I don’t know exactly why the Spring Boot Plugin would declare this, but I would guess that perhaps something in commons-beanutils:1.9.3 breaks some functionality in the plugin.
If semantic versioning is adhered to, then yes 1.9.3 should take precedence.