You're right, that dependency is not needed. I've removed it from both this file and from security-model/pom.xml