Support BOMs/dependencyManagement

Correct me if I’m wrong, but to me it seems that the Coursier CLI doesn’t support fetching/resolving the dependencyManagement dependencies in BOMs?

For example: https://github.com/FasterXML/jackson-bom/blob/master/pom.xml#L75

I’ve tried all kinds of variants

$ coursier resolve com.fasterxml.jackson:jackson-bom:2.9.10 -t
$ coursier fetch com.fasterxml.jackson:jackson-bom:2.9.10 -j dep-tree.json && cat dep-tree.json

and more.

Also see https://maven.apache.org/guides/introduction/introduction-to-dependency-mechanism.html#Dependency_Management

The dependency management section is a mechanism for centralizing dependency information. When you have a set of projects that inherits a common parent it’s possible to put all information about the dependency in the common POM and have simpler references to the artifacts in the child POMs.

Commonly used in large companies with a lot of teams developing various services in order to align them on external dependency versions!

[kohsuke]

@alexarchambault I’m worried that the point of this feature request was misunderstood, so let me try to clarify.

What @mandrean is asking isn’t so much "fetching all the dependencies of the dependencyManagement section.

The request is that the resolution should take dependencyManagement into account, in particular the dependency management included via the import scope, aka the BOM pattern. And that the equivalent capability be exposed via CLI:

• command line option to contribute an entry to ResolutionParams.addForceVersion, which IIUC is the equivalent of dependencyManagement in pom.xml
• command line option that takes a groupId:artifactId:version coordinate of a POM, then read its dependencyManagement and put those into ResolutionParams.addForceVersion recursively.

I’m in the same boat as @mandrean in that I’m blocked by the aforementioned bazel feature. Hope this helps to prioritize this issue accordingly.

[rdesgroppes]

To give another case where this feature would be more than desirable is with distributed computing frameworks (Apache Beam/Google Cloud Dataflow, Apache Flink, Apache Spark, etc.), where we frequently encounter the following pattern: container images (vanilla or custom) are deployed with a predefined and mostly consistent set of dependencies whose versions are finely selected to be compatible with each other. Their selection is sometimes the result of considerable effort (example: BOM: com.google.cloud:libraries-bom:25.2.0) and, when at least one of them is incremented, all direct dependencies are re-examined with the same care in order to increment them if necessary, and so on, until a new version of the container image is consistent as a whole. For each such container image, a BOM is produced that provides an exhaustive list of the selected dependencies (either provided when shared with the framework’s runtime and/or to save assembly and upload times, or compile otherwise). This BOM is consumed by users in order to compile, test and assemble “fat” JARs (or uber-JARs) containing their application code as well as the additional dependencies they need. It is therefore the BOM that sets the pace for the versions guaranteed to be available in the deployment and consistent with each other. What’s missing is therefore a mechanism that would allow to automatically pick the individual dependency versions from BOMs, instead of doing that manually or by means of home-baked build system extensions.

Edit: what I meant above is probably better summarized by Google’s Using Cloud Client Libraries:

Updating your project to use the BOM

To make sure that your projects uses compatible versions of the libraries and their component artifacts, import com.google.cloud:libraries-bom and use the BOM to specify dependency versions. Be sure to remove any versions that you set previously.

Maven

Import the BOM in the dependencyManagement section of your pom.xml file. […]

Gradle

BOMs are supported by default in Gradle 5.x or later. Add a platform dependency on com.google.cloud:libraries-bom […]

SBT

SBT doesn’t support BOMs. You can find recommended versions of libraries from a particular BOM versions on the dashboard and set the versions manually.

Bazel

Bazel doesn’t support BOMs. You can find recommended versions of libraries from a particular BOM version on the dashboard and set the versions manually.