Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Change BOM activation and stop managing dependencies #265

Merged
merged 2 commits into from
Oct 10, 2024
Merged

Change BOM activation and stop managing dependencies #265

merged 2 commits into from
Oct 10, 2024

Conversation

vy
Copy link
Member

@vy vy commented Oct 10, 2024 •
edited
Loading

This PR implements following changes

  • Activate flatten-bom execution of flatten-maven-plugin using a .logging-parent-bom-activator file
  • Remove following managed dependencies to avoid polluting BOMs:
    • biz.aQute.bnd:biz.aQute.bnd.annotation
    • com.github.spotbugs:spotbugs-annotations
    • org.jspecify:jspecify
    • org.osgi:osgi.annotation
    • org.osgi:org.osgi.annotation.bundle
    • org.osgi:org.osgi.annotation.versioning

The removal of managed dependencies fixes apache/logging-log4j2#3066.

@vy vy added this to the 11.4.0 milestone Oct 10, 2024
@vy vy self-assigned this Oct 10, 2024
@vy vy requested a review from ppkarwasz October 10, 2024 14:56
@vy vy added bug dependencies Pull requests that update a dependency file labels Oct 10, 2024
ppkarwasz
ppkarwasz requested changes Oct 10, 2024
View reviewed changes
Copy link
Contributor

@ppkarwasz ppkarwasz left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks good to me, except we could remove the parent of the POMs.

That makes me wonder if we can omit <pomElements> and use the defaults.

pom.xml Outdated Show resolved Hide resolved
@vy
Copy link
Member Author

vy commented Oct 10, 2024

That makes me wonder if we can omit <pomElements> and use the defaults.

@ppkarwasz, I prefer not to – it keeps properties, profiles, etc. all redundant (and potentially dangerous) stuff there.

@vy vy merged commit 0a66ccb into main Oct 10, 2024
7 checks passed
@vy vy deleted the fix/main/bom branch October 10, 2024 18:47
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@ppkarwasz ppkarwasz ppkarwasz approved these changes

Assignees

@vy vy

Labels
bug dependencies Pull requests that update a dependency file
Projects
None yet
Milestone
11.4.0
Development

Successfully merging this pull request may close these issues.

log4j-bom leaks non-Log4j dependencies
2 participants
@vy @ppkarwasz