This is a Spring Security API only dependency. The idea is to have only the classes used by Quarkus (and the transitive dependencies) This absolutely minimum dependencies would be a great benefit to reduce the footprint of Quarkus applications using the spring modules.