Skip to content

build: drop unused spring-boot dependency management entries - #1262

Merged
bengbengbalabalabeng merged 1 commit into
apache:mainfrom
GOODBOY008:build/drop-dead-spring-boot-pins
Oct 26, 2026
Merged

bengbengbalabalabeng merged 1 commit into
apache:mainfrom
GOODBOY008:build/drop-dead-spring-boot-pins

Conversation

@GOODBOY008

Copy link
Copy Markdown
Member

Problem

The root pom.xml manages two Spring Boot artifacts that nothing in the project uses:

<spring-boot-starter-web.version>2.7.18</spring-boot-starter-web.version>
...
<dependency>org.springframework.boot:spring-boot-starter-web</dependency>
<dependency>org.springframework.boot:spring-boot-starter-test</dependency> <!-- test scope -->

Verified on main:

  • no module POM declares either artifact (git grep spring-boot -- '*.xml' hits only the root POM);
  • no Java source references org.springframework.boot (the spring.md docs pages describe downstream Spring integration, not a build dependency);
  • a reactor-wide mvn dependency:tree -Dincludes=org.springframework.boot resolves zero artifacts.

The pins are also stale by policy: Spring Boot 2.7 is EOL, and history shows the entries are dead weight — dependabot's bump of the managed version (#583) was closed unmerged, and the starter-module proposal (#616) was closed too. Until removed, the 2.7.18 pin keeps showing up in dependency scans of every generated POM.

Change

Delete the spring-boot-starter-web.version property and the two dependencyManagement entries. 12 lines removed, nothing else touched. spring-core stays — it is a real dependency (shaded in fesod-shaded).

Notes for reviewers

  • Open PR [Feat] Introduce cli tool #769 (cli tool) re-introduces an examples module that declares spring-boot-starter-test without a version, relying on this management entry. If that PR moves forward it should pin its own version (or propose a fresh, current management entry) rather than depend on an EOL 2.7.18 pin — happy to help rebase it if that lands first.
  • No behavioural or API impact: managed entries with no consumers cannot affect the built artifacts.

Verification

$ ./mvnw -q dependency:tree -Dincludes=org.springframework.boot   # no artifacts resolved
$ ./mvnw -DskipTests package
BUILD SUCCESS

Full reactor builds green with the entries removed.

Copilot AI balanced review requested due to automatic review settings October 25, 2026 04:33

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot was unable to review this pull request because the user who requested the review has insufficient remaining quota.

Signed-off-by: gongzhongqiang <gongzhongqiang@apache.org>
@GOODBOY008
GOODBOY008 force-pushed the build/drop-dead-spring-boot-pins branch from 165612f to ea776bb Compare October 26, 2026 03:46
@GOODBOY008

Copy link
Copy Markdown
Member Author

Rebased onto the latest main (conflict was with the fastjson2 removal in #1256 touching the same properties block — resolved by keeping both deletions). New head: ea776bb, still a pure 12-line deletion.

For reviewers, some history on why these entries existed in the first place: they were left over from the fesod-examples module (removed in #1028, 2026-08-25). That module's POM declared spring-boot-starter-web and spring-boot-starter-test without versions, relying exactly on these root dependencyManagement entries:

$ git show cdf48b71^:fesod-examples/fesod-sheet-examples/pom.xml
        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-web</artifactId>   <!-- no version -->
        </dependency>
        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-test</artifactId>  <!-- no version -->
        </dependency>

When the examples module was removed, the management entries were not cleaned up along with it — since then they pin an EOL Spring Boot 2.7.18 that nothing resolves anymore (reactor-wide dependency:tree -Dincludes=org.springframework.boot is empty). Hence this cleanup.

@bengbengbalabalabeng bengbengbalabalabeng left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM.

@bengbengbalabalabeng
bengbengbalabalabeng merged commit bcba4f1 into apache:main Oct 26, 2026
9 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants