Quarkus BOM references many missing artifacts

[jskillin-idt]

Describe the bug

The Quarkus BOM references many artifacts which don't appear to exist, at least in Maven Central:

com.google.auto.service:auto-service-annotations:1.3.5
com.google.auto.service:auto-service:1.3.5
io.quarkiverse.opentelemetry.exporter:quarkus-opentelemetry-exporter-jaeger-deployment:1.0.0
io.quarkiverse.opentelemetry.exporter:quarkus-opentelemetry-exporter-jaeger:1.0.0
io.smallrye.reactive:smallrye-mutiny-vertx-health-checks:3.3.0
io.vertx:vertx-consul:4.4.1
io.vertx:vertx-jgroups:4.4.1
io.vertx:vertx-jwt:4.4.1
io.vertx:vertx-lang-groovy-parent:4.4.1
io.vertx:vertx-lang-kotlin-compiler:4.4.1
io.vertx:vertx-maven-service-factory-parent:4.4.1
io.vertx:vertx-sql-common:4.4.1
org.gradle:gradle-tooling-api:8.1.1
org.jboss.resteasy:resteasy-context-propagation:6.2.1.Final
org.opensaml:opensaml-saml-impl:4.2.0
org.opensaml:opensaml-xacml-impl:4.2.0
org.opensaml:opensaml-xacml-saml-impl:4.2.0

Expected behavior

No response

Actual behavior

No response

How to Reproduce?

No response

Output of uname -a or ver

No response

Output of java -version

No response

GraalVM version (if different from Java)

No response

Quarkus version or git rev

3.0.3.Final

Build tool (ie. output of mvnw --version or gradlew --version)

No response

Additional information

No response

[quarkus-bot]

/cc @evanchooly (kotlin), @geoand (kotlin)

[geoand]

cc @aloubyansky

[gsmet]

@jskillin-idt thanks for the report. Could you clarify the groupId:artifactId of the BOM you're talking about?

Thanks.

[jskillin-idt]

The GAV is io.quarkus:quarkus-bom:3.0.3.Final

[gsmet]

Hmmm, I will have a look. I could have understood the presence of them in the io.quarkus.platform BOM given it's an aggregation of several BOM files but I'm surprised our own BOM contains non-existing artifacts.

[aloubyansky]

That's not news @gsmet. @cescoffier has already opened PRs in Vert.X to clean most of them up.

[aloubyansky]

I think the rest of the platform BOMs will be clean due to filtering applied during the alignment. Some projects managed in quarkus-bom are still leaking non-existing constraints due to their special handling.

[cescoffier]

• For Vert.x is will be fixed with the next update.
• I'm still chasing io.smallrye.reactive:smallrye-mutiny-vertx-health-checks:3.3.0
• I don't know about the other ones.

[gsmet]

com.google.auto.service:auto-service-annotations:1.3.5
com.google.auto.service:auto-service:1.3.5

These ones come from an external BOM we import.

io.quarkiverse.opentelemetry.exporter:quarkus-opentelemetry-exporter-jaeger-deployment:1.0.0
io.quarkiverse.opentelemetry.exporter:quarkus-opentelemetry-exporter-jaeger:1.0.0

The versions in the relocations were wrong. I fixed them.

io.smallrye.reactive:smallrye-mutiny-vertx-health-checks:3.3.0
io.vertx:vertx-consul:4.4.1
io.vertx:vertx-jgroups:4.4.1
io.vertx:vertx-jwt:4.4.1
io.vertx:vertx-lang-groovy-parent:4.4.1
io.vertx:vertx-lang-kotlin-compiler:4.4.1
io.vertx:vertx-maven-service-factory-parent:4.4.1
io.vertx:vertx-sql-common:4.4.1

Either already fixed or @cescoffier is on them.

org.gradle:gradle-tooling-api:8.1.1

This one we need but Gradle doesn't publish the artifacts to Maven Central.

org.jboss.resteasy:resteasy-context-propagation:6.2.1.Final

This one doesn't exist anymore, I dropped it.

org.opensaml:opensaml-saml-impl:4.2.0
org.opensaml:opensaml-xacml-impl:4.2.0
org.opensaml:opensaml-xacml-saml-impl:4.2.0

These ones come from an external BOM.

I created #33898 with the fixes I could apply. @aloubyansky do you have a tool to understand where the ones coming from external BOMs are coming from?

[gsmet]

@aloubyansky btw, if you have a tool, maybe you can tell @cescoffier where io.smallrye.reactive:smallrye-mutiny-vertx-health-checks is coming from.

[aloubyansky]

Not sure about the actual chain but just in case I see it in https://github.com/smallrye/smallrye-mutiny-vertx-bindings/blob/main/vertx-mutiny-clients-bom/pom.xml

[cescoffier]

I've fixed it this morning. I'm cutting a release right now.

(it: io.smallrye.reactive:smallrye-mutiny-vertx-health-checks)

[gsmet]

I think we can close this one. We fixed what was on our side. For things coming from external BOMs, please report them to the appropriate projects.