoryBean.java
@@ -21,14 +21,13 @@ import java.io.InputStream;
 import java.security.PublicKey;
 
 import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
 
 import org.cryptacular.util.KeyPairUtil;
 import org.springframework.beans.factory.BeanCreationException;
 import org.springframework.beans.factory.FactoryBean;
 import org.springframework.core.io.Resource;
 
-import net.shibboleth.shared.logic.Constraint;
-
 /**
  * Spring bean factory for producing a {@link PublicKey} from a {@link Resource}.
  * 
@@ -37,18 +36,18 @@ import net.shibboleth.shared.logic.Constraint;
 public class PublicKeyFactoryBean implements FactoryBean<PublicKey> {
 
     /** Public key resource. */
-    private Resource resource;
+    @Nullable private Resource resource;
 
     /** The singleton instance of the public key produced by this factory. */
-    private PublicKey key;
+    @Nullable private PublicKey key;
 
     /**
      * Sets the public key resource.
      * 
      * @param res public key resource
      */
-    public void setResource(@Nonnull final Resource res) {
-        resource = Constraint.isNotNull(res, "Public key resource can not be null");
+    public void setResource(@Nullable final Resource res) {
+        resource = res;
     }
 
     /** {@inheritDoc} */
@@ -58,7 +57,8 @@ public class PublicKeyFactoryBean implements FactoryBean<PublicKey> {
                 throw new BeanCreationException("Public key resource must be provided in order to use this factory.");
             }
 
-            try (InputStream is = resource.getInputStream()) {
+            assert resource != null;
+            try (final InputStream is = resource.getInputStream()) {
                 key = KeyPairUtil.readPublicKey(is);
             }
         }
diff --git a/shib-security-spring/src/main/java/net/shibboleth/shared/spring/security/factory/X509CertificateChainFactoryBean.java b/shib-security-spring/src/main/java/net/shibboleth/shared/spring/security/factory/X509CertificateChainFactoryBean.java
index 3a09716f..cd057b1e 100644
--- a/shib-security-spring/src/main/java/net/shibboleth/shared/spring/security/factory/X509CertificateChainFactoryBean.java
+++ b/shib-security-spring/src/main/java/net/shibboleth/shared/spring/security/factory/X509CertificateChainFactoryBean.java
@@ -21,14 +21,13 @@ import java.io.InputStream;
 import java.security.cert.X509Certificate;
 
 import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
 
 import org.cryptacular.util.CertUtil;
 import org.springframework.beans.factory.BeanCreationException;
 import org.springframework.beans.factory.FactoryBean;
 import org.springframework.core.io.Resource;
 
-import net.shibboleth.shared.logic.Constraint;
-
 /**
  * Spring bean factory for producing a {@link X509Certificate} chain from a {@link Resource}.
  * 
@@ -37,18 +36,18 @@ import net.shibboleth.shared.logic.Constraint;
 public class X509CertificateChainFactoryBean implements FactoryBean<X509Certificate[]> {
 
     /** Certificate chain resource. */
-    private Resource resource;
+    @Nullable private Resource resource;
 
     /** The singleton instance of the public certificate chain produced by this factory. */
-    private X509Certificate[] certificates;
+    @Nullable private X509Certificate[] certificates;
 
     /**
      * Sets the certificate chain resource.
      * 
      * @param res certificate chain resource
      */
-    public void setResource(@Nonnull final Resource res) {
-        resource = Constraint.isNotNull(res, "Certificate chain resource can not be null");
+    public void setResource(@Nullable final Resource res) {
+        resource = res;
     }
 
     /** {@inheritDoc} */
@@ -59,7 +58,8 @@ public class X509CertificateChainFactoryBean implements FactoryBean<X509Certific
                         "Certificate chain resource must be provided in order to use this factory.");
             }
 
-            try (InputStream is = resource.getInputStream()) {
+            assert resource != null;
+            try (final InputStream is = resource.getInputStream()) {
                 certificates = CertUtil.readCertificateChain(is);
             }
         }
@@ -76,4 +76,5 @@ public class X509CertificateChainFactoryBean implements FactoryBean<X509Certific
     @Override public boolean isSingleton() {
         return true;
     }
+    
 }
\ No newline at end of file
diff --git a/shib-security-spring/src/main/java/net/shibboleth/shared/spring/security/factory/X509CertificateFactoryBean.java b/shib-security-spring/src/main/java/net/shibboleth/shared/spring/security/factory/X509CertificateFactoryBean.java
index 04fef112..11c80f29 100644
--- a/shib-security-spring/src/main/java/net/shibboleth/shared/spring/security/factory/X509CertificateFactoryBean.java
+++ b/shib-security-spring/src/main/java/net/shibboleth/shared/spring/security/factory/X509CertificateFactoryBean.java
@@ -21,14 +21,13 @@ import java.io.InputStream;
 import java.security.cert.X509Certificate;
 
 import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
 
 import org.cryptacular.util.CertUtil;
 import org.springframework.beans.factory.BeanCreationException;
 import org.springframework.beans.factory.FactoryBean;
 import org.springframework.core.io.Resource;
 
-import net.shibboleth.shared.logic.Constraint;
-
 /**
  * Spring bean factory for producing a {@link X509Certificate} from a {@link Resource}.
  * 
@@ -37,18 +36,18 @@ import net.shibboleth.shared.logic.Constraint;
 public class X509CertificateFactoryBean implements FactoryBean<X509Certificate> {
 
     /** Certificate chain resource. */
-    private Resource resource;
+    @Nullable private Resource resource;
 
     /** The singleton instance of the certificate produced by this factory. */
-    private X509Certificate certificate;
+    @Nullable private X509Certificate certificate;
 
     /**
      * Sets the certificate resource.
      * 
      * @param res certificate resource
      */
-    public void setResource(@Nonnull final Resource res) {
-        resource = Constraint.isNotNull(res, "Certificate resource can not be null");
+    public void setResource(@Nullable final Resource res) {
+        resource = res;
     }
 
     /** {@inheritDoc} */
@@ -58,7 +57,8 @@ public class X509CertificateFactoryBean implements FactoryBean<X509Certificate>
                 throw new BeanCreationException("Certificate resource must be provided in order to use this factory.");
             }
 
-            try (InputStream is = resource.getInputStream()) {
+            assert resource != null;
+            try (final InputStream is = resource.getInputStream()) {
                 certificate = CertUtil.readCertificate(is);
             }
         }
@@ -75,4 +75,5 @@ public class X509CertificateFactoryBean implements FactoryBean<X509Certificate>
     @Override public boolean isSingleton() {
         return true;
     }
+
 }
\ No newline at end of file
diff --git a/shib-security-spring/src/main/java/net/shibboleth/shared/spring/security/factory/package-info.java b/shib-security-spring/src/main/java/net/shibboleth/shared/spring/security/factory/package-info.java
index 09f535fd..5388c759 100644
--- a/shib-security-spring/src/main/java/net/shibboleth/shared/spring/security/factory/package-info.java
+++ b/shib-security-spring/src/main/java/net/shibboleth/shared/spring/security/factory/package-info.java
@@ -18,4 +18,7 @@
 /**
  * Factory beans for security classes.
  */
-package net.shibboleth.shared.spring.security.factory;
\ No newline at end of file
+ at NonnullElements
+package net.shibboleth.shared.spring.security.factory;
+
+import net.shibboleth.shared.annotation.constraint.NonnullElements;
diff --git a/shib-security/src/main/java/net/shibboleth/shared/security/impl/BasicAccessControlService.java b/shib-security/src/main/java/net/shibboleth/shared/security/impl/BasicAccessControlService.java
index 4560e065..982effe4 100644
--- a/shib-security/src/main/java/net/shibboleth/shared/security/impl/BasicAccessControlService.java
+++ b/shib-security/src/main/java/net/shibboleth/shared/security/impl/BasicAccessControlService.java
@@ -26,7 +26,6 @@ import javax.annotation.Nullable;
 import org.slf4j.Logger;
 
 import jakarta.servlet.ServletRequest;
-import net.shibboleth.shared.annotation.constraint.NonnullElements;
 import net.shibboleth.shared.collection.CollectionSupport;
 import net.shibboleth.shared.component.AbstractIdentifiableInitializableComponent;
 import net.shibboleth.shared.primitive.LoggerFactory;
@@ -42,7 +41,7 @@ public class BasicAccessControlService extends AbstractIdentifiableInitializable
     @Nonnull private final Logger log = LoggerFactory.getLogger(BasicAccessControlService.class);
     
     /** Map of named policies. */
-    @Nonnull @NonnullElements private Map<String,AccessControl> policyMap;
+    @Nonnull private Map<String,AccessControl> policyMap;
     
     /** Constructor. */
     public BasicAccessControlService() {
@@ -54,7 +53,7 @@ public class BasicAccessControlService extends AbstractIdentifiableInitializable
      * 
      * @param map map of named policies
      */
-    public void setPolicyMap(@Nullable @NonnullElements final Map<String,AccessControl> map) {
+    public void setPolicyMap(@Nullable final Map<String,AccessControl> map) {
         checkSetterPreconditions();
         
         if (map != null) {
@@ -91,4 +90,4 @@ public class BasicAccessControlService extends AbstractIdentifiableInitializable
         };
     }
 
-}
+}
\ No newline at end of file
diff --git a/shib-security/src/main/java/net/shibboleth/shared/security/impl/BasicKeystoreKeyStrategyTool.java b/shib-security/src/main/java/net/shibboleth/shared/security/impl/BasicKeystoreKeyStrategyTool.java
index 06a664c9..4baafa78 100644
--- a/shib-security/src/main/java/net/shibboleth/shared/security/impl/BasicKeystoreKeyStrategyTool.java
+++ b/shib-security/src/main/java/net/shibboleth/shared/security/impl/BasicKeystoreKeyStrategyTool.java
@@ -137,6 +137,7 @@ public class BasicKeystoreKeyStrategyTool {
         args.versionFile = Constraint.isNotNull(file, "Key versioning file cannot be null");
     }
     
+// Checkstyle: CyclomaticComplexity OFF
     /**
      * The main routine.
      * 
@@ -207,6 +208,7 @@ public class BasicKeystoreKeyStrategyTool {
             versionInfo.store(versionOut, null);
         }
     }
+// Checkstyle: CyclomaticComplexity ON
     
     /**
      * Command line entry point.
diff --git a/shib-security/src/main/java/net/shibboleth/shared/security/impl/IPRangeAccessControl.java b/shib-security/src/main/java/net/shibboleth/shared/security/impl/IPRangeAccessControl.java
index 0c657107..2510df37 100644
--- a/shib-security/src/main/java/net/shibboleth/shared/security/impl/IPRangeAccessControl.java
+++ b/shib-security/src/main/java/net/shibboleth/shared/security/impl/IPRangeAccessControl.java
@@ -27,7 +27,6 @@ import org.slf4j.Logger;
 import com.google.common.net.InetAddresses;
 
 import jakarta.servlet.ServletRequest;
-import net.shibboleth.shared.annotation.constraint.NonnullElements;
 import net.shibboleth.shared.collection.CollectionSupport;
 import net.shibboleth.shared.component.AbstractIdentifiableInitializableComponent;
 import net.shibboleth.shared.logic.Constraint;
@@ -45,7 +44,7 @@ public class IPRangeAccessControl extends AbstractIdentifiableInitializableCompo
     @Nonnull private final Logger log = LoggerFactory.getLogger(IPRangeAccessControl.class);
 
     /** List of CIDR blocks allowed to access this servlet. */
-    @Nonnull @NonnullElements private Collection<IPRange> allowedRanges;
+    @Nonnull private Collection<IPRange> allowedRanges;
     
     /**
      * Constructor.
@@ -60,7 +59,7 @@ public class IPRangeAccessControl extends AbstractIdentifiableInitializableCompo
      * 
      * @param ranges ranges to allow
      */
-    public void setAllowedRanges(@Nonnull @NonnullElements final Collection<IPRange> ranges) {
+    public void setAllowedRanges(@Nonnull final Collection<IPRange> ranges) {
         checkSetterPreconditions();
         Constraint.isNotNull(ranges, "IPRange collection cannot be null");
         
diff --git a/shib-security/src/main/java/net/shibboleth/shared/security/impl/RandomIdentifierGenerationStrategy.java b/shib-security/src/main/java/net/shibboleth/shared/security/impl/RandomIdentifierGenerationStrategy.java
index f9c2cd62..d57095b0 100644
--- a/shib-security/src/main/java/net/shibboleth/shared/security/impl/RandomIdentifierGenerationStrategy.java
+++ b/shib-security/src/main/java/net/shibboleth/shared/security/impl/RandomIdentifierGenerationStrategy.java
@@ -118,4 +118,5 @@ public class RandomIdentifierGenerationStrategy implements IdentifierGenerationS
             throw new RuntimeException(e);
         }
     }
+
 }
\ No newline at end of file
diff --git a/shib-security/src/main/java/net/shibboleth/shared/security/impl/ScriptedKeyStrategy.java b/shib-security/src/main/java/net/shibboleth/shared/security/impl/ScriptedKeyStrategy.java
index 90df04e3..f8d7625c 100644
--- a/shib-security/src/main/java/net/shibboleth/shared/security/impl/ScriptedKeyStrategy.java
+++ b/shib-security/src/main/java/net/shibboleth/shared/security/impl/ScriptedKeyStrategy.java
@@ -191,7 +191,7 @@ public class ScriptedKeyStrategy extends AbstractInitializableComponent implemen
             } else {
                 internalTaskTimer = updateTaskTimer;
             }
-            assert(internalTaskTimer != null);
+            assert internalTaskTimer != null;
             internalTaskTimer.schedule(updateTask, updateInterval.toMillis(), updateInterval.toMillis());
         }
     }
@@ -230,6 +230,7 @@ public class ScriptedKeyStrategy extends AbstractInitializableComponent implemen
     }
     
     /** {@inheritDoc} */
+    @SuppressWarnings("null")
     @Nonnull public SecretKey getKey(@Nonnull @NotEmpty final String name) throws KeyException {
         synchronized(this) {
             if (defaultKey != null && name.equals(currentAlias)) {
@@ -254,7 +255,7 @@ public class ScriptedKeyStrategy extends AbstractInitializableComponent implemen
                 return (SecretKey) result;
             } else if (result instanceof Pair && ((Pair<?,?>) result).getSecond() instanceof SecretKey) {
                 final SecretKey key = (SecretKey) ((Pair<?,?>) result).getSecond();
-                assert(key != null);
+                assert key != null;
                 synchronized(this) {
                     keyCache.put(name, key);
                 }
diff --git a/shib-security/src/main/java/net/shibboleth/shared/security/impl/SelfSignedCertificateGenerator.java b/shib-security/src/main/java/net/shibboleth/shared/security/impl/SelfSignedCertificateGenerator.java
index 8d54928e..b7b188c9 100644
--- a/shib-security/src/main/java/net/shibboleth/shared/security/impl/SelfSignedCertificateGenerator.java
+++ b/shib-security/src/main/java/net/shibboleth/shared/security/impl/SelfSignedCertificateGenerator.java
@@ -56,7 +56,6 @@ import com.beust.jcommander.JCommander;
 import com.beust.jcommander.Parameter;
 import com.beust.jcommander.converters.BaseConverter;
 
-import net.shibboleth.shared.annotation.constraint.NonnullElements;
 import net.shibboleth.shared.annotation.constraint.NotEmpty;
 import net.shibboleth.shared.annotation.constraint.Positive;
 import net.shibboleth.shared.logic.Constraint;
@@ -179,7 +178,7 @@ public class SelfSignedCertificateGenerator {
      * 
      * @param altNames collection of subject alt names.
      */
-    public void setDNSSubjectAltNames(@Nonnull @NonnullElements final Collection<String> altNames) {
+    public void setDNSSubjectAltNames(@Nonnull final Collection<String> altNames) {
         args.dnsSubjectAltNames = new ArrayList<>(StringSupport.normalizeStringCollection(altNames));
     }
 
@@ -188,7 +187,7 @@ public class SelfSignedCertificateGenerator {
      * 
      * @param altNames collection of subject alt names.
      */
-    public void setURISubjectAltNames(@Nonnull @NonnullElements final Collection<String> altNames) {
+    public void setURISubjectAltNames(@Nonnull final Collection<String> altNames) {
         args.uriSubjectAltNames = new ArrayList<>(StringSupport.normalizeStringCollection(altNames));
     }
     
