From 3746155916c3d81fd9df964e951554a3ae2471da Mon Sep 17 00:00:00 2001
From: Andy Wilkinson <wilkinsona@vmware.com>
Date: Wed, 23 Jun 2021 17:53:09 +0100
Subject: [PATCH] Align Nimbus dependency versions with Spring Security

Closes gh-26820
---
 .../spring-boot-dependencies/build.gradle         | 15 +++++++++++++--
 1 file changed, 13 insertions(+), 2 deletions(-)

diff --git a/spring-boot-project/spring-boot-dependencies/build.gradle b/spring-boot-project/spring-boot-dependencies/build.gradle
index 2d57d61baa61..10a368edfb08 100644
--- a/spring-boot-project/spring-boot-dependencies/build.gradle
+++ b/spring-boot-project/spring-boot-dependencies/build.gradle
@@ -1196,14 +1196,20 @@ bom {
 			]
 		}
 	}
-	library("OAuth2 OIDC SDK", "8.36.2") {
+	library("OAuth2 OIDC SDK") {
+		version("8.36.1") {
+			shouldAlignWithVersionFrom("Spring Security")
+		}
 		group("com.nimbusds") {
 			modules = [
 				"oauth2-oidc-sdk"
 			]
 		}
 	}
-	library("Nimbus JOSE JWT", "8.20.2") {
+	library("Nimbus JOSE JWT") {
+		version("8.20.2") {
+			shouldAlignWithVersionFrom("Spring Security")
+		}
 		group("com.nimbusds") {
 			modules = [
 				"nimbus-jose-jwt"
@@ -1630,6 +1636,11 @@ bom {
 				"spring-security-bom"
 			]
 		}
+		dependencyVersions {
+			extractFrom {
+				dependencyLock("https://raw.githubusercontent.com/spring-projects/spring-security/<libraryVersion>/config/gradle/dependency-locks/optional.lockfile")
+			}
+		}
 	}
 	library("Spring Session Bom", "2020.0.5") {
 		group("org.springframework.session") {