Fix dependency management: use specified versions #27496
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
github-actions
bot
added
component/zeebe
Member
Author
|
@entangled90 - somehow I thought I requested a review, but I guess not 😄 |
entangled90
approved these changes
Feb 18, 2025
Contributor
entangled90
left a comment
entangled90
left a comment
There was a problem hiding this comment.
🚀
However we potentially have the same problems, but not from spring now.
We probably need to think how to enforce this in a more consistent way
npepinpe
added
backport stable/8.6
Member
Author
|
/backport |
Collaborator
|
Created backport PR for
Please cherry-pick the changes locally and resolve any conflicts. git fetch origin backport-27496-to-stable/8.6
git worktree add --checkout .worktree/backport-27496-to-stable/8.6 backport-27496-to-stable/8.6
cd .worktree/backport-27496-to-stable/8.6
git reset --hard HEAD^
git cherry-pick -x 9f505bf71ee3d7bb77d8b30a5ca7a1b5f1548aa9 6b3b5e3437098cbe219f54581f15574be370da23
git push --force-with-lease |
Collaborator
|
Created backport PR for
Please cherry-pick the changes locally and resolve any conflicts. git fetch origin backport-27496-to-stable/8.7
git worktree add --checkout .worktree/backport-27496-to-stable/8.7 backport-27496-to-stable/8.7
cd .worktree/backport-27496-to-stable/8.7
git reset --hard HEAD^
git cherry-pick -x 9f505bf71ee3d7bb77d8b30a5ca7a1b5f1548aa9 6b3b5e3437098cbe219f54581f15574be370da23
git push --force-with-lease |
github-merge-queue bot
pushed a commit
that referenced
this pull request
Mar 13, 2025
…ns (#28965) # Description Backport of #27496 to `stable/8.7`. Reasoning for bumping up `micrometer` dependency: - This backport fixes io.micrometer:`micrometer-registry-otlp to 1.13.6` - In `stable/8.7` we have `springboot` provided version `io.micrometer:micrometer-registry-otlp:jar:1.14.4:test` `MetricsConfigurationIT` won't pass with version `1.13.6` as spring class `OtlpMetricsProperties` requires `HistogramFlavor` and it is not present in` 1.13.6`
korthout
added
the
version:8.7.0
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Description
This PR fixes an issue with our dependency management. It seems since April, we introduced
spring-boot-dependenciesinto our parent POM. This means our project generally tries to use the same version for shared dependencies as Spring does (e.g. Netty, Awaitility, Mockito, etc.). I assume the goal was to avoid dependency convergence issues.This was a nuclear bomb kind of solution however, because what it ended up doing is overwriting any version we later specify via other
POM/IMPORTdependencies.So take, for example, Micrometer (this is how I stumbled on it). We specify in the parent POM version
1.14.3. If you look at themvn dependency:tree, you'll see it's pulling in 1.13.9. This is extremely confusing, and hard to pinpoint: where is this coming from? We explicitly include themicrometer-bomin ourparent/pomand set the version, after all.The trick is, since the
micrometer-bomis declared after thespring-boot-dependencies, any shared dependencies are ignored. The fix is to ensure all explicit, library-specificPOM/IMPORTdeclarations are beforespring-boot-dependencies.I personally would prefer not use
spring-boot-dependencies, and having explicit declarations: it's more verbose, but much easier to know and ensure we use the right versions. It also decouples us from the choices of another company on which library versions to use.For this PR, I didn't do this yet, I'd like to know what others think (in particular those who included it originally), and opted for just declaring our library versions higher. I also had to move the
google-librariesdeclaration second-last, as it overwrote our Protobuf, Netty, gRPC, etc., all so-called "first party libraries" from Google.Note that this implies we may have been shipping with different versions than we thought, but generally this should not affect CVEs as our scanner runs on the resolved tree, not the POMs themselves.
It does mean however that we may have been merging dependency updates which break things unknowingly, because the version was not even used.