Taming Java Dependencies in 70+ GCP Client Libraries
summary
Google Cloud manages 70+ Java client libraries, each with 20+ direct dependencies, by publishing a centralized google cloud share dependencies bom and using the maven flattened plugin to lock transitive versions into flattened POMs. That workflow cuts dependency-update PRs from 104 to 31 (Q1→Q3 2020), resolves upper-bound conflicts, and fixed a commons-codec CVE by forcing 1.15 into published artifacts; a compatibility dashboard helps pick matching client versions.
AI-written summary · about
chapters (8)
- 0:00Start
- 1:03What are client libraries?
- 2:45When you have 70+ Java client libraries...
- 5:03Understand our problems
- 14:46Transformation can have issues
- 16:43Case study: Address security vulnerability
- 20:57How to achieve client library compatibility?
- 22:50Case study: GCP customer Data Fusion
related talks
38mKnow thy neighbours: dependency management done right.
55mCI Pulled It, Prod Ran It: The Real Risk in Dependency, by GraphsIlkka Turunen
42mDependency Updates: Before and After
28mgRPC and Java Diamond Dependency Conflicts
43mLibrary Developer Confidential
34mKeeping Up with the Java Release Train
48mJava's Hidden Gems: Tools and Libraries
40mWhat I Learned from Publishing Libraries to Maven Central