Use spring-boot-dependencies as spring-boot-dependency-tools' parent

Previously spring-boot-dependency-tools used spring-boot-tools as its
parent. This meant that it inherited spring-boot-parents' dependency
management that we did not want to expose to applications. The
solution to this was to generate the effective pom and then filter
out any thing that did not appear in spring-boot-dependencies' pom.
This filtering had to unwanted side-effect of breaking bom imports:
the effective pom would contain the dependency management from the
imported bom, but this would be filtered out as the entries didn't
appear in spring-boot-dependencies' pom.

This commit updates spring-boot-dependency-tools to use
spring-boot-dependencies as its parent. This means that its effective
pom contains the desired dependency management and nothing more,
allowing the filtering logic to be removed.

The use of Spring Security's bom has been reinstated as it will now
work as intended and versions for its modules will be available in the
CLI and via the Gradle plugin.

Closes spring-projects#825
Fixes spring-projects#838

Author: wilkinsona

spring-boot-dependencies/pom.xml

@@ -1015,58 +1015,10 @@
 			</dependency>
 			<dependency>
 				<groupId>org.springframework.security</groupId>
-				<artifactId>spring-security-acl</artifactId>
-				<version>${spring-security.version}</version>
-			</dependency>
-			<dependency>
-				<groupId>org.springframework.security</groupId>
-				<artifactId>spring-security-aspects</artifactId>
-				<version>${spring-security.version}</version>
-			</dependency>
-			<dependency>
-				<groupId>org.springframework.security</groupId>
-				<artifactId>spring-security-cas</artifactId>
-				<version>${spring-security.version}</version>
-			</dependency>
-			<dependency>
-				<groupId>org.springframework.security</groupId>
-				<artifactId>spring-security-config</artifactId>
-				<version>${spring-security.version}</version>
-			</dependency>
-			<dependency>
-				<groupId>org.springframework.security</groupId>
-				<artifactId>spring-security-core</artifactId>
-				<version>${spring-security.version}</version>
-			</dependency>
-			<dependency>
-				<groupId>org.springframework.security</groupId>
-				<artifactId>spring-security-crypto</artifactId>
-				<version>${spring-security.version}</version>
-			</dependency>
-			<dependency>
-				<groupId>org.springframework.security</groupId>
-				<artifactId>spring-security-ldap</artifactId>
-				<version>${spring-security.version}</version>
-			</dependency>
-			<dependency>
-				<groupId>org.springframework.security</groupId>
-				<artifactId>spring-security-openid</artifactId>
-				<version>${spring-security.version}</version>
-			</dependency>
-			<dependency>
-				<groupId>org.springframework.security</groupId>
-				<artifactId>spring-security-remoting</artifactId>
-				<version>${spring-security.version}</version>
-			</dependency>
-			<dependency>
-				<groupId>org.springframework.security</groupId>
-				<artifactId>spring-security-taglibs</artifactId>
-				<version>${spring-security.version}</version>
-			</dependency>
-			<dependency>
-				<groupId>org.springframework.security</groupId>
-				<artifactId>spring-security-web</artifactId>
+				<artifactId>spring-security-bom</artifactId>
 				<version>${spring-security.version}</version>
+				<scope>import</scope>
+				<type>pom</type>
 			</dependency>
 			<dependency>
 				<groupId>org.springframework.security</groupId>

spring-boot-tools/spring-boot-dependency-tools/pom.xml

@@ -3,8 +3,9 @@
 	<modelVersion>4.0.0</modelVersion>
 	<parent>
 		<groupId>org.springframework.boot</groupId>
-		<artifactId>spring-boot-tools</artifactId>
+		<artifactId>spring-boot-dependencies</artifactId>
 		<version>1.1.0.BUILD-SNAPSHOT</version>
+		<relativePath>../../spring-boot-dependencies</relativePath>
 	</parent>
 	<artifactId>spring-boot-dependency-tools</artifactId>
 	<name>Spring Boot Dependency Tools</name>
@@ -18,6 +19,18 @@
 		<main.basedir>${basedir}/../..</main.basedir>
 		<generated.pom.dir>${project.build.directory}/generated-resources/org/springframework/boot/dependency/tools</generated.pom.dir>
 	</properties>
+	<dependencies>
+		<dependency>
+			<groupId>junit</groupId>
+			<artifactId>junit</artifactId>
+			<scope>test</scope>
+		</dependency>
+		<dependency>
+			<groupId>org.hamcrest</groupId>
+			<artifactId>hamcrest-library</artifactId>
+			<scope>test</scope>
+		</dependency>
+	</dependencies>
 	<build>
 		<resources>
 			<resource>

spring-boot-tools/spring-boot-dependency-tools/src/main/java/org/springframework/boot/dependency/tools/PomManagedDependencies.java

@@ -18,9 +18,7 @@
 
 import java.io.InputStream;
 import java.util.ArrayList;
-import java.util.HashMap;
 import java.util.List;
-import java.util.Map;
 
 import javax.xml.parsers.DocumentBuilder;
 import javax.xml.parsers.DocumentBuilderFactory;
@@ -32,7 +30,7 @@
 
