Spring doesn't contains cglib dependency, both cglib and spring cglib has the Enhancer class, one is net.sf.cglib.proxy.Enhancer while the another is org.springframework.cglib.proxy, what's the difference between them?
This is called repackaging: instead of using some library as a dependency, a project makes a copy of the dependency as part of their own project and places it in a different package.
The reason for doing this is that a project using Spring might want to use cglib itself. If Spring had a particular version of cglib as a dependency, it would be impossible for the project using Spring to pick a different version. But if Spring uses repackaged cglib which is in a different package, there is no version conflict and the project can use any version of cglib if they like.
Some projects repackage Guava, Netty or other popular libraries in a similar manner.