googleapis / googleapis/google-cloud-java

[java-spanner] Why does this project flatten dependencies?

オープン
#12,239 コメント 0 件 リアクション 0 件 担当者 1 名 @rahul2393 が担当を希望しています GitHub で見る
api: spanner
主要言語
Java
スター
2.1k
フォーク
1.2k
平均マージ
1日 23時間
マージ済み PR(30日)
154

説明

I have a question: Why does this project flatten its dependencies using `maven-flatten-plugin`?

I have read https://github.com/googleapis/java-spanner/pull/172, but I don't believe any reason was stated there.

I'll try to explain a case where this matters to us:

For example, we manage the version of `com.google.guava` to a specific version in a BOM. This guava version uses `com.google.guava:failureaccess:1.0.3`.

Due to the flattening, `java-spanner` has a direct dependency to `com.google.guava:failureaccess:1.0.2`. This means that maven will resolve this artifact to whichever is "closer".

I'll provide an example of when I think this setup causes issues:

```xml

4.0.0

example
spanner-dep-example
0-SNAPSHOT




com.google.cloud
google-cloud-spanner
6.94.0


com.google.guava
guava-bom
33.4.8-jre
import
pom




com.google.cloud
google-cloud-spanner


com.google.guava
guava

```

With this setup, `com.google.guava:failureaccess` will resolve to `1.0.2`:
```sh
❯ mvn dependency:tree | grep failureaccess
[INFO] | +- com.google.guava:failureaccess:jar:1.0.2:compile
```

If guava is moved up before google-cloud-spanner, it will resolve to `1.0.3`.

What I'm trying to say is that this flattening of the bom can cause dependencies to resolve to other versions than what they otherwise would have resolved to. Without flattening, the above example pom would resolve to `1.0.3` regardless of declaration order (as the dependency to `failureaccess` is not a direct dependency from this project, but rather a transitive dependency through guava).

**Why this matters**

While we haven't seen any issues from this yet, we have validations in our build that dependencies resolve to a single version.

I believe other major projects typically do not do this flattening, so I wonder why this project does?

**Proposal:**

I would propose to stop flattening the pom and let maven resolve its dependencies normally.

コントリビューションガイド

コントリビューションガイドを開く

評価

この issue はまだ評価されていません。

新しい issue をメールで受け取る

初心者向けの GitHub issue を短くまとめたダイジェスト。