[WW-5376] struts2-bom should not pull in non-struts dependencies from struts2-parent - ASF JIRA

Attach files

Attach Screenshot

Add vote

Voters

Watch issue

Watchers

Create sub-task

Link

Clone

Update Comment Author

Replace String in Comment

Update Comment Visibility

Delete Comments

XML

Word

Printable

JSON

Details

Type: Bug
Status: Open
Priority: Minor
Resolution: Unresolved
Affects Version/s: None
Fix Version/s: 6.5.0
Component/s: None
Labels:
None

Description

The parent of struts-bom pom file is the struts2-parent pom file. The struts2-parent pom file includes a dependencyManagement section with many non-struts dependencies (including test dependencies such as junit and mockito), which are inherited in the struts-bom pom file. This is bad practice for a bom file since consumers of that bom will have versions for dependencies unrelated to struts locked down.

See https://www.garretwilson.com/blog/2023/06/14/improve-maven-bom-pattern and https://github.com/apache/logging-log4j2 for an example of how they have both parent and bom pom files