WIP: feat: DH-21198: publish deephaven-bom-third-party for constraints

bom-third-party/build.gradle

@@ -0,0 +1,13 @@
+plugins {
+    id 'io.deephaven.project.register'
+}
+
+description = 'Deephaven Bill of Materials for Third Party dependencies'
+
+dependencies {
+    constraints {
+        runtime('net.minidev:json-smart:2.5.2') {
+            because 'fixes CVE-2024-57699'
+        }
+    }
+}

bom-third-party/gradle.properties

@@ -0,0 +1 @@
+io.deephaven.project.ProjectType=BOM_PUBLIC

bom/build.gradle

@@ -4,7 +4,12 @@ plugins {
 
 description = 'Deephaven Bill of Materials'
 
+javaPlatform {
+    allowDependencies()
+}
+
 dependencies {
+    // List out all of the public Deephaven projects with their version
     constraints { constraint ->
         project.rootProject
             .subprojects
@@ -14,4 +19,8 @@ dependencies {
                 constraint.api p
             }
     }
+
+    // When downstream consumer inherit the Deephaven BOM, they will also inherit our 3rd party constraints BOM. They
+    // can choose to exclude this if they prefer.
+    api platform(project(':bom-third-party'))
 }

buildSrc/src/main/groovy/io.deephaven.java-test-conventions.gradle

@@ -8,6 +8,11 @@ def testJar = project.tasks.register 'testJar', Jar, { Jar jar ->
     jar.archiveClassifier = 'test'
 }
 
+dependencies {
+    // All tests should be assembled with adherence to our third-party constraints
+    testImplementation platform(project(':bom-third-party'))
+}
+
 configurations {
     testOutput.extendsFrom testRuntimeClasspath
 }

buildSrc/src/main/groovy/io.deephaven.project.java-application.gradle

@@ -10,6 +10,11 @@ plugins {
     id 'io.deephaven.java-coding-conventions'
 }
 
+dependencies {
+    // All application should be assembled with adherence to our third-party constraints
+    implementation platform(project(':bom-third-party'))
+}
+
 def quickTask = project.tasks.getByName('quick')
 
 // We need to make sure that all JAVA_APPLICATION dependencies are public

buildSrc/src/main/groovy/io.deephaven.project.java-local.gradle

@@ -4,3 +4,9 @@ plugins {
     id 'io.deephaven.java-test-conventions'
     id 'io.deephaven.java-coding-conventions'
 }
+
+dependencies {
+    // All local applications (which includes how we package of deephaven-server classpath for the wheel) should be
+    // assembled with adherence to our third-party constraints
+    implementation platform(project(':bom-third-party'))
+}

buildSrc/src/main/groovy/io.deephaven.project.java-public.gradle

@@ -9,6 +9,16 @@ plugins {
     id 'io.deephaven.default-description'
 }
 
+dependencies {
+    // This would make all of our public POMs have a dependencyManagement block on our 3rd party constraints. This is
+    // excessive most of the time, since the majority of our projects don't depend on the constraints in question. In
+    // addition, this might make it harder for downstream consumers to exclude as they would need to do it in a generic
+    // way or for each dependency individually. Instead, `deephaven-bom-third-party` will be published so that downstream
+    // consumers can depend on it directly; or, if they are already depending on `deephaven-bom`, they will inherit it.
+    //
+    // implementation platform(project(':bom-third-party'))
+}
+
 def quickTask = project.tasks.getByName('quick')
 
 // We need to make sure that all JAVA_PUBLIC dependencies are public

extensions/flight-sql/build.gradle

@@ -32,11 +32,6 @@ dependencies {
     // :sql does not expose calcite as a dependency (maybe it should?); in the meantime, we want to make sure we can
     // provide reasonable error messages to the client
     implementation libs.calcite.core
-    constraints {
-        implementation(libs.json.smart) {
-            because 'CVE-2024-57699'
-        }
-    }
 
     implementation libs.dagger
     implementation libs.arrow.flight.sql
@@ -55,6 +50,9 @@ dependencies {
     testRuntimeOnly project(':log-to-slf4j')
     testRuntimeOnly libs.slf4j.simple
 
+    // The ADBC test classpath should be assembled with adherence to our third-party constraints.
+    // (It does not inherit it by default since jdbcTestImplementation does not extend testImplementation.)
+    adbcTestImplementation platform(project(':bom-third-party'))
     // ADBC testing needs an actually server instance bound to a port because it can only connect over ADBC URIs like
     // grpc://localhost:10000
     adbcTestImplementation project(':server-jetty')
@@ -70,6 +68,9 @@ dependencies {
     adbcTestRuntimeOnly project(':log-to-slf4j')
     adbcTestRuntimeOnly libs.slf4j.simple
 
+    // The JDBC test classpath should be assembled with adherence to our third-party constraints.
+    // (It does not inherit it by default since jdbcTestImplementation does not extend testImplementation.)
+    jdbcTestImplementation platform(project(':bom-third-party'))
     // JDBC testing needs an actually server instance bound to a port because it can only connect over JDBC URIs like
     // jdbc:arrow-flight-sql://localhost:10000.
     jdbcTestImplementation project(':server-jetty')

gradle/libs.versions.toml

@@ -8,11 +8,8 @@ awssdk = "2.29.52"
 aws-s3-tables-catalog-for-iceberg = "0.1.8"
 # See dependency matrix for particular gRPC versions at https://github.com/grpc/grpc-java/blob/master/SECURITY.md#netty
 boringssl = "2.0.61.Final"
-
-# Note: when bumping Calcite version, see if we still need the version constraint for json-smart
+# Note: when bumping Calcite version, see if we still need the version constraint for json-smart (see bom-third-party project)
 calcite = "1.39.0"
-json-smart = "2.5.2"
-
 classgraph = "4.8.180"
 commons-compress = "1.28.0"
 commons-io = "2.21.0"
@@ -135,7 +132,6 @@ s3-tables-catalog-for-iceberg = { module = "software.amazon.s3tables:s3-tables-c
 boringssl = { module = "io.netty:netty-tcnative-boringssl-static", version.ref = "boringssl" }
 
 calcite-core = { module = "org.apache.calcite:calcite-core", version.ref = "calcite" }
-json-smart = { module = "net.minidev:json-smart", version.ref = "json-smart" }
 
 classgraph = { module = "io.github.classgraph:classgraph", version.ref = "classgraph" }
 

settings.gradle

@@ -44,6 +44,7 @@ include webMods
 include mods
 
 include 'bom'
+include 'bom-third-party'
 
 include(':configs')
 project(':configs').projectDir = file('props/configs')

sql/build.gradle

@@ -9,11 +9,6 @@ description = 'The Deephaven SQL parser'
 dependencies {
     api project(':qst')
     implementation libs.calcite.core
-    constraints {
-        implementation(libs.json.smart) {
-            because 'CVE-2024-57699'
-        }
-    }
 
     compileOnly project(':util-immutables')
     annotationProcessor libs.immutables.value