[jira] [Created] (FLINK-14444) Publish BOMs for Flink

["Michael Holler (Jira)" <ji...@apache.org>]

Michael Holler created FLINK-14444:
--------------------------------------

             Summary: Publish BOMs for Flink
                 Key: FLINK-14444
                 URL: https://issues.apache.org/jira/browse/FLINK-14444
             Project: Flink
          Issue Type: Improvement
            Reporter: Michael Holler


Hey there! Love the project, but I would love it if there was a BOM file that is published for each version. If you're not familiar with a BOM, it stands for "Bill of Materials" it helps your Gradle (in my case, but it's originally a Maven thing) file look like this (using JDBI's implementation as an example):
{code:java}
dependencies {
    implementation(platform("org.jdbi:jdbi3-bom:3.10.1"))
    implementation("org.jdbi:jdbi3-core")
    implementation("org.jdbi:jdbi3-kotlin")
    implementation("org.jdbi:jdbi3-kotlin-sqlobject")
    implementation("org.jdbi:jdbi3-jackson2")
}
{code}
Instead of this:
{code:java}
val jdbiVersion by extra { "2.6.1" }
 
dependencies {
    implementation("org.jdbi:jdbi3-core:$jdbiVersion")
    implementation("org.jdbi:jdbi3-kotlin:$jdbiVersion")
    implementation("org.jdbi:jdbi3-kotlin-sqlobject:$jdbiVersion")
    implementation("org.jdbi:jdbi3-jackson2:$jdbiVersion")
}
{code}
Notice how you just leave the versions off when you use a BOM. This can help reduce the number of dependency compatibility surprises one can encounter, especially if a transitive dependency brings in a newer version of one of the components (it'll be reduced to the BOM's version). Note also that you still have to list dependencies you want with a BOM, just not the versions.

Here's a deeper dive into how a BOM works:

[https://howtodoinjava.com/maven/maven-bom-bill-of-materials-dependency/]

 The Maven help site also has a section on it (Ctrl+F for "BOM"):

[https://maven.apache.org/guides/introduction/introduction-to-dependency-mechanism.html]

I think BOMs would be a great for the users of the Flink project because there are lots of Flink libraries (core, connectors, etc) that require the same version as other Flink dependencies to work correctly. BOMs were designed for exactly this use case :)



--
This message was sent by Atlassian Jira
(v8.3.4#803005)