reckart opened a new issue, #1894:
URL: https://github.com/apache/wicket/issues/1894
**Current Behavior**
Wicket publishes no BOM. To manage the versions of all Wicket modules in one
place, a consumer has to import wicket-parent with scope import. But
wicket-parent is the project's parent POM, so it brings the whole project's
dependency management with it. In 11.0.0 that's 83 managed entries. Only 22 are
Wicket modules. The rest are third-party libraries (Jetty, Spring, Jackson,
Bouncy Castle, dropwizard metrics, ASM, slf4j, JUnit, Mockito, …), and 27
entries carry a scope, e.g. jakarta.annotation-api, jakarta.servlet.jsp-api and
hamcrest in provided scope.
That means:
- whichever of the consumer's BOM imports comes first decides the
third-party versions. If wicket-parent comes before e.g.
spring-boot-dependencies, the versions from Wicket's build override the ones
from Spring Boot;
- the scopes leak too: a transitive hamcrest ends up in provided scope
instead of test;
- Maven 4 warns about every artifact that is managed more than once with
differing versions, scopes or exclusions.
**Expected Behavior**
A wicket-bom artifact that manages only the Wicket modules, at the release
version and with no scopes. It must not inherit from wicket-parent, or the
inherited dependency management comes along again.
**Steps To Reproduce**
Run the following command and see that the dependency management contains
much more than the Wicket modules:
mvn -N org.apache.maven.plugins:maven-help-plugin:3.5.1:effective-pom \
-Dartifact=org.apache.wicket:wicket-parent:11.0.0
**Version**
10.12.0, 11.0.0
**Workaround**
Instead of importing wicket-parent, manage every Wicket module you use
individually in your own dependencyManagement.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
