...
We only ever inject HttpServletRequest or HttpServletResponse into an object if it is known to have a short life (which means exactly one place - org.opensaml.saml.saml2.profile.impl.ValidateAssertions.AssertionValidationInput. In all other places we inject a java.util.function.Supplier. Two new beans are set in global-system which return the object directly from the TLS.
net.shibboleth.shared.spring.service.ClassBasedServiceStrategy can now handle arbitrary objects. This means that the zero parameter constructor no longer exists.
Migration of net.shibboleth.utilities.java.support → net.shibboleth.shared
...