Skip to content

Commit 61df79c

Browse files
jxblumjxblum
committed
Add section in the reference documentation on declaring (transitive) dependency exclusions when using Gradle or Maven.
1 parent d5f6a8c commit 61df79c

File tree

1 file changed

+158
-0
lines changed
  • spring-geode-project/spring-geode-docs/src/docs/asciidoc

1 file changed

+158
-0
lines changed

‎spring-geode-project/spring-geode-docs/src/docs/asciidoc/index.adoc‎

Lines changed: 158 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -747,6 +747,164 @@ the https://maven.apache.org/guides/introduction/introduction-to-dependency-mech
747747
For more details on Gradle dependency management, please refer to
748748
the https://docs.gradle.org/current/userguide/core_dependency_management.html[documentation]
749749

750+
[[sbdg-dependency-exclusions]]
751+
=== Excluding Dependencies
752+
753+
Sometimes, though rarely, it may be necessary to exclude a (transitive) dependency included by a Spring Boot,
754+
or Spring Boot for Apache Geode, starter.
755+
756+
Perhaps a transitive dependency, such as Apache Log4j or Jackson, is pulled in by an underlying data store dependency,
757+
such as Apache Geode or Redis, when using a starter (for example: `spring-boot-starter-data-redis`, or `spring-geode-starter`),
758+
that could cause a conflict with your Spring Boot application. Or, maybe the transitive dependency currently contains
759+
a serious bug or CVE.
760+
761+
Either way, you have concluded that it is safe to exclude this (transitive) dependency without adversely affecting
762+
the runtime behavior and correctness of your Spring Boot application.
763+
764+
WARNING: You should be absolutely certain that removing the (transitive) dependency, rather than <<sbdg-dependency-version-overrides,overridding>>
765+
the (transitive) dependency is the correct course of action.
766+
767+
For example, when you include the `spring-geode-starter` (the base starter of Spring Boot for Apache Geode), you notice
768+
that Apache Lucene is transitively included by `org.apache.geode:geode-lucene`:
769+
770+
.Analyzing Dependencies using Gradle
771+
[source, text]
772+
----
773+
$ gradlew :spring-geode-starter:dependencies
774+
775+
...
776+
compileClasspath - Compile classpath for source set 'main'.
777+
+--- org.springframework.boot:spring-boot-starter -> 3.0.0-M5
778+
| +--- org.springframework.boot:spring-boot:3.0.0-M5
779+
| | +--- org.springframework:spring-core:6.0.0-M6
780+
...
781+
+--- project :spring-geode
782+
| +--- project :apache-geode-extensions
783+
| | +--- org.apache.geode:geode-core:1.15.0
784+
| | | +--- antlr:antlr:2.7.7
785+
...
786+
| | +--- org.apache.geode:geode-lucene:1.15.0
787+
| | | +--- org.apache.geode:geode-core:1.15.0 (*)
788+
| | | \--- org.apache.lucene:lucene-core:6.6.6
789+
...
790+
| | \--- org.apache.geode:geode-wan:1.15.0
791+
...
792+
----
793+
794+
.Analyzing Dependencies using Maven
795+
[source,txt]
796+
----
797+
$ mvn dependency:tree
798+
799+
...
800+
[INFO] --- maven-dependency-plugin:3.3.0:tree (default-cli) @ spring-geode-app ---
801+
[INFO] org.example.app:spring-geode-app:jar:0.0.1-SNAPSHOT
802+
[INFO] +- org.springframework.geode:spring-geode-starter:jar:1.7.4:compile
803+
[INFO] | +- org.springframework.boot:spring-boot-starter:jar:2.7.1:compile
804+
[INFO] | | +- org.springframework.boot:spring-boot:jar:2.7.1:compile
805+
...
806+
[INFO] | +- org.springframework.geode:spring-geode:jar:1.7.4:compile
807+
[INFO] | | +- org.springframework.data:spring-data-geode:jar:2.7.1:compile
808+
[INFO] | | | +- org.apache.geode:geode-core:jar:1.14.4:compile
809+
...
810+
[INFO] | | | +- org.apache.geode:geode-lucene:jar:1.14.4:compile
811+
[INFO] | | | | +- org.apache.lucene:lucene-core:jar:6.6.6:compile
812+
[INFO] | | | | +- org.apache.geode:geode-gfsh:jar:1.14.4:runtime
813+
