FasterXML / FasterXML/jackson-bom

Using v2 and v3 BOMs results in ambiguous version management of jackson-annotations

Open
#125 6 comments 0 reactions 0 assignees View on GitHub
Dominant language
Logos
Stars
71
Forks
36
Avg merge
2h 26m
Merged PRs (30d)
2

Description

Using v2 and v3 BOMs together results in ambiguous version management of `jackson-annotations`. The BOM listed higher "wins", which when coupled with the [requireUpperBoundDeps](https://maven.apache.org/enforcer/enforcer-rules/requireUpperBoundDeps.html) enforcer rule causes thrashing as each are released independently.

2.22.0
https://github.com/FasterXML/jackson-bom/blob/112e8591b5e14dff30c278c142d8111231c3a48f/pom.xml#L62

3.1.4
https://github.com/FasterXML/jackson-bom/blob/4085e4d95cf9d7a9f69e1dd2272d0c565f859fe1/pom.xml#L60

```
Rule 0: org.apache.maven.enforcer.rules.dependency.RequireUpperBoundDeps failed with message:
Failed while enforcing RequireUpperBoundDeps. The error(s) are [
Require upper bound dependencies error for com.fasterxml.jackson.core:jackson-annotations:2.21 [test] paths to dependency are:
+-myGroup:myArtifact:1.0.0-SNAPSHOT
+-com.fasterxml.jackson.core:jackson-annotations:2.21 [test]
and
+-myGroup:myArtifact:1.0.0-SNAPSHOT
+-com.fasterxml.jackson.core:jackson-databind:2.22.0 [test]
+-com.fasterxml.jackson.core:jackson-annotations:2.21 [test] (managed) <-- com.fasterxml.jackson.core:jackson-annotations:2.22 [test]
]
```

```xml



com.fasterxml.jackson
jackson-bom
2.22.0
pom
import


tools.jackson
jackson-bom
3.1.4
pom
import

```

----

### Current workarounds

- Evaluate and reorder BOMs on every version bump to determine which should be first.
- Manage jackson-annotations explicitly.

### Possible solution

- Create a combined BOM that include v2 and v3.
- Sync up v2/v3 releases to minimize divergence.

Contributor guide

No contributing guide indexed for this repository

Research direction

Start by comparing the jackson-bom v2 POM at line 62 with the v3 POM at line 60, then reproduce the dependencyManagement example with Maven's requireUpperBoundDeps rule. Review the proposed combined-BOM and synchronized-release options; done means an agreed approach prevents ambiguous jackson-annotations management without requiring manual BOM reordering.

Written by the indexing model from the issue text.

Assessment

Tech stack
java
Domain
build-system
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.