@@ -248,7 +247,7 @@ public class SelfSignedCertificateGenerator {
             final KeyStore store = KeyStore.getInstance(args.keystoreType);
             store.load(null, null);
             final String password = args.keystorePassword;
-            assert(password != null);
+            assert password != null;
             store.setKeyEntry(args.hostname, keypair.getPrivate(), password.toCharArray(),
                     new X509Certificate[] {certificate});
 
@@ -336,7 +335,7 @@ public class SelfSignedCertificateGenerator {
      * 
      * @return subject alt names for the certificate
      */
-    @Nonnull @NonnullElements protected ASN1Encodable[] buildSubjectAltNames() {
+    @Nonnull protected ASN1Encodable[] buildSubjectAltNames() {
         
         final ArrayList<ASN1Encodable> subjectAltNames = new ArrayList<>();
 
diff --git a/shib-security/src/main/java/net/shibboleth/shared/security/impl/Type4UUIDIdentifierGenerationStrategy.java b/shib-security/src/main/java/net/shibboleth/shared/security/impl/Type4UUIDIdentifierGenerationStrategy.java
index d66e8be9..fa94756b 100644
--- a/shib-security/src/main/java/net/shibboleth/shared/security/impl/Type4UUIDIdentifierGenerationStrategy.java
+++ b/shib-security/src/main/java/net/shibboleth/shared/security/impl/Type4UUIDIdentifierGenerationStrategy.java
@@ -46,7 +46,8 @@ public class Type4UUIDIdentifierGenerationStrategy implements IdentifierGenerati
      */
     public Type4UUIDIdentifierGenerationStrategy(@Nonnull final IdentifierGenerationStrategy.ParameterSpec params)
             throws InvalidAlgorithmParameterException {
-        throw new InvalidAlgorithmParameterException("Type4UUIDIdentifierGenerationStrategy does not support parameters");
+        throw new InvalidAlgorithmParameterException(
+                "Type4UUIDIdentifierGenerationStrategy does not support parameters");
     }
 
     /** {@inheritDoc} */
diff --git a/shib-security/src/main/java/net/shibboleth/shared/security/impl/package-info.java b/shib-security/src/main/java/net/shibboleth/shared/security/impl/package-info.java
index 629b8672..8b670b88 100644
--- a/shib-security/src/main/java/net/shibboleth/shared/security/impl/package-info.java
+++ b/shib-security/src/main/java/net/shibboleth/shared/security/impl/package-info.java
@@ -18,5 +18,7 @@
 /**
  * Implementations of security interfaces.
  */
+ at NonnullElements
+package net.shibboleth.shared.security.impl;
 
-package net.shibboleth.shared.security.impl;
\ No newline at end of file
+import net.shibboleth.shared.annotation.constraint.NonnullElements;
diff --git a/shib-security/src/main/java/net/shibboleth/shared/security/package-info.java b/shib-security/src/main/java/net/shibboleth/shared/security/package-info.java
index 2b051a0e..114db03c 100644
--- a/shib-security/src/main/java/net/shibboleth/shared/security/package-info.java
+++ b/shib-security/src/main/java/net/shibboleth/shared/security/package-info.java
@@ -16,5 +16,7 @@
  */
 
 /** Helpers for common security related tasks. */
+ at NonnullElements
+package net.shibboleth.shared.security;
 
-package net.shibboleth.shared.security;
\ No newline at end of file
+import net.shibboleth.shared.annotation.constraint.NonnullElements;
diff --git a/shib-service/src/main/java/net/shibboleth/shared/service/ReloadableServiceGaugeSet.java b/shib-service/src/main/java/net/shibboleth/shared/service/ReloadableServiceGaugeSet.java
index ac207174..738e6bb5 100644
--- a/shib-service/src/main/java/net/shibboleth/shared/service/ReloadableServiceGaugeSet.java
+++ b/shib-service/src/main/java/net/shibboleth/shared/service/ReloadableServiceGaugeSet.java
@@ -31,7 +31,6 @@ import com.codahale.metrics.MetricSet;
 import net.shibboleth.shared.annotation.ParameterName;
 import net.shibboleth.shared.annotation.constraint.Live;
 import net.shibboleth.shared.annotation.constraint.NonnullAfterInit;
-import net.shibboleth.shared.annotation.constraint.NonnullElements;
 import net.shibboleth.shared.annotation.constraint.NotEmpty;
 import net.shibboleth.shared.collection.CollectionSupport;
 import net.shibboleth.shared.component.AbstractInitializableComponent;
@@ -45,7 +44,7 @@ import net.shibboleth.shared.logic.Constraint;
 public class ReloadableServiceGaugeSet<T> extends AbstractInitializableComponent implements MetricSet, MetricFilter {
 
     /** The map of gauges. */
-    @Nonnull @NonnullElements private Map<String,Metric> gauges;
+    @Nonnull private Map<String,Metric> gauges;
     
     /** The service to report on. */
     @NonnullAfterInit private ReloadableService<T> service;
@@ -135,7 +134,7 @@ public class ReloadableServiceGaugeSet<T> extends AbstractInitializableComponent
      * 
      * @return map of metrics
      */
-    @Nonnull @NonnullElements @Live protected Map<String,Metric> getMetricMap() {
+    @Nonnull @Live protected Map<String,Metric> getMetricMap() {
         return gauges;
     }
 
diff --git a/shib-service/src/main/java/net/shibboleth/shared/service/impl/LogbackLoggingService.java b/shib-service/src/main/java/net/shibboleth/shared/service/impl/LogbackLoggingService.java
index e7391115..e033c516 100644
--- a/shib-service/src/main/java/net/shibboleth/shared/service/impl/LogbackLoggingService.java
+++ b/shib-service/src/main/java/net/shibboleth/shared/service/impl/LogbackLoggingService.java
@@ -209,7 +209,7 @@ public class LogbackLoggingService extends AbstractReloadableService<Object>
      * 
      * @throws ServiceException thrown is there is a problem loading the logging configuration
      */
-    protected void loadLoggingConfiguration(final InputStream loggingConfig) {
+    protected void loadLoggingConfiguration(@Nonnull final InputStream loggingConfig) {
         try {
             loggerContext.reset();
             loadHomeProperty();
diff --git a/shib-service/src/main/java/net/shibboleth/shared/service/impl/package-info.java b/shib-service/src/main/java/net/shibboleth/shared/service/impl/package-info.java
index ae474308..bac5fe75 100644
--- a/shib-service/src/main/java/net/shibboleth/shared/service/impl/package-info.java
+++ b/shib-service/src/main/java/net/shibboleth/shared/service/impl/package-info.java
@@ -18,4 +18,7 @@
 /**
  * Implementations of shared service interfaces.
  */
-package net.shibboleth.shared.service.impl;
\ No newline at end of file
+ at NonnullElements
+package net.shibboleth.shared.service.impl;
+
+import net.shibboleth.shared.annotation.constraint.NonnullElements;
diff --git a/shib-service/src/main/java/net/shibboleth/shared/service/package-info.java b/shib-service/src/main/java/net/shibboleth/shared/service/package-info.java
index 98adb97e..90acc040 100644
--- a/shib-service/src/main/java/net/shibboleth/shared/service/package-info.java
+++ b/shib-service/src/main/java/net/shibboleth/shared/service/package-info.java
@@ -18,4 +18,7 @@
 /**
  * Shared service APIs.
  */
-package net.shibboleth.shared.service;
\ No newline at end of file
+ at NonnullElements
+package net.shibboleth.shared.service;
+
+import net.shibboleth.shared.annotation.constraint.NonnullElements;
diff --git a/shib-service/src/main/java/net/shibboleth/shared/service/reloadable/ProxiedFactoryBean.java b/shib-service/src/main/java/net/shibboleth/shared/service/reloadable/ProxiedFactoryBean.java
index e47c0b16..28f90fa8 100644
--- a/shib-service/src/main/java/net/shibboleth/shared/service/reloadable/ProxiedFactoryBean.java
+++ b/shib-service/src/main/java/net/shibboleth/shared/service/reloadable/ProxiedFactoryBean.java
@@ -105,7 +105,7 @@ public class ProxiedFactoryBean<T> extends AbstractFactoryBean<T> {
 
     /** {@inheritDoc} */
     @Override
-    public Class<T> getObjectType() {
+    @Nonnull public Class<T> getObjectType() {
         return beanType;
     }
 
diff --git a/shib-service/src/main/java/net/shibboleth/shared/service/reloadable/package-info.java b/shib-service/src/main/java/net/shibboleth/shared/service/reloadable/package-info.java
index fbd3bc82..f96ec883 100644
--- a/shib-service/src/main/java/net/shibboleth/shared/service/reloadable/package-info.java
+++ b/shib-service/src/main/java/net/shibboleth/shared/service/reloadable/package-info.java
@@ -18,4 +18,7 @@
 /**
  * Classes related to reloading beans.
  */
-package net.shibboleth.shared.service.reloadable;
\ No newline at end of file
+ at NonnullElements
+package net.shibboleth.shared.service.reloadable;
+
+import net.shibboleth.shared.annotation.constraint.NonnullElements;
diff --git a/shib-service/src/main/java/net/shibboleth/shared/service/security/impl/DelegatingAccessControlService.java b/shib-service/src/main/java/net/shibboleth/shared/service/security/impl/DelegatingAccessControlService.java
index 9dcfcf65..bb08ba05 100644
--- a/shib-service/src/main/java/net/shibboleth/shared/service/security/impl/DelegatingAccessControlService.java
+++ b/shib-service/src/main/java/net/shibboleth/shared/service/security/impl/DelegatingAccessControlService.java
@@ -44,7 +44,7 @@ public class DelegatingAccessControlService extends AbstractIdentifiableInitiali
     @Nonnull private final Logger log = LoggerFactory.getLogger(DelegatingAccessControlService.class);
 
     /** The service which manages the reloading. */
-    private final ReloadableService<AccessControlService> service;
+    @Nonnull private final ReloadableService<AccessControlService> service;
 
     /**
      * Constructor.
diff --git a/shib-service/src/main/java/net/shibboleth/shared/service/security/impl/ReloadingAccessControlService.java b/shib-service/src/main/java/net/shibboleth/shared/service/security/impl/ReloadingAccessControlService.java
index fe5917c3..507c8b79 100644
--- a/shib-service/src/main/java/net/shibboleth/shared/service/security/impl/ReloadingAccessControlService.java
+++ b/shib-service/src/main/java/net/shibboleth/shared/service/security/impl/ReloadingAccessControlService.java
@@ -34,7 +34,7 @@ public class ReloadingAccessControlService extends AbstractServiceableComponent<
         implements AccessControlService {
 
     /** The embedded service. */
-    private final AccessControlService service;
+    @Nonnull private final AccessControlService service;
 
     /**
      * Constructor.
diff --git a/shib-service/src/main/java/net/shibboleth/shared/service/security/impl/ServiceableAccessControlService.java b/shib-service/src/main/java/net/shibboleth/shared/service/security/impl/ServiceableAccessControlService.java
index 4f1afe70..534bdec4 100644
--- a/shib-service/src/main/java/net/shibboleth/shared/service/security/impl/ServiceableAccessControlService.java
+++ b/shib-service/src/main/java/net/shibboleth/shared/service/security/impl/ServiceableAccessControlService.java
@@ -34,7 +34,7 @@ public class ServiceableAccessControlService extends AbstractServiceableComponen
         implements AccessControlService {
 
     /** The embedded service. */
-    private final AccessControlService service;
+    @Nonnull private final AccessControlService service;
 
     /**
      * Constructor.
diff --git a/shib-service/src/main/java/net/shibboleth/shared/service/security/impl/package-info.java b/shib-service/src/main/java/net/shibboleth/shared/service/security/impl/package-info.java
index c361c579..1a8b9c14 100644
--- a/shib-service/src/main/java/net/shibboleth/shared/service/security/impl/package-info.java
+++ b/shib-service/src/main/java/net/shibboleth/shared/service/security/impl/package-info.java
@@ -18,4 +18,7 @@
 /**
  * Security-related service implementation classes.
  */
-package net.shibboleth.shared.service.security.impl;
\ No newline at end of file
+ at NonnullElements
+package net.shibboleth.shared.service.security.impl;
+
+import net.shibboleth.shared.annotation.constraint.NonnullElements;
diff --git a/shib-service/src/main/java/net/shibboleth/shared/spring/service/ApplicationContextServiceableComponent.java b/shib-service/src/main/java/net/shibboleth/shared/spring/service/ApplicationContextServiceableComponent.java
index 214d3aa8..b312bbe0 100644
--- a/shib-service/src/main/java/net/shibboleth/shared/spring/service/ApplicationContextServiceableComponent.java
+++ b/shib-service/src/main/java/net/shibboleth/shared/spring/service/ApplicationContextServiceableComponent.java
@@ -21,8 +21,6 @@ import javax.annotation.Nonnull;
 
 import org.springframework.context.ApplicationContext;
 
-import net.shibboleth.shared.logic.Constraint;
-
 /**
  * Wraps a Spring {@link ApplicationContext} so it can itself be exposed as a serviceable component.
  * 
@@ -34,7 +32,10 @@ public class ApplicationContextServiceableComponent extends AbstractServiceableC
     @Override
     @Nonnull public ApplicationContext getComponent() {
         final ApplicationContext context = getApplicationContext();
-        return Constraint.isNotNull(context, "ApplicationContext not yet set");
+        if (context != null) {
+            return context;
+        }
+        throw new IllegalStateException("ApplicationContext not yet set");
     }
 
 }
\ No newline at end of file
diff --git a/shib-service/src/main/java/net/shibboleth/shared/spring/service/ClassBasedServiceStrategy.java b/shib-service/src/main/java/net/shibboleth/shared/spring/service/ClassBasedServiceStrategy.java
index bbb8400d..a8d8f81c 100644
--- a/shib-service/src/main/java/net/shibboleth/shared/spring/service/ClassBasedServiceStrategy.java
+++ b/shib-service/src/main/java/net/shibboleth/shared/spring/service/ClassBasedServiceStrategy.java
@@ -48,7 +48,7 @@ public class ClassBasedServiceStrategy<T>
      * @param serviceableClaz what to look for.
      */
     public ClassBasedServiceStrategy(
-            @ParameterName(name="serviceableClaz") final Class<T> serviceableClaz) {
+            @ParameterName(name="serviceableClaz") @Nonnull final Class<T> serviceableClaz) {
         serviceClaz = Constraint.isNotNull(serviceableClaz, "Serviceable Class cannot be null");
     }
 
diff --git a/shib-service/src/main/java/net/shibboleth/shared/spring/service/ReloadableSpringService.java b/shib-service/src/main/java/net/shibboleth/shared/spring/service/ReloadableSpringService.java
index d3deccee..b6431f21 100644
--- a/shib-service/src/main/java/net/shibboleth/shared/spring/service/ReloadableSpringService.java
+++ b/shib-service/src/main/java/net/shibboleth/shared/spring/service/ReloadableSpringService.java
@@ -42,7 +42,6 @@ import org.springframework.core.convert.ConversionService;
 import org.springframework.core.io.Resource;
 
 import net.shibboleth.shared.annotation.ParameterName;
-import net.shibboleth.shared.annotation.constraint.NonnullElements;
 import net.shibboleth.shared.collection.CollectionSupport;
 import net.shibboleth.shared.component.ComponentInitializationException;
 import net.shibboleth.shared.logic.Constraint;
@@ -73,16 +72,16 @@ public class ReloadableSpringService<T> extends AbstractReloadableService<T> imp
     @Nonnull private final Logger log = LoggerFactory.getLogger(ReloadableSpringService.class);
 
     /** List of configuration resources for this service. */
-    @Nonnull @NonnullElements private List<Resource> serviceConfigurations;
+    @Nonnull private List<Resource> serviceConfigurations;
 
     /** List of bean factory post processors for this service's content. */
-    @Nonnull @NonnullElements private List<BeanFactoryPostProcessor> factoryPostProcessors;
+    @Nonnull private List<BeanFactoryPostProcessor> factoryPostProcessors;
 
     /** List of bean post processors for this service's content. */
-    @Nonnull @NonnullElements private List<BeanPostProcessor> postProcessors;
+    @Nonnull private List<BeanPostProcessor> postProcessors;
     
     /** Bean profiles to enable. */
-    @Nonnull @NonnullElements private Collection<String> beanProfiles;
+    @Nonnull private Collection<String> beanProfiles;
 
