Coursier: Support BOMs/dependencyManagement

[mandrean]

Correct me if I'm wrong, but to me it seems that the Coursier CLI doesn't support fetching/resolving the dependencyManagement dependencies in BOMs?

For example: https://github.com/FasterXML/jackson-bom/blob/master/pom.xml#L75

I've tried all kinds of variants

$ coursier resolve com.fasterxml.jackson:jackson-bom:2.9.10 -t
$ coursier fetch com.fasterxml.jackson:jackson-bom:2.9.10 -j dep-tree.json && cat dep-tree.json

and more.

Also see https://maven.apache.org/guides/introduction/introduction-to-dependency-mechanism.html#Dependency_Management

The dependency management section is a mechanism for centralizing dependency information. When you have a set of projects that inherits a common parent it's possible to put all information about the dependency in the common POM and have simpler references to the artifacts in the child POMs.

Commonly used in large companies with a lot of teams developing various services in order to align them on external dependency versions!

[alexarchambault]

You mean, you'd like the CLI to fetch all the dependencies of the dependencyManagement section? It's not something that's supported as is. What would be the use case for that?

Resolution does take into account parent POMs / import scope during resolution though.

[mandrean]

Partially, the use-case is: https://github.com/bazelbuild/rules_jvm_external/issues/229

But also more broadly speaking:

Many companies (including Spotify, where I'm at) use BOMs to centrally manage versions of various company-wide internal dependencies. Also some open-source projects have support for that, like: https://github.com/FasterXML/jackson-bom

As it is today, if you run coursier fetch on some artifact that happens to rely on a BOM to resolve some of its dependencies, then coursier, would make an incomplete job at downloading all the transitive dependencies (mvn can do this, however).

Same if you use --json-output-file - the dependency resolution list there is in fact incomplete!

[kohsuke]

@alexarchambault I'm worried that the point of this feature request was misunderstood, so let me try to clarify.

What @mandrean is asking isn't so much "fetching all the dependencies of the dependencyManagement section.

The request is that the resolution should take dependencyManagement into account, in particular the dependency management included via the import scope, aka the BOM pattern. And that the equivalent capability be exposed via CLI:

• command line option to contribute an entry to ResolutionParams.addForceVersion, which IIUC is the equivalent of dependencyManagement in pom.xml
• command line option that takes a groupId:artifactId:version coordinate of a POM, then read its dependencyManagement and put those into ResolutionParams.addForceVersion recursively.

I'm in the same boat as @mandrean in that I'm blocked by the aforementioned bazel feature. Hope this helps to prioritize this issue accordingly.

[lefou]

As Mill also uses coursier, we also face the issue that users want to feed some BOM and expect to get the right versions selected/forced. Is that even possible with current coursier?