[jira] [Closed] (OFBIZ-13487) Introduce a Gradle version catalog for dependency versions

["Mridul Pathak (Jira)" <ji...@apache.org>]

     [ https://issues.apache.org/jira/browse/OFBIZ-13487?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

Mridul Pathak closed OFBIZ-13487.
---------------------------------
    Fix Version/s: Upcoming Branch
       Resolution: Fixed

> Introduce a Gradle version catalog for dependency versions
> ----------------------------------------------------------
>
>                 Key: OFBIZ-13487
>                 URL: https://issues.apache.org/jira/browse/OFBIZ-13487
>             Project: OFBiz
>          Issue Type: Improvement
>          Components: framework
>    Affects Versions: Upcoming Branch
>            Reporter: Mridul Pathak
>            Assignee: Mridul Pathak
>            Priority: Major
>             Fix For: Upcoming Branch
>
>
> Root dependencies.gradle declares ~80 dependency coordinates as scattered literal strings (e.g. implementation 'org.apache.poi:poi:5.5.1'), and settings.gradle pins two plugin versions the same way. No single source of truth exists for a version that repeats across multiple artifacts (e.g. log4j's 7 co-versioned modules), and no structured way to bump one.
> Propose adding a Gradle version catalog (gradle/libs.versions.toml) — auto-detected by Gradle, wired into every subproject with no extra plumbing, usable since Gradle 7.4 (we've been on 7.6+ since OFBIZ-12400, Jan 2023) — and rewriting dependencies.gradle / settings.gradle to reference it instead of literals. Groups already sharing one version and configuration (jersey, swagger, batik, tika, pdfbox) get a bundles entry; the rest get individual libraries entries, sharing a versions key where a version repeats.
> Out of scope: per-component build.gradle files (e.g. plugins/ldap's CAS dependency) keep declaring their own versions independently. No Dependabot config change needed — it already understands version catalogs natively.
> Pure declaration-format refactor: no version bumps, no change to resolved dependencies or how they're downloaded.
> Affected Components:
> - dependencies.gradle
> - settings.gradle
> - gradle/libs.versions.toml (new)
> Testing:
> - Dependency-tree diff before/after the change, required to be identical.
> - Full multi-project compile (./gradlew classes testClasses) — catches any typo'd alias.
> - ./gradlew help after the settings.gradle change, to confirm plugin aliases resolve.



--
This message was sent by Atlassian Jira
(v8.20.10#820010)