Spring Cloud Contract: Rest Assured version inconsistent with Spring Boot

[varpa89]

Spring boot BOM file has
<rest-assured.version>3.3.0</rest-assured.version>
https://repo1.maven.org/maven2/org/springframework/boot/spring-boot-dependencies/2.3.0.RELEASE/spring-boot-dependencies-2.3.0.RELEASE.pom

Spring Cloud Contract Parent has version 4.2.0
https://github.com/spring-cloud/spring-cloud-contract/blob/master/pom.xml#L47

For such POM running

./mvnw verify

returns

Require upper bound dependencies error for io.rest-assured:spring-mock-mvc:3.3.0 paths to dependency are:
+-com.example:demo:0.0.1-SNAPSHOT
+-org.springframework.cloud:spring-cloud-starter-contract-verifier:2.2.3.RELEASE
+-io.rest-assured:spring-mock-mvc:3.3.0 (managed) <-- io.rest-assured:spring-mock-mvc:4.1.1

<?xml version="1.0" encoding="UTF-8"?>
<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
	xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 https://maven.apache.org/xsd/maven-4.0.0.xsd">
	<modelVersion>4.0.0</modelVersion>
	<parent>
		<groupId>org.springframework.boot</groupId>
		<artifactId>spring-boot-starter-parent</artifactId>
		<version>2.3.1.RELEASE</version>
		<relativePath/> <!-- lookup parent from repository -->
	</parent>
	<groupId>com.example</groupId>
	<artifactId>demo</artifactId>
	<version>0.0.1-SNAPSHOT</version>
	<name>demo</name>
	<description>Demo project for Spring Boot</description>

	<properties>
		<java.version>1.8</java.version>
		<spring-cloud.version>Hoxton.SR5</spring-cloud.version>
	</properties>

	<dependencies>
		<dependency>
			<groupId>org.springframework.boot</groupId>
			<artifactId>spring-boot-starter</artifactId>
		</dependency>

		<dependency>
			<groupId>org.springframework.boot</groupId>
			<artifactId>spring-boot-starter-test</artifactId>
			<scope>test</scope>
			<exclusions>
				<exclusion>
					<groupId>org.junit.vintage</groupId>
					<artifactId>junit-vintage-engine</artifactId>
				</exclusion>
			</exclusions>
		</dependency>
		<dependency>
			<groupId>org.springframework.cloud</groupId>
			<artifactId>spring-cloud-starter-contract-verifier</artifactId>
			<scope>test</scope>
		</dependency>
	</dependencies>

	<dependencyManagement>
		<dependencies>
			<dependency>
				<groupId>org.springframework.cloud</groupId>
				<artifactId>spring-cloud-dependencies</artifactId>
				<version>${spring-cloud.version}</version>
				<type>pom</type>
				<scope>import</scope>
			</dependency>
		</dependencies>
	</dependencyManagement>

	<build>
		<plugins>
			<plugin>
				<groupId>org.springframework.cloud</groupId>
				<artifactId>spring-cloud-contract-maven-plugin</artifactId>
				<version>2.2.3.RELEASE</version>
				<extensions>true</extensions>
				<configuration>
					<testFramework>JUNIT5</testFramework>
				</configuration>
			</plugin>
			<plugin>
				<groupId>org.springframework.boot</groupId>
				<artifactId>spring-boot-maven-plugin</artifactId>
			</plugin>
			<plugin>
				<groupId>org.apache.maven.plugins</groupId>
				<artifactId>maven-enforcer-plugin</artifactId>
				<version>3.0.0-M3</version>
				<executions>
					<execution>
						<id>default-cli</id>
						<goals>
							<goal>enforce</goal>
						</goals>
						<configuration>
							<rules>
								<requireUpperBoundDeps/>
								<requireJavaVersion>
									<version>11</version>
								</requireJavaVersion>
								<requireMavenVersion>
									<version>3.6.0</version>
								</requireMavenVersion>
							</rules>
						</configuration>
					</execution>
				</executions>
			</plugin>
		</plugins>
	</build>

</project>

Why Spring Cloud Contract uses own version not from Spring Boot BOM?

[marcingrzejszczak]

There must have been a reason for this, but I neither I remember what the reason was nor do I see any sense of it. Since it's been there in contract 2.x I'll apply the change in master cause that's a breaking change.

[varpa89]

So the fix will be only for Spring Boot 2.4.X? Or 2.3.X also?

[marcingrzejszczak]

The fix will take place for Spring Cloud Contract 3.0.x. I don't want to change the 2.x versions.