     /** Conversion service to use. */
     @Nullable private ConversionService conversionService;
@@ -175,7 +174,7 @@ public class ReloadableSpringService<T> extends AbstractReloadableService<T> imp
      * 
      * @param configs list of configurations for this service
      */
-    public void setServiceConfigurations(@Nonnull @NonnullElements final List<Resource> configs) {
+    public void setServiceConfigurations(@Nonnull final List<Resource> configs) {
         checkSetterPreconditions();
 
         serviceConfigurations = CollectionSupport.copyToList(
@@ -224,8 +223,7 @@ public class ReloadableSpringService<T> extends AbstractReloadableService<T> imp
      * 
      * @param processors bean factory post processors to apply
      */
-    public void setBeanFactoryPostProcessors(
-            @Nonnull @NonnullElements final List<BeanFactoryPostProcessor> processors) {
+    public void setBeanFactoryPostProcessors(@Nonnull final List<BeanFactoryPostProcessor> processors) {
         checkSetterPreconditions();
         Constraint.isNotNull(processors, "BeanFactoryPostProcessor collection cannot be null");
 
@@ -237,7 +235,7 @@ public class ReloadableSpringService<T> extends AbstractReloadableService<T> imp
      * 
      * @param processors bean post processors to apply
      */
-    public void setBeanPostProcessors(@Nonnull @NonnullElements final List<BeanPostProcessor> processors) {
+    public void setBeanPostProcessors(@Nonnull final List<BeanPostProcessor> processors) {
         checkSetterPreconditions();
         Constraint.isNotNull(processors, "BeanPostProcessor collection cannot be null");
 
@@ -251,7 +249,7 @@ public class ReloadableSpringService<T> extends AbstractReloadableService<T> imp
      * 
      * @since 5.4.0
      */
-    public void setBeanProfiles(@Nonnull @NonnullElements final Collection<String> profiles) {
+    public void setBeanProfiles(@Nonnull final Collection<String> profiles) {
         checkSetterPreconditions();
         
         beanProfiles = StringSupport.normalizeStringCollection(profiles);
diff --git a/shib-service/src/main/java/net/shibboleth/shared/spring/service/impl/SpringServiceableComponent.java b/shib-service/src/main/java/net/shibboleth/shared/spring/service/impl/SpringServiceableComponent.java
index 92d9c775..b6188de4 100644
--- a/shib-service/src/main/java/net/shibboleth/shared/spring/service/impl/SpringServiceableComponent.java
+++ b/shib-service/src/main/java/net/shibboleth/shared/spring/service/impl/SpringServiceableComponent.java
@@ -40,7 +40,7 @@ public class SpringServiceableComponent<T> extends AbstractServiceableComponent<
      *
      * @param what the object we are wrapping.
      */
-    public SpringServiceableComponent(final @Nonnull T what) {
+    public SpringServiceableComponent(@Nonnull final T what) {
         theComponent = what;
         if (what instanceof IdentifiableComponent) {
             @Nullable final String id = ((IdentifiableComponent) what).getId();
diff --git a/shib-service/src/main/java/net/shibboleth/shared/spring/service/impl/package-info.java b/shib-service/src/main/java/net/shibboleth/shared/spring/service/impl/package-info.java
index e559e947..9eacea2d 100644
--- a/shib-service/src/main/java/net/shibboleth/shared/spring/service/impl/package-info.java
+++ b/shib-service/src/main/java/net/shibboleth/shared/spring/service/impl/package-info.java
@@ -19,5 +19,7 @@
  * Spring specific implementation of 
  * {@link net.shibboleth.shared.spring.service.AbstractServiceableComponent}.
  */
+ at NonnullElements
+package net.shibboleth.shared.spring.service.impl;
 
-package net.shibboleth.shared.spring.service.impl;
\ No newline at end of file
+import net.shibboleth.shared.annotation.constraint.NonnullElements;
diff --git a/shib-service/src/main/java/net/shibboleth/shared/spring/service/package-info.java b/shib-service/src/main/java/net/shibboleth/shared/spring/service/package-info.java
index bbfca8ff..bdc1b4f7 100644
--- a/shib-service/src/main/java/net/shibboleth/shared/spring/service/package-info.java
+++ b/shib-service/src/main/java/net/shibboleth/shared/spring/service/package-info.java
@@ -20,5 +20,7 @@
  * {@link net.shibboleth.shared.service.ServiceableComponent} and 
  * {@link net.shibboleth.shared.service.ReloadableService}.
  */
+ at NonnullElements
+package net.shibboleth.shared.spring.service;
 
-package net.shibboleth.shared.spring.service;
\ No newline at end of file
+import net.shibboleth.shared.annotation.constraint.NonnullElements;
diff --git a/shib-spring/src/main/java/net/shibboleth/ext/spring/context/DelimiterAwareApplicationContext.java b/shib-spring/src/main/java/net/shibboleth/ext/spring/context/DelimiterAwareApplicationContext.java
index fdf1aa36..deb69c0d 100644
--- a/shib-spring/src/main/java/net/shibboleth/ext/spring/context/DelimiterAwareApplicationContext.java
+++ b/shib-spring/src/main/java/net/shibboleth/ext/spring/context/DelimiterAwareApplicationContext.java
@@ -30,6 +30,7 @@ public class DelimiterAwareApplicationContext
         extends net.shibboleth.shared.spring.context.DelimiterAwareApplicationContext {
 
     /** Constructor. */
+    @SuppressWarnings("null")
     public DelimiterAwareApplicationContext() {
         DeprecationSupport.warn(ObjectType.CLASS, getClass().getName(), "web.xml",
                 "auto-registration via updated web.xml");
diff --git a/shib-spring/src/main/java/net/shibboleth/shared/spring/config/DeprecatedBeanDetector.java b/shib-spring/src/main/java/net/shibboleth/shared/spring/config/DeprecatedBeanDetector.java
index db81fb97..bd27e5d1 100644
--- a/shib-spring/src/main/java/net/shibboleth/shared/spring/config/DeprecatedBeanDetector.java
+++ b/shib-spring/src/main/java/net/shibboleth/shared/spring/config/DeprecatedBeanDetector.java
@@ -27,7 +27,6 @@ import org.springframework.context.ApplicationContext;
 import org.springframework.context.ApplicationListener;
 import org.springframework.context.event.ContextRefreshedEvent;
 
-import net.shibboleth.shared.annotation.constraint.NonnullElements;
 import net.shibboleth.shared.primitive.DeprecationSupport;
 import net.shibboleth.shared.primitive.StringSupport;
 import net.shibboleth.shared.primitive.DeprecationSupport.ObjectType;
@@ -47,7 +46,7 @@ public class DeprecatedBeanDetector implements ApplicationListener<ContextRefres
     @Nullable private final String warnContext;
     
     /** Deprecated bean names. */
-    @Nonnull @NonnullElements private final Map<String,String> beanNames; 
+    @Nonnull private final Map<String,String> beanNames; 
     
     /**
      * Constructor.
diff --git a/shib-spring/src/main/java/net/shibboleth/shared/spring/config/IdentifiableBeanPostProcessor.java b/shib-spring/src/main/java/net/shibboleth/shared/spring/config/IdentifiableBeanPostProcessor.java
index 14f59b2b..c607767b 100644
--- a/shib-spring/src/main/java/net/shibboleth/shared/spring/config/IdentifiableBeanPostProcessor.java
+++ b/shib-spring/src/main/java/net/shibboleth/shared/spring/config/IdentifiableBeanPostProcessor.java
@@ -35,7 +35,7 @@ public class IdentifiableBeanPostProcessor implements BeanPostProcessor {
     @Nonnull private final Logger log = LoggerFactory.getLogger(IdentifiableBeanPostProcessor.class);
 
     /** {@inheritDoc} */
-    public Object postProcessBeforeInitialization(@Nonnull final Object bean, @Nonnull final String beanName) {
+    @Nonnull public Object postProcessBeforeInitialization(@Nonnull final Object bean, @Nonnull final String beanName) {
         if (bean instanceof IdentifiableComponent) {
             final IdentifiableComponent component = (IdentifiableComponent) bean;
             final String id = component.getId();
@@ -54,7 +54,7 @@ public class IdentifiableBeanPostProcessor implements BeanPostProcessor {
     }
 
     /** {@inheritDoc} */
-    public Object postProcessAfterInitialization(@Nonnull final Object bean, @Nonnull final String beanName) {
+    @Nonnull public Object postProcessAfterInitialization(@Nonnull final Object bean, @Nonnull final String beanName) {
         return bean;
     }
 
diff --git a/shib-spring/src/main/java/net/shibboleth/shared/spring/config/IdentifiedComponentManager.java b/shib-spring/src/main/java/net/shibboleth/shared/spring/config/IdentifiedComponentManager.java
index 51a28181..c9827a81 100644
--- a/shib-spring/src/main/java/net/shibboleth/shared/spring/config/IdentifiedComponentManager.java
+++ b/shib-spring/src/main/java/net/shibboleth/shared/spring/config/IdentifiedComponentManager.java
@@ -26,7 +26,6 @@ import javax.annotation.Nullable;
 
 import org.slf4j.Logger;
 
-import net.shibboleth.shared.annotation.constraint.NonnullElements;
 import net.shibboleth.shared.collection.CollectionSupport;
 import net.shibboleth.shared.component.IdentifiedComponent;
 import net.shibboleth.shared.primitive.LoggerFactory;
@@ -51,17 +50,17 @@ public class IdentifiedComponentManager<T extends IdentifiedComponent> {
     @Nonnull private Logger log = LoggerFactory.getLogger(IdentifiedComponentManager.class);
     
     /** Initial component list. */
-    @Nonnull @NonnullElements private Collection<T> initialComponents;
+    @Nonnull private Collection<T> initialComponents;
 
     /** Underlying collection. */
-    @Nonnull @NonnullElements private Collection<T> components;
+    @Nonnull private Collection<T> components;
 
     /**
      * Auto-wiring point for free-standing objects.
      * 
      * @param freeObjects free-standing objects
      */
-    public IdentifiedComponentManager(@Nullable @NonnullElements final Collection<T> freeObjects) {
+    public IdentifiedComponentManager(@Nullable final Collection<T> freeObjects) {
         if (freeObjects != null) {
             initialComponents = CollectionSupport.copyToList(freeObjects);
         } else {
@@ -78,7 +77,7 @@ public class IdentifiedComponentManager<T extends IdentifiedComponent> {
      * 
      * @param additionalObjects additional objects
      */
-    public void setComponents(@Nullable @NonnullElements final Collection<T> additionalObjects) {
+    public void setComponents(@Nullable final Collection<T> additionalObjects) {
         if (additionalObjects != null) {
             final Collection<T> holder = new LinkedHashSet<>(additionalObjects);
             holder.addAll(
@@ -102,7 +101,7 @@ public class IdentifiedComponentManager<T extends IdentifiedComponent> {
      * 
      * @return merged components
      */
-    @Nonnull @NonnullElements public Collection<T> getComponents() {
+    @Nonnull public Collection<T> getComponents() {
         return components;
     }
     
diff --git a/shib-spring/src/main/java/net/shibboleth/shared/spring/config/RelocatedBeanFactoryPostProcessor.java b/shib-spring/src/main/java/net/shibboleth/shared/spring/config/RelocatedBeanFactoryPostProcessor.java
index 50a2c149..5be0d6e3 100644
--- a/shib-spring/src/main/java/net/shibboleth/shared/spring/config/RelocatedBeanFactoryPostProcessor.java
+++ b/shib-spring/src/main/java/net/shibboleth/shared/spring/config/RelocatedBeanFactoryPostProcessor.java
@@ -28,7 +28,6 @@ import org.springframework.beans.factory.config.BeanFactoryPostProcessor;
 import org.springframework.beans.factory.config.ConfigurableListableBeanFactory;
 
 import net.shibboleth.shared.annotation.ParameterName;
-import net.shibboleth.shared.annotation.constraint.NonnullElements;
 import net.shibboleth.shared.collection.CollectionSupport;
 import net.shibboleth.shared.primitive.DeprecationSupport;
 import net.shibboleth.shared.primitive.StringSupport;
@@ -42,10 +41,10 @@ import net.shibboleth.shared.primitive.DeprecationSupport.ObjectType;
 public class RelocatedBeanFactoryPostProcessor implements BeanFactoryPostProcessor {
     
     /** Relocated classes. */
-    @Nonnull @NonnullElements private Map<String,String> movedClasses;
+    @Nonnull private Map<String,String> movedClasses;
 
     /** Relocated beans. */
-    @Nonnull @NonnullElements private Map<String,String> movedBeans;
+    @Nonnull private Map<String,String> movedBeans;
 
     /** Constructor. */
     public RelocatedBeanFactoryPostProcessor() {
diff --git a/shib-spring/src/main/java/net/shibboleth/shared/spring/config/StringToDurationConverter.java b/shib-spring/src/main/java/net/shibboleth/shared/spring/config/StringToDurationConverter.java
index 987f0ea2..d93cd851 100644
--- a/shib-spring/src/main/java/net/shibboleth/shared/spring/config/StringToDurationConverter.java
+++ b/shib-spring/src/main/java/net/shibboleth/shared/spring/config/StringToDurationConverter.java
@@ -20,6 +20,7 @@ package net.shibboleth.shared.spring.config;
 import java.time.Duration;
 
 import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
 
 import org.springframework.core.convert.converter.Converter;
 
@@ -31,7 +32,8 @@ import net.shibboleth.shared.xml.DOMTypeSupport;
 public class StringToDurationConverter implements Converter<String,Duration> {
 
     /** {@inheritDoc} */
-    public Duration convert(@Nonnull final String source) {
+    @SuppressWarnings("null")
+    @Nullable public Duration convert(@Nonnull final String source) {
         if (source.startsWith("P") || source.startsWith("-P")) {
             return DOMTypeSupport.stringToDuration(source.trim());
         }
diff --git a/shib-spring/src/main/java/net/shibboleth/shared/spring/config/StringToPeriodConverter.java b/shib-spring/src/main/java/net/shibboleth/shared/spring/config/StringToPeriodConverter.java
index 61f38bab..c79499aa 100644
--- a/shib-spring/src/main/java/net/shibboleth/shared/spring/config/StringToPeriodConverter.java
+++ b/shib-spring/src/main/java/net/shibboleth/shared/spring/config/StringToPeriodConverter.java
@@ -20,6 +20,7 @@ package net.shibboleth.shared.spring.config;
 import java.time.Period;
 
 import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
 
 import org.springframework.core.convert.converter.Converter;
 
@@ -29,7 +30,7 @@ import org.springframework.core.convert.converter.Converter;
 public class StringToPeriodConverter implements Converter<String,Period> {
 
     /** {@inheritDoc} */
-    public Period convert(@Nonnull final String source) {
+    @Nullable public Period convert(@Nonnull final String source) {
         if (source.startsWith("P") || source.startsWith("-P")) {
             return Period.parse(source);
         }
@@ -37,4 +38,5 @@ public class StringToPeriodConverter implements Converter<String,Period> {
         // Treat as days.
         return Period.ofDays(Integer.valueOf(source));
     }
-}
+
+}
\ No newline at end of file
diff --git a/shib-spring/src/main/java/net/shibboleth/shared/spring/config/StringToResourceConverter.java b/shib-spring/src/main/java/net/shibboleth/shared/spring/config/StringToResourceConverter.java
index 7f9b0ace..69373869 100644
--- a/shib-spring/src/main/java/net/shibboleth/shared/spring/config/StringToResourceConverter.java
+++ b/shib-spring/src/main/java/net/shibboleth/shared/spring/config/StringToResourceConverter.java
@@ -46,7 +46,7 @@ public class StringToResourceConverter implements Converter<String, Resource>, A
     @Nonnull private final Logger log = LoggerFactory.getLogger(StringToResourceConverter.class);
 
     /** {@inheritDoc} */
-    public Resource convert(@Nonnull final String source) {
+    @Nullable public Resource convert(@Nonnull final String source) {
         
