与org.apache.santuario:xmlsec相关的spring安全性中的Maven依赖收敛不匹配

Question

对于spring/spring Security2.4.0.RELEASE，我们得到了一个Maven执行器插件依赖收敛错误。

Apache的xmlsec版本1.x和2.x是传递依赖关系。

排除1.x版本的org.apache.santuario:xmlsec安全吗？

Dependency convergence error for org.apache.santuario:xmlsec:1.5.8 paths to dependency are:
+-com.acme.web.app:3.14.0.0-SNAPSHOT
  +-org.springframework.ws:spring-ws-security:2.4.0.RELEASE
    +-org.apache.ws.security:wss4j:1.6.19
      +-org.apache.santuario:xmlsec:1.5.8
and
+-com.acme.web.app:3.14.0.0-SNAPSHOT
  +-org.springframework.ws:spring-ws-security:2.4.0.RELEASE
    +-org.apache.ws.security:wss4j:1.6.19
      +-org.opensaml:opensaml:2.5.1-1
        +-org.opensaml:openws:1.4.2-1
          +-org.opensaml:xmltooling:1.3.2-1
            +-org.apache.santuario:xmlsec:1.4.4
and
+-com.acme.web.app:3.14.0.0-SNAPSHOT
  +-org.springframework.ws:spring-ws-security:2.4.0.RELEASE
    +-org.apache.wss4j:wss4j-ws-security-dom:2.1.4
      +-org.apache.wss4j:wss4j-ws-security-common:2.1.4
        +-org.apache.santuario:xmlsec:2.0.5
and
+-com.acme.web.app:3.14.0.0-SNAPSHOT
  +-org.springframework.ws:spring-ws-security:2.4.0.RELEASE
    +-org.apache.wss4j:wss4j-ws-security-dom:2.1.4
      +-org.apache.wss4j:wss4j-ws-security-common:2.1.4
        +-org.opensaml:opensaml-saml-impl:3.1.1
          +-org.opensaml:opensaml-security-impl:3.1.1
            +-org.opensaml:opensaml-security-api:3.1.1
              +-org.apache.santuario:xmlsec:2.0.3

Answer 1

最近，我在添加此依赖项时遇到了此错误。

 <dependency>
    <groupId>org.springframework.security.extensions</groupId>
    <artifactId>spring-security-saml2-core</artifactId>
    <version>1.0.9.RELEASE</version>
  </dependency>

正如在https://maven.apache.org/enforcer/enforcer-rules/dependencyConvergence.html中所描述的，解决方案是排除重复的依赖关系，但使用不同的版本。