Maven spring-boot-starter-security limiting org.springframework.security to version 3.2.8 and not using 4.0.2

Question

Any idea when the dependencies in Maven will be updated?

I want to use org.springframework.security 4.0.2 with my Spring Boot application however if I implement spring-boot-starter-security as a dependacy it will limit the version to 3.2.8.

Trying to override each dependency with a manual version is not a maintainable solution.

Answer 1

To override a version from a Spring Boot managed dependency it is enough to specify the property for that dependency. Spring Boot defines a version property for all dependencies, you can find the list of them here: https://github.com/spring-projects/spring-boot/blob/master/spring-boot-dependencies/pom.xml

So just add the following to your pom.xml:

<properties>
    <spring-security.version>4.0.2.RELEASE</spring-security.version>
</properties>

Besides that, Spring Boot 1.3 will depend on Spring Security 4, Spring Boot 1.2.x will stay on Spring Security 3.2.x. A patch release won't upgrade a dependency to a new major version.