         ResourceLoader loader = applicationContext;
         if (loader == null) {
diff --git a/shib-spring/src/main/java/net/shibboleth/shared/spring/config/package-info.java b/shib-spring/src/main/java/net/shibboleth/shared/spring/config/package-info.java
index ee2e120b..366568b7 100644
--- a/shib-spring/src/main/java/net/shibboleth/shared/spring/config/package-info.java
+++ b/shib-spring/src/main/java/net/shibboleth/shared/spring/config/package-info.java
@@ -18,4 +18,7 @@
 /**
  * Classes supporting Spring configuration activities.
  */
-package net.shibboleth.shared.spring.config;
\ No newline at end of file
+ at NonnullElements
+package net.shibboleth.shared.spring.config;
+
+import net.shibboleth.shared.annotation.constraint.NonnullElements;
diff --git a/shib-spring/src/main/java/net/shibboleth/shared/spring/context/AbstractPropertiesApplicationContextInitializer.java b/shib-spring/src/main/java/net/shibboleth/shared/spring/context/AbstractPropertiesApplicationContextInitializer.java
index f34421e8..3bff0d89 100644
--- a/shib-spring/src/main/java/net/shibboleth/shared/spring/context/AbstractPropertiesApplicationContextInitializer.java
+++ b/shib-spring/src/main/java/net/shibboleth/shared/spring/context/AbstractPropertiesApplicationContextInitializer.java
@@ -46,7 +46,6 @@ import org.springframework.core.env.PropertiesPropertySource;
 import org.springframework.core.io.ClassPathResource;
 import org.springframework.core.io.Resource;
 
-import net.shibboleth.shared.annotation.constraint.NonnullElements;
 import net.shibboleth.shared.annotation.constraint.NotEmpty;
 import net.shibboleth.shared.annotation.constraint.NotLive;
 import net.shibboleth.shared.annotation.constraint.Unmodifiable;
@@ -253,7 +252,7 @@ public abstract class AbstractPropertiesApplicationContextInitializer
      * 
      * @return a collection of paths
      */
-    @Nonnull @NonnullElements @NotLive @Unmodifiable protected Collection<String> getAdditionalSources(
+    @Nonnull @Unmodifiable @NotLive protected Collection<String> getAdditionalSources(
             @Nonnull final String searchLocation, @Nonnull final Properties properties) {
        final Collection<String> sources = new ArrayList<>();
        
diff --git a/shib-spring/src/main/java/net/shibboleth/shared/spring/context/DeferPlaceholderFileSystemXmlWebApplicationContext.java b/shib-spring/src/main/java/net/shibboleth/shared/spring/context/DeferPlaceholderFileSystemXmlWebApplicationContext.java
index 2f57397d..9f72031a 100644
--- a/shib-spring/src/main/java/net/shibboleth/shared/spring/context/DeferPlaceholderFileSystemXmlWebApplicationContext.java
+++ b/shib-spring/src/main/java/net/shibboleth/shared/spring/context/DeferPlaceholderFileSystemXmlWebApplicationContext.java
@@ -29,10 +29,6 @@ public class DeferPlaceholderFileSystemXmlWebApplicationContext extends FileSyst
     /** Whether property sources have been initialized. */
     private boolean propertySourcesInitialized;
 
-    /** Constructor. */
-    public DeferPlaceholderFileSystemXmlWebApplicationContext() {
-    }
-
     /**
      * {@inheritDoc}
      * 
diff --git a/shib-spring/src/main/java/net/shibboleth/shared/spring/context/DelimiterAwareApplicationContext.java b/shib-spring/src/main/java/net/shibboleth/shared/spring/context/DelimiterAwareApplicationContext.java
index d44e7258..e7f41e38 100644
--- a/shib-spring/src/main/java/net/shibboleth/shared/spring/context/DelimiterAwareApplicationContext.java
+++ b/shib-spring/src/main/java/net/shibboleth/shared/spring/context/DelimiterAwareApplicationContext.java
@@ -46,8 +46,7 @@ public class DelimiterAwareApplicationContext extends DeferPlaceholderFileSystem
      * 
      * @return the delimiters
      */
-    @Nonnull
-    protected String getDelimiters() {
+    @Nonnull protected String getDelimiters() {
         return ",;\t\n";
     }
 
diff --git a/shib-spring/src/main/java/net/shibboleth/shared/spring/context/FileSystemXmlWebApplicationContext.java b/shib-spring/src/main/java/net/shibboleth/shared/spring/context/FileSystemXmlWebApplicationContext.java
index dc8c18a7..1745d9a8 100644
--- a/shib-spring/src/main/java/net/shibboleth/shared/spring/context/FileSystemXmlWebApplicationContext.java
+++ b/shib-spring/src/main/java/net/shibboleth/shared/spring/context/FileSystemXmlWebApplicationContext.java
@@ -71,6 +71,7 @@ public class FileSystemXmlWebApplicationContext extends XmlWebApplicationContext
      * Supports wildcard classpath locations prefixed with {@link ResourcePatternResolver#CLASSPATH_ALL_URL_PREFIX}.
      * </p>
      */
+    @SuppressWarnings("null")
     @Override
     @Nonnull public Resource getResource(@Nonnull final String location) {
         Constraint.isNotNull(location, "Location must not be null");
diff --git a/shib-spring/src/main/java/net/shibboleth/shared/spring/context/package-info.java b/shib-spring/src/main/java/net/shibboleth/shared/spring/context/package-info.java
index dd9081ef..cbb4797f 100644
--- a/shib-spring/src/main/java/net/shibboleth/shared/spring/context/package-info.java
+++ b/shib-spring/src/main/java/net/shibboleth/shared/spring/context/package-info.java
@@ -18,4 +18,7 @@
 /**
  * Spring application context classes.
  */
-package net.shibboleth.shared.spring.context;
\ No newline at end of file
+ at NonnullElements
+package net.shibboleth.shared.spring.context;
+
+import net.shibboleth.shared.annotation.constraint.NonnullElements;
diff --git a/shib-spring/src/main/java/net/shibboleth/shared/spring/custom/BaseSpringNamespaceHandler.java b/shib-spring/src/main/java/net/shibboleth/shared/spring/custom/BaseSpringNamespaceHandler.java
index bbf43b7a..b2d51c65 100644
--- a/shib-spring/src/main/java/net/shibboleth/shared/spring/custom/BaseSpringNamespaceHandler.java
+++ b/shib-spring/src/main/java/net/shibboleth/shared/spring/custom/BaseSpringNamespaceHandler.java
@@ -45,7 +45,6 @@ import org.w3c.dom.Element;
 import org.w3c.dom.Node;
 
 import net.shibboleth.shared.annotation.ParameterName;
-import net.shibboleth.shared.annotation.constraint.NonnullElements;
 import net.shibboleth.shared.annotation.constraint.NotEmpty;
 import net.shibboleth.shared.primitive.LoggerFactory;
 import net.shibboleth.shared.primitive.StringSupport;
@@ -80,7 +79,7 @@ public abstract class BaseSpringNamespaceHandler implements NamespaceHandler {
      * Stores the {@link BeanDefinitionParser} implementations keyed by the local name of the {@link Element Elements}
      * they handle.
      */
-    @Nonnull @NonnullElements private final Map<QName,BeanDefinitionParser> parsers;
+    @Nonnull private final Map<QName,BeanDefinitionParser> parsers;
 
     /** Constructor. */
     public BaseSpringNamespaceHandler() {
@@ -153,7 +152,7 @@ public abstract class BaseSpringNamespaceHandler implements NamespaceHandler {
      * 
      * @return the parser for the given bean element
      */
-    protected BeanDefinitionParser findParserForElement(@Nonnull final Element element) {
+    @Nonnull protected BeanDefinitionParser findParserForElement(@Nonnull final Element element) {
         BeanDefinitionParser parser = null;
 
         final QName typeName = DOMTypeSupport.getXSIType(element);
diff --git a/shib-spring/src/main/java/net/shibboleth/shared/spring/custom/EmbeddedAndSchemaAwareReader.java b/shib-spring/src/main/java/net/shibboleth/shared/spring/custom/EmbeddedAndSchemaAwareReader.java
index 0f35d848..dbfcdc33 100644
--- a/shib-spring/src/main/java/net/shibboleth/shared/spring/custom/EmbeddedAndSchemaAwareReader.java
+++ b/shib-spring/src/main/java/net/shibboleth/shared/spring/custom/EmbeddedAndSchemaAwareReader.java
@@ -48,7 +48,7 @@ public class EmbeddedAndSchemaAwareReader extends SchemaTypeAwareBeanDefinitionD
         
         super.registerBeanDefinitions(doc, readerContext);
         
-        final List<Element> beans = ElementSupport.getChildElements(doc.getDocumentElement(), 
+        final List<Element> beans = ElementSupport.getChildElements(ElementSupport.ensureDocumentElement(doc), 
                 new QName(BeanDefinitionParserDelegate.BEANS_NAMESPACE_URI, NESTED_BEANS_ELEMENT));
         if (beans.isEmpty()) {
             return;
diff --git a/shib-spring/src/main/java/net/shibboleth/shared/spring/custom/SecondaryNamespaceHandler.java b/shib-spring/src/main/java/net/shibboleth/shared/spring/custom/SecondaryNamespaceHandler.java
index af68181a..c5566e6e 100644
--- a/shib-spring/src/main/java/net/shibboleth/shared/spring/custom/SecondaryNamespaceHandler.java
+++ b/shib-spring/src/main/java/net/shibboleth/shared/spring/custom/SecondaryNamespaceHandler.java
@@ -25,7 +25,6 @@ import javax.xml.namespace.QName;
 import org.springframework.beans.factory.xml.BeanDefinitionParser;
 import org.w3c.dom.Element;
 
-import net.shibboleth.shared.annotation.constraint.NonnullElements;
 import net.shibboleth.shared.collection.CollectionSupport;
 import net.shibboleth.shared.logic.Constraint;
 
@@ -40,7 +39,7 @@ public abstract class SecondaryNamespaceHandler {
      * Stores the {@link BeanDefinitionParser} implementations keyed by the local name of the {@link Element Elements}
      * they handle.
      */
-    @Nonnull @NonnullElements private Map<QName, BeanDefinitionParser> parsers; 
+    @Nonnull private Map<QName, BeanDefinitionParser> parsers; 
     
     /** Constructor. */
     public SecondaryNamespaceHandler() {
@@ -54,7 +53,7 @@ public abstract class SecondaryNamespaceHandler {
      *  
      * @param theParsers the parsers to use.
      */
-    protected void init(@Nonnull @NonnullElements final Map<QName, BeanDefinitionParser> theParsers) {
+    protected void init(@Nonnull final Map<QName, BeanDefinitionParser> theParsers) {
         parsers = Constraint.isNotNull(theParsers, "Parser map cannot be null");
         doInit();
     }
diff --git a/shib-spring/src/main/java/net/shibboleth/shared/spring/custom/package-info.java b/shib-spring/src/main/java/net/shibboleth/shared/spring/custom/package-info.java
index 5884c1f5..cdc1e8da 100644
--- a/shib-spring/src/main/java/net/shibboleth/shared/spring/custom/package-info.java
+++ b/shib-spring/src/main/java/net/shibboleth/shared/spring/custom/package-info.java
@@ -18,4 +18,7 @@
 /**
  * Classes used in custom XML Spring configuration handling.
  */
-package net.shibboleth.shared.spring.custom;
\ No newline at end of file
+ at NonnullElements
+package net.shibboleth.shared.spring.custom;
+
+import net.shibboleth.shared.annotation.constraint.NonnullElements;
diff --git a/shib-spring/src/main/java/net/shibboleth/shared/spring/error/package-info.java b/shib-spring/src/main/java/net/shibboleth/shared/spring/error/package-info.java
index 06bf2623..80b994c6 100644
--- a/shib-spring/src/main/java/net/shibboleth/shared/spring/error/package-info.java
+++ b/shib-spring/src/main/java/net/shibboleth/shared/spring/error/package-info.java
@@ -18,5 +18,7 @@
 /**
  * Extensions for Spring error handling.
  */
+ at NonnullElements
+package net.shibboleth.shared.spring.error;
 
-package net.shibboleth.shared.spring.error;
\ No newline at end of file
+import net.shibboleth.shared.annotation.constraint.NonnullElements;
diff --git a/shib-spring/src/main/java/net/shibboleth/shared/spring/expression/package-info.java b/shib-spring/src/main/java/net/shibboleth/shared/spring/expression/package-info.java
index 73a9dcf0..3641f345 100644
--- a/shib-spring/src/main/java/net/shibboleth/shared/spring/expression/package-info.java
+++ b/shib-spring/src/main/java/net/shibboleth/shared/spring/expression/package-info.java
@@ -18,4 +18,7 @@
 /**
  * Classes supporting use of Spring Expression Language (SpEL).
  */
-package net.shibboleth.shared.spring.expression;
\ No newline at end of file
+ at NonnullElements
+package net.shibboleth.shared.spring.expression;
+
+import net.shibboleth.shared.annotation.constraint.NonnullElements;
diff --git a/shib-spring/src/main/java/net/shibboleth/shared/spring/factory/CombiningListFactoryBean.java b/shib-spring/src/main/java/net/shibboleth/shared/spring/factory/CombiningListFactoryBean.java
index 3ed15950..45fe40f6 100644
--- a/shib-spring/src/main/java/net/shibboleth/shared/spring/factory/CombiningListFactoryBean.java
+++ b/shib-spring/src/main/java/net/shibboleth/shared/spring/factory/CombiningListFactoryBean.java
@@ -26,6 +26,10 @@ import javax.annotation.Nullable;
 import org.springframework.beans.factory.BeanCreationException;
 import org.springframework.beans.factory.config.ListFactoryBean;
 
+import net.shibboleth.shared.annotation.constraint.Live;
+import net.shibboleth.shared.annotation.constraint.NotLive;
+import net.shibboleth.shared.annotation.constraint.NullableElements;
+import net.shibboleth.shared.annotation.constraint.Unmodifiable;
 import net.shibboleth.shared.collection.CollectionSupport;
 
 /**
@@ -47,34 +51,34 @@ public class CombiningListFactoryBean extends ListFactoryBean {
     /** Set the first list to combine.
      * @return Returns the firstList.
      */
-    @Nullable public List<?> getFirstList() {
+    @Nullable @NullableElements @Unmodifiable @NotLive public List<?> getFirstList() {
         return firstList;
     }
 
     /** Get the first list to combine.
      * @param list The firstList to set.
      */
-    public void setFirstList(@Nullable final List<?> list) {
+    public void setFirstList(@Nullable @NullableElements final List<?> list) {
         firstList = list;
     }
 
     /** Set the second list to combine.
      * @return Returns the secondList.
      */
-    @Nullable public List<?> getSecondList() {
+    @Nullable @NullableElements @Unmodifiable @NotLive public List<?> getSecondList() {
         return secondList;
     }
 
     /** Get the second list to combine.
      * @param list The secondList to set.
      */
-    public void setSecondList(@Nullable final List<?> list) {
+    public void setSecondList(@Nullable @NullableElements final List<?> list) {
         secondList = list;
     }
     
     /** {@inheritDoc} */
     @Override
-    @Nonnull protected List<Object> createInstance() {
+    @Nonnull @NullableElements @Live protected List<Object> createInstance() {
         final ArrayList<Object> combined = new ArrayList<>();
         if (firstList != null) {
             combined.addAll(firstList);
diff --git a/shib-spring/src/main/java/net/shibboleth/shared/spring/factory/package-info.java b/shib-spring/src/main/java/net/shibboleth/shared/spring/factory/package-info.java
index c309e2bf..59f45480 100644
--- a/shib-spring/src/main/java/net/shibboleth/shared/spring/factory/package-info.java
+++ b/shib-spring/src/main/java/net/shibboleth/shared/spring/factory/package-info.java
@@ -18,4 +18,7 @@
 /**
  * Spring factory beans.
  */
-package net.shibboleth.shared.spring.factory;
\ No newline at end of file
+ at NonnullElements
+package net.shibboleth.shared.spring.factory;
+
+import net.shibboleth.shared.annotation.constraint.NonnullElements;
diff --git a/shib-spring/src/main/java/net/shibboleth/shared/spring/resource/ConditionalResource.java b/shib-spring/src/main/java/net/shibboleth/shared/spring/resource/ConditionalResource.java
index ba47ba92..e4c096e2 100644
--- a/shib-spring/src/main/java/net/shibboleth/shared/spring/resource/ConditionalResource.java
+++ b/shib-spring/src/main/java/net/shibboleth/shared/spring/resource/ConditionalResource.java
@@ -39,7 +39,6 @@ import net.shibboleth.shared.component.AbstractIdentifiedInitializableComponent;
 import net.shibboleth.shared.logic.Constraint;
 import net.shibboleth.shared.primitive.LoggerFactory;
 
