Dependency convergence error in azure-sdk-bom:1.2.18

[mikmoila]

Maven enforcer reports a dependency convergence error in com.azure:azure-sdk-bom:1.2.18 as msal4j is included as two different versions:

[ERROR] Dependency convergence error for com.microsoft.azure:msal4j:jar:1.13.9 paths to dependency are:
[ERROR]   +-com.azure:azure-identity:jar:1.10.4:compile
[ERROR]     +-com.microsoft.azure:msal4j:jar:1.13.9:compile
[ERROR] and
[ERROR]   +-com.azure:azure-identity:jar:1.10.4:compile
[ERROR]     +-com.microsoft.azure:msal4j-persistence-extension:jar:1.2.0:compile
[ERROR]       +-com.microsoft.azure:msal4j:jar:1.4.0:compile

Also json-smart is included twice:

[ERROR] Dependency convergence error for net.minidev:json-smart:jar:1.3.3 paths to dependency are:
[ERROR]   +-com.azure:azure-identity:jar:1.10.4:compile
[ERROR]     +-com.microsoft.azure:msal4j:jar:1.13.9:compile
[ERROR]       +-com.nimbusds:oauth2-oidc-sdk:jar:10.7.1:compile
[ERROR]         +-net.minidev:json-smart:jar:1.3.3:compile
[ERROR] and
[ERROR]   +-com.azure:azure-identity:jar:1.10.4:compile
[ERROR]     +-com.microsoft.azure:msal4j:jar:1.13.9:compile
[ERROR]       +-net.minidev:json-smart:jar:2.4.10:compile

[alzimmermsft]

Thank you for filing this issue @mikmoila.

At this time azure-sdk-bom only guarantees dependency convergence between Azure SDKs and doesn't guarantee the same dependency convergence for transitive dependencies, such as this. The MSAL4J project is outside of the scope of Azure SDKs so, unfortunately, we don't have many options on enforcing dependency convergence here.

[bowbahdoe]

@alzimmermsft Forgive me if i'm missing something, but MSAL4j is published under

com.microsoft.azure/msal4j

The MSAL4J project is outside of the scope of Azure SDKs

So this doesn't make sense.

[alzimmermsft]

HI @bowbahdoe, while MSAL4J is published in the com.microsoft.azure group it's part of another repository which isn't managed by azure-sdk-for-java:

https://github.com/AzureAD/microsoft-authentication-library-for-java

We work with them to try and align their dependencies with what we use but at the end of the day since it's not all managed together there are times where there is some minor dependency skew.