Skip to content

Commit 7b02aa2

Browse files
javier-aliagajavier-aliaga
committed
feat: publish dapr-sdk-bom artifact for transitive dependency management (dapr#1722)
* feat: add dapr-sdk-bom module for dependency version management (dapr#1720) Standalone BOM (no parent inheritance) so consumers only get Dapr SDK artifact versions and security-critical transitive dependency overrides without inheriting the parent's 1500+ internal managed dependencies. Includes all published io.dapr and io.dapr.spring modules, plus security overrides for netty-bom (CVE-2026-33870/33871), jackson-bom, commons-compress, and commons-codec. Closes dapr#1720 Signed-off-by: Javier Aliaga <javier@aliaga.dev> Signed-off-by: Javier Aliaga <javier@diagrid.io> * docs: add BOM usage instructions to README (dapr#1720) Document dapr-sdk-bom as the recommended way to import the SDK, with version-free dependency declarations for both Maven and Gradle. Keep the manual version approach as an alternative. Signed-off-by: Javier Aliaga <javier@aliaga.dev> Signed-off-by: Javier Aliaga <javier@diagrid.io> * fix: update version script to handle standalone BOM (dapr#1720) The BOM has no parent, so mvn versions:set skips it during the reactor walk. Add explicit -f sdk-bom/pom.xml calls to update both the artifact version and dapr.sdk.version property. Signed-off-by: Javier Aliaga <javier@aliaga.dev> Signed-off-by: Javier Aliaga <javier@diagrid.io> * fix: add deploy and signing config to standalone BOM (dapr#1720) The BOM has no parent so it doesn't inherit distributionManagement, nexus-staging-maven-plugin, or maven-gpg-plugin from the root POM. Without these the publish step would fail to stage and sign the artifact for Maven Central. Signed-off-by: Javier Aliaga <javier@aliaga.dev> Signed-off-by: Javier Aliaga <javier@diagrid.io> * fix: skip site generation for standalone BOM (dapr#1720) The BOM has no parent, so it picks up maven-site-plugin 3.3 from Maven's defaults instead of 3.12.1 from pluginManagement. Pin the version and skip site since a POM-only BOM has no content to render. Signed-off-by: Javier Aliaga <javier@aliaga.dev> Signed-off-by: Javier Aliaga <javier@diagrid.io> * refactor: split BOM into core and Spring BOMs (dapr#1720) Per review feedback from @siri-varma, split the single BOM into two: - io.dapr:dapr-sdk-bom — core SDK modules (dapr-sdk, dapr-sdk-actors, dapr-sdk-workflows, dapr-sdk-autogen, durabletask-client, testcontainers-dapr) plus security overrides - io.dapr.spring:dapr-spring-bom — Spring-specific modules (dapr-sdk-springboot, dapr-spring-*). Imports dapr-sdk-bom so Spring users only need this single BOM. This keeps the core BOM lightweight for non-Spring users, while letting Spring users align naturally with their existing dependency management. Also updates the version script and README to cover both BOMs. Signed-off-by: Javier Aliaga <javier@aliaga.dev> Signed-off-by: Javier Aliaga <javier@diagrid.io> --------- Signed-off-by: Javier Aliaga <javier@aliaga.dev> Signed-off-by: Javier Aliaga <javier@diagrid.io>
1 parent 48d7007 commit 7b02aa2

