[
https://issues.apache.org/jira/browse/MNG-6564?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17516136#comment-17516136
]
Ralph Goers commented on MNG-6564:
----------------------------------
I just want to add a practical side to this. We have a company-wide parent pom
that does
{code:java}
<spring-boot.version>2.5.12</spring-boot.version>
<spring-cloud-dependencies.version>2020.0.5</spring-cloud-dependencies.version>
<spring-cloud-function.version>3.1.7</spring-cloud-function.version>
{code}
Every project then has
{code:java}
<dependency>
<groupId>org.springframework.cloud</groupId>
<artifactId>spring-cloud-dependencies</artifactId>
<version>${spring-cloud-dependencies.version}</version>
<type>pom</type>
<scope>import</scope>
</dependency> {code}
We are trying to add the spring-cloud-function version to remediate against one
of the latest Spring CVEs but the import uses version 3.1.6 instead of 3.1.7
since 3.1.6 is what spring-cloud-dependencies declares. So now, in addition to
just updating the parent pom version they have to also add
{code:java}
<dependency>
<groupId>org.springframework.cloud</groupId>
<artifactId>spring-cloud-function-dependencies</artifactId>
<version>${spring-cloud-function.version}</version>
<type>pom</type>
<scope>import</scope>
</dependency> {code}
which, of course, is identical to what is inside of spring-cloud-dependencies.
Also, it must appear before the spring-cloud-dependencies declaration or else
it is ignored.
> Lack of ability to overwrite properties of specified dependencies
> -----------------------------------------------------------------
>
> Key: MNG-6564
> URL: https://issues.apache.org/jira/browse/MNG-6564
> Project: Maven
> Issue Type: New Feature
> Components: Dependencies
> Affects Versions: 3.3.9
> Reporter: Rik Schaaf
> Priority: Major
>
> For example, if I want to update the flyway version to 4.2.0 in spring boot
> 1.5 (by default Flyway 3.2.1) I want to do something like this:
> {code:xml}
> <properties>
> <flyway.version>4.2.0</flyway.version>
> <springboot.version>1.5.17.RELEASE</springboot.version>
> </properties>
> <dependencyManagement>
> <dependencies>
> <dependency>
> <groupId>org.springframework.boot</groupId>
> <artifactId>spring-boot-dependencies</artifactId>
> <version>${springboot.version}</version>
> <type>pom</type>
> <scope>import</scope>
> </dependency>
> <dependencies>
> </dependencyManagement>
> {code}
> The flyway dependency is already defined in the dependency management of
> spring-boot-dependencies:
> {code:xml}
> <dependency>
> <groupId>org.flywaydb</groupId>
> <artifactId>flyway-core</artifactId>
> <version>${flyway.version}</version>
> </dependency>
> {code}
> But that same pom also defines flyway.version to be 3.2.1. When I include the
> flyway dependency in my own dependency management, my application does
> correctly use Flyway 4.2.0, but if I only provide the property, it
> incorrectly uses version 3.2.1, meaning that my property was ignored. I have
> heard from others that you can forcefully override a property by using a
> commandline parameter or an environment variable, but I would prefer to use a
> property in my pom file instead.
--
This message was sent by Atlassian Jira
(v8.20.1#820001)
