Switch from thymeleaf-extras-springsecurity4 to thymeleaf-extras-springsecurity5

[danielfernandez]

A new thymeleaf-extras-springsecurity5 artifact has been released that provides Thymeleaf integration with Spring Security 5 (5.0 and 5.1's current snapshots). Support is both for Spring MVC and Spring WebFlux apps. See more here and at the package's Github repo.

Please consider adopting this new package (version 3.0.3.RELEASE) instead of the thymeleaf-extras-springsecurity4 currently being used for Spring Boot 2.1's dev branch.

[wilkinsona]

Thank you, @danielfernandez.

We could offer dependency management and auto-configuration for both thymeleaf-extras-springsecurity4 and thymeleaf-extras-springsecurity5, but there is minimal benefit in doing so. If we switch from 4 to 5 the vast majority of applications that were using thymeleaf-extras-springsecurity4 will only require a single character change to the pom.xml or build.gradle. I think we should just switch and document it in the release notes.

[snicoll]

@wilkinsona shouldn't we provide dependency management for this new artifact in 2.0.x (I am not talking about switching, but allowing users to use it if they want to).

This seems compliant with our dependency management policy and won't break any use cases as far as I know.

[wilkinsona]

Good point. Thinking about it some more, I think we should conditionally auto-configure both the Spring Security 4 dialect or the Spring Security 5 dialect in 2.0.x and warning in the case of the former to guide people towards using the latter.

[wilkinsona]

I've opened #14828.