You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@solr.apache.org by Christos Malliaridis <c....@gmail.com> on 2025/01/14 17:03:23 UTC
Changing the way we lock dependencies
Hello everyone,
I would like to merge https://github.com/apache/solr/pull/2925 next week,
after doing some small cleanups.
The PR improves the way our dependencies are resolved by introducing a
platform module that automatically adds all our dependencies from our
version catalog (gradle/libs.version.toml) as constraints.
After the merge, we should be able to use solrbot again (some post-testing
is required), as dependabot has proven quite difficult to introduce (see
discussions in #2880).
With the PR changes merged it should now be easier to add, remove or update
a dependency. We no longer have to manually add or maintain a list of
dependency constraints. Resolving conflicts should also be as simple as
adding the library to our catalog with the specific version that solves the
conflict.
What changes from the flow is that we now lock versions with the gradle
task "gradlew resolveAndLockAll --write-locks" and no longer use the task
"writeLocks" that was provided by a third-party plugin.
The impact of a dependency change is made clearer when reviewing a PR, as
the lockfiles are more human-readable. Each module stores its own lockfile,
which should make it more obvious when a dependency change affects other
sub-modules as well.
New modules should consider adding the platform module as a dependency via
`implementation platform(project(":platform"))` to ensure that the version
constraints are applied correctly.
If you plan to review the PR and don't have the time this week, let me know
so that I can postpone the merge of the PR.
Best,
Christos
Re: Changing the way we lock dependencies
Posted by Christos Malliaridis <c....@gmail.com>.
Thanks Jason for the feedback. I'm glad that my contribution is of value. :)
I will proceed and merge tomorrow the PR. Hopefully solrbot will be
operational again right after the merge.
On Wed, Jan 15, 2025 at 12:12 PM Jason Gerlowski <ge...@gmail.com>
wrote:
> Hi Christos,
>
> Just wanted to say I really appreciate the detailed discussion of the
> benefits and tradeoffs here. Very helpful for those of us without much
> context on the gradle stuff.
>
> Best,
>
> Jason
>
> On Tue, Jan 14, 2025 at 12:04 PM Christos Malliaridis
> <c....@gmail.com> wrote:
> >
> > Hello everyone,
> >
> > I would like to merge https://github.com/apache/solr/pull/2925 next
> week,
> > after doing some small cleanups.
> >
> > The PR improves the way our dependencies are resolved by introducing a
> > platform module that automatically adds all our dependencies from our
> > version catalog (gradle/libs.version.toml) as constraints.
> >
> > After the merge, we should be able to use solrbot again (some
> post-testing
> > is required), as dependabot has proven quite difficult to introduce (see
> > discussions in #2880).
> >
> > With the PR changes merged it should now be easier to add, remove or
> update
> > a dependency. We no longer have to manually add or maintain a list of
> > dependency constraints. Resolving conflicts should also be as simple as
> > adding the library to our catalog with the specific version that solves
> the
> > conflict.
> >
> > What changes from the flow is that we now lock versions with the gradle
> > task "gradlew resolveAndLockAll --write-locks" and no longer use the task
> > "writeLocks" that was provided by a third-party plugin.
> >
> > The impact of a dependency change is made clearer when reviewing a PR, as
> > the lockfiles are more human-readable. Each module stores its own
> lockfile,
> > which should make it more obvious when a dependency change affects other
> > sub-modules as well.
> >
> > New modules should consider adding the platform module as a dependency
> via
> > `implementation platform(project(":platform"))` to ensure that the
> version
> > constraints are applied correctly.
> >
> > If you plan to review the PR and don't have the time this week, let me
> know
> > so that I can postpone the merge of the PR.
> >
> > Best,
> > Christos
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: dev-unsubscribe@solr.apache.org
> For additional commands, e-mail: dev-help@solr.apache.org
>
>
Re: Changing the way we lock dependencies
Posted by Jason Gerlowski <ge...@gmail.com>.
Hi Christos,
Just wanted to say I really appreciate the detailed discussion of the
benefits and tradeoffs here. Very helpful for those of us without much
context on the gradle stuff.
Best,
Jason
On Tue, Jan 14, 2025 at 12:04 PM Christos Malliaridis
<c....@gmail.com> wrote:
>
> Hello everyone,
>
> I would like to merge https://github.com/apache/solr/pull/2925 next week,
> after doing some small cleanups.
>
> The PR improves the way our dependencies are resolved by introducing a
> platform module that automatically adds all our dependencies from our
> version catalog (gradle/libs.version.toml) as constraints.
>
> After the merge, we should be able to use solrbot again (some post-testing
> is required), as dependabot has proven quite difficult to introduce (see
> discussions in #2880).
>
> With the PR changes merged it should now be easier to add, remove or update
> a dependency. We no longer have to manually add or maintain a list of
> dependency constraints. Resolving conflicts should also be as simple as
> adding the library to our catalog with the specific version that solves the
> conflict.
>
> What changes from the flow is that we now lock versions with the gradle
> task "gradlew resolveAndLockAll --write-locks" and no longer use the task
> "writeLocks" that was provided by a third-party plugin.
>
> The impact of a dependency change is made clearer when reviewing a PR, as
> the lockfiles are more human-readable. Each module stores its own lockfile,
> which should make it more obvious when a dependency change affects other
> sub-modules as well.
>
> New modules should consider adding the platform module as a dependency via
> `implementation platform(project(":platform"))` to ensure that the version
> constraints are applied correctly.
>
> If you plan to review the PR and don't have the time this week, let me know
> so that I can postpone the merge of the PR.
>
> Best,
> Christos
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@solr.apache.org
For additional commands, e-mail: dev-help@solr.apache.org
Re: Changing the way we lock dependencies
Posted by Christos Malliaridis <ma...@apache.org>.
Hello again,
I just wanted to let you know that the PR #2925 has been merged into main. If you have any branch that includes changes in the dependency tree, remember to pull the latest changes from main and run "./gradlew resolveAndLockAll --write-locks" to update the lockfiles accordingly.
In case of any issues with dependencies / locking, please let me know.
Best,
Christos
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@solr.apache.org
For additional commands, e-mail: dev-help@solr.apache.org