Wrong elasticsearch-java dependency in 5.2.0

[EugenMayer]

Using 5.2.0 gradle resolves co.elastic.clients:elasticsearch-java to 8.10.4.

This 'some what' corresponds to #2729 which is also named in the changelog https://github.com/spring-projects/spring-data-elasticsearch/releases/tag/5.2.0 as
Upgrade to Elasticsearch REST Client 8.10.3 https://github.com/spring-projects/spring-data-elasticsearch/issues/2729

(it should have been 8.10.4 in the changelogs though).

Still, nexus reports 8.11.1 - https://mvnrepository.com/artifact/org.springframework.data/spring-data-elasticsearch/5.2.0
which is no suprise, since for the tag 5.2.0 in this repo we find https://github.com/spring-projects/spring-data-elasticsearch/blob/5.2.0/pom.xml#L24

So it should be 8.11.0.

In the end, when upgrading to 5.2.0 one will find an exception:

Since the 8.10.4 is not compatible with 5.2.0. One would need to override the dependency vai

co.elastic.clients:elasticsearch-java:8.11.1

---

If you find the above confusing, the reason is rather, it is confusing or a little mess. It seems like Changelog, Implementation and BOM are fairly out of sync, most probably due to a last minute upgrade of the elasticsearch-java library to 8.11.1 via d25fd52

[sothawo]

Spring Data Elasticsearch does not use gradle, so I don't know about the setup where you gradle project resolves to 8.10.4.

Spring Data Elasticsearch 5.2.0 is built against Elasticsearch 8.11.1 (issue #2762, PR #2763 on 15.11.2023).
Both mvnrepository and sonatype show that.

Why this update is not in the release notes I can't say, they are made by the Spring team doing the release.

So there is no wrong dependency Spring Data Elasticsearch, we define the Elasticsearch version we depend on and that's version 8.11.1 for Sde 5.2.0

[kaismh]

I am using maven and had the same exact issue, the problem is not related to spring-data-elasticsearch, the 8.10.4 dependency comes from spring-boot-starter-parent version 3.2.0

@EugenMayer one solution is to override elasticsearch-client.version property in pom.xml, ex:

<properties> <elasticsearch-client.version>8.11.1</elasticsearch-client.version> </properties>

[EugenMayer]

@kaismh did that before i opened the ticket and yes, just did not know which BOM was responsible, recently found it is of SB and that is what it makes it entirely surprising, considering what you expect from SDE to define. I see there is a compat matrix of SDE just because of that, basically SDE depends on SB's bom just because of the elasticsearch library version - a problem in itself.

For the 8.11.2 update SDE now needs to wait for SB 3.x.x (see 8a3df63).

Considering how aligned SDE needs to be to the elasticsearch lib, i really ask myself how it ended up to be managed in an external BOM in the first place.

[sothawo]

SDE does not depend on SB or it's BOM. All the dependencies that SDE depends on are defined in SDE's pom.xml or in the parent project spring-data-common (which doesn't depend on SB either).

For the 8.11.2 update SDE now needs to wait for SB 3.x.x

No. SDE updates to a new Elasticsearch version when it's available, SB needs to align to that.

SB maintains an ES version in their BOM, because they not only support SDE but a plain ES integration as well and normally check their dependencies just before releasing. I more than once got a notice that I should upgrade the ES dependency of SDE just a day before the release. It seems that this time they didn't use the current version of ES in their BOM when releasing.

The SB version shown in the versions table shows which version of SB uses which version of Spring Data Elasticsearch. I updated the documentation in the main branch to make that clearer.

[kaismh]

@sothawo thanks for your explanation, If I am only using elastic via spring-data-elastic any downside for overriding elasticsearch-client.version?

[sothawo]

I don't see any.