spring-boot-configuration-metadata leaks enforced dependency constraints into consuming builds

[remal]

A minimal reproducible build.gradle:

apply plugin: 'java'

dependencies {
    testImplementation platform('org.springframework.boot:spring-boot-dependencies:2.5.3')
    constraints {
        testImplementation 'org.mockito:mockito-core:3.11.2'
    }
    
    testImplementation 'org.springframework.boot:spring-boot-properties-migrator'
    testImplementation 'org.mockito:mockito-core'
}

The expected Mockito version in testImplementation configuration is 3.11.2, but I get 3.9.0. However, I can get 3.11.2 version by removing org.springframework.boot:spring-boot-properties-migrator dependency.

 

The bug can be fixed by changing this line:

spring-boot/spring-boot-project/spring-boot-tools/spring-boot-configuration-metadata/build.gradle

Line 10 in 092ac69

api(platform(project(path: ":spring-boot-project:spring-boot-parent")))

... to this one:

    api(platform(project(path: ":spring-boot-project:spring-boot-dependencies")))

 

Let me explain why I think it makes sense to change the current behavior.

1. spring-boot-properties-migrator module depends on spring-boot-configuration-metadata:

   spring-boot/spring-boot-project/spring-boot-properties-migrator/build.gradle

   Line 11 in 60e57f7

   api(project(":spring-boot-project:spring-boot-tools:spring-boot-configuration-metadata"))

2. spring-boot-configuration-metadata module depends on spring-boot-parent platform:

   spring-boot/spring-boot-project/spring-boot-tools/spring-boot-configuration-metadata/build.gradle

   Line 10 in 092ac69

   api(platform(project(path: ":spring-boot-project:spring-boot-parent")))

3. spring-boot-parent platform depends on spring-boot-dependencies enforced platform:

   spring-boot/spring-boot-project/spring-boot-parent/build.gradle

   Line 176 in 092ac69

   api(enforcedPlatform(project(":spring-boot-project:spring-boot-dependencies")))

4. Enforcing spring-boot-dependencies platform makes Gradle prioritize its versions over versions defined in dependencies.constraints { ... }, even if the version in constraints is greater than the version in spring-boot-dependencies.

By making spring-boot-configuration-metadata depend on spring-boot-dependencies instead of spring-boot-parent we'll make Spring versions not enforced, and this will allow changing dependency versions in constraints.

[remal]

For those who's faced this issue: you can fix it by using dependency substitution:

dependencies {
    modules {
        module('org.springframework.boot:spring-boot-parent') {
            replacedBy('org.springframework.boot:spring-boot-dependencies', 'org.springframework.boot:spring-boot-parent enforces versions')
        }
    }
}