BOMs can have conflicting artifact versions

• Type: Bug
• Status: Closed
• Resolution: Fixed
• Affects Version/s: Master
• Fix Version/s: 7.0.X, 7.1.X, 7.2.X, 7.3.1 CE GA2, 7.3.2 CE GA3, 7.3.10 DXP GA1, Master
• Component/s: Dev Tools > BOMs
• Labels:
  • 7.3-devtools
• Branch Version/s:
  7.2.x, 7.1.x, 7.0.x
• Backported to Branch:
  Committed
• Fix Priority: 4

The BOM scripts will generate 3 BOMs.

*.bom
*.bom.compile.only
*.bom.third.party

The problem for instance in the 7.1.10.fp14 compile.only bom specifies this

<dependency>
<groupId>javax.servlet</groupId>
<artifactId>javax.servlet-api</artifactId>
<version>3.0.1</version>
</dependency>

And then in the third.party BOM, we have this

<dependency>
<groupId>javax.servlet</groupId>
<artifactId>javax.servlet-api</artifactId>
<version>3.1.0</version>
</dependency>

And the way that our workspace applies the 3 BOMs, the third.party BOM seems to get picked up during dependency resolution.