Which version of spring security is compatible with org.springframework

Question

After a migration from spring 4.3.9 to 5.3.22 / spring security from 4.2.3.RELEASE to 5.3.9.RELEASE, I have this error:

org.springframework.beans.factory.BeanExpressionException: Expression
parsing failed; nested exception is java.lang.NoSuchMethodError:
org.springframework.expression.spel.support.StandardTypeConverter.<init>(Ljava/util/function/Supplier;)V
        at
org.springframework.context.expression.StandardBeanExpressionResolver.evaluate(StandardBeanExpressionResolver.java:170)

I think is related to spring-expression version, because there is a conflict:

I ask which version of spring security I should have with spring framework 5.3.22?

this is my list of dependencies:

 <dependency>
     <groupId>com.oracle.database.jdbc</groupId>
     <artifactId>ojdbc8</artifactId>
     <version>${ojdbc.version}</version>
 </dependency>
 
 <dependency>
     <groupId>javax.servlet</groupId>
     <artifactId>javax.servlet-api</artifactId>
     <version>${version.servlet.api}</version>
     <scope>compile</scope>
 </dependency>
 
 <dependency>
     <groupId>javax.ws.rs</groupId>
     <artifactId>javax.ws.rs-api</artifactId>
     <version>${version.ws-rs.api}</version>
 </dependency>
 <dependency>
     <groupId>org.apache.cxf</groupId>
     <artifactId>cxf-rt-transports-http</artifactId>
     <version>${cxf.version}</version>
 
     <exclusions>
         <exclusion>
             <artifactId>spring-web</artifactId>
             <groupId>org.springframework</groupId>
         </exclusion>
         <exclusion>
             <artifactId>spring-core</artifactId>
             <groupId>org.springframework</groupId>
         </exclusion>
         <exclusion>
             <artifactId>spring-asm</artifactId>
             <groupId>org.springframework</groupId>
         </exclusion>
         <exclusion>
             <artifactId>spring-aop</artifactId>
             <groupId>org.springframework</groupId>
         </exclusion>
         <exclusion>
             <artifactId>spring-context</artifactId>
             <groupId>org.springframework</groupId>
         </exclusion>
         <exclusion>
             <artifactId>spring-beans</artifactId>
             <groupId>org.springframework</groupId>
         </exclusion>
         <exclusion>
             <artifactId>spring-expression</artifactId>
             <groupId>org.springframework</groupId>
         </exclusion>
     </exclusions>
 </dependency>
 <dependency>
     <groupId>org.apache.cxf</groupId>
     <artifactId>cxf-rt-frontend-jaxws</artifactId>
     <version>${cxf.version}</version>
     <exclusions>
         <exclusion>
             <artifactId>spring-web</artifactId>
             <groupId>org.springframework</groupId>
         </exclusion>
         <exclusion>
             <artifactId>spring-core</artifactId>
             <groupId>org.springframework</groupId>
         </exclusion>
         <exclusion>
             <artifactId>spring-asm</artifactId>
             <groupId>org.springframework</groupId>
         </exclusion>
         <exclusion>
             <artifactId>spring-aop</artifactId>
             <groupId>org.springframework</groupId>
         </exclusion>
         <exclusion>
             <artifactId>spring-context</artifactId>
             <groupId>org.springframework</groupId>
         </exclusion>
         <exclusion>
             <artifactId>spring-beans</artifactId>
             <groupId>org.springframework</groupId>
         </exclusion>
         <exclusion>
             <artifactId>spring-expression</artifactId>
             <groupId>org.springframework</groupId>
         </exclusion>
     </exclusions>
 </dependency>
 <dependency>
     <groupId>org.apache.cxf</groupId>
     <artifactId>cxf-rt-frontend-jaxrs</artifactId>
     <version>${cxf.version}</version>
     <exclusions>
         <exclusion>
             <artifactId>spring-core</artifactId>
             <groupId>org.springframework</groupId>
         </exclusion>
         <exclusion>
             <groupId>javax.ws.rs</groupId>
             <artifactId>javax.ws.rs-api</artifactId>
         </exclusion>
     </exclusions>
 </dependency>
  
 <dependency>
     <artifactId>spring-web</artifactId>
     <groupId>org.springframework</groupId>
     <version>${spring.version}</version>
     <scope>compile</scope>
 </dependency>
 
 <dependency>
     <artifactId>spring-context</artifactId>
     <groupId>org.springframework</groupId>
     <version>${spring.version}</version>
     <scope>compile</scope>
 </dependency>
 
 <dependency>
     <groupId>org.springframework</groupId>
     <artifactId>spring-orm</artifactId>
     <version>${spring.version}</version>
     <scope>compile</scope>
 </dependency>
 
 <dependency>
     <groupId>org.springframework</groupId>
     <artifactId>spring-core</artifactId>
     <version>${spring.version}</version>
     <scope>compile</scope>
 </dependency>
 
