Discontinue used of `io.spring.dependency-management`, use Gradle's BOM support instead

[candrews]

The io.spring.dependency-management Gradle plugin performs dependency management, specifically with regards to BOM importing. Gradle 5.0 added BOM importing. Spring Boot requires Gradle 5.6 or later. Therefore, I think Spring Boot's documentation and Spring Initializr should be updated to use Gradle's built in functionality and stop recommending the use of the io.spring.dependency-management plugin.

Here's an example build.gradle from Initializr today:

plugins {
	id 'org.springframework.boot' version '2.3.0.RELEASE'
	id 'io.spring.dependency-management' version '1.0.9.RELEASE'
	id 'java'
}

group = 'com.example'
version = '0.0.1-SNAPSHOT'
sourceCompatibility = '1.8'

repositories {
	mavenCentral()
}

dependencies {
	implementation 'org.springframework.boot:spring-boot-starter'
	testImplementation('org.springframework.boot:spring-boot-starter-test') {
		exclude group: 'org.junit.vintage', module: 'junit-vintage-engine'
	}
}

test {
	useJUnitPlatform()
}

I recommend it be changed to look like this:

plugins {
	id 'org.springframework.boot' version '2.3.0.RELEASE'
	id 'java'
}

group = 'com.example'
version = '0.0.1-SNAPSHOT'
sourceCompatibility = '1.8'

repositories {
	bom
	annotationProcessor {
		extendsFrom bom
	}
	implementation {
		extendsFrom bom
	}
	mavenCentral()
}

dependencies {
	bom platform(org.springframework.boot.gradle.plugin.SpringBootPlugin.BOM_COORDINATES)
	implementation 'org.springframework.boot:spring-boot-starter'
	testImplementation('org.springframework.boot:spring-boot-starter-test') {
		exclude group: 'org.junit.vintage', module: 'junit-vintage-engine'
	}
}

test {
	useJUnitPlatform()
}

and Spring Boot documentation updated as well.

Relevant Stack Overflow discussion

Advantages of this change include:

• No more need to dedicate resources to the io.spring.dependency-management project
• Closer to standard/typical Gradle builds, reducing the learning curve for users

[wilkinsona]

Thanks for the suggestion.

From a Spring Boot perspective this is a duplicate of #21570. While our long term goal is to no longer have to maintain the dependency management plugin, until Gradle supports an equivalent of the version property overrides that are possible with the dependency management plugin (and with Maven) we won’t be able to do so. It’s likely that #21570 will result in us documenting both approaches, their pros and cons, and leaving it to users to decide which to use.

[candrews]

until Gradle supports an equivalent of the version property overrides that are possible with the dependency management plugin (and with Maven) we won’t be able to do so.

Can you elaborate on what is missing in Gradle? I'd like to better understand so I can make the appropriate decision on an approach my projects. Also, is there an feature request in a Gradle issue tracker that I can follow?

[wilkinsona]

spring-boot-dependencies provides properties to control the versions that it manages. The values of these properties can be overridden to tune Boot’s dependency management to your project’s needs. There’s some more information about this in Boot’s Gradle plugin’s documentation. An override can be configured in a single line, for example:

ext['slf4j.version'] = '1.7.20'

There’s no equivalent in Gradle that’s as concise as this, particularly when the property manages multiple dependencies split across different group IDs.

We’ve talked off and on about this with @ljacomet and @melix over the last several months. They have a few ideas about things that could be done in Gradle, but, AIUI, there’s no low-hanging fruit and none of them is particularly easy to implement. I’m not sure if things have crystallised to the point where there’s an issue tracking it.