6 files changed

Lines changed: 472 additions & 16 deletions

File tree

‎.github/scripts/update_sdk_version.sh‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -12,6 +12,11 @@ mvn versions:set -DnewVersion=$DAPR_JAVA_SDK_VERSION -DprocessDependencies=true
1212
mvn versions:set-property -Dproperty=dapr.sdk.alpha.version -DnewVersion=$DAPR_JAVA_SDK_ALPHA_VERSION
1313
mvn versions:set-property -Dproperty=dapr.sdk.version -DnewVersion=$DAPR_JAVA_SDK_VERSION
1414
mvn versions:set-property -Dproperty=dapr.sdk.version -DnewVersion=$DAPR_JAVA_SDK_VERSION -f sdk-tests/pom.xml
15+
# BOMs are standalone (no parent), so versions:set skips them — update explicitly.
16+
mvn versions:set -DnewVersion=$DAPR_JAVA_SDK_VERSION -f sdk-bom/pom.xml
17+
mvn versions:set-property -Dproperty=dapr.sdk.version -DnewVersion=$DAPR_JAVA_SDK_VERSION -f sdk-bom/pom.xml
18+
mvn versions:set -DnewVersion=$DAPR_JAVA_SDK_VERSION -f dapr-spring/dapr-spring-bom/pom.xml
19+
mvn versions:set-property -Dproperty=dapr.sdk.version -DnewVersion=$DAPR_JAVA_SDK_VERSION -f dapr-spring/dapr-spring-bom/pom.xml
1520
mvn versions:set-property -Dproperty=dapr.sdk.alpha.version -DnewVersion=$DAPR_JAVA_SDK_ALPHA_VERSION -f sdk-tests/pom.xml
1621

1722

‎README.md‎

Lines changed: 112 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -59,47 +59,143 @@ For the full list of available APIs, see the [Dapr API reference](https://docs.d
5959
If using [SDKMAN!](https://sdkman.io), execute `sdk env install` to install the required JDK.
6060

6161
### Importing Dapr's Java SDK
62-
For a Maven project, add the following to your `pom.xml` file:
62+
63+
#### Using a BOM (recommended)
64+
65+
Two BOMs are published:
66+
67+
- **`io.dapr:dapr-sdk-bom`** — core SDK modules (`dapr-sdk`, `dapr-sdk-actors`, `dapr-sdk-workflows`, `dapr-sdk-autogen`, `durabletask-client`, `testcontainers-dapr`) plus security-patched transitive dependencies (Netty, Jackson, commons-compress, commons-codec).
68+
- **`io.dapr.spring:dapr-spring-bom`** — Spring-specific modules (`dapr-sdk-springboot`, `dapr-spring-*`). Imports `dapr-sdk-bom` transitively, so Spring users only need this single BOM.
69+
70+
Pick the one that matches your project. Importing a BOM ensures you inherit security fixes for transitive dependencies like the Netty CVEs.
71+
72+
##### Core (non-Spring) projects
73+
74+
For Maven:
6375
```xml
6476
<project>
6577
...
78+
<dependencyManagement>
79+
<dependencies>
80+
<dependency>
81+
<groupId>io.dapr</groupId>
82+
<artifactId>dapr-sdk-bom</artifactId>
83+
<version>1.18.0</version>
84+
<type>pom</type>
85+
<scope>import</scope>
86+
</dependency>
87+
</dependencies>
88+
</dependencyManagement>
89+
6690
<dependencies>
67-
...
68-
<!-- Dapr's core SDK with all features, except Actors. -->
91+
<!-- Dapr's core SDK with all features, except Actors. -->
6992
<dependency>
7093
<groupId>io.dapr</groupId>
7194
<artifactId>dapr-sdk</artifactId>
72-
<version>1.17.2</version>
7395
</dependency>
7496
<!-- Dapr's SDK for Actors (optional). -->
7597
<dependency>
7698
<groupId>io.dapr</groupId>
7799
<artifactId>dapr-sdk-actors</artifactId>
78-
<version>1.17.2</version>
79100
</dependency>
80-
<!-- Dapr's SDK integration with SpringBoot (optional). -->
101+
</dependencies>
102+
...
103+
</project>
104+
```
105+
106+
For Gradle:
107+
```groovy
108+
dependencies {
109+
implementation platform('io.dapr:dapr-sdk-bom:1.18.0')
110+
111+
// Dapr's core SDK with all features, except Actors.
112+
implementation 'io.dapr:dapr-sdk'
113+
// Dapr's SDK for Actors (optional).
114+
implementation 'io.dapr:dapr-sdk-actors'
115+
}
116+
```
117+
118+
##### Spring Boot projects
119+
120+
For Maven:
121+
```xml
122+
<project>
123+
...
124+
<dependencyManagement>
125+
<dependencies>
126+
<dependency>
127+
<groupId>io.dapr.spring</groupId>
128+
<artifactId>dapr-spring-bom</artifactId>
129+
<version>1.18.0</version>
130+
<type>pom</type>
131+
<scope>import</scope>
132+
</dependency>
133+
</dependencies>
134+
</dependencyManagement>
135+
136+
<dependencies>
137+
<!-- Dapr's SDK integration with Spring Boot. -->
81138
<dependency>
82139
<groupId>io.dapr</groupId>
83140
<artifactId>dapr-sdk-springboot</artifactId>
84-
<version>1.17.2</version>
85141
</dependency>
86-
...
142+
<!-- Optional Spring Boot starter. -->
143+
<dependency>
144+
<groupId>io.dapr.spring</groupId>
145+
<artifactId>dapr-spring-boot-starter</artifactId>
146+
</dependency>
87147
</dependencies>
88148
...
89149
</project>
90150
```
91151

