[MNG-8003] Maven BOM should have a cleaner parent

• Type: Bug
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Fix Version/s: 4.0.0-alpha-12, 4.0.0
• Component/s: Bootstrap & Build
• Assignee: Guillaume Nodet
• Reporter: Tamas Cservenak
• Created: 10/Jan/24 15:56
• Updated: 17/Feb/24 08:04
• Resolved: 11/Jan/24 15:13

Description

Maven project at top level POM (current master) has 3 imports:

• maven-bom
• junit bom
• mockito bom

While debugging, spotted that junit and mockito imports are "pristine" (in a way they contain what one can expect), but the maven-bom had more than BOM enlists! It turns out that BOM uses maven-parent@41 (same as top level POM or Maven project), and it has 4 extra depMgt entries (plexus, sisu, plexus-xml and plexus-util). Basically whoever imports Maven BOM will import these as well.

Moreover, this causes a bit of mess, as maven-parent depMgt section is:

• imported via maven-bom that inherits them from maven-parent
• but also inherited as maven top level POM uses maven-parent as well

Reported conflicts:

• org.eclipse.sisu:org.eclipse.sisu.plexus:jar:0.9.0.M2@compile vs org.eclipse.sisu:org.eclipse.sisu.plexus:jar:0.9.0.M2@compile[2 exclusions] – as in Maven project we add exclusions to decouple plexus and sisu
• org.codehaus.plexus:plexus-xml:jar:3.0.0@compile vs org.codehaus.plexus:plexus-xml:jar:4.0.1@compile – this is a version conflict

Issue Links

• causes: MNG-8009 BOM peculiarities with build ordering
• links to: GitHub Pull Request #1374