Spring Framework 5.3.22兼容的Spring Security版本及依赖冲突排查

云原生阿岚

2026-8-8

Spring与Spring Security迁移后版本冲突问题及适配咨询

将Spring从4.3.9迁移至5.3.22、Spring Security从4.2.3.RELEASE迁移至5.3.9.RELEASE后，出现如下错误：

org.springframework.beans.factory.BeanExpressionException: Expression parsing failed; nested exception is java.lang.NoSuchMethodError: org.springframework.expression.spel.support.StandardTypeConverter.<init>(Ljava/util/function/Supplier;)V
        at org.springframework.context.expression.StandardBeanExpressionResolver.evaluate(StandardBeanExpressionResolver.java:170)

判断该问题与spring-expression版本冲突有关，现咨询适配Spring Framework 5.3.22的Spring Security版本。

依赖列表

<dependency>
    <groupId>com.oracle.database.jdbc</groupId>
    <artifactId>ojdbc8</artifactId>
    <version>${ojdbc.version}</version>
</dependency>

<dependency>
    <groupId>javax.servlet</groupId>
    <artifactId>javax.servlet-api</artifactId>
    <version>${version.servlet.api}</version>
    <scope>compile</scope>
</dependency>

<dependency>
    <groupId>javax.ws.rs</groupId>
    <artifactId>javax.ws.rs-api</artifactId>
    <version>${version.ws-rs.api}</version>
</dependency>
<dependency>
    <groupId>org.apache.cxf</groupId>
    <artifactId>cxf-rt-transports-http</artifactId>
    <version>${cxf.version}</version>

    <exclusions>
        <exclusion>
            <artifactId>spring-web</artifactId>
            <groupId>org.springframework</groupId>
        </exclusion>
        <exclusion>
            <artifactId>spring-core</artifactId>
            <groupId>org.springframework</groupId>
        </exclusion>
        <exclusion>
            <artifactId>spring-asm</artifactId>
            <groupId>org.springframework</groupId>
        </exclusion>
        <exclusion>
            <artifactId>spring-aop</artifactId>
            <groupId>org.springframework</groupId>
        </exclusion>
        <exclusion>
            <artifactId>spring-context</artifactId>
            <groupId>org.springframework</groupId>
        </exclusion>
        <exclusion>
            <artifactId>spring-beans</artifactId>
            <groupId>org.springframework</groupId>
        </exclusion>
        <exclusion>
            <artifactId>spring-expression</artifactId>
            <groupId>org.springframework</groupId>
        </exclusion>
    </exclusions>
</dependency>
<dependency>
    <groupId>org.apache.cxf</groupId>
    <artifactId>cxf-rt-frontend-jaxws</artifactId>
    <version>${cxf.version}</version>
    <exclusions>
        <exclusion>
            <artifactId>spring-web</artifactId>
            <groupId>org.springframework</groupId>
        </exclusion>
        <exclusion>
            <artifactId>spring-core</artifactId>
            <groupId>org.springframework</groupId>
        </exclusion>
        <exclusion>
            <artifactId>spring-asm</artifactId>
            <groupId>org.springframework</groupId>
        </exclusion>
        <exclusion>
            <artifactId>spring-aop</artifactId>
            <groupId>org.springframework</groupId>
        </exclusion>
        <exclusion>
            <artifactId>spring-context</artifactId>
            <groupId>org.springframework</groupId>
        </exclusion>
        <exclusion>
            <artifactId>spring-beans</artifactId>
            <groupId>org.springframework</groupId>
        </exclusion>
        <exclusion>
            <artifactId>spring-expression</artifactId>
            <groupId>org.springframework</groupId>
        </exclusion>
    </exclusions>
</dependency>
<dependency>
    <groupId>org.apache.cxf</groupId>
    <artifactId>cxf-rt-frontend-jaxrs</artifactId>
    <version>${cxf.version}</version>
    <exclusions>
        <exclusion>
            <artifactId>spring-core</artifactId>
            <groupId>org.springframework</groupId>
        </exclusion>
        <exclusion>
            <groupId>javax.ws.rs</groupId>
            <artifactId>javax.ws.rs-api</artifactId>
        </exclusion>
    </exclusions>
</dependency>

<dependency>
    <artifactId>spring-web</artifactId>
    <groupId>org.springframework</groupId>
    <version>${spring.version}</version>
    <scope>compile</scope>
</dependency>

<dependency>
    <artifactId>spring-context</artifactId>
    <groupId>org.springframework</groupId>
    <version>${spring.version}</version>
    <scope>compile</scope>
</dependency>

<dependency>
    <groupId>org.springframework</groupId>
    <artifactId>spring-orm</artifactId>
    <version>${spring.version}</version>
    <scope>compile</scope>
</dependency>

<dependency>
    <groupId>org.springframework</groupId>
    <artifactId>spring-core</artifactId>
    <version>${spring.version}</version>
    <scope>compile</scope>
</dependency>

