Don't include the whole Spring Boot parent in your `springdoc-openapi` pom

[jacekbilski]

Is your feature request related to a problem? Please describe.

We're using Maven to build our projects. We're also using spring-boot-starter-parent as our parent pom. Once we import your springdoc-openapi with type pom and scope import, you're overwriting versions from spring-boot-starter-parent. We've noticed this problem today as we wanted to upgrade Spring Boot to 3.4.4, but the newest version of SpringDoc (2.8.5) is still using Spring Boot 3.4.2.

In the end, even though we were starting from Spring Boot 3.4.4, we were getting dependencies from Spring Boot 3.4.2, which are incompatible. For example, instead of Spring Framework 6.2.5, we were getting 6.2.2.

Describe the solution you'd like

Please include in your BOM only versions for JARs you're providing. Everything else should be our responsibility. Of course, it would be nice if you've kept an information in release notes that your version X is compatible with Spring Boot version Y, so that the users would know what to expect. Any deviations in versions would then be responsibility of those users.

Describe alternatives you've considered

For now I had to do two things:

1. Apart from using spring-boot-starter-parent as parent pom for our project, we had to import, again, spring-boot-dependencies in dependencyManagement section.
2. Move springdoc-openapi to the bottom of dependencyManagement so that versions of all other libraries are already set before Maven gets to SpringDoc dependencies.

[Mattias-Sehlstedt]

To me it looks like the release notes already include that information? We have that 2.8.4 upgraded to 3.4.2. And then the omission of a version mentioned in 2.8.5 means that we still have the same version.

There also exists a weakly version-matched compatibility matrix in some dark corner of their docs.

But yes this does not take away from the fact that it would be beneficial if they could be detached from each other.

[bnasslahsen]

@jacekbilski,

This is an invalid issue.
Feel free to provide a Minimal, Reproducible Example - with HelloController that reproduces the problem.

This ticket will be closed, but can be reopened if your provide the reproducible sample.

[jacekbilski]

I'm attaching a small demo that shows how importing SpringDoc's BOM changes the version of Spring Framework, effectively breaking the app. ./mvnw clean package works, but ./mvnw clean spring-boot:run doesn't. You can make it run again by uncommenting spring-boot-dependencies dependency in dependencyManagement section.

I hope that makes this ticket more understandable for you.

demo.tar.gz

[bnasslahsen]

@jacekbilski,

I have added springdoc-openapi-bom, that may resolve your issue.

	<dependencyManagement>
		<dependencies>
			<dependency>
				<groupId>org.springdoc</groupId>
				<artifactId>springdoc-openapi-bom</artifactId>
				<version>2.8.7-SNAPSHOT</version>
				<type>pom</type>
				<scope>import</scope>
			</dependency>
		</dependencies>
	</dependencyManagement>

Can you validate with the latest SNAPSHOT, if it resolves your issue ?

[jacekbilski]

Hi @bnasslahsen,

Unfortunately, it does not. It's still too strong, because this bom is still using springdoc-openapi as its parent, and, transitively, spring-boot-starter-parent as its grandparent. I was hoping for something more along the lines of https://central.sonatype.com/artifact/de.codecentric/spring-boot-admin-dependencies.

I was trying to prepare a proposal, but it's not that trivial, and I have, unfortunately, other projects to attend to. Maybe I'll find the time sometime in the future.

[bnasslahsen]

@jacekbilski,

I have updated with a new version.
Let me know now!