Hi all,
I'd like to propose introducing a Gradle version catalog
(gradle/libs.versions.toml) to centralize the dependency versions currently
declared as scattered literal strings in dependencies.gradle (~80
coordinates, e.g. implementation 'org.apache.poi:poi:5.5.1'), plus the two
plugin versions pinned in settings.gradle.
Version catalogs have been usable since Gradle 7.4; we've been on 7.6+
since OFBIZ-12400 (Jan 2023).
This only covers the shared, core-framework dependencies. Plugins that
declare their own dependencies (like plugins/ldap's CAS library) keep doing
that exactly as before, nothing changes for them. Dependabot already
understands this format too, so no config changes are needed there.
The change itself is simple: add one new file, then update
dependencies.gradle to point at it instead of listing versions directly.
We'll compare the dependency list before and after to ensure nothing
shifts, same versions, same behavior, just organized differently.
Happy to file a JIRA ticket and open a PR if there's no objection.
Thanks,
Mridul Pathak
