BOM improvements

[snicoll]

I am reacting on the call of @sdeleuze on a Spring Boot issue.

The BOM looks very good overall, here are some suggestions:

• Please don't use kotlin.version or any other version property but rather hardcode the version in each dependency. This makes the intent much more clear and doesn't give the impression that overriding that property in a user's project will change dependency management. It won't
• Given the state of the parent, can you please avoid having a parent at all? This makes the structure of the bom self-contained and it is easier to figure out what it does
• As you've noticed yourself, plugin management is not inherited by a BOM. Removing that section altogether would be better IMO
• We order dependencies alphabetically (groupId then artifactId). It makes much easier to find something
• Please don't add scope to a dependency. The purpose is to harmonize the version, not to provide any extra semantic (in particular overriding default semantics)

[cy6erGn0m]

Given the state of the parent, can you please avoid having a parent at all?

The idea was to reserve parent to be able to write multiple BOM's for different "worlds" however I am not sure about yet

[snicoll]

It's ok to have something to aggregate things but I personally prefer to avoid hierarchies with BOMs.

[cy6erGn0m]

The other issue is that without kotlin.version there is no way to specify compiler plugin's version (e.g. allopen) except via substitution

[snicoll]

I am not following. That bom is going to be imported and those properties won't be available. And a BOM doesn't take care of plugin configuration at all.

Or do you intend to use this bom as a parent of something else?

[cy6erGn0m]

Ah I see. Then the problem becomes more serious.

https://issues.apache.org/jira/browse/MNG-2496
https://issues.apache.org/jira/browse/MNG-2172

[snicoll]

@cy6erGn0m nothing new there, it's been like that for years and I don't think having a BOM means those should be fixed first.

[cy6erGn0m]

Isn't allopen plugin good to have for spring? Any options?

[sdeleuze]

We configure it explicitely is order to make it easier to disable it and less surprising for end users, so better to focus only on dependency versions in any case in the BOM (we don't really have the choice).