Spring Security 5.0 removed the dependency on aopalliance, so there is no need to exclude aopalliance. See https://github.com/spring-projects/spring-security/pull/4431