How are some gradle dependencies working with no version supplied - gradle

Question

As far as I know gradle requires a version number when setting dependencies, but partial wildcards are allowed. For example if I want Guava, I cannot do this as it fails:
compile('com.google.guava:guava')
It has to be (as an example):
compile('com.google.guava:guava:21.0')
However, I'm learning Spring, which has the following:
compile("org.springframework.boot:spring-boot-starter")
compile("org.springframework:spring-web")
compile("com.fasterxml.jackson.core:jackson-databind")
How are these dependencies working with no version supplied?
Is it because of the following, but I thought these lines were required only for my plugin 'org.springframework.boot':
buildscript {
repositories {
mavenCentral()
}
dependencies {
classpath("org.springframework.boot:spring-boot-gradle-plugin:1.4.3.RELEASE")
}
}

Answer 1

It is worth mentioning that the trick is called BOM (bill of materials) and the actual versions can be checked in the related POM file (in this example, it is for the version 2.7.0) inside spring-boot-dependencies package. This is mentioned in the Spring Boot official documentation here: Build Systems.
Another way that Spring provides this (for non Boot projects) is through Spring Platform BOM where it actually provides version for the following dependencies.
buildscript {
repositories {
jcenter()
}
dependencies {
classpath 'io.spring.gradle:dependency-management-plugin:0.6.0.RELEASE'
}
}
apply plugin: 'io.spring.dependency-management'
dependencyManagement {
imports {
mavenBom 'io.spring.platform:platform-bom:Athens-SR2'
}
}

Answer 2

TL;DR - spring boot uses custom dependencies resolver.
A spring boot plugin that is applied with the following piece of code:
apply plugin: 'spring-boot'
handles the dependencies that are listed without version. This logic is implemented in this class which delegates it to here. DependencyManagementPluginFeatures are applied here.

Answer 3

The spring boot gradle plugin documentation states the following:
The version of the spring-boot gradle plugin that you declare
determines the version of the spring-boot-starter-parent bom that is
imported (this ensures that builds are always repeatable). You should
always set the version of the spring-boot gradle plugin to the actual
Spring Boot version that you wish to use.

Answer 4

Spring Boot Dependency Management Plugin is not necessary.
You may use build-in Gradle BOM support instead of Spring Boot Dependency Management Plugin
For example:
plugins {
id 'java'
id 'org.springframework.boot' version '2.1.0.RELEASE'
}
repositories {
jcenter()
}
dependencies {
implementation platform('org.springframework.boot:spring-boot-dependencies:2.1.0.RELEASE')
implementation 'org.springframework.boot:spring-boot-starter-web'
implementation 'org.springframework.boot:spring-boot-starter-security'
}
and for multi-module project:
in root build.gradle :
plugins {
id 'java-library'
id 'org.springframework.boot' version '2.1.0.RELEASE'
}
allprojects {
apply plugin: 'java-library'
repositories {
jcenter()
}
}
dependencies {
implementation project(':core')
implementation 'org.springframework.boot:spring-boot-starter-web'
}
and in core/build.gradle
dependencies {
api platform('org.springframework.boot:spring-boot-dependencies:2.1.0.RELEASE')
implementation 'org.springframework.boot:spring-boot-starter-web'
testImplementation 'org.springframework.boot:spring-boot-starter-test'
}