jduo commented on PR #38336: URL: https://github.com/apache/arrow/pull/38336#issuecomment-1771032149
> Thanks @jduo ! > > I'm not a BOM file expert, does it make sense to also pin Arrow's 3rd party deps in here as well? And is it possible to pin 3rd party deps based on JDK version? (Java 8 support requires pinning some deps to outdated versions e.g. Mockito). Maybe a follow up PR would be better to add this, though. I took a look at BOMs for a few projects: - Jackson - Spring - Beam - gRPC and they all only included internally-built modules in their BOM files rather than also including 3rd party dependencies. This sort of makes sense though, if the BOM is intended to describe what libraries are being shipped. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
