In WFS 2.0, the expiry parameter of GetFeatureWithLock/LockFeature was changed to be in seconds (OGC 09-025r1 : paragraph 22.214.171.124 : "The expiry limit is specified in number of seconds."), whereas previous versions was in minutes (sigh...). It seems GeoServer/GeoTools doesn't take that into account.
The below request should lock the features for 1 seconds, but it actually locks them for 1 minute.
curl -X POST --header "Content-Type:application/xml" --data-binary '<wfs:GetFeatureWithLock service="WFS" version="2.0.0" handle="GetFeatureWithLock-tc1" expiry="1" resultType="results" xmlns:fes="http://www.opengis.net/fes/2.0"
Related to that, the doc at http://docs.geoserver.org/stable/en/user/services/wfs/reference.html mentions in the GetFeatureWithLock that this "This POST example retrieves the features of the topp:states layer, but in addition locks those features for five minutes." with expiry=5. This is indeed what GeoServer does, but not what is expected.
Linux 64 bit