upgrade common-collections / velocity?

[Brent Putman]

On 5/15/17 8:30 AM, Etienne Dysli-Metref wrote:
> Spring solves this by providing a "bill of materials" POM [1] meant to
> be included in <dependencyManagement>. It ensures that all Spring
> Framework artifacts are at the same version. Spring Boot goes even
> further and manages its transitive dependencies in a BOM to provide a
> consistent, tested set of libraries.

So if I'm understanding correctly, this is essentially introducing a
layer of indirection, by 1) creating a POM-only project that contains a
dependencyManagement section 2) including that dependency in your own
POM's dependencyManagement section.  So sort of declaring the
dependencies by reference rather than by value.

I think I like it.   IMHO I think we should look into this in more
detail to understand the nuances of how it works and confirm it does
what we want.  So yes, seems very interesting.

In a way, this is kind of like multiple inheritance for the POM - since
you can presumably include multiple BOMs - but just for the
dependencyManagement section.  So I guess it's more like a mix-in.

> I already suggested using the Spring BOM in your java-parent project to
> simplify its POM [3].

I remember seeing that (nearly 2 years ago!), and apologize for not
looking at it more closely.    (Whenever I see BOM I think Unicode
byte-order-mark...)


>  Come to think of it, also providing a BOM for the
> IdP would be really convenient for extension developers.

Yes, developing an idp-bom for IdP extension devs seems useful.  And for
the OP's original case in this thread, seems like an opensaml-bom would
be in order.

Can BOM POMs be layered like regular POMs (that is, inherit from other
BOM POMs)?  Just wondering about avoiding duplicating common versions
all over the place.  If so, seems like we might factor the
java-parent-v3 dependencyManagement out to a parent-bom, from which we
then inherit for the opensaml-bom, and idp-bom.  So sort of a parallel
inheritance hierarchy as currently exists for the regular POMs.  Or
maybe it's slightly different, depending on how it all works, but you
get the basic idea of why I'm asking.



-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/dev/attachments/20170515/c7b9b37a/attachment.html>