Based on the changes in SLING-1933, auth.selector 1.0.4 (the next release) will depend upon auth.core 1.0.6. auth.selector now depends upon a new substitution variable which only exists in auth.core 1.0.6 (and higher).
This change (adding the substitution variable) wasn't an API change in the way I normally think of an API change, but I think it is important to capture this dependency somewhere. It this just as simple as upgrading the export version of org.apache.sling.auth.core.spi to 1.0.4 and specifying this as the import version in auth.selector? Is there some better way of expressing this? Thanks, Justin