Publish a BOM

[jaredsburrows]

Summary

Request to add a Bill of Materials (BOM) to the Moshi project similar to what's provided in Retrofit, OkHttp, and OkIO. This would simplify dependency version management and reduce maintenance overhead for downstream projects.

Motivation

• Consistency: Keeps all Moshi modules (core, adapters, kotlin, etc.) on the same version automatically.
• Ease of Upgrades: Reduces the number of Dependabot/Renovate PRs triggered by Moshi version bumps.
• Parity with Other Square Libraries: Retrofit, OkHttp, and OkIO already offer BOMs that standardize version alignment across modules.
• Modern Gradle Support: Gradle's version catalogs (libs.versions.toml) and Maven dependency management both support BOM imports natively.

Example (Current vs Ideal)

Current:

[versions]
moshi = "1.15.2"

[libraries]
squareup-moshi = { module = "com.squareup.moshi:moshi", version.ref = "moshi" }
squareup-moshi-adapters = { module = "com.squareup.moshi:moshi-adapters", version.ref = "moshi" }
squareup-moshi-kotlin = { module = "com.squareup.moshi:moshi-kotlin-codegen", version.ref = "moshi" }

Ideal:

[versions]
moshi = "1.15.2"

[libraries]
squareup-moshi-bom = { module = "com.squareup.moshi:moshi-bom", version.ref = "moshi" }
squareup-moshi = { module = "com.squareup.moshi:moshi" }
squareup-moshi-adapters = { module = "com.squareup.moshi:moshi-adapters" }
squareup-moshi-kotlin = { module = "com.squareup.moshi:moshi-kotlin-codegen" }

Then in Gradle:

implementation(platform(libs.squareup.moshi.bom))
implementation(libs.squareup.moshi)
implementation(libs.squareup.moshi.adapters)
implementation(libs.squareup.moshi.kotlin)

Suggested Implementation

• Add a new module moshi-bom similar to okhttp-bom:

  • Parent POM defining dependency versions for all Moshi modules.
  • Publish to Maven Central alongside other artifacts.

References

• [OkHttp BOM example](https://github.com/square/okhttp/tree/master/okhttp-bom)
• [Retrofit BOM example](https://github.com/square/retrofit/tree/trunk/retrofit-bom)
• [OkIO BOM example](https://github.com/square/okio/tree/master/okio-bom)

Benefit

This makes dependency management more consistent across all Square libraries and aligns Moshi's release process with the rest of the ecosystem.

[JakeWharton]

BOMs are for Maven. With Gradle we can add constraints so this happens entirely transparently and without the added verbosity.