# Spring Dependencies in Gradle Can Be Tricky

DevFeed: [Spring Dependencies in Gradle Can Be Tricky](<https://devfeed.tech/articles/spring-dependencies-in-gradle-can-be-tricky-17705.md>)

Original publisher: [Read original article](<https://nexocode.com/blog/posts/spring-dependencies-in-gradle/>)

Author: piotr-kubowicz

Published: 2020-01-13T00:00:00Z

Content type: tutorial

Language: en

Sources: [Backend Development on nexocode](<https://devfeed.tech/sources/backend-development-on-nexocode.md>)

Topics: [Gradle](<https://devfeed.tech/topics/gradle.md>), [Dependency management](<https://devfeed.tech/topics/dependency-management.md>), [Spring Boot](<https://devfeed.tech/topics/spring-boot.md>), [Spring Framework](<https://devfeed.tech/topics/spring-framework.md>)

Tags: [build-tool](<https://devfeed.tech/tags/build-tool.md>), [dependencies](<https://devfeed.tech/tags/dependencies.md>), [gradle](<https://devfeed.tech/tags/gradle.md>), [java](<https://devfeed.tech/tags/java.md>), [jvm](<https://devfeed.tech/tags/jvm.md>), [security](<https://devfeed.tech/tags/security.md>), [spring](<https://devfeed.tech/tags/spring.md>), [spring-boot](<https://devfeed.tech/tags/spring-boot.md>), [spring-framework](<https://devfeed.tech/tags/spring-framework.md>)

## AI overview

This article explains why managing Spring dependencies with Gradle can be difficult, especially when applications use multiple Spring projects and related libraries. It recommends importing a Spring-provided BOM instead of managing versions manually, describes the history and limitations of the Spring Dependency Management Plugin, and shows that an attempted Jackson Databind version override may leave the vulnerable version in use.

## Source excerpt

Spring is the most popular Java web framework for many years and Gradle has an established position as a build tool. You might expect it's easy to find instructions on how to set up those two together -- yet the Internet is filled with advice that will get you into trouble. The official Spring documentation does not make the situation any better in this case. Using Spring in your applications typically means your classpath contains not only Spring Framework itself, but also other Spring projects like Spring Security plus Spring dependencies that are independent libraries. It may require lots of work to get versions of dependencies right, avoiding incompatible versions being used together. So a much better solution is -- not to manage all those versions manually and choose a set suggested by Spring. Technically speaking: importing a BOM (bill of materials).