92-
For a Gradle project, add the following to your `build.gradle` file:
152+
For Gradle:
153+
```groovy
154+
dependencies {
155+
implementation platform('io.dapr.spring:dapr-spring-bom:1.18.0')
93156
157+
// Dapr's SDK integration with Spring Boot.
158+
implementation 'io.dapr:dapr-sdk-springboot'
159+
// Optional Spring Boot starter.
160+
implementation 'io.dapr.spring:dapr-spring-boot-starter'
161+
}
94162
```
163+
164+
#### Without the BOM
165+
166+
If you prefer to manage versions manually, specify the version on each dependency:
167+
168+
For Maven:
169+
```xml
170+
<project>
171+
...
172+
<dependencies>
173+
<dependency>
174+
<groupId>io.dapr</groupId>
175+
<artifactId>dapr-sdk</artifactId>
176+
<version>1.17.2</version>
177+
</dependency>
178+
<dependency>
179+
<groupId>io.dapr</groupId>
180+
<artifactId>dapr-sdk-actors</artifactId>
181+
<version>1.17.2</version>
182+
</dependency>
183+
<dependency>
184+
<groupId>io.dapr</groupId>
185+
<artifactId>dapr-sdk-springboot</artifactId>
186+
<version>1.17.2</version>
187+
</dependency>
188+
</dependencies>
189+
...
190+
</project>
191+
```
192+
193+
For Gradle:
194+
```groovy
95195
dependencies {
96-
...
97-
// Dapr's core SDK with all features, except Actors.
98-
compile('io.dapr:dapr-sdk:1.17.2')
99-
// Dapr's SDK for Actors (optional).
100-
compile('io.dapr:dapr-sdk-actors:1.17.2')
101-
// Dapr's SDK integration with SpringBoot (optional).
102-
compile('io.dapr:dapr-sdk-springboot:1.17.2')
196+
implementation 'io.dapr:dapr-sdk:1.17.2'
197+
implementation 'io.dapr:dapr-sdk-actors:1.17.2'
198+
implementation 'io.dapr:dapr-sdk-springboot:1.17.2'
103199
}
104200
```
105201

