Skip to content

Commit db140d3

Browse files
javier-aliagajavier-aliaga
committed
feat: add dapr-sdk-bom module for dependency version management (#1720)
Standalone BOM (no parent inheritance) so consumers only get Dapr SDK artifact versions and security-critical transitive dependency overrides without inheriting the parent's 1500+ internal managed dependencies. Includes all published io.dapr and io.dapr.spring modules, plus security overrides for netty-bom (CVE-2026-33870/33871), jackson-bom, commons-compress, and commons-codec. Closes #1720 Signed-off-by: Javier Aliaga <javier@aliaga.dev> Signed-off-by: Javier Aliaga <javier@diagrid.io>
1 parent 9b80cfc commit db140d3

2 files changed

Lines changed: 183 additions & 0 deletions

File tree

‎pom.xml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -727,6 +727,7 @@
727727
</scm>
728728

729729
<modules>
730+
<module>sdk-bom</module>
730731
<module>sdk-autogen</module>
731732
<module>sdk</module>
732733
<module>sdk-actors</module>

‎sdk-bom/pom.xml‎

Lines changed: 182 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,182 @@
1+
<project
2+
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
3+
xmlns="http://maven.apache.org/POM/4.0.0"
4+
xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd">
5+
<modelVersion>4.0.0</modelVersion>
6+
7+
<groupId>io.dapr</groupId>
8+
<artifactId>dapr-sdk-bom</artifactId>
9+
<version>1.18.0-SNAPSHOT</version>
10+
<packaging>pom</packaging>
11+
<name>dapr-sdk-bom</name>
12+
<description>Dapr SDK Bill of Materials (BOM). Import this POM to manage versions
13+
of all Dapr SDK modules and their security-critical transitive dependencies.</description>
14+
<url>https://dapr.io</url>
15+
16+
<licenses>
17+
<license>
18+
<name>Apache License Version 2.0</name>
19+
<url>https://opensource.org/licenses/Apache-2.0</url>
20+
</license>
21+
</licenses>
22+
23+
<developers>
24+
<developer>
25+
<name>Dapr</name>
26+
<email>daprweb@microsoft.com</email>
27+
<organization>Dapr</organization>
28+
<organizationUrl>https://dapr.io</organizationUrl>
29+
</developer>
30+
</developers>
31+
32+
<scm>
33+
<url>https://github.com/dapr/java-sdk</url>
34+
<connection>scm:git:https://github.com/dapr/java-sdk.git</connection>
35+
<tag>HEAD</tag>
36+
</scm>
37+
38+
<properties>
39+
<dapr.sdk.version>1.18.0-SNAPSHOT</dapr.sdk.version>
40+
<!-- TODO: Remove netty-bom override once gRPC ships with Netty >= 4.1.132 (CVE-2026-33871, CVE-2026-33870) -->
41+
<netty.version>4.1.132.Final</netty.version>
42+
<jackson.version>2.21.2</jackson.version>
43+
<!-- TODO: Remove commons-compress override once testcontainers ships with >= 1.26.0 -->
44+
<commons-compress.version>1.26.0</commons-compress.version>
45+
</properties>
46+
47+
<dependencyManagement>
48+
<dependencies>
49+
<!-- ====================================================================== -->
50+
<!-- Dapr SDK modules -->
51+
<!-- ====================================================================== -->
52+
<dependency>
53+
<groupId>io.dapr</groupId>
54+
<artifactId>dapr-sdk-autogen</artifactId>
55+
<version>${dapr.sdk.version}</version>
56+
</dependency>
57+
<dependency>
58+
<groupId>io.dapr</groupId>
59+
<artifactId>dapr-sdk</artifactId>
60+
<version>${dapr.sdk.version}</version>
61+
</dependency>
62+
<dependency>
63+
<groupId>io.dapr</groupId>
64+
<artifactId>dapr-sdk-actors</artifactId>
65+
<version>${dapr.sdk.version}</version>
66+
</dependency>
67+
<dependency>
68+
<groupId>io.dapr</groupId>
69+
<artifactId>dapr-sdk-workflows</artifactId>
70+
<version>${dapr.sdk.version}</version>
71+
</dependency>
72+
<dependency>
73+
<groupId>io.dapr</groupId>
74+
<artifactId>dapr-sdk-springboot</artifactId>
75+
<version>${dapr.sdk.version}</version>
76+
