Code10x
Build toolshard5-8 years

A project imports the Spring Boot BOM, and a developer bumps just the Spring Security version by hand to pick up a patch, leaving the rest of the BOM's versions alone. Soon after, the app fails to start with a confusing bean-wiring error. What did the BOM actually provide, and what did overriding one version break?

A BOM contributes no jars at all — it's a POM containing only <dependencyManagement>, a table of versions consulted whenever the project declares a dependency without specifying one itself. The Spring Boot BOM's entire value is that its versions were tested together as a matched set by the Spring team; overriding a single one by hand doesn't just bump that library, it silently pulls that one dependency out of the matched set while leaving eleven others pinned to versions chosen to work with the original version of the one just changed. The bean-wiring failure is exactly the kind of subtle incompatibility that surfaces when one component in a tightly coordinated release train is swapped out from under the rest — the fix isn't reverting the override blindly, it's either waiting for the BOM itself to bump (getting a version the whole set was tested against) or accepting that a manual override needs to be verified against everything else the BOM still pins.

The lesson behind it →
PreviousA developer rebases their own feature branch and pushes with `git push --force-with-lease`, expecting it to refuse if a colleague pushed to the same branch in the meantime. It doesn't refuse, and the colleague's commit is gone from the remote. What went wrong with the safety it's supposed to provide?Next A team migrates a service from Maven to Gradle, keeping the same declared dependency versions. A transitive dependency that resolved one way under Maven resolves to a different version under Gradle, and a test that passed before now fails. Why would the same declared dependencies produce two different classpaths?
More on Build tools
A service compiles cleanly, but throws `NoSuchMethodError` in production on a code path that calls into a third-party library the team never directly wrote a version for. Where would you look first, and what's the actual mechanism that produces this?A team migrates a service from Maven to Gradle, keeping the same declared dependency versions. A transitive dependency that resolved one way under Maven resolves to a different version under Gradle, and a test that passed before now fails. Why would the same declared dependencies produce two different classpaths?A security review asks the team to prove that a specific jar deployed to production was built from a specific commit, byte for byte. What three things does the project need to have in place for that proof to actually be possible, and why does each one matter?A parent POM lists three modules — `orders-domain`, `orders-api`, `orders-worker` — with no explicit build order given anywhere. How does Maven decide what order to build them in, and what stops a developer from accidentally importing `orders-api` classes into `orders-domain`?