[
https://issues.apache.org/jira/browse/WW-5376?focusedWorklogId=958603&page=com.atlassian.jira.plugin.system.issuetabpanels:worklog-tabpanel#worklog-958603
]
ASF GitHub Bot logged work on WW-5376:
--------------------------------------
Author: ASF GitHub Bot
Created on: 25/Feb/25 02:24
Start Date: 25/Feb/25 02:24
Worklog Time Spent: 10m
Work Description: kusalk commented on PR #1234:
URL: https://github.com/apache/struts/pull/1234#issuecomment-2680224999
No idea why CodeQL thinks the project structure is invalid - I can't
reproduce the error locally either
Issue Time Tracking
-------------------
Worklog Id: (was: 958603)
Time Spent: 40m (was: 0.5h)
> struts2-bom should not pull in non-struts dependencies from struts2-parent
> --------------------------------------------------------------------------
>
> Key: WW-5376
> URL: https://issues.apache.org/jira/browse/WW-5376
> Project: Struts 2
> Issue Type: Bug
> Reporter: Tyler King
> Priority: Minor
> Fix For: 6.8.0
>
> Time Spent: 40m
> Remaining Estimate: 0h
>
> The parent of struts-bom pom file is the struts2-parent pom file. The
> struts2-parent pom file includes a dependencyManagement section with many
> non-struts dependencies (including test dependencies such as junit and
> mockito), which are inherited in the struts-bom pom file. This is bad
> practice for a bom file since consumers of that bom will have versions for
> dependencies unrelated to struts locked down.
> See [https://www.garretwilson.com/blog/2023/06/14/improve-maven-bom-pattern]
> and [https://github.com/apache/logging-log4j2] for an example of how they
> have both parent and bom pom files
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