[INFO] | | | | +- org.apache.lucene:lucene-analyzers-common:jar:6.6.6:runtime
814+
[INFO] | | | | +- org.apache.lucene:lucene-queryparser:jar:6.6.6:runtime
815+
[INFO] | | | | | \- org.apache.lucene:lucene-queries:jar:6.6.6:runtime
816+
[INFO] | | | | +- mx4j:mx4j:jar:3.0.2:runtime
817+
[INFO] | | | | \- org.apache.lucene:lucene-analyzers-phonetic:jar:6.6.6:runtime
818+
[INFO] | | | | \- commons-codec:commons-codec:jar:1.15:runtime
819+
...
820+
[INFO] | | | +- org.apache.geode:geode-wan:jar:1.14.4:compile
821+
----
822+
823+
However, you do not have any "search" use cases in your Spring Boot application that would require Apache Geode's
824+
integration with Apache Lucene.
825+
826+
Using your build tool, such as Gradle or Maven, you can add an exclusion on the `org.apache.geode:geode-lucene`
827+
transitive dependency pulled in and included by Spring Boot for Apache Geode's `spring-geode-starter`, like so:
828+
829+
.Declaring Exclusions with Gradle
830+
[source,groovy]
831+
[subs="verbatim,attributes"]
832+
----
833+
implementation("org.springframework.geode:spring-geode-starter:{version}") {
834+
exclude group: "org.apache.geode", module: "geode-lucene"
835+
}
836+
----
837+
838+
.Declaring Exclusions with Maven
839+
[source,xml]
840+
[subs="verbatim,attributes"]
841+
----
842+
<?xml version="1.0" encoding="UTF-8"?>
843+
<pom>
844+
<dependencies>
845+
<dependency>
846+
<groupId>org.springframework.geode</groupId>
847+
<artifactId>spring-geode-starter</artifactId>
848+
<version>{version}</version>
849+
<exclusions>
850+
<exclusion>
851+
<groupId>org.apache.geode</groupId>
852+
<artifactId>geode-lucene</artifactId>
853+
</exclusion>
854+
</exclusions>
855+
</dependency>
856+
</dependencies>
857+
</pom>
858+
----
859+
860+
After the appropriate exclusion is declared, the resulting dependencies (or dependency tree) should look like
861+
the following:
862+
863+
.Analyzing Dependencies using Gradle after Exclusions
864+
[source, text]
865+
----
866+
$ gradlew :spring-geode-starter:dependencies
867+
868+
...
869+
compileClasspath - Compile classpath for source set 'main'.
870+
+--- org.springframework.boot:spring-boot-starter -> 3.0.0-M5
871+
| +--- org.springframework.boot:spring-boot:3.0.0-M5
872+
| | +--- org.springframework:spring-core:6.0.0-M6
873+
...
874+
+--- project :spring-geode
875+
| +--- project :apache-geode-extensions
876+
| | +--- org.apache.geode:geode-core:1.15.0
877+
| | | +--- antlr:antlr:2.7.7
878+
...
879+
| | \--- org.apache.geode:geode-wan:1.15.0
880+
...
881+
----
882+
883+
.Analyzing Dependencies using Maven
884+
[source,txt]
885+
----
886+
$ mvn dependency:tree
887+
888+
...
889+
[INFO] --- maven-dependency-plugin:3.3.0:tree (default-cli) @ spring-geode-app ---
890+
[INFO] org.example.app:spring-geode-app:jar:0.0.1-SNAPSHOT
891+
[INFO] +- org.springframework.geode:spring-geode-starter:jar:1.7.4:compile
892+
[INFO] | +- org.springframework.boot:spring-boot-starter:jar:2.7.1:compile
893+
[INFO] | | +- org.springframework.boot:spring-boot:jar:2.7.1:compile
894+
...
895+
[INFO] | +- org.springframework.geode:spring-geode:jar:1.7.4:compile
896+
[INFO] | | +- org.springframework.data:spring-data-geode:jar:2.7.1:compile
897+
[INFO] | | | +- org.apache.geode:geode-core:jar:1.14.4:compile
898+
...
899+
[INFO] | | | +- org.apache.geode:geode-wan:jar:1.14.4:compile
900+
----
901+
902+
Again, it cannot be overstated the importance of being careful when declaring exclusions.
903+
904+
TIP: Please refer to the appropriate documentation in
905+
https://maven.apache.org/guides/introduction/introduction-to-optional-and-excludes-dependencies.html[Maven]
906+
and https://docs.gradle.org/current/userguide/dependency_downgrade_and_exclude.html[Gradle] to declare exclusions.
907+
750908

751909
include::{include-dir}/clientcache-applications.adoc[]
752910
include::{include-dir}/configuration-auto.adoc[]

0 commit comments

Comments
 (0)