<dependency>
    <groupId>org.springframework</groupId>
    <artifactId>spring-aop</artifactId>
    <version>${spring.version}</version>
</dependency>

<dependency>
    <groupId>org.springframework</groupId>
    <artifactId>spring-test</artifactId>
    <version>${spring.version}</version>
    <scope>test</scope>
</dependency>

<dependency>
    <groupId>org.springframework.security</groupId>
    <artifactId>spring-security-core</artifactId>
    <version>${spring.security.version}</version>
</dependency>

<dependency>
    <groupId>ch.qos.logback</groupId>
    <artifactId>logback-classic</artifactId>
    <version>${logback.version}</version>
    <scope>compile</scope>
</dependency>
<dependency>
    <groupId>org.slf4j</groupId>
    <artifactId>jcl-over-slf4j</artifactId>
    <version>${slf4j.version}</version>
</dependency>

<dependency>
    <groupId>net.bull.javamelody</groupId>
    <artifactId>javamelody-core</artifactId>
    <version>1.63.0</version>
</dependency>

<dependency>
    <groupId>org.junit.jupiter</groupId>
    <artifactId>junit-jupiter-engine</artifactId>
    <version>${junit.version}</version>
    <scope>test</scope>
</dependency>

<dependency>
    <groupId>org.apache.commons</groupId>
    <artifactId>commons-lang3</artifactId>
    <version>3.10</version>
</dependency>

<dependency>
    <groupId>org.mockito</groupId>
    <artifactId>mockito-core</artifactId>
    <version>${mockito.version}</version>
</dependency>

<dependency>
    <groupId>org.mockito</groupId>
    <artifactId>mockito-junit-jupiter</artifactId>
    <version>${mockito.version}</version>
</dependency>
<dependency>
    <groupId>com.sun.xml.bind</groupId>
    <artifactId>jaxb-core</artifactId>
    <version>${version.jaxb.api}</version>
</dependency>
<dependency>
    <groupId>com.sun.xml.bind</groupId>
    <artifactId>jaxb-impl</artifactId>
    <version>${version.jaxb.api}</version>
</dependency>
<dependency>
    <groupId>com.sun.activation</groupId>
    <artifactId>javax.activation</artifactId>
    <version>${javax.activation.version}</version>
</dependency>
<dependency>
    <groupId>javax.xml.bind</groupId>
    <artifactId>jaxb-api</artifactId>
    <version>${version.jaxb.api}</version>
</dependency>

版本配置

<maven.compiler.source>11</maven.compiler.source>
<maven.compiler.target>11</maven.compiler.target>
<version.ws-rs.api>2.0</version.ws-rs.api>
<version.jaxb.api>2.3.0</version.jaxb.api>
<javax.activation.version>1.2.0</javax.activation.version>
<version.servlet.api>3.1.0</version.servlet.api>        
<spring.version>5.3.22</spring.version>
<spring.security.version>5.3.9.RELEASE</spring.security.version>
<slf4j.version>1.7.25</slf4j.version>
<logback.version>1.2.3</logback.version>
<cxf.version>3.3.0</cxf.version>
<junit.version>5.8.2</junit.version>
<powermock.version>1.4.8</powermock.version>
<mockito.version>4.6.1</mockito.version>
<version.maven-compiler-plugin>3.8.0</version.maven-compiler-plugin>
<version.jaxb2-maven-plugin>2.5.0</version.jaxb2-maven-plugin>
<version.build-helper-maven-plugin>1.7</version.build-helper-maven-plugin>
<version.jaxb-java-time-adapters>1.1.3</version.jaxb-java-time-adapters>
<ojdbc.version>19.3.0.0</ojdbc.version>

适配版本说明及修复方案

版本对应规则：Spring Framework 5.3.x系列对应的Spring Security稳定分支为5.3.x，其中Spring Security 5.3.20.RELEASE是该分支的最终维护版本，与Spring Framework 5.3.22完全兼容。
冲突根源：当前使用的Spring Security 5.3.9.RELEASE依赖的spring-expression版本低于Spring 5.3.22，导致StandardTypeConverter构造方法签名不匹配（高版本新增了带Supplier参数的重载）。

修复步骤：

将spring.security.version修改为5.3.20.RELEASE
执行mvn clean dependency:tree检查依赖树，确保所有spring-expression依赖统一为5.3.22版本

若仍存在冲突，可在spring-security-core依赖中显式排除旧版本的spring-expression：

<dependency>
    <groupId>org.springframework.security</groupId>
    <artifactId>spring-security-core</artifactId>
    <version>5.3.20.RELEASE</version>
    <exclusions>
        <exclusion>
            <groupId>org.springframework</groupId>
            <artifactId>spring-expression</artifactId>
        </exclusion>
    </exclusions>
</dependency>

内容的提问来源于stack exchange，提问作者Souha

Spring Framework 5.3.22兼容的Spring Security版本及依赖冲突排查

依赖列表 #

版本配置 #

适配版本说明及修复方案 #

依赖列表

版本配置

适配版本说明及修复方案