evolution-gaming / kafka-flow / 32950284182

84%

push

github

Publish the pinned dependency versions to consumers (#913)

* Drop redundant versionPolicyIgnored from build.sbt

* Keep versionPolicyIgnored for guava and netty

These are bumped via `dependencyOverrides`, which sbt does not publish to
the POM. Version policy therefore resolves the previous release with the
versions pulled in by the Cassandra driver (guava 19.0, netty 4.1.94) and
reports the difference against our overridden ones as breaking.

Only the smetrics and kafka-journal entries were actually redundant.

* Declare the pinned transitive dependencies explicitly

`dependencyOverrides` are not published to the POM, so pinning lz4, jackson,
guava and netty there fixed the resolution of this build only, while the
consumers of the library kept resolving the vulnerable versions the parents
bring in.

Declare them as direct dependencies of the modules that pull them in, so that
the versions end up in the published POMs. The overrides are kept for the
test-only dependency paths.

387 of 455 branches covered (85.05%)

Branch coverage included in aggregate %.

1929 of 2303 relevant lines covered (83.76%)

1.28 hits per line