Dropwizard BOM provides dependency management for modules outside the Dropwizard project

The BOM is setting dependency management for modules that aren’t part of Dropwizard. This is not ideal, as it can cause conflicts when other projects import the BOM.

A simple example would be if I had a project using the Dropwizard BOM, and also depending on something that depends on tomcat-jdbc:9.0.8 and tomcat-dbcp:9.0.8. In this case I would get tomcat-jdbc:9.0.22 from Dropwizard, and tomcat-dbcp:9.0.8, which might not work together. This will happen even if I don’t use a Dropwizard module that requires tomcat-jdbc.

See a similar discussion here https://github.com/dropwizard/metrics/issues/1336

Ideally the BOM would only set the versions of io.dropwizard modules, and let the consuming project handle resolving any conflicts between transitive dependencies. This is also how several other modular projects do their BOMs (e.g. JUnit, Jackson, Camel)

[joschi]

The dependencies have been reorganized in #2897.

@black-snow Could you please create a new issue for this and add a minimal example to reproduce the problem?

[black-snow]

Will most likely be fixed with 2.0.0.