 /**
  * {@link ManagedDependencies} implementation backed a maven POM.
- * 
+ *
  * @author Phillip Webb
  * @since 1.1.0
  */
@@ -42,36 +40,13 @@ public class PomManagedDependencies extends AbstractManagedDependencies {
 	 * Create a new {@link PomManagedDependencies} instance.
 	 * @param effectivePomInputStream the effective POM containing resolved versions. The
 	 * input stream will be closed once content has been loaded.
-	 * @param dependenciesInputStream and optional POM used to limit the dependencies. The
-	 * input stream will be closed once content has been loaded. which will be added from
-	 * the effective POM
 	 */
-	public PomManagedDependencies(InputStream effectivePomInputStream,
-			InputStream dependenciesInputStream) {
+	public PomManagedDependencies(InputStream effectivePomInputStream) {
 		try {
 			Document effectivePom = readDocument(effectivePomInputStream);
-			Document dependenciesPom = readDocument(dependenciesInputStream);
 
-			if (dependenciesPom == null) {
-				// No dependencies POM, add all items
-				for (Dependency dependency : readDependencies(effectivePom)) {
-					add(new ArtifactAndGroupId(dependency), dependency);
-				}
-			}
-			else {
-				// Only add items that are also in the dependencies POM
-				Map<ArtifactAndGroupId, Dependency> all = new HashMap<ArtifactAndGroupId, Dependency>();
-				for (Dependency dependency : readDependencies(effectivePom)) {
-					all.put(new ArtifactAndGroupId(dependency), dependency);
-				}
-				for (Dependency dependency : readDependencies(dependenciesPom)) {
-					ArtifactAndGroupId artifactAndGroupId = new ArtifactAndGroupId(
-							dependency);
-					Dependency effectiveDependency = all.get(artifactAndGroupId);
-					if (effectiveDependency != null) {
-						add(artifactAndGroupId, effectiveDependency);
-					}
-				}
+			for (Dependency dependency : readDependencies(effectivePom)) {
+				add(new ArtifactAndGroupId(dependency), dependency);
 			}
 		}
 		catch (Exception ex) {

spring-boot-tools/spring-boot-dependency-tools/src/main/java/org/springframework/boot/dependency/tools/PropertiesFileManagedDependencies.java

@@ -24,9 +24,9 @@
 
 /**
  * {@link ManagedDependencies} backed by an external properties file (of the form created
- * by the Spring IO platform). The property key should be the groupID and versionId (in
- * the form {@literal group:version}) and the value should be the version.
- * 
+ * by the Spring IO platform). The property key should be the groupId and artifactId (in
+ * the form {@literal groupId:artifactId}) and the value should be the version.
+ *
  * @author Phillip Webb
  * @since 1.1.0
  */

spring-boot-tools/spring-boot-dependency-tools/src/main/java/org/springframework/boot/dependency/tools/VersionManagedDependencies.java

@@ -24,7 +24,7 @@
  * {@link ManagedDependencies} used by various spring boot tools. Provides programmatic
  * access to 'spring-boot-dependencies' and can also support user defined version managed
  * dependencies.
- * 
+ *
  * @author Phillip Webb
  * @since 1.1.0
  */
@@ -70,7 +70,7 @@ private void addAll(ManagedDependencies dependencies) {
 	private static ManagedDependencies getSpringBootDependencies() {
 		if (springBootDependencies == null) {
 			springBootDependencies = new PomManagedDependencies(
-					getResource("effective-pom.xml"), getResource("dependencies-pom.xml"));
+					getResource("effective-pom.xml"));
 		}
 		return springBootDependencies;
 	}

spring-boot-tools/spring-boot-dependency-tools/src/test/java/org/springframework/boot/dependency/tools/PomManagedDependenciesTests.java

@@ -29,7 +29,7 @@
 
 /**
  * Tests for {@link PomManagedDependencies}.
- * 
+ *
  * @author Phillip Webb
  */
 public class PomManagedDependenciesTests {
@@ -39,8 +39,7 @@ public class PomManagedDependenciesTests {
 	@Before
 	public void setup() {
 		InputStream x = getResource("test-effective-pom.xml");
-		InputStream y = getResource("test-dependencies-pom.xml");
-		this.dependencies = new PomManagedDependencies(x, y);
+		this.dependencies = new PomManagedDependencies(x);
 	}
 
 	private InputStream getResource(String name) {
@@ -76,11 +75,6 @@ public void findByArtifactAndGroupIdMissing() throws Exception {
 		assertThat(this.dependencies.find("org.sample", "missing"), nullValue());
 	}
 
-	@Test
-	public void findByArtifactAndGroupIdOnlyInEffectivePom() throws Exception {
-		assertThat(this.dependencies.find("org.extra", "extra01"), nullValue());
-	}
-
 	@Test
 	public void findByArtifactId() throws Exception {
 		assertThat(this.dependencies.find("sample02").toString(),

spring-boot-tools/spring-boot-dependency-tools/src/test/resources/org/springframework/boot/dependency/tools/test-dependencies-pom.xml

@@ -29,11 +29,6 @@
 				<artifactId>spring-boot</artifactId>
 				<version>1.0.0.BUILD-SNAPSHOT</version>
 			</dependency>
-			<dependency>
-				<groupId>org.extra</groupId>
-				<artifactId>extra01</artifactId>
-				<version>2.0.0</version>
-			</dependency>
 		</dependencies>
 	</dependencyManagement>
 </project>