‎dapr-spring/dapr-spring-bom/pom.xml‎

Lines changed: 185 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,185 @@
1+
<project
2+
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
3+
xmlns="http://maven.apache.org/POM/4.0.0"
4+
xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd">
5+
<modelVersion>4.0.0</modelVersion>
6+
7+
<groupId>io.dapr.spring</groupId>
8+
<artifactId>dapr-spring-bom</artifactId>
9+
<version>1.18.0-SNAPSHOT</version>
10+
<packaging>pom</packaging>
11+
<name>dapr-spring-bom</name>
12+
<description>Dapr Spring Bill of Materials (BOM). Import this POM to manage versions
13+
of dapr-sdk-springboot and all dapr-spring-* modules. Imports dapr-sdk-bom
14+
transitively, so Spring users only need this single BOM.</description>
15+
<url>https://dapr.io</url>
16+
17+
<licenses>
18+
<license>
19+
<name>Apache License Version 2.0</name>
20+
<url>https://opensource.org/licenses/Apache-2.0</url>
21+
</license>
22+
</licenses>
23+
24+
<developers>
25+
<developer>
26+
<name>Dapr</name>
27+
<email>daprweb@microsoft.com</email>
28+
<organization>Dapr</organization>
29+
<organizationUrl>https://dapr.io</organizationUrl>
30+
</developer>
31+
</developers>
32+
33+
<scm>
34+
<url>https://github.com/dapr/java-sdk</url>
35+
<connection>scm:git:https://github.com/dapr/java-sdk.git</connection>
36+
<tag>HEAD</tag>
37+
</scm>
38+
39+
<distributionManagement>
40+
<snapshotRepository>
41+
<id>ossrh</id>
42+
<url>https://central.sonatype.com/repository/maven-snapshots/</url>
43+
</snapshotRepository>
44+
</distributionManagement>
45+
46+
<properties>
47+
<gpg.skip>true</gpg.skip>
48+
<dapr.sdk.version>1.18.0-SNAPSHOT</dapr.sdk.version>
49+
</properties>
50+
51+
<build>
52+
<plugins>
53+
<plugin>
54+
<groupId>org.apache.maven.plugins</groupId>
55+
<artifactId>maven-site-plugin</artifactId>
56+
<version>3.12.1</version>
57+
<configuration>
58+
<skip>true</skip>
59+
</configuration>
60+
</plugin>
61+
<plugin>
62+
<groupId>org.sonatype.plugins</groupId>
63+
<artifactId>nexus-staging-maven-plugin</artifactId>
64+
<version>1.7.0</version>
65+
<extensions>true</extensions>
66+
<configuration>
67+
<serverId>ossrh</serverId>
68+
<nexusUrl>https://ossrh-staging-api.central.sonatype.com</nexusUrl>
69+
<autoReleaseAfterClose>true</autoReleaseAfterClose>
70+
</configuration>
71+
</plugin>
72+
<plugin>
73+
<groupId>org.apache.maven.plugins</groupId>
74+
<artifactId>maven-gpg-plugin</artifactId>
75+
<version>3.1.0</version>
76+
<executions>
77+
<execution>
78+
<id>sign-artifacts</id>
79+
<phase>verify</phase>
80+
<goals>
81+
<goal>sign</goal>
82+
</goals>
83+
<configuration>
84+
<gpgArguments>
85+
<arg>--batch</arg>
86+
<arg>--pinentry-mode</arg>
87+
<arg>loopback</arg>
88+
</gpgArguments>
89+
</configuration>
90+
</execution>
91+
</executions>
92+
</plugin>
93+
</plugins>
94+
</build>
95+
96+
<dependencyManagement>
97+
<dependencies>
98+
<!-- ====================================================================== -->
99+
<!-- Import the core Dapr SDK BOM so Spring users get all SDK modules -->
100+
<!-- and security overrides via this single BOM. -->
101+
<!-- ====================================================================== -->
102+
<dependency>
103+
<groupId>io.dapr</groupId>
104+
<artifactId>dapr-sdk-bom</artifactId>
105+
<version>${dapr.sdk.version}</version>
106+
<type>pom</type>
107+
<scope>import</scope>
108+
</dependency>
109+
110+
