[Task] Reactor dependency convergence / upper-bound alignment

Description

Enabling dependencyConvergence and requireUpperBoundDeps (via maven-enforcer-plugin, see #6602) surfaces existing dependency drift across the whole reactor. This issue tracks the actual alignment work so those rules can be promoted to hard-fail; it is intentionally split out of #6602, which stays scoped to introducing the plugin + version guardrails.

Findings

Audit on commit 297ac6f849857bd0c2ad368709013e98494b0330 (2.7.2-SNAPSHOT):

191 of 213 reactor projects report dependency-rule violations.
15 distinct artifact coordinates for dependencyConvergence, 36 for requireUpperBoundDeps (39 across both rules).
Counts include transitive problems inherited by downstream projects and are not 191 independent root causes.

Known conflicts (starting point)

Artifact	Observed conflict
`org.checkerframework:checker-qual`	Caffeine 2.9.3 requests 3.19.0 vs Guava 32.0.0-jre requests 3.33.0 (both rules fail)
`com.google.errorprone:error_prone_annotations`	Gson 2.13.2 requests 2.41.0 vs Caffeine requests 2.10.0 vs Guava requests 2.18.0 (convergence fails)
`org.slf4j:slf4j-api`	dependency management resolves 2.0.13 vs OSHI 6.10.0 requests 2.0.17 (upper-bound fails)

Full-reactor framework / BOM alignment (examples):

Spring Context resolves 6.1.10 while a transitive path requests 6.2.19
Reactor Core resolves 3.6.7 while a transitive path requests 3.7.19
MCP resolves 0.17.0 while Spring AI 1.1.8 requests 0.18.3
Others: Jackson, Micrometer, ASM, Guava, OkHttp, Commons IO, Spring LDAP, Elasticsearch

Plan (staged)

Land dependencyConvergence + requireUpperBoundDeps in report-only mode (non-failing) so drift is visible in CI without blocking builds.
Align the graph via <dependencyManagement> / BOM alignment, module by module.
Flip both rules to hard-fail (globally, or per-module via <pluginManagement> overrides as each module is cleaned).

Reproduction

Minimal: ./mvnw -B -ntp -pl shenyu-common -am validate fails with the shenyu-common conflicts above.
Whole-reactor inventory (does not stop at first violation): ./mvnw -B -ntp validate -Denforcer.fail=false -Dcheckstyle.skip=true.

Related: #6602

As requested in the #6602 rollout decision, here is the verified shenyu-common minimal reproduction.

Tested at 297ac6f849857bd0c2ad368709013e98494b0330 (2.7.2-SNAPSHOT), using the Maven wrapper (3.6.3) and JDK 21.0.10. Invoke the dependency rules explicitly; this does not require editing any POM or enabling them in the #6602 version-guardrail change:

./mvnw -B -ntp -pl shenyu-common -am \
  org.apache.maven.plugins:maven-enforcer-plugin:3.6.3:enforce \
  -Denforcer.rules=dependencyConvergence,requireUpperBoundDeps

On Windows, use .\mvnw.cmd and put the arguments on one line (quote the -Denforcer.rules=... argument in PowerShell).

The root, shenyu-register-center, and shenyu-register-protocol pass. The command exits 1 at shenyu-common, with these failures:

Rule	Artifact	Dependency paths / versions
`dependencyConvergence`	`org.checkerframework:checker-qual`	`shenyu-common -> caffeine:2.9.3 -> checker-qual:3.19.0` versus `shenyu-common -> guava:32.0.0-jre -> checker-qual:3.33.0`
`dependencyConvergence`	`com.google.errorprone:error_prone_annotations`	`gson:2.13.2 -> 2.41.0`, `caffeine:2.9.3 -> 2.10.0`, and `guava:32.0.0-jre -> 2.18.0`
`requireUpperBoundDeps`	`org.checkerframework:checker-qual`	Resolved 3.19.0 is below Guava's requested 3.33.0.
`requireUpperBoundDeps`	`org.slf4j:slf4j-api`	Resolved/managed 2.0.13 is below `shenyu-common -> oshi-core:6.10.0 -> slf4j-api:2.0.17`.

Representative output:

shenyu ............................................. SUCCESS
shenyu-register-center ............................. SUCCESS
shenyu-register-protocol ........................... SUCCESS
shenyu-common ...................................... FAILURE
Rule 0: org.apache.maven.enforcer.rules.dependency.DependencyConvergence failed
Rule 1: org.apache.maven.enforcer.rules.dependency.RequireUpperBoundDeps failed

For a non-blocking whole-reactor inventory using the same explicit rules:

./mvnw -B -ntp \
  org.apache.maven.plugins:maven-enforcer-plugin:3.6.3:enforce \
  -Denforcer.rules=dependencyConvergence,requireUpperBoundDeps \
  -Denforcer.fail=false

The last override is for collecting all diagnostics; a successful exit in that mode does not establish that the graph is aligned. A plain validate after the scoped #6602 change checks toolchain versions only, so it will not reproduce these dependency errors.

@yangjj-iso

Hi, I'd like to help with the checker-qual and error_prone_annotations alignment slice of this issue, if nobody is already working on it.

Thanks @yangjj-iso for the verified reproduction. I reproduced the conflicts on master at 8f3ee32 and prepared a small root dependency-management change for checker-qual 3.33.0 and error_prone_annotations 2.41.0, matching the highest versions already requested on the shenyu-common paths.

Local validation with JDK 17 and the Maven wrapper:

shenyu-common and its four-project reactor pass verify, Checkstyle and Apache RAT: 506 tests passed, with one existing skipped test.
DependencyConvergence passes for the selected reactor after the change.
The combined Enforcer command still fails for the separate existing SLF4J upper-bound conflict; I am keeping SLF4J, framework BOM alignment and the [Task] No maven-enforcer-plugin anywhere #6602 / [ISSUE #6602] Enforce Maven and Java build requirements #7680 Enforcer guardrails outside this slice.

If this scope is available, could I take this slice and submit a focused PR? Please let me know if it overlaps with anyone's ongoing work. Thanks!

fix common : align annotation dependency versions.

fix common : align annotation dependency versions. (#7688)

Navigation Menu

Repository navigation

[Task] Reactor dependency convergence / upper-bound alignment #7679

Description

Findings

Known conflicts (starting point)

Plan (staged)

Reproduction

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

[Task] Reactor dependency convergence / upper-bound alignment #7679

Description

Description

Findings

Known conflicts (starting point)

Plan (staged)

Reproduction

Activity

yangjj-iso commented on Oct 16, 2026

laomo-hub commented on Oct 16, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions