[
https://issues.apache.org/jira/browse/MNG-6806?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17502271#comment-17502271
]
Konrad Windszus commented on MNG-6806:
--------------------------------------
It seems that some dependencies are yet managed by the BOM
(https://github.com/apache/maven/blob/master/maven-bom/pom.xml) but they are
(at least partially) provided through the Core Classloader
(https://github.com/apache/maven/blob/master/maven-core/src/main/resources/META-INF/maven/extension.xml):
# plexus-utils
# wagon-api
# maven-resolver-api, maven-resolver-spi, maven-resolver-impl
# plexus-container
# plexus-component-annotations
# JAnsi
IMHO every dependency which is always loaded through the Core classloader
should be managed in the BOM.
> Provide Maven BOM
> -----------------
>
> Key: MNG-6806
> URL: https://issues.apache.org/jira/browse/MNG-6806
> Project: Maven
> Issue Type: Improvement
> Reporter: Robert Scholte
> Assignee: Robert Scholte
> Priority: Major
> Fix For: 4.0.0, 4.0.0-alpha-1, 3.9.0-candidate
>
>
> Maven libraries should always have the same version to ensure they work as
> expected, hence the preferred way to manage that is with a bom.
> Let's introduce the {{maven-dependencies}}, a
> [bom|https://maven.apache.org/guides/introduction/introduction-to-dependency-mechanism.html#Importing_Dependencies]
> for Maven dependencies. We will likely need the same for plugins.
> See https://www.baeldung.com/spring-maven-bom about how to write and use the
> bom.
--
This message was sent by Atlassian Jira
(v8.20.1#820001)