 <dependency>
     <groupId>org.springframework</groupId>
     <artifactId>spring-aop</artifactId>
     <version>${spring.version}</version>
 </dependency>
 
 <dependency>
     <groupId>org.springframework</groupId>
     <artifactId>spring-test</artifactId>
     <version>${spring.version}</version>
     <scope>test</scope>
 </dependency>
 
 <dependency>
     <groupId>org.springframework.security</groupId>
     <artifactId>spring-security-core</artifactId>
     <version>${spring.security.version}</version>
 </dependency>
 
 <dependency>
     <groupId>ch.qos.logback</groupId>
     <artifactId>logback-classic</artifactId>
     <version>${logback.version}</version>
     <scope>compile</scope>
 </dependency>
 <dependency>
     <groupId>org.slf4j</groupId>
     <artifactId>jcl-over-slf4j</artifactId>
     <version>${slf4j.version}</version>
 </dependency>
 
 <dependency>
     <groupId>net.bull.javamelody</groupId>
     <artifactId>javamelody-core</artifactId>
     <version>1.63.0</version>
 </dependency>
 
 <dependency>
     <groupId>org.junit.jupiter</groupId>
     <artifactId>junit-jupiter-engine</artifactId>
     <version>${junit.version}</version>
     <scope>test</scope>
 </dependency>
 
 <dependency>
     <groupId>org.apache.commons</groupId>
     <artifactId>commons-lang3</artifactId>
     <version>3.10</version>
 </dependency>
 
 <dependency>
     <groupId>org.mockito</groupId>
     <artifactId>mockito-core</artifactId>
     <version>${mockito.version}</version>
 </dependency>
 
 <dependency>
     <groupId>org.mockito</groupId>
     <artifactId>mockito-junit-jupiter</artifactId>
     <version>${mockito.version}</version>
 </dependency>
 <dependency>
     <groupId>com.sun.xml.bind</groupId>
     <artifactId>jaxb-core</artifactId>
     <version>${version.jaxb.api}</version>
 </dependency>
 <dependency>
     <groupId>com.sun.xml.bind</groupId>
     <artifactId>jaxb-impl</artifactId>
     <version>${version.jaxb.api}</version>
 </dependency>
 <dependency>
     <groupId>com.sun.activation</groupId>
     <artifactId>javax.activation</artifactId>
     <version>${javax.activation.version}</version>
 </dependency>
 <dependency>
     <groupId>javax.xml.bind</groupId>
     <artifactId>jaxb-api</artifactId>
     <version>${version.jaxb.api}</version>
 </dependency>

with versions:

<maven.compiler.source>11</maven.compiler.source>
<maven.compiler.target>11</maven.compiler.target>
<version.ws-rs.api>2.0</version.ws-rs.api>
<version.jaxb.api>2.3.0</version.jaxb.api>
<javax.activation.version>1.2.0</javax.activation.version>
<version.servlet.api>3.1.0</version.servlet.api>        <spring.version>5.3.22</spring.version>
<spring.security.version>5.3.9.RELEASE</spring.security.version>
<slf4j.version>1.7.25</slf4j.version>
<logback.version>1.2.3</logback.version>
<cxf.version>3.3.0</cxf.version>
<junit.version>5.8.2</junit.version>
<powermock.version>1.4.8</powermock.version>
<mockito.version>4.6.1</mockito.version>
<version.maven-compiler-plugin>3.8.0</version.maven-compiler-plugin>
<version.jaxb2-maven-plugin>2.5.0</version.jaxb2-maven-plugin>
<version.build-helper-maven-plugin>1.7</version.build-helper-maven-plugin>
<version.jaxb-java-time-adapters>1.1.3</version.jaxb-java-time-adapters>
<ojdbc.version>19.3.0.0</ojdbc.version>

Answer 1

To answer your initial question you should be using Spring Security 5.5 or higher as that supports Spring 5.3 (it is build against it). Using anything lower might work but YMMV.

To answer your additional question in the comment based upon my take on your dependency management. You should be using the Spring Framework BOM to manage your dependencies (Spring Security has one as well). See also this blog which explains the usage and benefits of a bom (and what is solves).

In your case it would drastically improve your dependency management.

<dependencyManagement>
  <dependencies>
    <dependency>
      <groupId>org.springframework</groupId>
      <artifactId>spring-framework-bom</artifactId>
      <version>${spring.version}</version>
      <scope>import</scope>
      <type>pom</type>
    </dependency>

    <dependency>
      <groupId>org.springframework.security</groupId>
      <artifactId>spring-security-bom</artifactId>
      <version>${spring.security.version}</version>
      <scope>import</scope>
      <type>pom</type>
    </dependency>

    <dependency>
      <groupId>org.mockito</groupId>
      <artifactId>mockito-bom</artifactId>
      <version>${mockito.version}</version>
      <scope>import</scope>
      <type>pom</type>
    </dependency>

