-
Notifications
You must be signed in to change notification settings - Fork 6.1k
Closed
Labels
in: buildAn issue in the buildAn issue in the buildstatus: backportedAn issue that has been backported to maintenance branchesAn issue that has been backported to maintenance branchestype: breaks-passivityA change that breaks passivity with the previous releaseA change that breaks passivity with the previous releasetype: bugA general bugA general bug
Milestone
Description
Update Rather than embedding spring-security-crypto, spirng-security-core should just depend on it to avoid this scenario. This breaks passivity for applications that do not leverage transitive dependencies, but it should not impact a majority of users. Users that don't leverage transitive dependencies will need to explicitly add the spring-security-crypto jar to their classpath.
In 5.5.0, spring-security-core
has started declaring a dependency on spring-security-crypto
in addition to embedding spring-security-crypto
's classes. This resulted in a number of Spring Boot's starters containing duplicates of the crypto classes. We've worked around it by excluding spring-security-crypto
.
Metadata
Metadata
Assignees
Labels
in: buildAn issue in the buildAn issue in the buildstatus: backportedAn issue that has been backported to maintenance branchesAn issue that has been backported to maintenance branchestype: breaks-passivityA change that breaks passivity with the previous releaseA change that breaks passivity with the previous releasetype: bugA general bugA general bug