Repository navigation
BOM has dependency management for non direct dependencies #3639
Description
A user reported that the Netflix BOM has a dependency on RXJava.
The plan for a BOM is to only have dependency management for their own modules (typically the Spring Cloud modules) and their direct/specific dependencies. In the case of this project, having an opinion on Eureka, Ribbon, etc totally makes sense since it's the very purpose of the project to offer an integration with those.
I don't know if we've written that anywhere but I do remember that we've discussed that everything else should be in the build and not exposed in the BOM. If we don't do that and two boms have an opinion for the same coordinates, you get a warning when using Maven as conflict resolution won't work as expected.
The current version has an opinion on RXJava, okhttp3 and xstream which does not sound legit to me.
Activity
spencergibb commentedon Aug 29, 2019
So this dates back a long time. Most (all?) of the netflix libraries declare their dependencies as 'runtime' in their poms https://repo1.maven.org/maven2/com/netflix/eureka/eureka-client/1.9.12/eureka-client-1.9.12.pom
We had to include them to work since boot may have not managed those dependencies. We could move them to the root pom of s-c-netflix, but we still need to have dependency management for them.
spencergibb commentedon Aug 29, 2019
Looking, I think rxjava and okhttp3 can just be removed. Checking to see if moving xstream to the root pom works.
spencergibb commentedon Aug 29, 2019
Dep mgmt of okhttp3 was only added in boot 2.2, so it will have to move to the root for Greenwich.
Moves non-netflix dependencies out of bom into root pom.
snicoll commentedon Aug 30, 2019
Thanks for the quick turnaround @spencergibb!
merge from fork (#2)