guice-bom contains unrelated dependencies
- Dominant language
- Java
- Stars
- 12.7k
- Forks
- 1.7k
- Avg merge
- 11m
- Merged PRs (30d)
- 2
Description
guice-bom is used to manage versions of different `guice-*` artifacts. However, if you look at how "Managed Dependencies" section is parsed by Maven for the latest [guice-bom:7.0.0](https://mvnrepository.com/artifact/com.google.inject/guice-bom/7.0.0), you can see that it finds 23 dependency instead of 12 that are listed inside the guice-bom's [pom file](https://repo1.maven.org/maven2/com/google/inject/guice-bom/7.0.0/guice-bom-7.0.0.pom). This happens because `guice-bom` depends on `guice-parent`, and [parent's pom.xml](https://repo1.maven.org/maven2/com/google/inject/guice-parent/7.0.0/guice-parent-7.0.0.pom) also has `dependencyManagement` section that contains those extra 11 dependencies.
This is not a mvnrepository.com UI bug, this behavior was discovered in a Gradle project. After adding guice-bom, it started to affect not only `guice-*` modules, but those other 11 dependencies as well.
Expected behavior: `guice-bom` manages only `guice-*` dependencies.
Consider either removing reference to `guice-parent` from `guice-bom` or remove `dependencyManagement` section from `guice-parent`.
Example of a correct BOM: https://mvnrepository.com/artifact/org.slf4j/slf4j-bom/2.0.17
Contributor guide
Assessment
This issue has not been assessed yet.