-
 /**
  * A wrapper that guards a {@link Resource} that may be absent by returning an empty bean file instead.
  * 
diff --git a/shib-spring/src/main/java/net/shibboleth/shared/spring/resource/ResourceHelper.java b/shib-spring/src/main/java/net/shibboleth/shared/spring/resource/ResourceHelper.java
index b52d2cb3..eeb59775 100644
--- a/shib-spring/src/main/java/net/shibboleth/shared/spring/resource/ResourceHelper.java
+++ b/shib-spring/src/main/java/net/shibboleth/shared/spring/resource/ResourceHelper.java
@@ -36,7 +36,7 @@ import org.springframework.core.io.Resource;
 public final class ResourceHelper implements net.shibboleth.shared.resource.Resource {
 
     /** The cached Spring {@link Resource}. */
-    private Resource springResource;
+    @Nonnull private Resource springResource;
 
     /**
      * A private for shimming the provided input.
diff --git a/shib-spring/src/main/java/net/shibboleth/shared/spring/resource/package-info.java b/shib-spring/src/main/java/net/shibboleth/shared/spring/resource/package-info.java
index 1f661fda..507525c2 100644
--- a/shib-spring/src/main/java/net/shibboleth/shared/spring/resource/package-info.java
+++ b/shib-spring/src/main/java/net/shibboleth/shared/spring/resource/package-info.java
@@ -19,5 +19,7 @@
  * Shibboleth integration with Spring {@link org.springframework.core.io.Resource}.Helper functions, 
  * concrete implementations and a bridging class.
  */
+ at NonnullElements
+package net.shibboleth.shared.spring.resource;
 
-package net.shibboleth.shared.spring.resource;
\ No newline at end of file
+import net.shibboleth.shared.annotation.constraint.NonnullElements;
diff --git a/shib-spring/src/main/java/net/shibboleth/shared/spring/util/AnnotationParameterNameDiscoverer.java b/shib-spring/src/main/java/net/shibboleth/shared/spring/util/AnnotationParameterNameDiscoverer.java
index 53b6017e..a2d03b42 100644
--- a/shib-spring/src/main/java/net/shibboleth/shared/spring/util/AnnotationParameterNameDiscoverer.java
+++ b/shib-spring/src/main/java/net/shibboleth/shared/spring/util/AnnotationParameterNameDiscoverer.java
@@ -52,7 +52,7 @@ public class AnnotationParameterNameDiscoverer extends DefaultParameterNameDisco
      * @param annotations the annotations for the parameter
      * @return the "name" if one of ours. null otherwise
      */
-    @Nullable private String getMyAnnotation(final Annotation[] annotations) {
+    @Nullable private String getMyAnnotation(@Nonnull final Annotation[] annotations) {
         for (final Annotation a : annotations) {
             if (a instanceof ParameterName) {
                 final ParameterName param = (ParameterName) a;
@@ -67,7 +67,8 @@ public class AnnotationParameterNameDiscoverer extends DefaultParameterNameDisco
      *
      * <p>If we cannot do anything pass to the default discoverer.</p>
      */
-    @Override public String[] getParameterNames(@Nonnull final Constructor<?> ctor) {
+    @Override
+    @Nullable public String[] getParameterNames(@Nonnull final Constructor<?> ctor) {
 
         final Annotation[][] annotationsArray = ctor.getParameterAnnotations();
         if (annotationsArray.length == 0) {
@@ -93,7 +94,6 @@ public class AnnotationParameterNameDiscoverer extends DefaultParameterNameDisco
         }
 
         if (!allPresent) {
-
             log.debug("Constructor for class '{}' with {} parameters: "
                     + "Not all parameters are annotated with @ParameterName", className, annotationsArray.length);
             log.trace("Types : {}", (Object)ctor.getParameterTypes());
diff --git a/shib-spring/src/main/java/net/shibboleth/shared/spring/util/ApplicationContextBuilder.java b/shib-spring/src/main/java/net/shibboleth/shared/spring/util/ApplicationContextBuilder.java
index 87898a9e..05045b97 100644
--- a/shib-spring/src/main/java/net/shibboleth/shared/spring/util/ApplicationContextBuilder.java
+++ b/shib-spring/src/main/java/net/shibboleth/shared/spring/util/ApplicationContextBuilder.java
@@ -27,7 +27,6 @@ import java.util.stream.Collectors;
 import javax.annotation.Nonnull;
 import javax.annotation.Nullable;
 
-import net.shibboleth.shared.annotation.constraint.NonnullElements;
 import net.shibboleth.shared.annotation.constraint.NotEmpty;
 import net.shibboleth.shared.collection.CollectionSupport;
 import net.shibboleth.shared.logic.Constraint;
@@ -70,29 +69,29 @@ public class ApplicationContextBuilder {
     @Nullable @NotEmpty private String contextName;
     
     /** Unresolved configuration sources for this service. */
-    @Nullable @NonnullElements private List<String> configurationSources;
+    @Nullable private List<String> configurationSources;
 
     /** Configuration resources for this service. */
-    @Nullable @NonnullElements private List<Resource> configurationResources;
+    @Nullable private List<Resource> configurationResources;
 
     /** Conversion service to use. */
     @Nullable private ConversionService conversionService;
     
     /** List of context initializers. */
-    @Nullable @NonnullElements private List<ApplicationContextInitializer<? super FilesystemGenericApplicationContext>>
+    @Nullable private List<ApplicationContextInitializer<? super FilesystemGenericApplicationContext>>
     contextInitializers;
 
     /** List of bean factory post processors for this service's content. */
-    @Nullable @NonnullElements private List<BeanFactoryPostProcessor> factoryPostProcessors;
+    @Nullable private List<BeanFactoryPostProcessor> factoryPostProcessors;
 
     /** List of bean post processors for this service's content. */
-    @Nullable @NonnullElements private List<BeanPostProcessor> postProcessors;
+    @Nullable private List<BeanPostProcessor> postProcessors;
     
     /** List of property sources to add. */
-    @Nullable @NonnullElements private List<PropertySource<?>> propertySources;
+    @Nullable private List<PropertySource<?>> propertySources;
     
     /** Bean profiles to enable. */
-    @Nullable @NonnullElements private Collection<String> beanProfiles;
+    @Nullable private Collection<String> beanProfiles;
 
     /** Application context owning this engine. */
     @Nullable private ApplicationContext parentContext;
@@ -152,7 +151,7 @@ public class ApplicationContextBuilder {
      * @since 7.0.0
      */
     @Nonnull public ApplicationContextBuilder setUnresolvedServiceConfigurations(
-            @Nonnull @NonnullElements final Collection<String> configs) {
+            @Nonnull final Collection<String> configs) {
         configurationSources = CollectionSupport.copyToList(
                 Constraint.isNotNull(configs, "Service configurations cannot be null"));
         
@@ -167,7 +166,7 @@ public class ApplicationContextBuilder {
      * @return this builder
      */
     @Nonnull public ApplicationContextBuilder setServiceConfigurations(
-            @Nonnull @NonnullElements final Collection<Resource> configs) {
+            @Nonnull final Collection<Resource> configs) {
         configurationResources = CollectionSupport.copyToList(
                 Constraint.isNotNull(configs, "Service configurations cannot be null"));
         
@@ -182,7 +181,7 @@ public class ApplicationContextBuilder {
      * @return this builder
      */
     @Nonnull public ApplicationContextBuilder setPropertySources(
-            @Nonnull @NonnullElements final List<PropertySource<?>> sources) {
+            @Nonnull final List<PropertySource<?>> sources) {
         propertySources = List.copyOf(Constraint.isNotNull(sources, "Property sources cannot be null"));
         
         return this;
@@ -213,7 +212,7 @@ public class ApplicationContextBuilder {
      * @return this builder
      */
     @Nonnull public ApplicationContextBuilder setContextInitializers(
-            @Nonnull @NonnullElements
+            @Nonnull
             final List<ApplicationContextInitializer<? super FilesystemGenericApplicationContext>> initializers) {
         contextInitializers = List.copyOf(Constraint.isNotNull(initializers, "Context initializers cannot be null"));
         
@@ -245,7 +244,7 @@ public class ApplicationContextBuilder {
      * @return this builder
      */
     @Nonnull public ApplicationContextBuilder setBeanFactoryPostProcessors(
-            @Nonnull @NonnullElements final List<BeanFactoryPostProcessor> processors) {        
+            @Nonnull final List<BeanFactoryPostProcessor> processors) {        
         Constraint.isNotNull(processors, "BeanFactoryPostProcessor collection cannot be null");
 
         factoryPostProcessors = CollectionSupport.copyToList(processors);
@@ -276,7 +275,7 @@ public class ApplicationContextBuilder {
      * @return this builder
      */
     @Nonnull public ApplicationContextBuilder setBeanPostProcessors(
-            @Nonnull @NonnullElements final List<BeanPostProcessor> processors) {        
+            @Nonnull final List<BeanPostProcessor> processors) {        
         Constraint.isNotNull(processors, "BeanPostProcessor collection cannot be null");
 
         postProcessors = CollectionSupport.copyToList(processors);
@@ -291,8 +290,7 @@ public class ApplicationContextBuilder {
      * 
      * @return this builder
      */
-    @Nonnull public ApplicationContextBuilder setBeanProfiles(
-            @Nonnull @NonnullElements final Collection<String> profiles) {
+    @Nonnull public ApplicationContextBuilder setBeanProfiles(@Nonnull final Collection<String> profiles) {
         beanProfiles = StringSupport.normalizeStringCollection(profiles);
         
         return this;
diff --git a/shib-spring/src/main/java/net/shibboleth/shared/spring/util/SpringSupport.java b/shib-spring/src/main/java/net/shibboleth/shared/spring/util/SpringSupport.java
index bcd826c4..688adf37 100644
--- a/shib-spring/src/main/java/net/shibboleth/shared/spring/util/SpringSupport.java
+++ b/shib-spring/src/main/java/net/shibboleth/shared/spring/util/SpringSupport.java
@@ -50,7 +50,7 @@ import org.xml.sax.InputSource;
 import com.google.common.base.Strings;
 
 import jakarta.servlet.http.HttpServletRequest;
-import net.shibboleth.shared.annotation.constraint.NonnullElements;
+import net.shibboleth.shared.annotation.constraint.NotLive;
 import net.shibboleth.shared.annotation.constraint.Unmodifiable;
 import net.shibboleth.shared.collection.CollectionSupport;
 import net.shibboleth.shared.logic.Constraint;
@@ -85,16 +85,15 @@ public final class SpringSupport {
      * @param parserContext current parsing context
      *
      */
-    public static void parseCustomElements(
-            @Nullable @NonnullElements final Collection<Element> elements, @Nonnull final ParserContext parserContext) {
+    public static void parseCustomElements(@Nullable final Collection<Element> elements,
+            @Nonnull final ParserContext parserContext) {
         if (elements == null) {
             return;
         }
 
         for (final Element e : elements) {
-            if (e != null) {
-                parseCustomElement(e, parserContext, null, false);
-            }
+            assert e != null;
+            parseCustomElement(e, parserContext, null, false);
         }
     }
 
@@ -108,8 +107,7 @@ public final class SpringSupport {
      * @return list of bean definitions
      */
     @Nullable public static ManagedList<BeanDefinition> parseCustomElements(
-            @Nullable @NonnullElements final Collection<Element> elements,
-            @Nonnull final ParserContext parserContext,
+            @Nullable final Collection<Element> elements, @Nonnull final ParserContext parserContext,
             @Nonnull final BeanDefinitionBuilder parentBuilder) {
 
         if (elements == null) {
@@ -119,9 +117,8 @@ public final class SpringSupport {
 
         final ManagedList<BeanDefinition> definitions = new ManagedList<>(elements.size());
         for (final Element e : elements) {
-            if (e != null) {
-                definitions.add(parseCustomElement(e, parserContext, parentBuilder, false));
-            }
+            assert e != null;
+            definitions.add(parseCustomElement(e, parserContext, parentBuilder, false));
         }
 
         return definitions;
@@ -136,16 +133,14 @@ public final class SpringSupport {
      * 
      * @since 6.0.0
      */
-    public static void parseLazyInitCustomElements(
-            @Nullable @NonnullElements final Collection<Element> elements, @Nonnull final ParserContext parserContext) {
+    public static void parseLazyInitCustomElements(@Nullable final Collection<Element> elements,
+            @Nonnull final ParserContext parserContext) {
         if (elements == null) {
             return;
         }
 
         for (final Element e : elements) {
-            if (e != null) {
-                parseLazyInitCustomElement(e, parserContext);
-            }
+            parseLazyInitCustomElement(e, parserContext);
         }
     }
     
@@ -161,12 +156,9 @@ public final class SpringSupport {
      * @param lazyInit whether this is lazy initialized;
      * @return the bean definition, <em>unless this is for a parent scoped bean</em>
      */
-    @Nullable public static BeanDefinition parseCustomElement(@Nullable final Element element, 
+    @Nullable public static BeanDefinition parseCustomElement(@Nonnull final Element element, 
             @Nonnull final ParserContext parserContext, @Nullable final BeanDefinitionBuilder parentBuilder,
             final boolean lazyInit) {
-        if (element == null) {
-            return null;
-        }
         final AbstractBeanDefinition containingBd;
         if (parentBuilder != null) {
             containingBd = parentBuilder.getRawBeanDefinition();
@@ -334,21 +326,18 @@ public final class SpringSupport {
      * @param request the request to process
      * @return range returned from the browser request with the active Spring locale prepended
      */
-    @Nonnull @NonnullElements @Unmodifiable
+    @Nonnull @Unmodifiable @NotLive
     public static List<LanguageRange> getLanguageRange(@Nonnull final HttpServletRequest request) {
         final List<LanguageRange> fromBrowser = HttpServletSupport.getLanguageRange(request);
         final List<LanguageRange> outList = new ArrayList<>(1+fromBrowser.size());
 
         final Locale locale =  RequestContextUtils.getLocale(request);
-        if (locale == null) {
-            LOG.error("Spring returned a null locale");
-        } else {
-            try {
-                outList.add(new LanguageRange(locale.getLanguage()));
-            } catch (final Throwable t) {
-                LOG.error("Could not create LanguageRange for {}, Ignoring", locale, t);
-            }
+        try {
+            outList.add(new LanguageRange(locale.getLanguage()));
+        } catch (final Throwable t) {
+            LOG.error("Could not create LanguageRange for {}, Ignoring", locale, t);
         }
+
         outList.addAll(fromBrowser);
         return CollectionSupport.copyToList(outList);        
     }
diff --git a/shib-spring/src/main/java/net/shibboleth/shared/spring/util/package-info.java b/shib-spring/src/main/java/net/shibboleth/shared/spring/util/package-info.java
index 23bb7f8a..b1604fe5 100644
--- a/shib-spring/src/main/java/net/shibboleth/shared/spring/util/package-info.java
+++ b/shib-spring/src/main/java/net/shibboleth/shared/spring/util/package-info.java
@@ -18,5 +18,7 @@
 /**
  * Supporting classes for using Spring.
  */
+ at NonnullElements
+package net.shibboleth.shared.spring.util;
 
-package net.shibboleth.shared.spring.util;
\ No newline at end of file
+import net.shibboleth.shared.annotation.constraint.NonnullElements;
diff --git a/shib-spring/src/test/java/net/shibboleth/shared/spring/config/StringToResourceTest.java b/shib-spring/src/test/java/net/shibboleth/shared/spring/config/StringToResourceTest.java
index c47b5e6d..f05344dc 100644
--- a/shib-spring/src/test/java/net/shibboleth/shared/spring/config/StringToResourceTest.java
+++ b/shib-spring/src/test/java/net/shibboleth/shared/spring/config/StringToResourceTest.java
@@ -24,6 +24,8 @@ import java.io.File;
 import java.io.IOException;
 import java.nio.file.InvalidPathException;
 
+import javax.annotation.Nonnull;
+
 import org.testng.annotations.BeforeClass;
 import org.testng.annotations.Test;
 
@@ -32,7 +34,7 @@ import net.shibboleth.shared.resource.Resource;
 @SuppressWarnings("javadoc")
 public class StringToResourceTest {
 
-    private final StringToResourceConverter converter = new StringToResourceConverter();
+    @Nonnull private final StringToResourceConverter converter = new StringToResourceConverter();
 
     private String path;
 
@@ -46,20 +48,21 @@ public class StringToResourceTest {
 
     @Test public void exists() {
         final Resource r = converter.convert(path);
-        assertTrue(r.exists());
+        assertTrue(r != null && r.exists());
     }
 
