Don't set versions of external dependencies in BOM

For example, in https://github.com/GoogleCloudPlatform/google-cloud-java/blob/184c219c7a7d38bd8146e3a4d35f0972a1d24a10/google-cloud-bom/pom.xml#L136 we’re setting the version of netty-tcnative-boringssl-static. This conflicts with the version we’re using in spring-cloud-gcp.

If users build their application, they get

java.lang.NoClassDefFoundError: Could not initialize class io.netty.handler.ssl.OpenSslEngine
	at io.netty.handler.ssl.OpenSslContext.newEngine0(OpenSslContext.java:49)
	at io.netty.handler.ssl.ReferenceCountedOpenSslContext.newEngine(ReferenceCountedOpenSslContext.java:378)
	at io.grpc.netty.ProtocolNegotiators$TlsNegotiator$1.handlerAdded(ProtocolNegotiators.java:306)
	at io.netty.channel.DefaultChannelPipeline.callHandlerAdded0(DefaultChannelPipeline.java:606)
	... 19 common frames omitted

Ideally, BOMs only export the versions of the modules the project implements. The dependencies used by the project should go in another pom, e.g., https://github.com/GoogleCloudPlatform/google-cloud-java/blob/master/pom.xml

Can we remove the versions of the dependencies of google-cloud-java from the BOM?

[garrettjonesgoogle]

One of the biggest benefits people get from the google cloud BOM is gettings the correct tcnative dependency. If it conflicts with what you’re using, then it probably conflicts with google-cloud-java at large (well, through grpc).

Now you say that BOMs should only export the versions of the modules the project implements, but doesn’t spring-cloud-gcp export a bunch of dependencies not in spring-cloud-gcp?

[garrettjonesgoogle]

We have moved the dependencies not managed by our project to the parent pom, so closing this out now.