</dependency>
77+
<dependency>
78+
<groupId>io.dapr</groupId>
79+
<artifactId>testcontainers-dapr</artifactId>
80+
<version>${dapr.sdk.version}</version>
81+
</dependency>
82+
<dependency>
83+
<groupId>io.dapr</groupId>
84+
<artifactId>durabletask-client</artifactId>
85+
<version>${dapr.sdk.version}</version>
86+
</dependency>
87+
88+
<!-- ====================================================================== -->
89+
<!-- Dapr Spring modules -->
90+
<!-- ====================================================================== -->
91+
<dependency>
92+
<groupId>io.dapr.spring</groupId>
93+
<artifactId>dapr-spring-data</artifactId>
94+
<version>${dapr.sdk.version}</version>
95+
</dependency>
96+
<dependency>
97+
<groupId>io.dapr.spring</groupId>
98+
<artifactId>dapr-spring-6-data</artifactId>
99+
<version>${dapr.sdk.version}</version>
100+
</dependency>
101+
<dependency>
102+
<groupId>io.dapr.spring</groupId>
103+
<artifactId>dapr-spring-messaging</artifactId>
104+
<version>${dapr.sdk.version}</version>
105+
</dependency>
106+
<dependency>
107+
<groupId>io.dapr.spring</groupId>
108+
<artifactId>dapr-spring-workflows</artifactId>
109+
<version>${dapr.sdk.version}</version>
110+
</dependency>
111+
<dependency>
112+
<groupId>io.dapr.spring</groupId>
113+
<artifactId>dapr-spring-boot-properties</artifactId>
114+
<version>${dapr.sdk.version}</version>
115+
</dependency>
116+
<dependency>
117+
<groupId>io.dapr.spring</groupId>
118+
<artifactId>dapr-spring-boot-autoconfigure</artifactId>
119+
<version>${dapr.sdk.version}</version>
120+
</dependency>
121+
<dependency>
122+
<groupId>io.dapr.spring</groupId>
123+
<artifactId>dapr-spring-boot-4-autoconfigure</artifactId>
124+
<version>${dapr.sdk.version}</version>
125+
</dependency>
126+
<dependency>
127+
<groupId>io.dapr.spring</groupId>
128+
<artifactId>dapr-spring-boot-tests</artifactId>
129+
<version>${dapr.sdk.version}</version>
130+
</dependency>
131+
<dependency>
132+
<groupId>io.dapr.spring</groupId>
133+
<artifactId>dapr-spring-boot-starter</artifactId>
134+
<version>${dapr.sdk.version}</version>
135+
</dependency>
136+
<dependency>
137+
<groupId>io.dapr.spring</groupId>
138+
<artifactId>dapr-spring-boot-4-starter</artifactId>
139+
<version>${dapr.sdk.version}</version>
140+
</dependency>
141+
<dependency>
142+
<groupId>io.dapr.spring</groupId>
143+
<artifactId>dapr-spring-boot-starter-test</artifactId>
144+
<version>${dapr.sdk.version}</version>
145+
</dependency>
146+
<dependency>
147+
<groupId>io.dapr.spring</groupId>
148+
<artifactId>dapr-spring-boot-4-starter-test</artifactId>
149+
<version>${dapr.sdk.version}</version>
150+
</dependency>
151+
152+
<!-- ====================================================================== -->
153+
<!-- Security overrides - Transitive dependency version fixes for CVEs -->
154+
<!-- ====================================================================== -->
155+
<dependency>
156+
<groupId>io.netty</groupId>
157+
<artifactId>netty-bom</artifactId>
158+
<version>${netty.version}</version>
159+
<type>pom</type>
160+
<scope>import</scope>
161+
</dependency>
162+
<dependency>
163+
<groupId>com.fasterxml.jackson</groupId>
164+
<artifactId>jackson-bom</artifactId>
165+
<version>${jackson.version}</version>
166+
<type>pom</type>
167+
<scope>import</scope>
168+
</dependency>
169+
<dependency>
170+
<groupId>org.apache.commons</groupId>
171+
<artifactId>commons-compress</artifactId>
172+
<version>${commons-compress.version}</version>
173+
</dependency>
174+
<dependency>
175+
<groupId>commons-codec</groupId>
176+
<artifactId>commons-codec</artifactId>
177+
<version>1.17.2</version>
178+
</dependency>
179+
</dependencies>
180+
</dependencyManagement>
181+
182+
</project>

0 commit comments

Comments
 (0)