After Spring boot upgrade to 2.4.4 and spring framework to 5.3.5 , getting this error in spring session deserialization

[vkatoch2000]

It seems deserialization of the old session_attribute failed after the upgrade

byte[] bytes = getLobHandler().getBlobAsBytes(rs, "ATTRIBUTE_BYTES");
session.delegate.setAttribute(attributeName, lazily(() -> deserialize(bytes))); // failed here

The system keeps on throwing this error: any clue?
07, 46, 99, 111, 114, 101, 46, 68, 101, 99, 111, 114, 97, 116, 105, 110, 103, 80, 114, 111, 120, 121, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 120, 112, 115, 114, 0, 17, 106, 97, 118, 97, 46, 117, 116, 105, 108, 46, 72, 97, 115, 104, 77, 97, 112, 5, 7, -38, -63, -61, 22, 96, -47, 3, 0, 2, 70, 0, 10, 108, 111, 97, 100, 70, 97, 99, 116, 111, 114, 73, 0, 9, 116, 104, 114, 101, 115, 104, 111, 108, 100, 120, 112, 63, 64, 0, 0, 0, 0, 0, 0, 119, 8, 0, 0, 0, 16, 0, 0, 0, 0, 120}'; nested exception is org.springframework.core.serializer.support.SerializationFailedException: Failed to deserialize payload. Is the byte array a result of corresponding serialization for DefaultDeserializer?; nested exception is java.io.InvalidClassException: org.springframework.aop.framework.DefaultAopProxyFactory; local class incompatible: stream classdesc serialVersionUID = -5374615684281184745, local class serialVersionUID = 7930414337282325166
at org.springframework.core.convert.support.ConversionUtils.invokeConverter(ConversionUtils.java:47)
at org.springframework.core.convert.support.GenericConversionService.convert(GenericConversionService.java:192)
at org.springframework.session.jdbc.JdbcIndexedSessionRepository.deserialize(JdbcIndexedSessionRepository.java:597)
at org.springframework.session.jdbc.JdbcIndexedSessionRepository.access$1900(JdbcIndexedSessionRepository.java:131)
at org.springframework.session.jdbc.JdbcIndexedSessionRepository$SessionResultSetExtractor.lambda$extractData$0(JdbcIndexedSessionRepository.java:863)
at org.springframework.session.jdbc.JdbcIndexedSessionRepository$4.get(JdbcIndexedSessionRepository.java:619)
at org.springframework.session.jdbc.JdbcIndexedSessionRepository$JdbcSession.getAttribute(JdbcIndexedSessionRepository.java:694)
at org.springframework.session.web.http.HttpSessionAdapter.getAttribute(HttpSessionAdapter.java:112)
at org.springframework.web.context.request.ServletRequestAttributes.getAttribute(ServletRequestAttributes.java:158)
at org.springframework.web.context.request.AbstractRequestAttributesScope.get(AbstractRequestAttributesScope.java:43)
at org.springframework.web.context.request.SessionScope.get(SessionScope.java:57)
at org.springframework.beans.factory.support.AbstractBeanFactory.doGetBean(AbstractBeanFactory.java:371)
at org.springframework.beans.factory.support.AbstractBeanFactory.getBean(AbstractBeanFactory.java:208)
at org.springframework.aop.target.SimpleBeanTargetSource.getTarget(SimpleBeanTargetSource.java:35)
at org.springframework.aop.framework.JdkDynamicAopProxy.invoke(JdkDynamicAopProxy.java:195)
at com.sun.proxy.$Proxy141.getAccessToken(Unknown Source)
at org.springframework.cloud.security.oauth2.client.AccessTokenContextRelay.copyToken(AccessTokenContextRelay.java:53)
at org.springframework.cloud.security.oauth2.client.ResourceServerTokenRelayAutoConfiguration$ResourceServerTokenRelayRegistrationAutoConfiguration$1.preHandle(ResourceServerTokenRelayAutoConfiguration.java:98)
at org.springframework.web.servlet.HandlerExecutionChain.applyPreHandle(HandlerExecutionChain.java:148)
at org.springframework.web.servlet.DispatcherServlet.doDispatch(DispatcherServlet.java:1055)

Any clue why we are getting errors now or do we need to clean up the old session after upgrade?

[eleftherias]

@vkatoch2000 You are correct that you will need to invalidate the sessions to allow users to get a new one, since they are not intended to be serialized between different versions.

You may also find it useful to switch to Jackson serialization to avoid this issue in future version upgrades. See spring-projects/spring-security#3736

You can also see this Spring Security issue for more information spring-projects/spring-security#9204