agilesolutions/bomverifier repository overview

Scan Spring boot jar file for libraries to be matching with the the content of bom.yaml. This bom verifier container is designed to be configured on a Jenkins 2.0 pipeline as docker agent to be run as part of the library verification stage of any pipeline that needs to verify spring boot apps for libraries that are approved by your organization. This will let the jenkins build fail if any of the included libraries on that spring boot app are appearing on the BOM Bill of Material designed by your company. That BOM lists all libraries that are allowed to run in your organization, like apache commons http components. This BOM presents a baseline of libraries and versions that have been proven to be working together. What is Maven BOM? BOM stands for Bill Of Materials. A BOM is a special kind of POM that is used to control the versions of a project’s dependencies and provide a central place to define and update those versions.

BOM provides the flexibility to add a dependency to our module without worrying about the version that we should depend on.

Transitive Dependencies Maven can discover the libraries that are needed by our own dependencies in our pom.xml and includes them automatically. There's no limit to the number of dependency levels that the libraries are gathered from.

The conflict here comes when 2 dependencies refer to different versions of a specific artifact. Which one will be included by Maven?

Dependency Management Simply put, Dependency Management is a mechanism to centralize the dependency information.

Spring BOM We may find that a third-party library, or another Spring project, pulls in a transitive dependency to an older release. If we forget to explicitly declare a direct dependency, unexpected issues can arise.

To overcome such problems, Maven supports the concept of BOM dependency.

We can import the spring-framework-bom in our dependencyManagement section to ensure that all Spring dependencies are at the same version: org.springframework spring-framework-bom 4.3.8.RELEASE pom import We don't need to specify the version attribute when we use the Spring artifacts as in the following example:

When we have a set of projects that inherit a common parent, we can put all dependency information in a shared POM file called BOM.

More about the Spring boot BOM you can find here https://github.com/spring-projects/spring-boot/blob/master/spring-boot-project/spring-boot-dependencies/pom.xml⁠