Hi together, there was quite a discussion going on in https://issues.apache.org/jira/browse/SLING-5603 on how to deal with 3rd party dependencies in Sling. There are basically two different opinions there:
a) let each bundle decide on its own in which version it depends on a certain 3rd party dependency. Basically each module defines the minimal version of that dependency it can work with and the maven-bundle-plugin will automatically generate the according import-package version ranges. The Sling launchpad itself must just provide that 3rd party dependency in a version which is within all the accepted ranges of all bundles. b) try to consolidate versions in a way that all bundles depend on the same version of the same dependency. I am strongly in favor of a) for the following reason: - it makes the according bundle potentially compatible with other systems like AEM (which might not have the most recent version of 3rd party dependencies available). Therefore depending on the minimal version potentially allows to use that Sling bundle in more/older environments. The potential drawbacks are - different Sling modules might depend on incompatible versions of the same 3rd party library (of course then those cannot be executed easily in the same OSGi container, because deploying the same 3rd party bundle in two version within OSGi is not supported by the OSGi installer) - it is harder to trace down bugs related to using a certain version of the 3rd party lib, because potentially the range of compatible versions of that library is bigger than with approach b). IMHO most of the 3rd party libraries we depend on (Apache Commons) are binary-backwards compatible in case the major version is not increased, therefore in most cases, upgrading is not a problem (does not require recompiling a certain bundle). Another aspect of option a) is: With which version of the dependency you want to run the IT. Either it is the version being provided with the most recent Sling Launchpad or the minimal version the module claims to be compatible with. I would prefer the latter option here, as newer version of the library are completely backwards-compatible and the chance of regressions is rather low. In contrast when only running the IT with the newer version, the chance is pretty high, that there is a bug in the old version which prevent the Sling Module to run with that. I would like to hear, what the others think about that? Thanks, Konrad
