You are viewing a plain text version of this content. The canonical link for it is here.

Posted to issues@struts.apache.org by "Lukasz Lenart (Jira)" <ji...@apache.org> on 2025/02/25 12:54:00 UTC

[jira] [Resolved] (WW-5376) struts2-bom should not pull in non-struts dependencies from struts2-parent

     [ https://issues.apache.org/jira/browse/WW-5376?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

Lukasz Lenart resolved WW-5376.
-------------------------------
    Resolution: Fixed

> struts2-bom should not pull in non-struts dependencies from struts2-parent
> --------------------------------------------------------------------------
>
>                 Key: WW-5376
>                 URL: https://issues.apache.org/jira/browse/WW-5376
>             Project: Struts 2
>          Issue Type: Bug
>            Reporter: Tyler King
>            Priority: Minor
>             Fix For: 7.1.0
>
>          Time Spent: 2h 10m
>  Remaining Estimate: 0h
>
> The parent of struts-bom pom file is the struts2-parent pom file. The struts2-parent pom file includes a dependencyManagement section with many non-struts dependencies (including test dependencies such as junit and mockito), which are inherited in the struts-bom pom file. This is bad practice for a bom file since consumers of that bom will have versions for dependencies unrelated to struts locked down.
> See [https://www.garretwilson.com/blog/2023/06/14/improve-maven-bom-pattern] and [https://github.com/apache/logging-log4j2] for an example of how they have both parent and bom pom files



--
This message was sent by Atlassian Jira
(v8.20.10#820010)