This message was deleted.
# community-supports
Slackbot
09/01/2023, 4:38 PMThis message was deleted.
c
Clayton Walker
09/01/2023, 4:40 PM Copy code
implementation("ch.qos.logback:logback-classic:[1.2.0, 1.3.0[!!")
implementation("ch.qos.logback:logback-core:[1.2.0, 1.3.0[!!")v
Vampire
09/01/2023, 4:54 PMAs you defined a strict range, it should do what you want, unless you also configured to publish resolved versions. But actually, if a consumer project wants to ignore it, they can always do it, for example by depending on your library but excluding logback and then depending on their own version.
Or by using
resolutionStrategy...forcec
Clayton Walker
09/01/2023, 5:16 PMAh ok, yeah that’s sorta what we’re worried about. People using spring’s dependency management plugin, having it force a potentially new (untested) version of a library and breaking compatibility with us.
Clayton Walker
09/01/2023, 5:17 PMWe’re currently shading the library we’re trying to avoid conflicts with, I think we’ll continue to do so.
v
Vampire
09/01/2023, 5:48 PM😨
Vampire
09/01/2023, 5:49 PMWell, then your consumers can use an artifact transform to throw out the shaded classes and transform the usages back. 😄
Vampire
09/01/2023, 5:49 PMIf they really want, they can always trick your efforts. 🙂
Vampire
09/01/2023, 5:50 PMAnd if someone is using the Spring dependency management plugin, tell them to not use it.
It is a relict from times when Gradle did not have built-in BOM support and even the maintainer of the plugin recommends to not use it anymore.
c
Clayton Walker
09/01/2023, 5:50 PMTrue. Luckily in our case we’re not shading e.g. asm, but a json library which would be an implementation detail.
v
Vampire
09/01/2023, 5:51 PMIf you really feel you must shade it, at least also relocate it please.
c
Clayton Walker
09/01/2023, 5:51 PMYep we do that.
👌 1
Clayton Walker
09/01/2023, 5:55 PMWe provide convention plugins that use the dependency management plugin, and would love to get away from using that plugin.
Clayton Walker
09/01/2023, 5:56 PMIs the modern replacement doing something like
Copy code
implementation(project("spring-boot-bom"))Clayton Walker
09/01/2023, 6:00 PMOr even like this
Copy code
dependencies {
configurations.configureEach {
add(this.name, platform("org.springframework.boot:spring-boot-dependencies"))
}
}v
Vampire
09/01/2023, 6:54 PMI maybe wouldn't add it to all configurations broadly.
Especially, as not all configurations are meant for declaring dependencies and also you might want to not publish this dependency along.
But besides that, yes.
Vampire
09/01/2023, 6:54 PMActually if you applied the spring boot plugin, or at least have it on the classpath, it also has a constant with the BOM coordinates you can use, like they also show it in their documentation
c
Clayton Walker
09/01/2023, 7:08 PMAh ok, yeah we realized applying against all configurations had a high chance of breaking things. Kotlin for example wasn’t happy.
Clayton Walker
09/01/2023, 7:08 PM Copy code
val platformConfigurations = listOf("implementation", "kapt", "annotationProcessor")
configurations.matching { it.name in platformConfigurations }.configureEach {
this(platform(SpringBootPlugin.BOM_COORDINATES))
}👌 1
Clayton Walker
09/01/2023, 7:09 PMDo you perhaps have a source on
even the maintainer of the plugin recommends to not use it anymore.?
c
Clayton Walker
09/01/2023, 7:38 PMExcellent, thanks!
👌 1
3 Views