     @Test public void notExist() {
         final Resource r = converter.convert(path + "x");
-        assertFalse(r.exists());
+        assertFalse(r != null && r.exists());
     }
 
     @Test public void endsWithSpace() {
         try {
             final Resource r = converter.convert(path + " ");
-            assertFalse(r.exists()); // Linux
+            assertFalse(r != null && r.exists()); // Linux
         } catch (final InvalidPathException e) {
             // expected on Windows
         }
     }
-}
+
+}
\ No newline at end of file
diff --git a/shib-support/src/main/java/net/shibboleth/shared/xml/ElementSupport.java b/shib-support/src/main/java/net/shibboleth/shared/xml/ElementSupport.java
index af2f71a2..dbc1847b 100644
--- a/shib-support/src/main/java/net/shibboleth/shared/xml/ElementSupport.java
+++ b/shib-support/src/main/java/net/shibboleth/shared/xml/ElementSupport.java
@@ -444,4 +444,23 @@ public final class ElementSupport {
         return doc;
     }
     
+    
+    /**
+     * Return {@link Document#getDocumentElement()}, raising an {@link IllegalStateException} if null.
+     * 
+     * @param doc input Document
+     * 
+     * @return the document Element
+     * 
+     * @since 9.0.0
+     */
+    @Nonnull public static Node ensureDocumentElement(@Nonnull final Document doc) {
+        final Element e = doc.getDocumentElement();
+        if (e == null) {
+            throw new IllegalStateException("Document element was null");
+        }
+        
+        return e;
+    }
+
 }
\ No newline at end of file
diff --git a/shib-testing/src/main/java/net/shibboleth/shared/testing/ConstantSupplier.java b/shib-testing/src/main/java/net/shibboleth/shared/testing/ConstantSupplier.java
index 012d8496..fd0b14be 100644
--- a/shib-testing/src/main/java/net/shibboleth/shared/testing/ConstantSupplier.java
+++ b/shib-testing/src/main/java/net/shibboleth/shared/testing/ConstantSupplier.java
@@ -29,7 +29,7 @@ import net.shibboleth.shared.primitive.NonnullSupplier;
  */
 public final class ConstantSupplier<T> implements NonnullSupplier<T> {
 
-    /** The value we will return */
+    /** The value we will return. */
     @Nonnull private final T theValue;
     
     /**
diff --git a/shib-testing/src/main/java/net/shibboleth/shared/testing/DatabaseTestingSupport.java b/shib-testing/src/main/java/net/shibboleth/shared/testing/DatabaseTestingSupport.java
index 70078ffd..270962d7 100644
--- a/shib-testing/src/main/java/net/shibboleth/shared/testing/DatabaseTestingSupport.java
+++ b/shib-testing/src/main/java/net/shibboleth/shared/testing/DatabaseTestingSupport.java
@@ -39,10 +39,13 @@ import net.shibboleth.shared.primitive.StringSupport;
 /**
  * Helper class for testing database-backed classes using custom DDL and SQL.
  */
-public class DatabaseTestingSupport {
+public final class DatabaseTestingSupport {
 
     /** Logger. */
-    @Nonnull static Logger log = LoggerFactory.getLogger(DatabaseTestingSupport.class);
+    @Nonnull private static Logger log = LoggerFactory.getLogger(DatabaseTestingSupport.class);
+    
+    /** Hidden constructor. */
+    private DatabaseTestingSupport() {}
     
     /**
      * Initialize SQL database.
@@ -50,7 +53,8 @@ public class DatabaseTestingSupport {
      * @param initializingSQLFile path to SQL to run at init time
      * @param source the data source
      */
-    public static void InitializeDataSource(final @Nullable String initializingSQLFile, final DataSource source) {
+    public static void InitializeDataSource(final @Nullable String initializingSQLFile,
+            @Nonnull final DataSource source) {
 
         final String sql = ReadSqlFromFile(initializingSQLFile);
         if (sql == null) {
@@ -59,11 +63,13 @@ public class DatabaseTestingSupport {
         ExecuteUpdate(sql, source);
     }
 
-    /** Read some SQL from a file
+    /**
+     * Read some SQL from a file.
+     * 
      * @param initializingSQLFile the file name
      * @return the data
      */
-    protected static String ReadSqlFromFile(final @Nullable String initializingSQLFile) {
+    @Nullable protected static String ReadSqlFromFile(final @Nullable String initializingSQLFile) {
 
         final String file = StringSupport.trimOrNull(initializingSQLFile);
 
@@ -77,10 +83,10 @@ public class DatabaseTestingSupport {
             log.warn("Could not locate SQL file called {} ", file);
             return null;
         }
-        String sql;
+        final String sql;
         try {
             sql = StringSupport.trimOrNull(CharStreams.toString(new InputStreamReader(is)));
-        } catch (IOException e) {
+        } catch (final IOException e) {
             log.warn("Could not read SQL file called {}.", file);
             return null;
         }
@@ -93,7 +99,9 @@ public class DatabaseTestingSupport {
         return sql;
     }
 
-    /** Execute an SQP update
+    /**
+     * Execute an SQP update.
+     * 
      * @param sql what to execute
      * @param source what to executer it on
      */
@@ -106,7 +114,7 @@ public class DatabaseTestingSupport {
             final Statement statement = dbConn.createStatement();
 
             statement.executeUpdate(sql);
-        } catch (SQLException e) {
+        } catch (final SQLException e) {
             log.warn("Could not contact data source {} or execute commands", source, e);
             return;
         }
@@ -120,8 +128,8 @@ public class DatabaseTestingSupport {
      * @param identifier a name to uniquify this database.
      * @return a DataSource which can then be used for testing.
      */
-    public static DataSource GetMockDataSource(final @Nullable String initializingSQLFile, final @Nonnull String identifier) {
-
+    @Nonnull public static DataSource GetMockDataSource(final @Nullable String initializingSQLFile,
+            final @Nonnull String identifier) {
         return GetDataSourceFromUrl(initializingSQLFile, "jdbc:hsqldb:mem:" + identifier);
     }
 
@@ -131,8 +139,8 @@ public class DatabaseTestingSupport {
      * @param server the server name and database name.  For instance "//localhost/testdb"
      * @return a DataSource which can then be used for testing
      */
-    public static DataSource GetDataSourceFromHsqlServer(final @Nullable String initializingSQLFile, final @Nonnull String server) {
-
+    @Nonnull public static DataSource GetDataSourceFromHsqlServer(final @Nullable String initializingSQLFile,
+            final @Nonnull String server) {
         return GetDataSourceFromUrl(initializingSQLFile, "jdbc:hsqldb:hsql:" + server);
     }
 
@@ -145,18 +153,22 @@ public class DatabaseTestingSupport {
     public static void InitializeDataSourceFromFile(final String sqlFile, final DataSource source) {
         final String sql = ReadSqlFromFile(sqlFile);
         final String[] statements = sql.split(";");
-        for (String statement : statements) {
+        for (final String statement : statements) {
             ExecuteUpdate(statement.trim(), source);
         }
     }
 
-    /** Createa data source from a provided URL
+    /**
+     * Createa data source from a provided URL.
+     * 
      * @param initializingSQLFile what to initialize with
      * @param JdbcUri the URI
+     * 
      * @return the {@link DataSource}
      */
-    protected static DataSource GetDataSourceFromUrl(final String initializingSQLFile, final String JdbcUri) {
-        JDBCDataSource jdbcSource = new JDBCDataSource();
+    @Nonnull protected static DataSource GetDataSourceFromUrl(@Nonnull final String initializingSQLFile,
+            @Nonnull final String JdbcUri) {
+        final JDBCDataSource jdbcSource = new JDBCDataSource();
 
         jdbcSource.setUrl(JdbcUri);
         jdbcSource.setUser("SA");
diff --git a/shib-testing/src/main/java/net/shibboleth/shared/testing/InMemoryDirectory.java b/shib-testing/src/main/java/net/shibboleth/shared/testing/InMemoryDirectory.java
index cf4239a4..0d11213a 100644
--- a/shib-testing/src/main/java/net/shibboleth/shared/testing/InMemoryDirectory.java
+++ b/shib-testing/src/main/java/net/shibboleth/shared/testing/InMemoryDirectory.java
@@ -82,9 +82,7 @@ public class InMemoryDirectory {
      */
     public InMemoryDirectory(@ParameterName(name="baseDNs") @Nonnull final String[] baseDNs,
                              @ParameterName(name="ldif") @Nonnull final Resource ldif,
-                             @ParameterName(name="port") @Positive final int port)
-        throws RuntimeException
-    {
+                             @ParameterName(name="port") @Positive final int port) {
         Constraint.isNotNull(ldif, "LDIF resource cannot be null");
         try {
             final InMemoryDirectoryServerConfig config = new InMemoryDirectoryServerConfig(baseDNs);
@@ -102,7 +100,7 @@ public class InMemoryDirectory {
             addSuccessSaslBindHandlers(config);
             directoryServer = new InMemoryDirectoryServer(config);
             directoryServer.importFromLDIF(true, new LDIFReader(ldif.getInputStream()));
-        } catch (Exception e) {
+        } catch (final Exception e) {
             throw new RuntimeException("Error creating directory server", e);
         }
     }
@@ -122,9 +120,7 @@ public class InMemoryDirectory {
                              @ParameterName(name="ldif") @Nonnull final Resource ldif,
                              @ParameterName(name="port") @Positive final int port,
                              @ParameterName(name="keystore") @Nonnull final Resource keystore,
-                             @ParameterName(name="truststore") @Nonnull final Optional<Resource> truststore)
-        throws RuntimeException
-    {
+                             @ParameterName(name="truststore") @Nonnull final Optional<Resource> truststore) {
         Constraint.isNotNull(ldif, "LDIF resource cannot be null");
         try {
             final InMemoryDirectoryServerConfig config = new InMemoryDirectoryServerConfig(baseDNs);
@@ -146,7 +142,7 @@ public class InMemoryDirectory {
             addSuccessSaslBindHandlers(config);
             directoryServer = new InMemoryDirectoryServer(config);
             directoryServer.importFromLDIF(true, new LDIFReader(ldif.getInputStream()));
-        } catch (Exception e) {
+        } catch (final Exception e) {
             throw new RuntimeException("Error creating directory server", e);
         }
     }
@@ -201,10 +197,10 @@ public class InMemoryDirectory {
      *
      * @throws RuntimeException if the in-memory directory server cannot be started
      */
-    public void start() throws RuntimeException {
+    public void start() {
         try {
             directoryServer.startListening();
-        } catch (LDAPException e) {
+        } catch (final LDAPException e) {
             throw new RuntimeException(e);
         }
         log.info("In-memory directory server started");
@@ -231,8 +227,7 @@ public class InMemoryDirectory {
      * @throws IOException if the resource cannot be read
      */
     private static KeyManagerFactory getKeyManagerFactory(final Resource keystore)
-        throws GeneralSecurityException, IOException
-    {
+            throws GeneralSecurityException, IOException {
         final KeyManagerFactory keyManagerFactory = KeyManagerFactory.getInstance(
             KeyManagerFactory.getDefaultAlgorithm());
         keyManagerFactory.init(loadKeyStore(keystore, "changeit"), "changeit".toCharArray());
@@ -249,8 +244,7 @@ public class InMemoryDirectory {
      * @throws IOException if the resource cannot be read
      */
     private static TrustManagerFactory getTrustManagerFactory(final Resource keystore)
-        throws GeneralSecurityException, IOException
-    {
+            throws GeneralSecurityException, IOException {
         final TrustManagerFactory trustManagerFactory = TrustManagerFactory.getInstance(
             TrustManagerFactory.getDefaultAlgorithm());
         trustManagerFactory.init(loadKeyStore(keystore, "changeit"));
@@ -268,8 +262,7 @@ public class InMemoryDirectory {
      * @throws IOException if the resource cannot be read
      */
     private static KeyStore loadKeyStore(final Resource keystore, final String password)
-        throws GeneralSecurityException, IOException
-    {
+            throws GeneralSecurityException, IOException {
         final KeyStore ks = KeyStore.getInstance("JKS");
         ks.load(keystore.getInputStream(), password.toCharArray());
         return ks;
@@ -278,7 +271,8 @@ public class InMemoryDirectory {
     /** ServerSocketFactory wrapper class to track created sockets. */
     private static class CustomServerSocketFactory extends ServerSocketFactory {
 
-        private List<Socket> sockets = new ArrayList<>();
+        /** The socket list. */
+        @Nonnull private List<Socket> sockets = new ArrayList<>();
 
         @Override
         public ServerSocket createServerSocket(final int port) throws IOException {
@@ -292,8 +286,7 @@ public class InMemoryDirectory {
 
         @Override
         public ServerSocket createServerSocket(final int port, final int backlog, final InetAddress ifAddress)
-            throws IOException
-        {
+            throws IOException {
             return new CustomServerSocket(port, backlog ,ifAddress);
         }
 
@@ -301,8 +294,7 @@ public class InMemoryDirectory {
         private class CustomServerSocket extends ServerSocket {
 
             public CustomServerSocket(final int port, final int backlog, final InetAddress bindAddr)
-                throws IOException
-            {
+                throws IOException {
                 super(port, backlog, bindAddr);
             }
 
@@ -314,4 +306,5 @@ public class InMemoryDirectory {
             }
         }
     }
-}
+
+}
\ No newline at end of file
diff --git a/shib-testing/src/main/java/net/shibboleth/shared/testing/MockApplicationContext.java b/shib-testing/src/main/java/net/shibboleth/shared/testing/MockApplicationContext.java
index ce5b08fe..4b0eca52 100644
--- a/shib-testing/src/main/java/net/shibboleth/shared/testing/MockApplicationContext.java
+++ b/shib-testing/src/main/java/net/shibboleth/shared/testing/MockApplicationContext.java
@@ -80,7 +80,7 @@ public class MockApplicationContext implements ConfigurableApplicationContext {
     }
 
     /** {@inheritDoc} */
-    public boolean containsBeanDefinition(String beanName) {
+    public boolean containsBeanDefinition(final String beanName) {
         throw new IllegalStateException();
     }
 
@@ -95,125 +95,129 @@ public class MockApplicationContext implements ConfigurableApplicationContext {
     }
 
     /** {@inheritDoc} */
-    public @Nonnull String[] getBeanNamesForType(ResolvableType type) {
+    public @Nonnull String[] getBeanNamesForType(final ResolvableType type) {
         throw new IllegalStateException();
     }
 
     /** {@inheritDoc} */
-    public @Nonnull String[] getBeanNamesForType(ResolvableType type, boolean includeNonSingletons, boolean allowEagerInit) {
+    public @Nonnull String[] getBeanNamesForType(final ResolvableType type, final boolean includeNonSingletons,
+            final boolean allowEagerInit) {
         throw new IllegalStateException();
     }
 
     /** {@inheritDoc} */
-    public @Nonnull String[] getBeanNamesForType(@Nullable Class<?> type) {
+    public @Nonnull String[] getBeanNamesForType(@Nullable final Class<?> type) {
         throw new IllegalStateException();
     }
 
     /** {@inheritDoc} */
-    public @Nonnull String[] getBeanNamesForType(@Nullable Class<?> type, boolean includeNonSingletons, boolean allowEagerInit) {
+    public @Nonnull String[] getBeanNamesForType(@Nullable final Class<?> type, final boolean includeNonSingletons,
+            final boolean allowEagerInit) {
         throw new IllegalStateException();
     }
 
     /** {@inheritDoc} */
-    @Nonnull public <T> Map<String, T> getBeansOfType(@Nullable Class<T> type) throws BeansException {
+    @Nonnull public <T> Map<String, T> getBeansOfType(@Nullable final Class<T> type) throws BeansException {
         throw new IllegalStateException();
     }
 
     /** {@inheritDoc} */
-    @Nonnull public <T> Map<String, T> getBeansOfType(@Nullable Class<T> type, boolean includeNonSingletons, boolean allowEagerInit)
-            throws BeansException {
+    @Nonnull public <T> Map<String, T> getBeansOfType(@Nullable final Class<T> type, final boolean includeNonSingletons,
+            final boolean allowEagerInit) throws BeansException {
         throw new IllegalStateException();
     }
 
     /** {@inheritDoc} */
-    public @Nonnull String[] getBeanNamesForAnnotation(Class<? extends Annotation> annotationType) {
+    public @Nonnull String[] getBeanNamesForAnnotation(final Class<? extends Annotation> annotationType) {
         throw new IllegalStateException();
     }
 
