Spring-boot: gradle bom support not working with boot 2.0.1

[dyroberts]

When using gradle to build a new boot app, instead of using the spring dependency-management-plugin, you can use gradle's native bom support.

See the gradle docs here: https://docs.gradle.org/4.6/userguide/managing_transitive_dependencies.html#sec:bom_import
They even use spring-boot-dependencies as their example bom!

This works great with boot version 2.0.0.RELEASE and below. However, with 2.0.1.RELEASE it breaks!
Seems to be a dependency version conflict between boot 2.0.1 and beans 5.0.5 on org.yaml:snakeyaml

I've created a sample app to expose the issue:
https://github.com/pivotal-dylan-roberts/boot-2.0.1-bom-gradle

The sample was created with initializr, adding just the web starter dependency.
I then removed the dependency-management-plugin and added the enableFeaturePreview('IMPROVED_POM_SUPPORT') line in settings.gradle and the bom dependency, of course.

You'll see that the default contextLoads test fails when springBootVersion is set to 2.0.1.RELEASE and passes when the version is any previous release. The test failure is due to the following exception.

java.lang.NoSuchMethodError: org.yaml.snakeyaml.nodes.ScalarNode.getStyle()Ljava/lang/Character;

    at org.springframework.boot.env.OriginTrackedYamlLoader$KeyScalarNode.<init>(OriginTrackedYamlLoader.java:124)
...

[wilkinsona]

This is a bug in Gradle's bom support. It has appeared in Boot 2.0.1 due to the upgrade to Spring Framework 5.0.5.

Spring Framework is compatible with a range of SnakeYAML versions but compiles against the latest. In 5.0.5 that means it upgraded to SnakeYAML 1.20. Spring Boot uses SnakeYAML 1.19 (with which Spring Framework 5.0.5 is compatible) and specifies this version in its bom. Unfortunately, Gradle's bom support isn't honouring the version specified in the bom and, instead, the version declared in Spring Framework's optional dependency is winning. By contrast, the dependency management plugin honours Maven's semantics for a bom and the version in the bom is the one that's used.

@pivotal-dylan-roberts Please raise a Gradle issue for this. If you comment with a link to it, I'll keep an eye on it and comment as needed.

[dyroberts]

Thanks @wilkinsona! Will do.

[bountin]

For anyone who is looking for a temporary workaround, add the following to your gradle file:

    implementation ('org.yaml:snakeyaml:1.19') {
        force = true
    }

[adrian-baker]

Was this ever raised as a Gradle issue?

[wilkinsona]

https://github.com/gradle/gradle/issues/4979