Current Behavior

StandardInterceptUrlRegistry is defined in UrlAuthorizationConfigurer:

public class StandardInterceptUrlRegistry
    extends
    ExpressionUrlAuthorizationConfigurer<H>.AbstractInterceptUrlRegistry<StandardInterceptUrlRegistry, AuthorizedUrl> {

ExpressionInterceptUrlRegistry is defined in ExpressionUrlAuthorizationConfigurer

The latter is defined as:

public class ExpressionInterceptUrlRegistry
    extends
    ExpressionUrlAuthorizationConfigurer<H>.AbstractInterceptUrlRegistry<ExpressionInterceptUrlRegistry, AuthorizedUrl> {

Expected Behavior

It's inconsistent that StandardInterceptUrlRegistry refers to AbstractInterceptUrlRegistry through ExpressionUrlAuthorizationConfigurer. Instead, it should refer to it through its own parent class, UrlAuthorizationConfigurer like so:

public class StandardInterceptUrlRegistry
    extends
    UrlAuthorizationConfigurer<H>.AbstractInterceptUrlRegistry<StandardInterceptUrlRegistry, AuthorizedUrl> {

Without this, some JDK 9+ versions refuse to compile as it creates two distinct H type parameters:

/home/jzheaux/dev/spring-projects/spring-security-5.3.x/config/src/main/java/org/springframework/security/config/annotation/web/configurers/UrlAuthorizationConfigurer.java:122: error: type argument UrlAuthorizationConfigurer<H#1>.StandardInterceptUrlRegistry is not within bounds of type-variable R
                        ExpressionUrlAuthorizationConfigurer<H>.AbstractInterceptUrlRegistry<UrlAuthorizationConfigurer<H>.StandardInterceptUrlRegistry, AuthorizedUrl> {
                                                                                                                          ^
  where H#1,R,T,C,H#2 are type-variables:
    H#1 extends HttpSecurityBuilder<H#1> declared in class UrlAuthorizationConfigurer
    R extends AbstractInterceptUrlConfigurer<C,H#2>.AbstractInterceptUrlRegistry<R,T> declared in class AbstractInterceptUrlConfigurer.AbstractInterceptUrlRegistry
    T extends Object declared in class AbstractInterceptUrlConfigurer.AbstractInterceptUrlRegistry
    C extends AbstractInterceptUrlConfigurer<C,H#2> declared in class AbstractInterceptUrlConfigurer
    H#2 extends HttpSecurityBuilder<H#2> declared in class AbstractInterceptUrlConfigurer
/home/jzheaux/dev/spring-projects/spring-security-5.3.x/config/src/main/java/org/springframework/security/config/annotation/web/configurers/UrlAuthorizationConfigurer.java:122: error: improperly formed type, type arguments given on a raw type
                        ExpressionUrlAuthorizationConfigurer<H>.AbstractInterceptUrlRegistry<UrlAuthorizationConfigurer<H>.StandardInterceptUrlRegistry, AuthorizedUrl> {

AbstractInterceptUrlRegistry is declared in a shared parent AbstractInterceptUrlConfigurer. That means that changing extends ExpressionUrlAuthorizationConfigurer<H>.AbstractInterceptUrlRegistry to UrlAuthorizationConfigurer<H>.AbstractInterceptUrlRegistry won't change the inheritance graph and should be binary-compatible.