Protobuf-java version is not correct in Maven Library for 2.X

[NorthernMystic]

Protobuf-java version is not correct in Maven Library for 2.X

[dariuszkuc]

Hello 👋
It appears to be a Maven issue with your project setup - verify whether you import a BOM that specifies the old version or some other library transitively picks it up. Maven is rather crude with its dependency resolution strategy and uses shortest-path algorithm to select the first one it encounters (if path depth is the same then its picked in the the order they are defined in the pom file) so given something like

- foo-dependency
  |- bar-dependency v0.0.1
- baz-dependency
  |- bar-dependency v1.0.0

Maven will pick up the transitive dependency of foo-dependency even though baz-dependency uses new version.

You can use dependency:tree goal to check out the resolution. See https://maven.apache.org/plugins/maven-dependency-plugin/examples/filtering-the-dependency-tree.html (use verbose option to get full tree).

[NorthernMystic]

Hey, @dariuszkuc Thanks for the quick reply.
the result of maven dependency tree:

[INFO] +- com.apollographql.federation:federation-graphql-java-support:jar:2.0.4:compile
[INFO] | +- com.apollographql.federation:federation-graphql-java-support-api:jar:2.0.4:compile
[INFO] | +- com.graphql-java:graphql-java:jar:19.0:compile
[INFO] | | +- com.graphql-java:java-dataloader:jar:3.2.0:compile
[INFO] | | | - (org.slf4j:slf4j-api:jar:1.7.30:compile - version managed from 1.7.36; omitted for duplicate)
[INFO] | | +- org.reactivestreams:reactive-streams:jar:1.0.3:compile (version managed from 1.0.2)
[INFO] | | - (org.slf4j:slf4j-api:jar:1.7.30:compile - version managed from 1.7.35; scope updated from runtime; omitted for duplicate)
[INFO] | +- org.slf4j:slf4j-api:jar:1.7.30:compile
[INFO] | - com.google.protobuf:protobuf-java:jar:3.14.0:compile (version managed from 3.21.4)

After checking the maven docs, I suppose we need to put the import dependency under the dependencyManagement part.
Will close this issue as it is resolved.