Publish Maven Bill Of Materials (BOM) pom

Description

It would be great if the java driver publish a pom with dependency management for all the modules (core, mapping, extra, etc).

It should contain only a dependency management section with the all the modules and no opinion on third party dependencies.

A good practice is to NOT use project.version property when declaring a version, but the real version (and maven-release-plugin handles that).

this will allow end users to do things like this in their poms

Here are few examples of open source projects out there that publish BOMs

https://github.com/apache/logging-log4j2/blob/master/log4j-bom/pom.xml
https://github.com/spring-projects/spring-data-build/blob/master/bom/pom.xml
https://github.com/FasterXML/jackson-bom/blob/master/pom.xml
https://github.com/netty/netty/blob/4.1/bom/pom.xml

Environment

None

Pull Requests

None

Activity

Olivier Michallat 
January 31, 2020 at 11:11 PM

After reading up on it I see that it can be helpful if a project has both direct and transitive driver dependencies. And it's a simple change so OK for me.

Alex Dutra 
January 20, 2020 at 5:27 PM

I agree that a BOM would make more sense with driver 4.0 and its transitive dependencies. Let’s tentatively schedule this for 4.5.0.

Mark Paluch 
January 13, 2020 at 9:00 AM

Given the 4.x driver, there are a few dependencies (shaded guava, protocol implementation) that do not share the same version number. While it's totally doable to use version placeholders, importing a BOM and referring to just the artifacts is the preferred consumption of multi-module dependencies so that users can consume these dependencies in a simplified approach.

Maven does not benefit that much from an omitted `version` tag. Looking at Gradle, the dependency declaration is much more streamlined and there you see an immediate benefit. So +1 for a BOM for the 4.x driver.

Olivier Michallat 
August 1, 2017 at 8:26 PM

Hi,
Would that provide much value though? I see the advantage for spring-data, where the components listed in the BOM have different versions. But in our case all driver modules share the same version, so you could easily extract it in a variable:

Is there anything that a BOM handles better?

Fixed

Details

Assignee

Reporter

Fix versions

Priority

Created July 17, 2017 at 9:24 PM
Updated February 28, 2020 at 12:39 AM
Resolved February 11, 2020 at 6:04 PM