document how to avoid spring-security-core downgrade

[jamesfredley]

latest 6.1.2 build is showing spring security is downgraded,

+--- org.grails.plugins:spring-security-core:6.1.2
|   +--- org.grails:grails-core:6.2.2 (*)
|   +--- org.grails:grails-datastore-core:8.1.2 (*)
|   +--- org.grails:grails-datastore-gorm:8.1.2 (*)
|   +--- org.grails:grails-events-transform:5.0.2
|   +--- org.grails:grails-plugin-mimetypes:6.2.2 (*)
|   +--- org.grails.plugins:async:5.0.2
|   |   +--- org.grails:grails-async:5.0.2
|   |   \--- org.grails.plugins:events:5.0.2
|   |        +--- org.grails:grails-events:5.0.2
|   |        +--- org.grails:grails-events-compat:5.0.2
|   |        \--- org.grails:grails-events-transform:5.0.2
|   +--- org.grails:grails-web-common:6.2.2 (*)
|   +--- org.grails:grails-web-url-mappings:6.2.2 (*)
|   +--- org.springframework:spring-beans:5.3.39 (*)
|   +--- org.springframework:spring-context:5.3.39 (*)
|   +--- org.springframework:spring-expression:5.3.39 (*)
|   +--- org.springframework.security:spring-security-core:5.8.16 -> 5.7.11
|   |   +--- org.springframework.security:spring-security-crypto:5.7.11
|   |   +--- org.springframework:spring-aop:5.3.29 -> 5.3.39 (*)
|   |   +--- org.springframework:spring-beans:5.3.29 -> 5.3.39 (*)
|   |   +--- org.springframework:spring-context:5.3.29 -> 5.3.39 (*)
|   |   +--- org.springframework:spring-core:5.3.29 -> 5.3.39 (*)
|   |   \--- org.springframework:spring-expression:5.3.29 -> 5.3.39 (*)
|   +--- org.springframework.security:spring-security-web:5.8.16 -> 5.7.11
|   |   +--- org.springframework.security:spring-security-core:5.7.11 (*)
|   |   +--- org.springframework:spring-core:5.3.29 -> 5.3.39 (*)
|   |   +--- org.springframework:spring-aop:5.3.29 -> 5.3.39 (*)
|   |   +--- org.springframework:spring-beans:5.3.29 -> 5.3.39 (*)
|   |   +--- org.springframework:spring-context:5.3.29 -> 5.3.39 (*)
|   |   +--- org.springframework:spring-expression:5.3.29 -> 5.3.39 (*)
|   |   \--- org.springframework:spring-web:5.3.29 -> 5.3.39 (*)
|   \--- org.springframework:spring-web:5.3.39 (*)
+--- io.micronaut:micronaut-inject-groovy -> 3.10.4


org.springframework.security:spring-security-core:5.8.16 -> 5.7.11

org.springframework.boot:spring-boot-dependencies:2.7.18 is the cause

[matrei]

@jamesfredley You can also set:

ext.set('spring-security.version', '5.8.16')

and then you don't have to define the dependency.

[matrei]

Or

spring-security.version=5.8.16

in gradle.properties

[matrei]

But I guess it is probably easier to get this vital information seamlessly into the current documentation as you have done 👍