Add swagger version to BOM

[HenrikPublic]

This one got locked for comments, so i'll continue here:
#3212

@bnasslahsen I am confused about why adding the swagger dependencies to the BOM would force users to specify the version?
The whole point was to NOT have to do that.

The BOM should contain the dependency with the version.

[Mattias-Sehlstedt]

My understanding is that if a BOM adds a version then that could affect what "transitive dependency that wins". Thus it is a potential breaking change and hence dangerous. Any user that does not explicitly specify a version already might have their version changed. This would "force users to specify their version", to ensure that springdoc-openapi does not change it.

[HenrikPublic]

My suggestion comes after just such a case, where we had version of swagger defined ourselves (to avoid pulling in springdoc-openapi-starter-webmvc-api just to ensure we get the version of swagger used by springdoc).
When our dependency updater found a newer version of swagger, these were updated, resulting in springdoc no longer working due to incompatibility issues.

I believe defining a version in a bom is the way to allow this to not happen.

If users need a version of swagger that differs from the one defined in your bom, and if that version is incompatible with springdoc, then I believe they have other problems.

The article from https://reflectoring.io/maven-bom/ has a good quote:

The Bill Of Material is a special POM file that groups dependency versions that are known to be valid and tested to work together. This will reduce the developers' pain of having to test the compatibility of different versions and reduce the chances to have version mismatches.

A good example is Jackson's BOM:
https://github.com/FasterXML/jackson-bom

Or the big one. Spring Boot Dependencies:
https://github.com/spring-projects/spring-boot/tree/main/platform/spring-boot-dependencies

[Mattias-Sehlstedt]

Your case is the opposite I would say. You had an explicit version, that later happened to misaligned with springdoc. The issue with now adding it to the BOM is that anyone without an explicit version might have issues. Thus there is a decision whether to have it in the BOM or not, and since the decision to add it is the breaking change, then that might be the reason for not doing it (I am not involved with the project and its decisions, just assumptions on my part. But I have used this project for a while, and I have seen the complaints that much smaller breaking changes have caused, so I understand avoiding breaking changes almost completely).

[bnasslahsen]

Hi @HenrikPublic,

As mentioned in my previous comment, if you’ve found a more efficient workaround, please feel free to submit a PR directly!
It’s usually the fastest way to get improvements reviewed and merged.
Thanks for the help!

[HenrikPublic]

Here's my attempt.

A more elaborate fix would be to arrange the BOM to be a parent, with a base extending on that one, and then let all other modules extends from the base, like done in Jackson3.

See also: https://zetcode.com/maven/bom/

Add_swagger_and_therapi_to_BOM.patch

[HenrikPublic]

I couldn't commit a PR, so I created a patch instead. Did you have a chance to look at my suggested fix?

[HenrikPublic]

And, as mentioned, I was not allowed to submit a PR, so I made a patch instead.