googleapis / googleapis/google-cloud-java
[java-spanner] Why does this project flatten dependencies?
- Langage dominant
- Java
- Étoiles
- 2.1k
- Forks
- 1.2k
- Merge moyen
- 1 j 23 h
- PR mergées (30 j)
- 154
Description
I have a question: Why does this project flatten its dependencies using `maven-flatten-plugin`?
I have read https://github.com/googleapis/java-spanner/pull/172, but I don't believe any reason was stated there.
I'll try to explain a case where this matters to us:
For example, we manage the version of `com.google.guava` to a specific version in a BOM. This guava version uses `com.google.guava:failureaccess:1.0.3`.
Due to the flattening, `java-spanner` has a direct dependency to `com.google.guava:failureaccess:1.0.2`. This means that maven will resolve this artifact to whichever is "closer".
I'll provide an example of when I think this setup causes issues:
```xml
4.0.0
example
spanner-dep-example
0-SNAPSHOT
com.google.cloud
google-cloud-spanner
6.94.0
com.google.guava
guava-bom
33.4.8-jre
import
pom
com.google.cloud
google-cloud-spanner
com.google.guava
guava
```
With this setup, `com.google.guava:failureaccess` will resolve to `1.0.2`:
```sh
❯ mvn dependency:tree | grep failureaccess
[INFO] | +- com.google.guava:failureaccess:jar:1.0.2:compile
```
If guava is moved up before google-cloud-spanner, it will resolve to `1.0.3`.
What I'm trying to say is that this flattening of the bom can cause dependencies to resolve to other versions than what they otherwise would have resolved to. Without flattening, the above example pom would resolve to `1.0.3` regardless of declaration order (as the dependency to `failureaccess` is not a direct dependency from this project, but rather a transitive dependency through guava).
**Why this matters**
While we haven't seen any issues from this yet, we have validations in our build that dependencies resolve to a single version.
I believe other major projects typically do not do this flattening, so I wonder why this project does?
**Proposal:**
I would propose to stop flattening the pom and let maven resolve its dependencies normally.
Guide de contribution
Ouvrir le guide de contribution
Évaluation
Cette issue n'a pas encore été évaluée.