While scanning a docker image with our play (play 3.0.8 / Java 21 SDK) application, we found that our Java play application contains references to org.springframework.spring-context-5.3.39.jar.
Looking at the source in Dependencies.scala, the expected version of the springframework would be 6.2.3 as of the play release 3.0.8.

Steps to reproduce, without our application :-)

1. clone playframework examples
2. cd .\play-java-forms-example\
3. sbt dependencyTree outputs among other

+-org.playframework:play-java-forms_2.13:3.0.8 [S]
| +-net.jodah:typetools:0.6.3
| +-org.hibernate.validator:hibernate-validator:6.2.5.Final
| +-org.playframework:play-java_2.13:3.0.8 [S]
| +-org.springframework:spring-beans:5.3.39
| +-org.springframework:spring-context:5.3.39
| +-org.springframework:spring-core:5.3.39

4. sbt evicted does not contain any entry mentioning springframework.

Environment

sbt --version
sbt version in this project: 1.11.3
sbt script version: 1.9.9

• java version: 21.0.3
• Windows 11

Do you have any ideas, why 5.3.39 is loaded instead of 6.2.3, even in the small java forms example?