Version Governance
Central Rule
Section titled “Central Rule”bluetape4k-dependencies is the source of truth for shared dependency versions across the organization.
Downstream repositories should consume the central BOM and generated shared-version catalog updates instead of allowing independent Dependabot bumps for centrally governed libraries.
Current Published Baseline
Section titled “Current Published Baseline”| Scope | Maven coordinate | Version |
|---|---|---|
| Application dependency governance | io.github.bluetape4k:bluetape4k-dependencies | 1.4.0 |
Import bluetape4k-dependencies once with implementation(platform(...)).
Then add the bluetape4k modules your service uses without module versions.
The Version Consumers Choose
Section titled “The Version Consumers Choose”Applications only choose the published version of bluetape4k-dependencies. The central BOM composes repository BOMs such as projects, exposed, and aws, so consumers do not align those versions themselves.
A label such as Bluetape4k docs 1.11 at the top of a manual identifies the repository release line described by that documentation. It is not a dependency version to copy into an application. The same rule applies when a repository such as bluetape4k-aws uses a 0.x release line.
Exact repository version composition is useful for reproducing failures or diagnosing dependency conflicts. Normal installation guidance therefore avoids presenting subordinate BOM versions as consumer choices.
Governed Families
Section titled “Governed Families”- Kotlin, kotlinx, Dokka, and Kover
- Spring Boot 3/4, Spring dependency management, Jackson 2/3
- JetBrains Exposed, Ktor, Reactor, R2DBC drivers
- AWS SDKs, Redis clients, Kafka, Testcontainers
- Common build and runtime libraries used across multiple bluetape4k repositories
Upgrade Policy
Section titled “Upgrade Policy”Routine patch upgrades belong in the central version source first.
Breaking or compile-risk upgrades get their own issue and migration PR. Current examples:
- MyBatis Dynamic SQL 2.x migration
- Timefold Solver 2.x migration
Local Verification
Section titled “Local Verification”scripts/sync-shared-versions.py --workspace .. --check --summaryscripts/sync-dependabot-ignores.py --workspace .. --check --summary./gradlew compileTestKotlin --no-daemonUse central sync checks before merging downstream dependency governance PRs.