Version specifications for libraries based on JUnit APIs

[fmeum]

Over at Jazzer, we maintain a library, com.code-intelligence:jazzer-junit, with an @FuzzTest macro that adds fuzzing functionality within JUnit, based on parameterized tests. It also includes a custom test runner based on the Launcher API that can optionally be used to run fuzz tests.

On Maven, this library currently has the following dependencies:

org.junit.jupiter:junit-jupiter-api:5.8.2
org.junit.jupiter:junit-jupiter-params:5.8.2
org.junit.platform:junit-platform-commons:1.8.2
org.junit.platform:junit-platform-launcher:1.8.2

Since we do not (and probably shouldn't?) depend on any of the "engine" packages, we do not control the result of Maven's version resolution for e.g. org.junit.jupiter:junit-jupiter-engine. But if users end up with version resolutions that leave them with an outdated version of org.junit.jupiter:junit-jupiter-engine, then running @FuzzTests can fail with obscure errors.

Is there any best practice we can employ to ensure that users receive a consistent collection of the different JUnit artifacts and our own minimum version constraints on the API artifacts are honored?

[marcphilipp]

One option would be to recommend users to import org.junit:junit-bom. Another option may be to add a runtime dependency on junit-jupiter-engine. However, IIRC with Maven's dependency resolution a user's declaration would still win if it's declared before the dependency on jazzer-junit.