导入BOM表pom时如何覆盖Spring Boot的版本号？

Question

如何覆盖Spring Boot导入的版本号，而无需在依赖项管理部分中手动设置每个工件？

<properties>
    <spring.boot.version>1.5.7.RELEASE</spring.boot.version>
    <jackson.version>2.9.1</jackson.version>
</properties>
<dependencyManagement>
    <dependencies>
        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-dependencies</artifactId>
            <version>${spring.boot.version}</version>
            <type>pom</type>
            <scope>import</scope>
        </dependency>
        <dependency>
            <groupId>com.fasterxml.jackson</groupId>
            <artifactId>jackson-bom</artifactId>
            <version>${jackson.version}</version>
            <type>pom</type>
            <scope>import</scope>
        </dependency>
    </dependencies>
</dependencyManagement>

但是，当我跑步时

mvn dependency:tree "-Dincludes=com.fasterxml.jackson.*" -Dverbose

输出

[INFO] ------------------------------------------------------------------------
[INFO] Building dpt-domain-core 1.0.0
[INFO] ------------------------------------------------------------------------
[INFO]
[INFO] --- maven-dependency-plugin:2.8:tree (default-cli) @ dpt-domain-core ---
[INFO] net.initech.dpt:dpt-domain-core:jar:1.0.0
[INFO] +- com.fasterxml.jackson.core:jackson-annotations:jar:2.8.0:compile
[INFO] +- com.fasterxml.jackson.core:jackson-core:jar:2.8.10:compile
[INFO] +- com.fasterxml.jackson.core:jackson-databind:jar:2.8.10:compile
[INFO] |  +- (com.fasterxml.jackson.core:jackson-annotations:jar:2.8.0:compile - omitted for duplicate)
[INFO] |  \- (com.fasterxml.jackson.core:jackson-core:jar:2.8.10:compile - omitted for duplicate)
[INFO] \- com.fasterxml.jackson.datatype:jackson-datatype-jsr310:jar:2.8.10:compile
[INFO]    +- (com.fasterxml.jackson.core:jackson-annotations:jar:2.8.0:compile - omitted for duplicate)
[INFO]    +- (com.fasterxml.jackson.core:jackson-core:jar:2.8.10:compile - omitted for duplicate)
[INFO]    \- (com.fasterxml.jackson.core:jackson-databind:jar:2.8.10:compile - omitted for duplicate)

哪里2.8.10是值jackson.version那个org.springframework.boot:spring-boot-dependencies:1.5.7.RELEASE:pom定义。

但是，如果我明确添加

mvn dependency:tree "-Dincludes=com.fasterxml.jackson.*" -Dverbose

到我的依赖项管理部分，则可以正确解析为：

[INFO] ------------------------------------------------------------------------
[INFO] Building dpt-domain-core 1.0.0
[INFO] ------------------------------------------------------------------------
[INFO]
[INFO] --- maven-dependency-plugin:2.8:tree (default-cli) @ dpt-domain-core ---
[INFO] org.autodatacorp.dpt:dpt-domain-core:jar:1.0.0
[INFO] +- com.fasterxml.jackson.core:jackson-annotations:jar:2.9.1:compile
[INFO] +- com.fasterxml.jackson.core:jackson-core:jar:2.9.1:compile
[INFO] +- com.fasterxml.jackson.core:jackson-databind:jar:2.9.1:compile
[INFO] \- com.fasterxml.jackson.datatype:jackson-datatype-jsr310:jar:2.9.1:compile
[INFO] ------------------------------------------------------------------------

这是令人费解，因为这似乎应该是相当于做一个的import的com.fasterxml.jackson:jackson-bom:2.9.1:pom应该是相当于粘贴代码的内容转换成手动的。

我什至试过

[INFO] ------------------------------------------------------------------------
[INFO] Building dpt-domain-core 1.0.0
[INFO] ------------------------------------------------------------------------
[INFO]
[INFO] --- maven-dependency-plugin:2.8:tree (default-cli) @ dpt-domain-core ---
[INFO] net.initech.dpt:dpt-domain-core:jar:1.0.0
[INFO] +- com.fasterxml.jackson.core:jackson-annotations:jar:2.8.0:compile
[INFO] +- com.fasterxml.jackson.core:jackson-core:jar:2.8.10:compile
[INFO] +- com.fasterxml.jackson.core:jackson-databind:jar:2.8.10:compile
[INFO] |  +- (com.fasterxml.jackson.core:jackson-annotations:jar:2.8.0:compile - omitted for duplicate)
[INFO] |  \- (com.fasterxml.jackson.core:jackson-core:jar:2.8.10:compile - omitted for duplicate)
[INFO] \- com.fasterxml.jackson.datatype:jackson-datatype-jsr310:jar:2.8.10:compile
[INFO]    +- (com.fasterxml.jackson.core:jackson-annotations:jar:2.8.0:compile - omitted for duplicate)
[INFO]    +- (com.fasterxml.jackson.core:jackson-core:jar:2.8.10:compile - omitted for duplicate)
[INFO]    \- (com.fasterxml.jackson.core:jackson-databind:jar:2.8.10:compile - omitted for duplicate)

但没有效果。

---

PS-万一重要，我使用的Maven是：

Apache Maven 3.3.9 (bb52d8502b132ec0a5a3f4c09453c07478323dc5; 2015-11-10T11:41:47-05:00)
Java version: 9, vendor: Oracle Corporation

Answer 1

添加jackson-bom.version到 pom.xml 文件的属性部分应该会更新 jackson 依赖项。这将覆盖 Spring Boot Parent POM 中的 jackson 版本。

<properties>
    <jackson-bom.version>2.12.1</jackson-bom.version>
</properties>

使用jackson.version是行不通的。请参阅https://github.com/spring-projects/spring-boot/issues/17808

Answer 2

1. 您可以重新排序BOM表导入，这将起作用。将Jackson物料清单放在Spring Boot物料清单之前。快速示例https://github.com/Flaw101/gsonconverter/blob/feature/jackson_override/pom.xml
2. 如果您使用Spring Boot Parent POM，则只需覆盖其属性jackson.version即可覆盖其他框架/库的版本

Spring Boot也对此进行了记录，

https://docs.spring.io/spring-boot/docs/current/reference/html/using-boot-build-systems.html#using-boot-maven-parent-pom

https://docs.spring.io/spring-boot/docs/current/reference/html/using-boot-build-systems.html#using-boot-maven-without-a-parent