dependency management for third party libraries

[mrpiggi]

Currently, using optional features from SI within a maven project, it is necessary to specify an explicit version for the desired dependency. For example something like

<dependency>
	<groupId>org.eclipse.paho</groupId>
	<artifactId>org.eclipse.paho.mqttv5.client</artifactId>
	<version>1.2.5</version>
</dependency>

So when upgrading SI a lookup for updated dependencies on third party libraries should be done (at least for the optional included ones). Is there any reason, why third party libraries are not included in the dependency management or would it be possible to add those?

[artembilan]

Yeah... I know your pain, but we cannot help from here. Spring Integration doesn't not come as a parent to let target project to benefit from the dependency management. So, even if we would have it somehow in our Gradle build config, it won't help you in the end.

The Spring Boot on the other hand comes as a parent and it has most of those libraries in its dependency management, so you don't need to worry about versions.
Perhaps we just need to improve it to manage this org.eclipse.paho.mqttv5.client for us as well...

[mrpiggi]

As I am already using spring-boot-starter-parent something like <paho.version>1.2.5</paho.version> would be great, at least for my case.

[artembilan]

Well, that what has to be done on the Boot side, for your project you still have to add:

<dependency>
	<groupId>org.eclipse.paho</groupId>
	<artifactId>org.eclipse.paho.mqttv5.client</artifactId>
</dependency>

Since it is optional anyway and is not pulled transitively.

I'll talk to Boot team about that matter...

[mrpiggi]

Adding the optional dependency is absolutely fine, it's really just about getting rid of the manual versioning. Thanks a lot for taking over.

[mrpiggi]

Sorry for bothering you again, but alternatively, would it be possible to add dependencies on third party libraries to spring-integration-bom?

<dependencyManagement>
  <dependencies>
    ...
    
    <dependency>
      <groupId>org.eclipse.paho</groupId>
      <artifactId>org.eclipse.paho.client.mqttv3</artifactId>
      <version>1.2.5</version>
    </dependency>
    <dependency>
      <groupId>org.eclipse.paho</groupId>
      <artifactId>org.eclipse.paho.mqttv5.client</artifactId>
      <version>1.2.5</version>
    </dependency>
  </dependencies>
</dependencyManagement>

This way, one could then use project specific pom.xml like

  <dependencyManagement>
    <dependencies>
      <dependency>
        <groupId>org.springframework.integration</groupId>
        <artifactId>spring-integration-bom</artifactId>
        <version>5.5.8</version>
        <type>pom</type>
        <scope>import</scope>
      </dependency>
    </dependencies>
  </dependencyManagement>
  <dependencies>
    <dependency>
      <groupId>org.springframework.integration</groupId>
      <artifactId>spring-integration-mqtt</artifactId>
    </dependency>
    <dependency>
      <groupId>org.eclipse.paho</groupId>
      <artifactId>org.eclipse.paho.mqttv5.client</artifactId>
    </dependency>
  </dependencies>

Would this be feasible or is it rather a bad idea to add those libraries to the dependency management?

[artembilan]

We are not going to manage third-party dependencies in the spring-integration-bom since this represents a library by itself to be managed on the low-level.
It is best to rely on the opinionated management from the top-level project like Spring Boot. But I understand your problem with not managed library like that org.eclipse.paho.mqttv5.client.

We may consider to publish a separate BOM for those third-party optional dependencies to be included in your project alongside with this spring-integration-bom, but doesn't look like any one does that in the world...

[mrpiggi]

Don't worry, I was just updating the version of Spring Boot in my projects the other day and stumbled across the topic again. Would it make sense to at least make an issue out of this discussion so that it doesn't get forgotten? Either way, I'm going to leave it here for now, but I'll definitely be happy if you find a solution for it at some point. Thank you very much for your fantastic work.