Describe the bug
Under Spring Security - Project Modules and Dependencies documentation [1], the text appears to be incorrect, and (for the most part) a copy of [2]. In particular the following text appears to have been copied without updating it to reflect client scope of usage and package.
It is required by applications that use OAuth 2.0 or OpenID Connect Core 1.0, such as the client, the resource server, and the authorization server. The top-level package is
org.springframework.security.oauth2.core.
[1] https://docs.spring.io/spring-security/reference/modules.html#spring-security-oauth2-client [2] https://docs.spring.io/spring-security/reference/modules.html#spring-security-oauth2-core