Why does spring-security-core exclude commons-logging?

Question

We've written a component based on spring-security-core and spring-test (scope test). When I ran my first test, it could't find LogFactory of commons-logging. I looked into the pom.xml of spring-security-core and was surprised that it is excluded on spring-core which usually provides this dependency. The LogFactory of commons-logging is used at compile time in different spring classes, so why it is excluded?

JFTR: If I change the order so that spring-test is listed before spring-security-core everything is ok.

Answer 1

I think I got it now. The import point is, that spring-security-core declares commons-logging as optional dependency. So other projects using spring security can abstain from commons-logging and use the slf4j bridge jcl-over-slf4j or whatever they like :)

This other answer helped me: https://stackoverflow.com/a/3223701/482702