googleapis / googleapis/google-cloud-java

[java-spanner] Why does this project flatten dependencies?

未关闭
#12,239 0 条评论 0 个 reaction 已指派 1 人 已被 @rahul2393 认领 在 GitHub 查看
api: spanner
主要语言
Java
星标
2.1k
派生
1.2k
平均合并
1 天 23 小时
30 天内合并 PR
154

描述

I have a question: Why does this project flatten its dependencies using `maven-flatten-plugin`?

I have read https://github.com/googleapis/java-spanner/pull/172, but I don't believe any reason was stated there.

I'll try to explain a case where this matters to us:

For example, we manage the version of `com.google.guava` to a specific version in a BOM. This guava version uses `com.google.guava:failureaccess:1.0.3`.

Due to the flattening, `java-spanner` has a direct dependency to `com.google.guava:failureaccess:1.0.2`. This means that maven will resolve this artifact to whichever is "closer".

I'll provide an example of when I think this setup causes issues:

```xml

4.0.0

example
spanner-dep-example
0-SNAPSHOT




com.google.cloud
google-cloud-spanner
6.94.0


com.google.guava
guava-bom
33.4.8-jre
import
pom




com.google.cloud
google-cloud-spanner


com.google.guava
guava

```

With this setup, `com.google.guava:failureaccess` will resolve to `1.0.2`:
```sh
❯ mvn dependency:tree | grep failureaccess
[INFO] | +- com.google.guava:failureaccess:jar:1.0.2:compile
```

If guava is moved up before google-cloud-spanner, it will resolve to `1.0.3`.

What I'm trying to say is that this flattening of the bom can cause dependencies to resolve to other versions than what they otherwise would have resolved to. Without flattening, the above example pom would resolve to `1.0.3` regardless of declaration order (as the dependency to `failureaccess` is not a direct dependency from this project, but rather a transitive dependency through guava).

**Why this matters**

While we haven't seen any issues from this yet, we have validations in our build that dependencies resolve to a single version.

I believe other major projects typically do not do this flattening, so I wonder why this project does?

**Proposal:**

I would propose to stop flattening the pom and let maven resolve its dependencies normally.

贡献指南

打开贡献指南

评估

这个 Issue 还没有评估数据。

把新 issue 发到你的邮箱

精选适合新手参与的 GitHub issue 摘要。