Given https://github.com/FasterXML/jackson-databind/issues/2683 and the fact that 5.5 will likely use Jackson 2.12 or higher, spring-security-test should include jackson-datatype-jsr310 as a test dependency in order to register (de)serializers for java.time.* classes.