    <dependency>
      <groupId>org.junit</groupId>
      <artifactId>junit-bom</artifactId>
      <version>${junit.version}</version>
      <scope>import</scope>
      <type>pom</type>
    </dependency>

  </dependencies>
</dependencyManagement>

<dependency>
     <groupId>com.oracle.database.jdbc</groupId>
     <artifactId>ojdbc8</artifactId>
     <version>${ojdbc.version}</version>
 </dependency>
 
 <dependency>
     <groupId>javax.servlet</groupId>
     <artifactId>javax.servlet-api</artifactId>
     <version>${version.servlet.api}</version>
     <scope>provided</scope>
 </dependency>
 
 <dependency>
     <groupId>javax.ws.rs</groupId>
     <artifactId>javax.ws.rs-api</artifactId>
     <version>${version.ws-rs.api}</version>
 </dependency>
 <dependency>
     <groupId>org.apache.cxf</groupId>
     <artifactId>cxf-rt-transports-http</artifactId>
     <version>${cxf.version}</version>
     <exclusions>
         <!-- Spring ASM doesn't exist anymore, exclude to prevent inclusion of old versions of Spring jars -->
         <exclusion>
             <artifactId>spring-asm</artifactId>
             <groupId>org.springframework</groupId>
         </exclusion>
     </exclusions>
 </dependency>
 <dependency>
     <groupId>org.apache.cxf</groupId>
     <artifactId>cxf-rt-frontend-jaxws</artifactId>
     <version>${cxf.version}</version>
     <exclusions>
         <!-- Spring ASM doesn't exist anymore, exclude to prevent inclusion of old versions of Spring jars -->
         <exclusion>
             <artifactId>spring-asm</artifactId>
             <groupId>org.springframework</groupId>
         </exclusion>
     </exclusions>
 </dependency>
 <dependency>
     <groupId>org.apache.cxf</groupId>
     <artifactId>cxf-rt-frontend-jaxrs</artifactId>
     <version>${cxf.version}</version>     
 </dependency>
  
 <dependency>
     <groupId>org.springframework</groupId>
     <artifactId>spring-web</artifactId>
 </dependency>
 
 <dependency>
     <groupId>org.springframework</groupId>
     <artifactId>spring-context</artifactId>
 </dependency>
 
 <dependency>
     <groupId>org.springframework</groupId>
     <artifactId>spring-orm</artifactId>
 </dependency>
 
 <dependency>
     <groupId>org.springframework</groupId>
     <artifactId>spring-aop</artifactId>
 </dependency>
 
 <dependency>
     <groupId>org.springframework</groupId>
     <artifactId>spring-test</artifactId>
     <scope>test</scope>
 </dependency>
 
 <dependency>
     <groupId>org.springframework.security</groupId>
     <artifactId>spring-security-core</artifactId>
 </dependency>
 
 <dependency>
     <groupId>ch.qos.logback</groupId>
     <artifactId>logback-classic</artifactId>
     <version>${logback.version}</version>
     <scope>compile</scope>
 </dependency>
 <dependency>
     <groupId>org.slf4j</groupId>
     <artifactId>jcl-over-slf4j</artifactId>
     <version>${slf4j.version}</version>
 </dependency>
 
 <dependency>
     <groupId>net.bull.javamelody</groupId>
     <artifactId>javamelody-core</artifactId>
     <version>1.91.0</version>
 </dependency>
 
 <dependency>
     <groupId>org.junit.jupiter</groupId>
     <artifactId>junit-jupiter-engine</artifactId>
     <scope>test</scope>
 </dependency>
 
 <dependency>
     <groupId>org.apache.commons</groupId>
     <artifactId>commons-lang3</artifactId>
     <version>3.10</version>
 </dependency>
 
 <dependency>
     <groupId>org.mockito</groupId>
     <artifactId>mockito-core</artifactId>
 </dependency>
 
 <dependency>
     <groupId>org.mockito</groupId>
     <artifactId>mockito-junit-jupiter</artifactId>
 </dependency>
 <dependency>
     <groupId>com.sun.xml.bind</groupId>
     <artifactId>jaxb-core</artifactId>
     <version>${version.jaxb.api}</version>
 </dependency>
 <dependency>
     <groupId>com.sun.xml.bind</groupId>
     <artifactId>jaxb-impl</artifactId>
     <version>${version.jaxb.api}</version>
 </dependency>
 <dependency>
     <groupId>com.sun.activation</groupId>
     <artifactId>javax.activation</artifactId>
     <version>${javax.activation.version}</version>
 </dependency>
 <dependency>
     <groupId>javax.xml.bind</groupId>
     <artifactId>jaxb-api</artifactId>
     <version>${version.jaxb.api}</version>
 </dependency>

Something like this. Maven will now automatically use the version information from the bom to manage the versions. You don't need to include the version anymore and any transitive version will be managed as well. That saves you a lot of excludes. I took the liberty to add them for Spring, Spring Security, JUnit and Mockito. However I also believe there is one for JAXB and CXF as well.