Aias00 opened a new issue, #7679: URL: https://github.com/apache/shenyu/issues/7679
## Description Enabling `dependencyConvergence` and `requireUpperBoundDeps` (via `maven-enforcer-plugin`, see #6602) surfaces existing dependency drift across the whole reactor. This issue tracks the actual alignment work so those rules can be promoted to hard-fail; it is intentionally split out of #6602, which stays scoped to introducing the plugin + version guardrails. ## Findings Audit on commit `297ac6f849857bd0c2ad368709013e98494b0330` (`2.7.2-SNAPSHOT`): - **191 of 213** reactor projects report dependency-rule violations. - **15** distinct artifact coordinates for `dependencyConvergence`, **36** for `requireUpperBoundDeps` (39 across both rules). - Counts include transitive problems inherited by downstream projects and are **not** 191 independent root causes. ## Known conflicts (starting point) | Artifact | Observed conflict | | --- | --- | | `org.checkerframework:checker-qual` | Caffeine 2.9.3 requests 3.19.0 vs Guava 32.0.0-jre requests 3.33.0 (both rules fail) | | `com.google.errorprone:error_prone_annotations` | Gson 2.13.2 requests 2.41.0 vs Caffeine requests 2.10.0 vs Guava requests 2.18.0 (convergence fails) | | `org.slf4j:slf4j-api` | dependency management resolves 2.0.13 vs OSHI 6.10.0 requests 2.0.17 (upper-bound fails) | Full-reactor framework / BOM alignment (examples): - Spring Context resolves 6.1.10 while a transitive path requests 6.2.19 - Reactor Core resolves 3.6.7 while a transitive path requests 3.7.19 - MCP resolves 0.17.0 while Spring AI 1.1.8 requests 0.18.3 - Others: Jackson, Micrometer, ASM, Guava, OkHttp, Commons IO, Spring LDAP, Elasticsearch ## Plan (staged) 1. Land `dependencyConvergence` + `requireUpperBoundDeps` in **report-only** mode (non-failing) so drift is visible in CI without blocking builds. 2. Align the graph via `<dependencyManagement>` / BOM alignment, module by module. 3. Flip both rules to **hard-fail** (globally, or per-module via `<pluginManagement>` overrides as each module is cleaned). ## Reproduction - Minimal: `./mvnw -B -ntp -pl shenyu-common -am validate` fails with the `shenyu-common` conflicts above. - Whole-reactor inventory (does not stop at first violation): `./mvnw -B -ntp validate -Denforcer.fail=false -Dcheckstyle.skip=true`. Related: #6602 -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