<!-- ====================================================================== -->
111+
<!-- Spring integration module (groupId io.dapr) -->
112+
<!-- ====================================================================== -->
113+
<dependency>
114+
<groupId>io.dapr</groupId>
115+
<artifactId>dapr-sdk-springboot</artifactId>
116+
<version>${dapr.sdk.version}</version>
117+
</dependency>
118+
119+
<!-- ====================================================================== -->
120+
<!-- Dapr Spring modules (groupId io.dapr.spring) -->
121+
<!-- ====================================================================== -->
122+
<dependency>
123+
<groupId>io.dapr.spring</groupId>
124+
<artifactId>dapr-spring-data</artifactId>
125+
<version>${dapr.sdk.version}</version>
126+
</dependency>
127+
<dependency>
128+
<groupId>io.dapr.spring</groupId>
129+
<artifactId>dapr-spring-6-data</artifactId>
130+
<version>${dapr.sdk.version}</version>
131+
</dependency>
132+
<dependency>
133+
<groupId>io.dapr.spring</groupId>
134+
<artifactId>dapr-spring-messaging</artifactId>
135+
<version>${dapr.sdk.version}</version>
136+
</dependency>
137+
<dependency>
138+
<groupId>io.dapr.spring</groupId>
139+
<artifactId>dapr-spring-workflows</artifactId>
140+
<version>${dapr.sdk.version}</version>
141+
</dependency>
142+
<dependency>
143+
<groupId>io.dapr.spring</groupId>
144+
<artifactId>dapr-spring-boot-properties</artifactId>
145+
<version>${dapr.sdk.version}</version>
146+
</dependency>
147+
<dependency>
148+
<groupId>io.dapr.spring</groupId>
149+
<artifactId>dapr-spring-boot-autoconfigure</artifactId>
150+
<version>${dapr.sdk.version}</version>
151+
</dependency>
152+
<dependency>
153+
<groupId>io.dapr.spring</groupId>
154+
<artifactId>dapr-spring-boot-4-autoconfigure</artifactId>
155+
<version>${dapr.sdk.version}</version>
156+
</dependency>
157+
<dependency>
158+
<groupId>io.dapr.spring</groupId>
159+
<artifactId>dapr-spring-boot-tests</artifactId>
160+
<version>${dapr.sdk.version}</version>
161+
</dependency>
162+
<dependency>
163+
<groupId>io.dapr.spring</groupId>
164+
<artifactId>dapr-spring-boot-starter</artifactId>
165+
<version>${dapr.sdk.version}</version>
166+
</dependency>
167+
<dependency>
168+
<groupId>io.dapr.spring</groupId>
169+
<artifactId>dapr-spring-boot-4-starter</artifactId>
170+
<version>${dapr.sdk.version}</version>
171+
</dependency>
172+
<dependency>
173+
<groupId>io.dapr.spring</groupId>
174+
<artifactId>dapr-spring-boot-starter-test</artifactId>
175+
<version>${dapr.sdk.version}</version>
176+
</dependency>
177+
<dependency>
178+
<groupId>io.dapr.spring</groupId>
179+
<artifactId>dapr-spring-boot-4-starter-test</artifactId>
180+
<version>${dapr.sdk.version}</version>
181+
</dependency>
182+
</dependencies>
183+
</dependencyManagement>
184+
185+
</project>

‎dapr-spring/pom.xml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -18,6 +18,7 @@
1818
<description>SDK extension for Spring and Spring Boot</description>
1919

2020
<modules>
21+
<module>dapr-spring-bom</module>
2122
<module>dapr-spring-data</module>
2223
<module>dapr-spring-6-data</module>
2324
<module>dapr-spring-messaging</module>

‎pom.xml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -727,6 +727,7 @@
727727
</scm>
728728

729729
<modules>
730+
<module>sdk-bom</module>
730731
<module>sdk-autogen</module>
731732
<module>sdk</module>
732733
<module>sdk-actors</module>

0 commit comments

Comments
 (0)