What is a BOM (Bill of Materials)

What is a BOM (Bill of Materials)?

A BOM is a special kind of POM file (in Maven) that defines a set of dependencies with their versions. It doesn’t bring in the dependencies directly — it just tells the build tool which versions to use when those dependencies are needed.

Avoid version conflicts, Centralize version management, Ensure all modules use compatible versions, Reduce duplication in multi-module or large projects

Create and Use a BOM in a Multi-Microservice Setup

Create a new Maven project for your BOM. This will be a pom-only project — not a JAR.

pom.xml

<project xmlns="http://maven.apache.org/POM/4.0.0"
         xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 
                             http://maven.apache.org/xsd/maven-4.0.0.xsd">

    <modelVersion>4.0.0</modelVersion>
    <groupId>com.lahiru.company</groupId>
    <artifactId>lahiru-common-dependencies-bom</artifactId>
    <version>1.0.0</version>
    <packaging>pom</packaging>

    <dependencyManagement>
        <dependencies>
            <dependency>
                <groupId>com.lhu</groupId>
                <artifactId>abc-lib</artifactId>
                <version>1.2</version>
            </dependency>

            <dependency>
                <groupId>com.lhu</groupId>
                <artifactId>xyz-lib</artifactId>
                <version>2.2</version>
            </dependency>

            <!-- Add more shared dependencies here -->

        </dependencies>
    </dependencyManagement>
</project>

Publish the BOM

Publish to your internal Nexus/Artifactory repo

Or install it locally using -> mvn install

Use BOM in Each Microservice

In each microservice's pom.xml, import the BOM under dependencyManagement

<dependencyManagement>
    <dependencies>
        <dependency>
            <groupId>com.lahiru.company</groupId>
            <artifactId>lahiru-common-dependencies-bom</artifactId>
            <version>1.0.0</version>
            <type>pom</type>
            <scope>import</scope>
        </dependency>
    </dependencies>
</dependencyManagement>

Then, just use the dependencies without specifying version:

<dependencies>
<dependency>
    <groupId>com.lhu</groupId>
    <artifactId>abc-lib</artifactId>
</dependency>
<dependency>
    <groupId>com.lhu</groupId>
    <artifactId>xyz-lib</artifactId>
</dependency>
</dependencies>

BOM with Gradle

In Gradle, you create a platform project to define dependency versions centrally. build.gradle for your BOM project (let’s call it dependencies-platform):

plugins {
    id 'java-platform'
}

javaPlatform {
    allowDependencies()
}

dependencies {
    constraints {
        api 'com.lhu:abc-lib:1.2'
        api 'com.lhu:xyz-lib:2.2'
        // Add more shared dependencies here
    }
}

settings.gradle (optional if using multi-module):
rootProject.name = 'common-dependencies-bom'

settings.gradle (optional if using multi-module):

rootProject.name = 'common-dependencies-bom'

Publish or Include

Publish this to an internal repository (Artifactory/Nexus), or Include it as a module in your multi-module Gradle setup.

./gradlew publishToMavenLocal

dependencies {
    implementation platform('com.lahiru.company:lahiru-common-dependencies-bom:1.0.0')
    implementation 'com.lhu:abc-lib'
    implementation 'com.lhu:xyz-lib'
}

EX:

AWS BOM (Bill of Materials) using this block

dependencyManagement {
    dependencies {
        dependency "com.incentivio.utils:incentivio-utils:${com_incentivio_utils_version}"
    }
    imports {
        mavenBom "com.amazonaws:aws-java-sdk-bom:${com_amazonaws_aws_java_sdk_version}"

    }
}

A BOM (Bill of Materials) does not add any dependencies to your project by itself — it only manages versions.

It brings in consistent versioning for all AWS SDK modules (like s3, sns, sqs, etc.).

Gradle now knows what version to use for each AWS SDK module.

But no AWS dependency will actually be included in your project unless you explicitly declare it.

If you want to add dependency to the project: Includes the actual library (with the version resolved via the BOM).

implementation 'com.amazonaws:aws-java-sdk-s3'