     /** {@inheritDoc} */
-    public @Nonnull Map<String, Object> getBeansWithAnnotation(Class<? extends Annotation> annotationType)
+    public @Nonnull Map<String, Object> getBeansWithAnnotation(final Class<? extends Annotation> annotationType)
             throws BeansException {
         throw new IllegalStateException();
     }
 
     /** {@inheritDoc} */
-    public <A extends Annotation> A findAnnotationOnBean(String beanName, Class<A> annotationType)
+    public <A extends Annotation> A findAnnotationOnBean(final String beanName, final Class<A> annotationType)
             throws NoSuchBeanDefinitionException {
         throw new IllegalStateException();
     }
 
     /** {@inheritDoc} */
-    public @Nonnull Object getBean(String name) throws BeansException {
+    public @Nonnull Object getBean(final String name) throws BeansException {
         throw new IllegalStateException();
     }
 
     /** {@inheritDoc} */
-    public @Nonnull <T> T getBean(String name, Class<T> requiredType) throws BeansException {
+    public @Nonnull <T> T getBean(final String name, final Class<T> requiredType) throws BeansException {
         throw new IllegalStateException();
     }
 
     /** {@inheritDoc} */
-    public @Nonnull Object getBean(String name, Object... args) throws BeansException {
+    public @Nonnull Object getBean(final String name, final Object... args) throws BeansException {
         throw new IllegalStateException();
     }
 
     /** {@inheritDoc} */
-    public @Nonnull <T> T getBean(Class<T> requiredType) throws BeansException {
+    public @Nonnull <T> T getBean(final Class<T> requiredType) throws BeansException {
         throw new IllegalStateException();
     }
 
     /** {@inheritDoc} */
-    public @Nonnull <T> T getBean(Class<T> requiredType, Object... args) throws BeansException {
+    public @Nonnull <T> T getBean(final Class<T> requiredType, final Object... args) throws BeansException {
         throw new IllegalStateException();
     }
 
     /** {@inheritDoc} */
-    public @Nonnull <T> ObjectProvider<T> getBeanProvider(Class<T> requiredType) {
+    public @Nonnull <T> ObjectProvider<T> getBeanProvider(final Class<T> requiredType) {
         throw new IllegalStateException();
     }
 
     /** {@inheritDoc} */
-    public @Nonnull <T> ObjectProvider<T> getBeanProvider(ResolvableType requiredType) {
+    public @Nonnull <T> ObjectProvider<T> getBeanProvider(final ResolvableType requiredType) {
         throw new IllegalStateException();
     }
 
     /** {@inheritDoc} */
-    public boolean containsBean(String name) {
+    public boolean containsBean(final String name) {
         throw new IllegalStateException();
     }
 
     /** {@inheritDoc} */
-    public boolean isSingleton(String name) throws NoSuchBeanDefinitionException {
+    public boolean isSingleton(final String name) throws NoSuchBeanDefinitionException {
         throw new IllegalStateException();
     }
 
     /** {@inheritDoc} */
-    public boolean isPrototype(String name) throws NoSuchBeanDefinitionException {
+    public boolean isPrototype(final String name) throws NoSuchBeanDefinitionException {
         throw new IllegalStateException();
     }
 
     /** {@inheritDoc} */
-    public boolean isTypeMatch(String name, ResolvableType typeToMatch) throws NoSuchBeanDefinitionException {
+    public boolean isTypeMatch(final String name, final ResolvableType typeToMatch)
+            throws NoSuchBeanDefinitionException {
         throw new IllegalStateException();
     }
 
     /** {@inheritDoc} */
-    public boolean isTypeMatch(String name, Class<?> typeToMatch) throws NoSuchBeanDefinitionException {
+    public boolean isTypeMatch(final String name, final Class<?> typeToMatch) throws NoSuchBeanDefinitionException {
         throw new IllegalStateException();
     }
 
     /** {@inheritDoc} */
-    public Class<?> getType(String name) throws NoSuchBeanDefinitionException {
+    public Class<?> getType(final String name) throws NoSuchBeanDefinitionException {
         throw new IllegalStateException();
     }
 
     /** {@inheritDoc} */
-    public Class<?> getType(String name, boolean allowFactoryBeanInit) throws NoSuchBeanDefinitionException {
+    public Class<?> getType(final String name, final boolean allowFactoryBeanInit)
+            throws NoSuchBeanDefinitionException {
         throw new IllegalStateException();
     }
 
     /** {@inheritDoc} */
-    public @Nonnull String[] getAliases(String name) {
+    public @Nonnull String[] getAliases(final String name) {
         throw new IllegalStateException();
     }
 
@@ -223,37 +227,40 @@ public class MockApplicationContext implements ConfigurableApplicationContext {
     }
 
     /** {@inheritDoc} */
-    public boolean containsLocalBean(String name) {
+    public boolean containsLocalBean(final String name) {
         throw new IllegalStateException();
     }
 
     /** {@inheritDoc} */
-    public String getMessage(String code, @Nullable Object[] args, @Nullable String defaultMessage, Locale locale) {
+    public String getMessage(final String code, @Nullable final Object[] args, @Nullable final String defaultMessage,
+            final Locale locale) {
         throw new IllegalStateException();
     }
 
     /** {@inheritDoc} */
-    public @Nonnull String getMessage(String code , at Nullable Object[] args, Locale locale) throws NoSuchMessageException {
+    public @Nonnull String getMessage(final String code , at Nullable final Object[] args, final Locale locale)
+            throws NoSuchMessageException {
         throw new IllegalStateException();
     }
 
     /** {@inheritDoc} */
-    public @Nonnull String getMessage(MessageSourceResolvable resolvable, Locale locale) throws NoSuchMessageException {
+    public @Nonnull String getMessage(final MessageSourceResolvable resolvable, final Locale locale)
+            throws NoSuchMessageException {
         throw new IllegalStateException();
     }
 
     /** {@inheritDoc} */
-    public void publishEvent(Object event) {
+    public void publishEvent(final Object event) {
         throw new IllegalStateException();
     }
 
     /** {@inheritDoc} */
-    public @Nonnull Resource[] getResources(String locationPattern) throws IOException {
+    public @Nonnull Resource[] getResources(final String locationPattern) throws IOException {
         throw new IllegalStateException();
     }
 
     /** {@inheritDoc} */
-    public @Nonnull Resource getResource(String location) {
+    public @Nonnull Resource getResource(final String location) {
         throw new IllegalStateException();
     }
 
@@ -278,17 +285,17 @@ public class MockApplicationContext implements ConfigurableApplicationContext {
     }
 
     /** {@inheritDoc} */
-    public void setId(String id) {
+    public void setId(final String id) {
         throw new IllegalStateException();
     }
 
     /** {@inheritDoc} */
-    public void setParent(@Nullable ApplicationContext parent) {
+    public void setParent(@Nullable final ApplicationContext parent) {
         throw new IllegalStateException();
     }
 
     /** {@inheritDoc} */
-    public void setEnvironment(ConfigurableEnvironment environment) {
+    public void setEnvironment(final ConfigurableEnvironment environment) {
         throw new IllegalStateException();
     }
 
@@ -298,17 +305,17 @@ public class MockApplicationContext implements ConfigurableApplicationContext {
     }
 
     /** {@inheritDoc} */
-    public void addBeanFactoryPostProcessor(BeanFactoryPostProcessor postProcessor) {
+    public void addBeanFactoryPostProcessor(final BeanFactoryPostProcessor postProcessor) {
         throw new IllegalStateException();
     }
 
     /** {@inheritDoc} */
-    public void addApplicationListener(ApplicationListener<?> listener) {
+    public void addApplicationListener(final ApplicationListener<?> listener) {
         throw new IllegalStateException();
     }
 
     /** {@inheritDoc} */
-    public void addProtocolResolver(ProtocolResolver resolver) {
+    public void addProtocolResolver(final ProtocolResolver resolver) {
         throw new IllegalStateException();
     }
 
@@ -337,22 +344,23 @@ public class MockApplicationContext implements ConfigurableApplicationContext {
     }
 
     /** {@inheritDoc} */
-    public void setClassLoader(ClassLoader classLoader) {
+    public void setClassLoader(final ClassLoader classLoader) {
         throw new IllegalStateException();
     }
 
     /** {@inheritDoc} */
-    public @Nonnull <T> ObjectProvider<T> getBeanProvider(Class<T> requiredType, boolean allowEagerInit) {
+    public @Nonnull <T> ObjectProvider<T> getBeanProvider(final Class<T> requiredType, final boolean allowEagerInit) {
         throw new IllegalStateException();
     }
 
     /** {@inheritDoc} */
-    public @Nonnull <T> ObjectProvider<T> getBeanProvider(ResolvableType requiredType, boolean allowEagerInit) {
+    public @Nonnull <T> ObjectProvider<T> getBeanProvider(final ResolvableType requiredType,
+            final boolean allowEagerInit) {
         throw new IllegalStateException();
     }
 
     /** {@inheritDoc} */
-    public void setApplicationStartup(ApplicationStartup applicationStartup) {
+    public void setApplicationStartup(final ApplicationStartup applicationStartup) {
         throw new IllegalStateException();
     }
 
@@ -362,20 +370,21 @@ public class MockApplicationContext implements ConfigurableApplicationContext {
     }
 
     /** {@inheritDoc} */
-    public <A extends Annotation> A findAnnotationOnBean(String beanName, Class<A> annotationType,
-            boolean allowFactoryBeanInit) throws NoSuchBeanDefinitionException {
+    public <A extends Annotation> A findAnnotationOnBean(final String beanName, final Class<A> annotationType,
+            final boolean allowFactoryBeanInit) throws NoSuchBeanDefinitionException {
         throw new IllegalStateException();
     }
 
     /** {@inheritDoc} */
-    public void removeApplicationListener(ApplicationListener<?> listener) {
+    public void removeApplicationListener(final ApplicationListener<?> listener) {
         throw new IllegalStateException();
     }
 
     /** {@inheritDoc} */
     @Override
-    public @Nonnull <A extends Annotation> Set<A> findAllAnnotationsOnBean(String beanName, Class<A> annotationType,
-            boolean allowFactoryBeanInit) throws NoSuchBeanDefinitionException {
+    public @Nonnull <A extends Annotation> Set<A> findAllAnnotationsOnBean(final String beanName,
+            final Class<A> annotationType, final boolean allowFactoryBeanInit) throws NoSuchBeanDefinitionException {
         throw new IllegalStateException();
     }
-}
+    
+}
\ No newline at end of file
diff --git a/shib-testing/src/main/java/net/shibboleth/shared/testing/MockReloadableService.java b/shib-testing/src/main/java/net/shibboleth/shared/testing/MockReloadableService.java
index 65118aa3..0d1c33cd 100644
--- a/shib-testing/src/main/java/net/shibboleth/shared/testing/MockReloadableService.java
+++ b/shib-testing/src/main/java/net/shibboleth/shared/testing/MockReloadableService.java
@@ -40,7 +40,7 @@ public class MockReloadableService<T> extends AbstractReloadableService<T> {
      *
      * @param what component
      */
-    public MockReloadableService(final @Nullable T what) {
+    public MockReloadableService(@Nullable final T what) {
         if (what == null) {
             component = null;
         } else {
diff --git a/shib-testing/src/main/java/net/shibboleth/shared/testing/RepositorySupport.java b/shib-testing/src/main/java/net/shibboleth/shared/testing/RepositorySupport.java
index 91dce4e7..3ee00f2a 100644
--- a/shib-testing/src/main/java/net/shibboleth/shared/testing/RepositorySupport.java
+++ b/shib-testing/src/main/java/net/shibboleth/shared/testing/RepositorySupport.java
@@ -41,7 +41,8 @@ public final class RepositorySupport {
      * 
      * @return the HTTPS resource URL
      */
-    public static String buildHTTPSResourceURL(@Nonnull final String repoName, @Nonnull final String resourcePath) {
+    @Nonnull public static String buildHTTPSResourceURL(@Nonnull final String repoName,
+            @Nonnull final String resourcePath) {
         return buildHTTPResourceURL(repoName, resourcePath, true, "HEAD");
     }
     
@@ -54,8 +55,8 @@ public final class RepositorySupport {
      * 
      * @return the HTTP(S) resource URL
      */
-    public static String buildHTTPResourceURL(@Nonnull final String repoName, @Nonnull final String resourcePath, 
-            final boolean https) {
+    @Nonnull public static String buildHTTPResourceURL(@Nonnull final String repoName,
+            @Nonnull final String resourcePath, final boolean https) {
         return buildHTTPResourceURL(repoName, resourcePath, https, "HEAD");
     }
     
@@ -71,8 +72,8 @@ public final class RepositorySupport {
      * 
      * @since 8.2.0
      */
-    public static String buildHTTPResourceURL(@Nonnull final String repoName, @Nonnull final String resourcePath, 
-            final boolean https, @Nonnull @NotEmpty final String branch) {
+    @Nonnull public static String buildHTTPResourceURL(@Nonnull final String repoName,
+            @Nonnull final String resourcePath, final boolean https, @Nonnull @NotEmpty final String branch) {
         
         final String repo = Constraint.isNotNull(StringSupport.trimOrNull(repoName), 
                 "Repository name was null or empty");
@@ -84,7 +85,8 @@ public final class RepositorySupport {
         }
         
         if (https) {
-            return String.format("https://test.shibboleth.net/git/view/?p=%s.git&a=blob_plain&f=%s&hb=%s", repo, path, branch);
+            return String.format("https://test.shibboleth.net/git/view/?p=%s.git&a=blob_plain&f=%s&hb=%s",
+                    repo, path, branch);
         }
         return String.format("http://git.shibboleth.net/view/?p=%s.git&a=blob_plain&f=%s&hb=%s", repo, path, branch);
     }
diff --git a/shib-testing/src/main/java/net/shibboleth/shared/testing/ResourceTestHelper.java b/shib-testing/src/main/java/net/shibboleth/shared/testing/ResourceTestHelper.java
index 4d30aae2..601517e8 100644
--- a/shib-testing/src/main/java/net/shibboleth/shared/testing/ResourceTestHelper.java
+++ b/shib-testing/src/main/java/net/shibboleth/shared/testing/ResourceTestHelper.java
@@ -20,6 +20,8 @@ package net.shibboleth.shared.testing;
 import java.io.IOException;
 import java.io.InputStream;
 
+import javax.annotation.Nonnull;
+
 import org.springframework.core.io.Resource;
 
 /**
@@ -27,16 +29,23 @@ import org.springframework.core.io.Resource;
  * 
  * <p>NOTE: If this changes, change the "additional" copy in shib-spring.</p>
  */
-public class ResourceTestHelper {
+public final class ResourceTestHelper {
 
-    /** Compare to see whether the content of two resources are the same
+    /** Hidden constructor. */
+    private ResourceTestHelper() {}
+    
+    /** Compare to see whether the content of two resources are the same.
+     * 
      * @param first Resource to compare
      * @param second  Resource to compare
+     * 
      * @return whether They are equal
+     * 
      * @throws IOException if a read fails
      */
-    static public boolean compare(final Resource first, final Resource second) throws IOException {
-        try (final InputStream firstStream = first.getInputStream(); final InputStream secondStream = second.getInputStream()) {
+    public static boolean compare(@Nonnull final Resource first, @Nonnull final Resource second) throws IOException {
+        try (final InputStream firstStream = first.getInputStream();
+                final InputStream secondStream = second.getInputStream()) {
             while (true) {
 
                 // Remove any differences based on CRLF handling
@@ -57,4 +66,5 @@ public class ResourceTestHelper {
             }
         }
     }
-}
+
+}
\ No newline at end of file
diff --git a/shib-testing/src/main/java/net/shibboleth/shared/testing/ShowAutomaticModuleNames.java b/shib-testing/src/main/java/net/shibboleth/shared/testing/ShowAutomaticModuleNames.java
index 40b2a727..7394e2ab 100644
--- a/shib-testing/src/main/java/net/shibboleth/shared/testing/ShowAutomaticModuleNames.java
+++ b/shib-testing/src/main/java/net/shibboleth/shared/testing/ShowAutomaticModuleNames.java
@@ -79,7 +79,7 @@ public class ShowAutomaticModuleNames {
      * @throws TerminationException if something goes wrong
      */
     @Nullable
-    private String getAutomaticModuleName(@Nonnull JarFile jarFile) throws TerminationException {
+    private String getAutomaticModuleName(@Nonnull final JarFile jarFile) throws TerminationException {
         final Manifest manifest;
         try {
             manifest = jarFile.getManifest();
@@ -90,6 +90,7 @@ public class ShowAutomaticModuleNames {
         }
     }
 
