BOM provides dependency management for JUnit

[snicoll]

Because prometehus-bom has a parent with a profile enabled by default that provides dependency management for JUnit, the bom effectively provides dependency management for that.

It shouldn't a it can cause issues in downstream projects.

[snicoll]

I haven't identified why but this seems to be added in 1.3.7 (the dependency management bit).

[zeitlinger]

Introduced by #1287

[zeitlinger]

I created an empty project with the following:

//testImplementation("org.junit.jupiter:junit-jupiter-api:5.12.2")
	testImplementation("org.junit.jupiter:junit-jupiter-api")
	implementation("io.prometheus:prometheus-metrics-bom:1.3.7")

Dependency resolution fails - which means the published BOM doesn't have junit in it.

This is because -P release is used, which disables the default profile.

[zeitlinger]

My test was wrong - here's how to reproduce correctly:

plugins {
	id("java")
	id("io.spring.dependency-management") version "1.1.0"
}

repositories {
	mavenLocal()
	mavenCentral()
}

dependencyManagement {
  imports {
    mavenBom("io.prometheus:prometheus-metrics-bom:1.3.7")
  }
}

dependencies {
	testImplementation("org.junit.jupiter:junit-jupiter-api")
}