There is something unnecessary in the specification of the return value of UserDetailsPasswordService#updatePassword.

Expected Behavior

@return the updated UserDetails with the new password

 */
void updatePassword(UserDetails user, String newPassword);

Or, for compatibility:

 * @return the UserDetails (with the authorities)
 */
UserDetails updatePassword(UserDetails user, String newPassword);

Current Behavior

 * @return the updated UserDetails with the new password
 */
UserDetails updatePassword(UserDetails user, String newPassword);

But, "the new password" in the UserDetails will not be used anywhere.

Context

As long as we use DaoAuthenticationProvider, only the authorized property of the UserDetails returned by UserDetailsPasswordService#updatePassword will be used.
(As far as I know, only DaoAuthenticationProvider can set UserDetailsPasswordService.)
Therefore, even if we set the new password in the UserDetails whitch is return value of UserDetailsPasswordService#updatePassword, it will not be used anywhere.

What UserDetailsPasswordService#updatePassword should do is "Modify the specified user's password. This should change the user's password in the persistent user repository".
Following the above, the implementation of this method would be as simple as:

accountRepository.updatePassword(user.getUsername(), newPassword);

However, following "@return the updated UserDetails with the new password" will require we to recreate the UserDetails in most implementations.

return new ...

But in fact, unless we want to change the authorities, we can just return the UserDetails argument as is.

return user;

Start by reading the UserDetailsPasswordService#updatePassword contract and its use from DaoAuthenticationProvider, then inspect the surrounding API documentation and implementations. Done means the contract accurately states which returned UserDetails properties are used, with the compatibility choice for the return type resolved and documented.