172 managed dependencies is too many

[elharo]

Our code reports that com.google.cloud:google-cloud-bom:0.61.0-alpha has 172 managed dependencies:

  @Test
  public void tesReadBom() throws ArtifactDescriptorException {
    Artifact artifact = new DefaultArtifact("com.google.cloud:google-cloud-bom:0.61.0-alpha");
    List<Artifact> managedDependencies = RepositoryUtility.readBom(artifact);
    // Characterization test. As long as the artifact doesn't change (and it shouldn't)
    // the answer won't change.
    Assert.assertEquals(172, managedDependencies.size());
  }

I don't buy it. That's far too many. Most likely there's something we don't understand here. I'm not sure where the misunderstanding lies: in how a managedDependencies section is interpreted in Maven pom.xml? What Aether's ArtifactDescriptorResult.getManagedDependencies() method is reporting? Something else?

There's something fishy here.

[elharo]

11 GRPC
2 protobuf
179 in google-cloud-java! (They must have added a few in 0.62.0)

so it actually really is an issue in google-cloud-java

[elharo]

Furthermore, the google-cloud-java bom contains some dupes. That may be why I was tearing my hair out trying to figure out how our code was producing duplicates.

[elharo]

The dupes seem to have type test-jar so they're not true dupes.

[garrettjonesgoogle]

I think we resolved this offline. There aren't any grpc or protobuf runtime dependencies, there are only packages (that live within google-cloud-java) containing generated protobuf/grpc classes.

[garrettjonesgoogle]

Closing out.