+// Checkstyle: CyclomaticComplexity OFF
     /**
      * Process all of the <code>.jar</code> files in a given directory, and present
      * the results in a readable way.
@@ -100,7 +101,7 @@ public class ShowAutomaticModuleNames {
     private void runDirectory(@Nonnull final File directory) throws TerminationException {
         System.out.println("Processing directory: " + directory.getAbsolutePath());
         final File[] files = directory.listFiles(new FilenameFilter() {
-            public boolean accept(File dir, String name) {
+            public boolean accept(final File dir, final String name) {
                 return name.endsWith(".jar");
             }
         });
@@ -108,7 +109,7 @@ public class ShowAutomaticModuleNames {
         final List<File> noName = new ArrayList<>();
         final Map<File, String> withName = new HashMap<>();
         final Map<File, String> problemNames = new HashMap<>();
-        for (File file : files) {
+        for (final File file : files) {
             try (final JarFile jarFile = new JarFile(file)) {
                 final String automaticName = getAutomaticModuleName(jarFile);
                 if (automaticName == null) {
@@ -129,7 +130,7 @@ public class ShowAutomaticModuleNames {
         if (!problemNames.isEmpty()) {
             System.out.println("   *** with problematic names:");
             final List<File> problemFiles = new ArrayList<>(problemNames.keySet());
-            for (File file : problemFiles) {
+            for (final File file : problemFiles) {
                 System.out.println("      " + file.getName() + ": " + problemNames.get(file));
             }
         }
@@ -137,19 +138,20 @@ public class ShowAutomaticModuleNames {
             System.out.println("   with module names:");
             final List<File> withNameFiles = new ArrayList<>(withName.keySet());
             withNameFiles.sort(null);
-            for (File file : withNameFiles) {
+            for (final File file : withNameFiles) {
                 System.out.println("      " + file.getName() + " --> " + withName.get(file));
             }
         }
         if (!noName.isEmpty()) {
             System.out.println("   with no module name:");
             noName.sort(null);
-            for (File file : noName) {
+            for (final File file : noName) {
                 System.out.println("      " + file.getName());
             }
         }
     }
-
+// Checkstyle: CyclomaticComplexity ON
+    
     /**
      * Runnable main program, wrapped by <code>main</code> in an exception handler.
      *
@@ -184,10 +186,10 @@ public class ShowAutomaticModuleNames {
      *
      * @param args command-line arguments
      */
-    public static void main(String[] args) {
+    public static void main(final String[] args) {
         try {
             new ShowAutomaticModuleNames().run(args);
-        } catch (TerminationException e) {
+        } catch (final TerminationException e) {
             e.printStackTrace();
             System.err.println("*** ERROR: " + e.getMessage());
             System.exit(1);
@@ -195,4 +197,4 @@ public class ShowAutomaticModuleNames {
 
     }
 
-}
+}
\ No newline at end of file
diff --git a/shib-testing/src/main/java/net/shibboleth/shared/testing/TestSupport.java b/shib-testing/src/main/java/net/shibboleth/shared/testing/TestSupport.java
index 85b46d35..5717ea78 100644
--- a/shib-testing/src/main/java/net/shibboleth/shared/testing/TestSupport.java
+++ b/shib-testing/src/main/java/net/shibboleth/shared/testing/TestSupport.java
@@ -43,7 +43,7 @@ import javax.annotation.Nonnull;
  * specific features of the run-time environment, are to be preferred
  * over version-based methods. We don't have any of these yet, though.
  */
-public class TestSupport {
+public final class TestSupport {
 
     /** Constructor. */
     private TestSupport() {
@@ -151,4 +151,4 @@ public class TestSupport {
         return getJavaVersion(System.getProperty("java.version")) >= 11;
     }
 
-}
+}
\ No newline at end of file
diff --git a/shib-testing/src/main/java/net/shibboleth/shared/testing/VelocityEngine.java b/shib-testing/src/main/java/net/shibboleth/shared/testing/VelocityEngine.java
index 340fe790..abdb2786 100644
--- a/shib-testing/src/main/java/net/shibboleth/shared/testing/VelocityEngine.java
+++ b/shib-testing/src/main/java/net/shibboleth/shared/testing/VelocityEngine.java
@@ -23,6 +23,8 @@ import javax.annotation.Nonnull;
 
 import org.apache.velocity.runtime.RuntimeConstants;
 
+import net.shibboleth.shared.annotation.constraint.NullableElements;
+
 /**
  * This is a helper class for creating velocity engines.
  */
@@ -50,7 +52,8 @@ public final class VelocityEngine {
      * 
      * @return velocity engine
      */
-    @Nonnull public static org.apache.velocity.app.VelocityEngine newVelocityEngine(@Nonnull final Properties props) {
+    @Nonnull public static org.apache.velocity.app.VelocityEngine newVelocityEngine(
+            @Nonnull @NullableElements final Properties props) {
         final org.apache.velocity.app.VelocityEngine engine = new org.apache.velocity.app.VelocityEngine();
         engine.init(props);
         return engine;
@@ -75,4 +78,5 @@ public final class VelocityEngine {
         props.setProperty(RuntimeConstants.RESOURCE_LOADERS, "classpath, string");
         return props;
     }
+
 }
\ No newline at end of file
diff --git a/shib-testing/src/main/java/net/shibboleth/shared/testing/package-info.java b/shib-testing/src/main/java/net/shibboleth/shared/testing/package-info.java
index b7fd91b9..a0dc0828 100644
--- a/shib-testing/src/main/java/net/shibboleth/shared/testing/package-info.java
+++ b/shib-testing/src/main/java/net/shibboleth/shared/testing/package-info.java
@@ -21,4 +21,7 @@
  * Note that this package has no presence in the normal "jar" artifact,
  * only as part of the "test-jar".
  */
+ at NonnullElements
 package net.shibboleth.shared.testing;
+
+import net.shibboleth.shared.annotation.constraint.NonnullElements;
diff --git a/shib-velocity-spring/src/main/java/net/shibboleth/shared/spring/velocity/VelocityConfig.java b/shib-velocity-spring/src/main/java/net/shibboleth/shared/spring/velocity/VelocityConfig.java
index bc9309ee..57a4e63e 100644
--- a/shib-velocity-spring/src/main/java/net/shibboleth/shared/spring/velocity/VelocityConfig.java
+++ b/shib-velocity-spring/src/main/java/net/shibboleth/shared/spring/velocity/VelocityConfig.java
@@ -17,6 +17,8 @@
 
 package net.shibboleth.shared.spring.velocity;
 
+import javax.annotation.Nonnull;
+
 import org.apache.velocity.app.VelocityEngine;
 
 /**
@@ -37,5 +39,6 @@ public interface VelocityConfig {
       * 
       * @return the VelocityEngine
       */
-     VelocityEngine getVelocityEngine();
+     @Nonnull VelocityEngine getVelocityEngine();
+
 }
\ No newline at end of file
diff --git a/shib-velocity-spring/src/main/java/net/shibboleth/shared/spring/velocity/VelocityConfigurer.java b/shib-velocity-spring/src/main/java/net/shibboleth/shared/spring/velocity/VelocityConfigurer.java
index 03145abb..2eb31900 100644
--- a/shib-velocity-spring/src/main/java/net/shibboleth/shared/spring/velocity/VelocityConfigurer.java
+++ b/shib-velocity-spring/src/main/java/net/shibboleth/shared/spring/velocity/VelocityConfigurer.java
@@ -30,6 +30,7 @@ import org.springframework.context.ResourceLoaderAware;
 import org.springframework.web.context.ServletContextAware;
 
 import jakarta.servlet.ServletContext;
+import net.shibboleth.shared.annotation.constraint.NotEmpty;
 
 /**
  * JavaBean to configure Velocity for web usage, via the "configLocation"
@@ -74,12 +75,14 @@ public class VelocityConfigurer extends VelocityEngineFactory
         implements VelocityConfig, InitializingBean, ResourceLoaderAware, ServletContextAware {
 
     /** Name of the resource loader for Spring's bind macros. */
-    private static final String SPRING_MACRO_RESOURCE_LOADER_NAME = "springMacro";
+    @Nonnull @NotEmpty private static final String SPRING_MACRO_RESOURCE_LOADER_NAME = "springMacro";
 
     /** Key for the class of Spring's bind macro resource loader. */
+    @Nonnull @NotEmpty
     private static final String SPRING_MACRO_RESOURCE_LOADER_CLASS = "resource.loader.springMacro.class";
 
     /** Name of Spring's default bind macro library. */
+    @Nonnull @NotEmpty
     private static final String SPRING_MACRO_LIBRARY = "net/shibboleth/ext/spring/velocity/spring.vm";
 
     /** Servlet context. */
@@ -100,8 +103,8 @@ public class VelocityConfigurer extends VelocityEngineFactory
      */
     @Override
     public void afterPropertiesSet() throws IOException, VelocityException {
-        if (this.velocityEngine == null) {
-            this.velocityEngine = createVelocityEngine();
+        if (velocityEngine == null) {
+            velocityEngine = createVelocityEngine();
         }
     }
     
@@ -121,8 +124,12 @@ public class VelocityConfigurer extends VelocityEngineFactory
     }
 
     /** {@inheritDoc} */
-    public VelocityEngine getVelocityEngine() {
-        return velocityEngine;
+    @Nonnull public VelocityEngine getVelocityEngine() {
+        if (velocityEngine != null) {
+            return velocityEngine;
+        }
+        
+        throw new IllegalStateException("Velocity engine not yet created");
     }
 
 }
\ No newline at end of file
diff --git a/shib-velocity-spring/src/main/java/net/shibboleth/shared/spring/velocity/VelocityEngineFactory.java b/shib-velocity-spring/src/main/java/net/shibboleth/shared/spring/velocity/VelocityEngineFactory.java
index 3e4f5893..d6177a51 100644
--- a/shib-velocity-spring/src/main/java/net/shibboleth/shared/spring/velocity/VelocityEngineFactory.java
+++ b/shib-velocity-spring/src/main/java/net/shibboleth/shared/spring/velocity/VelocityEngineFactory.java
@@ -40,6 +40,7 @@ import org.springframework.core.io.support.PropertiesLoaderUtils;
 import org.springframework.util.CollectionUtils;
 import org.springframework.util.StringUtils;
 
+import net.shibboleth.shared.annotation.constraint.NullableElements;
 import net.shibboleth.shared.primitive.LoggerFactory;
 
 /**
@@ -82,7 +83,7 @@ public class VelocityEngineFactory {
     @Nullable private Resource configLocation;
 
     /** Configuration properties. */
-    @Nonnull private final Map<String, Object> velocityProperties;
+    @Nonnull @NullableElements private final Map<String, Object> velocityProperties;
 
     /** Path to load resources from. */
     @Nullable private String resourceLoaderPath;
@@ -143,7 +144,7 @@ public class VelocityEngineFactory {
      * 
      * @see #setVelocityProperties
      */
-    public void setVelocityPropertiesMap(@Nullable final Map<String,Object> map) {
+    public void setVelocityPropertiesMap(@Nullable @NullableElements final Map<String,Object> map) {
         if (map != null) {
             velocityProperties.putAll(map);
         }
diff --git a/shib-velocity-spring/src/main/java/net/shibboleth/shared/spring/velocity/VelocityView.java b/shib-velocity-spring/src/main/java/net/shibboleth/shared/spring/velocity/VelocityView.java
index 0331f47b..9ab2830c 100644
--- a/shib-velocity-spring/src/main/java/net/shibboleth/shared/spring/velocity/VelocityView.java
+++ b/shib-velocity-spring/src/main/java/net/shibboleth/shared/spring/velocity/VelocityView.java
@@ -40,6 +40,7 @@ import org.springframework.web.servlet.view.AbstractTemplateView;
 import jakarta.servlet.ServletException;
 import jakarta.servlet.http.HttpServletRequest;
 import jakarta.servlet.http.HttpServletResponse;
+import net.shibboleth.shared.annotation.constraint.NullableElements;
 
 /**
  * View using the Velocity template engine.
@@ -229,7 +230,7 @@ public class VelocityView extends AbstractTemplateView {
      * @throws Exception if there's a fatal error while rendering the model
      */
     @Override
-    protected void renderMergedTemplateModel(@Nonnull final Map<String,Object> model,
+    protected void renderMergedTemplateModel(@Nonnull @NullableElements final Map<String,Object> model,
             @Nonnull final HttpServletRequest request, @Nonnull final HttpServletResponse response) throws Exception {
 
         final Context velocityContext = createVelocityContext(model, request, response);
@@ -254,7 +255,7 @@ public class VelocityView extends AbstractTemplateView {
      * 
      * @throws Exception if there's a fatal error while creating the context
      */
-    @Nonnull protected Context createVelocityContext(@Nullable final Map<String,Object> model,
+    @Nonnull protected Context createVelocityContext(@Nullable @NullableElements final Map<String,Object> model,
             @Nonnull final HttpServletRequest request, @Nonnull final HttpServletResponse response) throws Exception {
 
         return createVelocityContext(model);
@@ -274,7 +275,8 @@ public class VelocityView extends AbstractTemplateView {
      * 
      * @throws Exception if there's a fatal error while creating the context
      */
-    @Nonnull protected Context createVelocityContext(final Map<String, Object> model) throws Exception {
+    @Nonnull protected Context createVelocityContext(@Nullable @NullableElements final Map<String, Object> model)
+            throws Exception {
         return new VelocityContext(model);
     }
 
@@ -317,7 +319,7 @@ public class VelocityView extends AbstractTemplateView {
      * 
      * @throws Exception if thrown by Velocity
      */
-    protected Template getTemplate() throws Exception {
+    @Nonnull protected Template getTemplate() throws Exception {
         // We already hold a reference to the template, but we might want to load it
         // if not caching. Velocity itself caches templates, so our ability to
         // cache templates in this class is a minor optimization only.
@@ -341,7 +343,7 @@ public class VelocityView extends AbstractTemplateView {
      * 
      * @throws Exception if thrown by Velocity
      */
-    protected Template getTemplate(final String name) throws Exception {
+    @Nonnull protected Template getTemplate(final String name) throws Exception {
         final VelocityEngine engine = getVelocityEngine();
         if (engine == null) {
             throw new ResourceNotFoundException("VelocityEngine not set");
@@ -361,7 +363,7 @@ public class VelocityView extends AbstractTemplateView {
      * 
      * @throws Exception if thrown by Velocity
      */
-    protected void mergeTemplate(final Template t, final Context context,
+    protected void mergeTemplate(@Nonnull final Template t, @Nonnull final Context context,
             @Nonnull final HttpServletResponse response) throws Exception {
 
         try {
@@ -376,4 +378,4 @@ public class VelocityView extends AbstractTemplateView {
         }
     }
 
-}
+}
\ No newline at end of file
diff --git a/shib-velocity-spring/src/main/java/net/shibboleth/shared/spring/velocity/package-info.java b/shib-velocity-spring/src/main/java/net/shibboleth/shared/spring/velocity/package-info.java
index 383d216f..b538237f 100644
--- a/shib-velocity-spring/src/main/java/net/shibboleth/shared/spring/velocity/package-info.java
+++ b/shib-velocity-spring/src/main/java/net/shibboleth/shared/spring/velocity/package-info.java
@@ -18,5 +18,7 @@
 /**
  * Side-port of Velocity support from Spring 4 after removal from Spring 5.
  */
+ at NonnullElements
+package net.shibboleth.shared.spring.velocity;
 
-package net.shibboleth.shared.spring.velocity;
\ No newline at end of file
+import net.shibboleth.shared.annotation.constraint.NonnullElements;
diff --git a/shib-velocity/src/main/java/net/shibboleth/shared/velocity/package-info.java b/shib-velocity/src/main/java/net/shibboleth/shared/velocity/package-info.java
index 1c6b91c4..aaa79ea5 100644
--- a/shib-velocity/src/main/java/net/shibboleth/shared/velocity/package-info.java
+++ b/shib-velocity/src/main/java/net/shibboleth/shared/velocity/package-info.java
@@ -16,5 +16,7 @@
  */
 
 /** Classes for working with Apache Velocity. */
+ at NonnullElements
+package net.shibboleth.shared.velocity;
 
-package net.shibboleth.shared.velocity;
\ No newline at end of file
+import net.shibboleth.shared.annotation.constraint.NonnullElements;

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.


More information about the commits mailing list