feat: monorepo internal BOMs

[TaurMorchant]

Goal: provide external consumers with a single BOM containing all approved versions of the core Java libraries.

[TaurMorchant]

Result 27.04.2026

• Article from Roman: https://wiki.qubership.org/en/cloud-core/core-platfrom-bom
  • Several comments have been left that require discussion.
• Key design desigions:
  • Three separate internal BOMs by technology: pure-java, spring, quarkus.
  • The spring and quarkus internal BOMs import the pure-java internal BOM, but last. This ensures that versions provided by the official spring and quarkus BOMs take precedence.
  • Each module must import exactly one of the new internal BOMs.
  • If a group of modules for the same framework shares a common parent, the import must be added to the parent.
  • If a library has its own internal BOM, it should be kept as is (for backward compatibility), while the modules of this library are migrated to the new internal BOMs.
• PR: feat: monorepo internal boms #42

[TaurMorchant]

MM 29.04.2026

• In the first phase, we do not place the new BOMs under a single parent.
• Design change: the Spring and Quarkus internal BOMs must import the pure Java internal BOM first, so that its versions take precedence over the versions from Quarkus and Spring. This is required because we must provide explicit third-party versions that our libraries were tested with, rather than relying on the versions from Spring and Quarkus.
• Design change: add imports of our new internal BOMs to the existing modular internal BOMs. Dependencies declared in both the old and new BOMs must be removed from the old BOMs. Keep only module-specific dependencies that are not present in the new shared BOMs.
• Design change: the new internal BOMs must include only dependencies that are used in three or more modules. In all other cases, dependency versions must remain in the modules.

[TaurMorchant]

Result 07.05.2026

• All design changes have been accounted for.
• PR: feat: monorepo internal boms #42
• Unresolved issue: how should plugin versions be managed? Managing them through a BOM will not work, because plugin versions are inherited only from the parent and cannot be imported like dependency versions.

[TaurMorchant]

MM 08.05.2026

• The approach is agreed upon
• AI: rename internal bom modules to cloud-core-internal-bom, cloud-core-quarkus-internal-bom, cloud-core-spring-internal bom
• AI: place three new modules into a single aggregator module

[TaurMorchant]

Result 12.05.2026

• Merged