Maven BOM for solving dependencies on Spring + Spring Data + Spring Security?

Question

Spring Data Jpa Docs suggest to use Maven BOM (bill of materials) due to:

Due to different inception dates of individual Spring Data modules, most of them carry different major and minor version numbers. The easiest way to find compatible ones is by relying on the Spring Data Release Train BOM we ship with the compatible versions defined. In a Maven project you’d declare this dependency in the <dependencyManagement/> section of your POM

Reference to official example is provided.

I've got the idea of BOM and dependencyManagement. Vendor officially supply us (developers) with tested/recommended/supported compatibility list. That is great!

In order to move versions synchronously I need some "super-BOM" that governs following BOMs:

org.springframework:spring-framework-bom
org.springframework.data:spring-data-releasetrain
org.springframework.security:spring-security-bom

How do I choose compatible ones?

Are there SPRING-SUPER-BOM for all umbrella (I mean official or community supported so I save my time by avoiding troubleshooting and if that happen and I have found and have resolved issue - I have an option to get back solution to community)?

Answer 1

NEW Thanks for pointing about Spring Platform deprecation to @jumping_monkey.

Now you should relay on org.springframework.boot:spring-boot-dependencies. It doesn't mean you started to use Spring Boot. It only means that you are using dependency management hosted by Spring Boot!

So your build file can look like:

apply plugin: 'io.spring.dependency-management'
dependencyManagement {
    imports {
        mavenBom "org.springframework.boot:spring-boot-starter-parent:${projSpringBootVersion}"
        mavenBom "org.springframework.cloud:spring-cloud-starter-parent:${projSpringCloudVersion}"
        mavenBom "org.springframework.cloud:spring-cloud-gcp-dependencies:${projSpringGcpVersion}"
    }
    applyMavenExclusions = false
}

Note that there is still uncertainty between version of spring-boot-starter-parent & spring-cloud-starter-parent. But it is OK. At least they help to manage versions of Hibernate/Jeckson/whatever!

OLD Thanks to @M.Deinum for pointing to Spring IO platform

This project provides versions of the various Spring projects and their dependencies.

Actual dependencies can be examined in corresponding http://docs.spring.io/platform/docs/ or from https://github.com/spring-io/platform/blob/master/platform-bom/pom.xml file by viewing at different tags: https://github.com/spring-io/platform/tags

This is easy to do with local Git clone:

$ git clone https://github.com/spring-io/platform.git
$ cd platform/
$ git tag --list
$ git co v1.0.2.RELEASE
$ less platform-bom/pom.xml

But you didn't find here dependencies for spring-core/spring-mvc/string-data/spring-security because they are in parent pom spring-boot-starter-parent which actually also include spring-boot-dependencies.

spring-boot-dependencies have version and dependency to

• spring-framework-bom
• spring-data-releasetrain
• spring-security-bom
• spring-integration-bom

So if your aplication is very reach - you may use io.spring.platform:platform-bom. But if that over-complicated list just use org.springframework.boot:spring-boot-dependencies as dependencyManagement.