googleapis / googleapis/google-cloud-java

[java-spanner] Why does this project flatten dependencies?

Aperta
#12,239 0 commenti 0 reazioni 1 assegnatario Rivendicata da @rahul2393 Vedi su GitHub
api: spanner
Lingua principale
Java
Stelle
2.1k
Fork
1.2k
Merge medio
1g 23h
PR unite (30g)
154

Descrizione

I have a question: Why does this project flatten its dependencies using `maven-flatten-plugin`?

I have read https://github.com/googleapis/java-spanner/pull/172, but I don't believe any reason was stated there.

I'll try to explain a case where this matters to us:

For example, we manage the version of `com.google.guava` to a specific version in a BOM. This guava version uses `com.google.guava:failureaccess:1.0.3`.

Due to the flattening, `java-spanner` has a direct dependency to `com.google.guava:failureaccess:1.0.2`. This means that maven will resolve this artifact to whichever is "closer".

I'll provide an example of when I think this setup causes issues:

```xml

4.0.0

example
spanner-dep-example
0-SNAPSHOT




com.google.cloud
google-cloud-spanner
6.94.0


com.google.guava
guava-bom
33.4.8-jre
import
pom




com.google.cloud
google-cloud-spanner


com.google.guava
guava

```

With this setup, `com.google.guava:failureaccess` will resolve to `1.0.2`:
```sh
❯ mvn dependency:tree | grep failureaccess
[INFO] | +- com.google.guava:failureaccess:jar:1.0.2:compile
```

If guava is moved up before google-cloud-spanner, it will resolve to `1.0.3`.

What I'm trying to say is that this flattening of the bom can cause dependencies to resolve to other versions than what they otherwise would have resolved to. Without flattening, the above example pom would resolve to `1.0.3` regardless of declaration order (as the dependency to `failureaccess` is not a direct dependency from this project, but rather a transitive dependency through guava).

**Why this matters**

While we haven't seen any issues from this yet, we have validations in our build that dependencies resolve to a single version.

I believe other major projects typically do not do this flattening, so I wonder why this project does?

**Proposal:**

I would propose to stop flattening the pom and let maven resolve its dependencies normally.

Guida per i contributori

Apri la guida per i contributori

Valutazione

Questa issue non è ancora stata valutata.

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.