Yes and so has Spring. Every module is a separate dependency. If you don't need security or DB persistence, don't include them.