Skip to content

Eliminate odlparent managed versions #2612

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
ihrasko wants to merge 1 commit into
base: main
Choose a base branch
from
Draft

Eliminate odlparent managed versions #2612

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 0 additions & 1 deletion lighty-core/dependency-versions/pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -100,7 +100,6 @@
<dependency>
<groupId>jakarta.activation</groupId>
<artifactId>jakarta.activation-api</artifactId>
<version>2.1.4</version>
</dependency>
<dependency>
<groupId>com.google.inject</groupId>
Expand Down
6 changes: 0 additions & 6 deletions lighty-core/lighty-parent/pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -43,22 +43,18 @@
<dependency>
<groupId>org.slf4j</groupId>
<artifactId>slf4j-api</artifactId>
<version>${slf4j.version}</version>
</dependency>
<dependency>
<groupId>org.apache.logging.log4j</groupId>
<artifactId>log4j-slf4j2-impl</artifactId>
<version>${log4j2.version}</version>
</dependency>
<dependency>
<groupId>org.apache.logging.log4j</groupId>
<artifactId>log4j-core</artifactId>
<version>${log4j2.version}</version>
</dependency>
<dependency>
<groupId>org.apache.logging.log4j</groupId>
<artifactId>log4j-api</artifactId>
<version>${log4j2.version}</version>
</dependency>
Comment on lines 43 to 58
Copy link
Copy Markdown

@gemini-code-assist gemini-code-assist bot Mar 31, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

medium

The versions for SLF4J and Log4j dependencies have been removed to rely on odlparent management. However, the properties slf4j.version and log4j2.version (defined at lines 32-33) are still present and used in the spotbugs-maven-plugin configuration (lines 222, 227). This creates a risk of version mismatch between the main project dependencies and the plugin's dependencies.

To ensure consistency, consider removing the explicit versions from the SpotBugs plugin dependencies as well (allowing them to be managed by the same BOM) and then removing these properties if they are no longer needed elsewhere.

References
  1. Dependency versions should be managed consistently across the project to avoid classpath conflicts and version drift between main code and build tools.

<dependency>
<groupId>io.lighty.resources</groupId>
Expand All @@ -78,12 +74,10 @@
<plugin>
<groupId>org.apache.maven.plugins</groupId>
<artifactId>maven-compiler-plugin</artifactId>
<version>3.15.0</version>
</plugin>
<plugin>
<groupId>org.apache.maven.plugins</groupId>
<artifactId>maven-clean-plugin</artifactId>
<version>3.5.0</version>
</plugin>
Comment on lines 74 to 81
Copy link
Copy Markdown

@gemini-code-assist gemini-code-assist bot Mar 31, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

high

Removing the versions for maven-compiler-plugin and maven-clean-plugin from pluginManagement requires that these versions are managed by a parent POM. However, lighty-parent inherits from lighty-minimal-parent, which does not inherit from odlparent (it only imports it for dependency management). Since pluginManagement is not inherited via BOM imports (scope=import), these plugins will now have unmanaged versions.

Additionally, this change is inconsistent with other plugins in the same section (e.g., maven-resources-plugin at line 84 and maven-jar-plugin at line 89) which still have explicit versions despite also being managed by odlparent.

If the goal is to use odlparent's plugin versions, lighty-minimal-parent should be updated to inherit from it; otherwise, these explicit versions should be retained to ensure build stability.

References
  1. Plugin versions should be managed either explicitly or via inheritance from a parent POM to ensure build reproducibility and avoid reliance on Maven defaults.

<plugin>
<groupId>org.apache.maven.plugins</groupId>
Expand Down
1 change: 0 additions & 1 deletion lighty-examples/lighty-controller-springboot-netconf/pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -102,7 +102,6 @@
<plugin>
<groupId>org.jacoco</groupId>
<artifactId>jacoco-maven-plugin</artifactId>
<version>0.8.14</version>
<executions>
<execution>
<id>jacoco-prepare-agent</id>
Expand Down
Loading