Closed jcoleman0redhat0com closed 10 years ago
Is that overrideTransitive ?
That would require knowing the full dependency graph up front so you can figure out what to inject...which is complicated further by the need to understand how those injected managed dependencies will affect the dependency graph (possibly bringing in other things that would need to be managed, or excluding things that would have been managed otherwise).
I think that is would be very complex to do. Possibly with this plugin we could ensure all projects list their direct dependencies and then we don't have to inject transitive dependencies which would make a much smaller change?
that plugin enforces a convention we try to encourage in maven, which is: If you import a class, you should have its artifact in a direct dependency. Of course, the chain of dependent classes from each import you specify in your codebase can be large, and according to this convention, could be in transitive dependencies.
I don't think it'd flatten your dependency graph enough to completely remove risk of the wrong dep version creeping in...but I'm not sure.
After speaking to @jcoleman0redhat0com he is happy for this to be closed.
If a project contains only a subset of the dependencies contained within the BOM, it would be nice to restrict the alterations to the project POM file(s) to only those dependencies in the transitive tree for the project, and not to include all of the dependencies in the BOM.