Missing dependency versions in POM when using BOM

Help/Discuss
1

I currently have an Android library project where there is a module called ‘bom’ defining the dependency versions used in the rest of the project:

plugins {
    id("java-platform")
}

javaPlatform {
    allowDependencies()
}

dependencies {
    constraints {
        val kotlinxSerializationVersion: String by project
        api("org.jetbrains.kotlinx:kotlinx-serialization-json:$kotlinxSerializationVersion")
        api("org.jetbrains.kotlinx:kotlinx-serialization-core:$kotlinxSerializationVersion")

        ...
    }
}

In another module, which is the library module it self, this ‘bom’ module is then imported and used to enforce versions across modules

dependencies {
    implementation(enforcedPlatform(project(":bom")))

    implementation("org.jetbrains.kotlinx:kotlinx-serialization-json")
    implementation("org.jetbrains.kotlinx:kotlinx-serialization-core")

    ...
}

And this functions without issue when running locally. However, when looking into publishing the project to maven I’ve noticed that when constructing the POM for the module that is being published, that all of its version information is missing.

publishing {
    repositories {
        mavenLocal()
    }
    publications {
        create<MavenPublication>("maven") {
            
            ....

            pom.withXml {
                val dependenciesNode = asNode().appendNode("dependencies")
                configurations.getByName("implementation") {
                    dependencies.forEach {
                        val dependencyNode = dependenciesNode.appendNode("dependency")
                        dependencyNode.appendNode("groupId", it.group)
                        dependencyNode.appendNode("artifactId", it.name)
                        dependencyNode.appendNode("version", it.version)
                    }
                }
            }
        }
    }
}

This results in the following POM

...
<dependencies>
    <dependency>
      <groupId>library</groupId>
      <artifactId>bom</artifactId>
      <version>null</version>
    </dependency>
    <dependency>
      <groupId>org.jetbrains.kotlinx</groupId>
      <artifactId>kotlinx-serialization-json</artifactId>
      <version>null</version>
    </dependency>
    <dependency>
      <groupId>org.jetbrains.kotlinx</groupId>
      <artifactId>kotlinx-serialization-core</artifactId>
      <version>null</version>
    </dependency>
....

Is there anyway to retrieve the versions for the dependencies that a particular module is using when publishing when they are defined in a ‘bom’ in this way? And if not, can the module still somehow be published with this setup (or would another setup be needed)?

2

You can publish the java component in the publication and it should already create all the necessary dependencies in the pom. Is there a reason you cannot use that or want to generate the pom dependencies yourself?
ie

create<MavenPublication>("maven") {
    from(components["java"])
}
3

As this is an Android library project I seem to be unable to use the from(components["java]) method (‘components’ is empty) and that is why I am doing the pom generation manually.

That may simply be the wrong way of going about it, but it is surprisingly difficult to get clear information on how to deal with the intricacies of publishing an Android library through Gradle.

However, if I were able to use the way you suggested, wouldn’t the generated POM simply contain a reference to the BOM module that I am using to enforce dependency versions from? And as that BOM hasn’t been pulished, I would again have a issue with how to deal with publishing when using a BOM.

For clarification, my project structure is as follows:

library-project-root
    |-- bom (module)
            - build.gradle.kts (java platform)
            - gradle.properties (contains version numbers)
    |-- library (module)
            - build.gradle.kts (imports 'bom' with 'enforceplatform')
            |-- rest of the library code
    |-- sample (module)
            - build.gradle.kts (imports 'bom' with 'enforcedplatform', imports 'library' )
            |-- rest of the sample code

I use the bom module to share dependency versions between the modules, but will only publish the library module to Maven. The sample module is left behind.

My hope was that I would somehow be able to “fold” the dependency information stored in the bom module into the pom created for the library module and thus not have to publish the bom module first to Maven and reference it by version in the library module pom.

Any help with this would be greatly appreciated.

4

Some progress has been made.

I didn’t realize that the components are only created after evaluate, but according to information found in the official Android documentation for using the maven publishing plugin, the trick is to simply wrap the publishing block in a afterEvaluate block.

So now the POM is automatically generated, during publishing:

afterEvaluate {
    publishing {
        repositories {
            mavenLocal()
        }
        publications{
            create<MavenPublication>("release") {
                from(components["release"])
            }
        }
}

After being pointed to the ability to set a version resolving strategy (by @t_broyer) I’m now looking into if that will be the last puzzle piece I need to achieve what I am looking for.

5

I’ve gone with an alltogether different setup, after being pointed towards some previous discussions on dependency managment.

The BOM module has been removed in favor of using the version catalogs feature instead:

//settings.gradle.kts

// The dependency resolution management feature used below is
// currently an incubating feature and needs to be opted into
enableFeaturePreview("VERSION_CATALOGS")

dependencyResolutionManagement {
    versionCatalogs {
        create("catalog") {
              val kotlinxSerializationVersion: String by settings
              val kotlinSerialization = version("kotlinx-serialization", kotlinxSerializationVersion)
              alias("kotlinx-serialization-json")
                .to("org.jetbrains.kotlinx", "kotlinx-serialization-json")
                .versionRef(kotlinSerialization)
              alias("kotlinx-serialization-core")
                .to("org.jetbrains.kotlinx", "kotlinx-serialization-core")
                .versionRef(kotlinSerialization)
              ....

Not only is this a solution to the POM geneation issue (the versions now show up in the generated POM) but using it in the scripts feels “correct”.