See the new code for this in the new commit below:

    protected void onSessionChange(String originalSessionId, HttpSession newSession, Authentication auth) {
        if(applicationEventPublisher != null) {
            applicationEventPublisher.publishEvent(new SessionFixationProtectionMigrationEvent(
                auth, originalSessionId, newSession.getId(), migrateSessionAttributes
            ));
        }
    }

Should never result in a NPE. Is that sufficient, or is the `NullEventPublisher` really needed here for something I'm not seeing?