safely overriding spring-boot dependency version

Question

I am using spring-boot 2.1.18.RELEASE.

We need to upgrade Spring security to 5.2+. Doing so led to errors of the like: NoClassDefFound so I started manually upgrading other libraries along the way, solving and finding other issues. For example, I had to upgrade one dependency (spring-security-web), which led to:

java.lang.NoClassDefFoundError: org/springframework/core/log/LogMessage

My question: how to know if upgrading one specific spring dependency is safe?

Is there any minimal requirements info for each dependency? For example: spring-security-web 5.2.10.RELEASE requires spring-core 5.2.0+

Answer 1

Generally speaking, all spring security dependencies should match the same version as they are managed together. So spring-security-web-5.2.10.RELEASE needs to match spring-security-core-5.2.10.RELEASE . But those dependencies are typically managed transitively, so whichever spring-security dependencies you explicitly depend on should have the same version, and any others (transitive dependencies) should not have versions declared in your build.

As far as something like spring-security-web depending on spring-core , there is no explicit guarantee made for any version since it is a separate project. But again, spring-core is a transitive dependency and shouldn't require specifying a version. Both projects (Spring Framework, Spring Security) use semver versioning and follow a release train, so the general rule of thumb is aligning on the minor version. Therefore, spring-security-web-5.2.10.RELEASE needs to match spring-core of 5.2.x.

Finally, if you're stuck maintaining an older Spring Boot app and can't upgrade, you should stick within the minor release of all the dependencies your project is compatible with. For example, trying to upgrade from spring-security 5.1 to 5.2+ for only some dependencies without upgrading Spring Boot may cause issues. Best to upgrade the entire ecosystem of spring projects at once using Spring Boot. Until then, you can pick up security patches without major upgrades as they are maintained for quite some time. In your case, upgrading to 5.2, you really need to look at upgrading Spring Boot to 2.2 to get the latest security patches for Spring Security.