Merge branch '4.1.x'

buildSrc/src/main/java/org/springframework/boot/build/bom/BomExtension.java

@@ -21,6 +21,7 @@ import java.util.Collection;
 import java.util.HashMap;
 import java.util.LinkedHashMap;
 import java.util.List;
+import java.util.Locale;
 import java.util.Map;
 import java.util.function.Function;
 import java.util.function.Predicate;
@@ -44,6 +45,7 @@ import org.springframework.boot.build.bom.BomExtension.LibraryHandler.AlignWithH
 import org.springframework.boot.build.bom.Library.BomAlignment;
 import org.springframework.boot.build.bom.Library.DependencyVersionAlignment;
 import org.springframework.boot.build.bom.Library.Exclusion;
+import org.springframework.boot.build.bom.Library.FirstParty;
 import org.springframework.boot.build.bom.Library.Group;
 import org.springframework.boot.build.bom.Library.ImportedBom;
 import org.springframework.boot.build.bom.Library.LibraryVersion;
@@ -120,8 +122,14 @@ public class BomExtension {
 				(version != null) ? version : "");
 		action.execute(libraryHandler);
 		LibraryVersion libraryVersion = new LibraryVersion(DependencyVersion.parse(libraryHandler.version));
+		FirstParty firstParty = null;
+		if (libraryHandler.firstParty) {
+			String releaseTrainId = (libraryHandler.releaseTrainId != null) ? libraryHandler.releaseTrainId
+					: name.replace(' ', '-').toLowerCase(Locale.ROOT);
+			firstParty = new FirstParty(releaseTrainId);
+		}
 		addLibrary(new Library(name, libraryHandler.calendarName, libraryVersion, libraryHandler.groups,
-				libraryHandler.upgradePolicy, libraryHandler.prohibitedVersions, libraryHandler.considerSnapshots,
+				libraryHandler.upgradePolicy, libraryHandler.prohibitedVersions, firstParty,
 				versionAlignment(libraryHandler), libraryHandler.alignWith.bomAlignment, libraryHandler.linkRootName,
 				libraryHandler.links));
 	}
@@ -212,7 +220,9 @@ public class BomExtension {
 
 		private final AlignWithHandler alignWith;
 
-		private boolean considerSnapshots;
+		private boolean firstParty = false;
+
+		private String releaseTrainId = null;
 
 		private String version;
 
@@ -233,8 +243,15 @@ public class BomExtension {
 			this.version = version;
 		}
 
-		public void considerSnapshots() {
-			this.considerSnapshots = true;
+		public void firstParty() {
+			this.firstParty = true;
+		}
+
+		public void firstParty(Action<FirstPartyHandler> action) {
+			FirstPartyHandler handler = new FirstPartyHandler();
+			action.execute(handler);
+			this.firstParty = true;
+			this.releaseTrainId = handler.releaseTrainId;
 		}
 
 		public void setCalendarName(String calendarName) {
@@ -493,6 +510,16 @@ public class BomExtension {
 
 		}
 
+		public static class FirstPartyHandler {
+
+			private String releaseTrainId;
+
+			public void setReleaseTrainId(String releaseTrainId) {
+				this.releaseTrainId = releaseTrainId;
+			}
+
+		}
+
 	}
 
 	public static class LinksHandler {

buildSrc/src/main/java/org/springframework/boot/build/bom/Library.java

@@ -73,7 +73,7 @@ public class Library {
 
 	private final List<ProhibitedVersion> prohibitedVersions;
 
-	private final boolean considerSnapshots;
+	private final FirstParty firstParty;
 
 	private final VersionAlignment versionAlignment;
 
@@ -94,7 +94,7 @@ public class Library {
 	 * @param upgradePolicy the upgrade policy of the library, or {@code null} to use the
 	 * containing bom's policy
 	 * @param prohibitedVersions version of the library that are prohibited
-	 * @param considerSnapshots whether to consider snapshots
+	 * @param firstParty configuration for a first-party library
 	 * @param versionAlignment version alignment, if any, for the library
 	 * @param bomAlignment the bom, if any, that this library should align with
 	 * @param linkRootName the root name to use when generating link variable or
@@ -102,7 +102,7 @@ public class Library {
 	 * @param links a list of HTTP links relevant to the library
 	 */
 	public Library(String name, String calendarName, LibraryVersion version, List<Group> groups,
-			UpgradePolicy upgradePolicy, List<ProhibitedVersion> prohibitedVersions, boolean considerSnapshots,
+			UpgradePolicy upgradePolicy, List<ProhibitedVersion> prohibitedVersions, FirstParty firstParty,
 			VersionAlignment versionAlignment, BomAlignment bomAlignment, String linkRootName,
 			Map<String, List<Link>> links) {
 		this.name = name;
@@ -113,7 +113,7 @@ public class Library {
 				: name.toLowerCase(Locale.ENGLISH).replace(' ', '-') + ".version";
 		this.upgradePolicy = upgradePolicy;
 		this.prohibitedVersions = prohibitedVersions;
-		this.considerSnapshots = considerSnapshots;
+		this.firstParty = firstParty;
 		this.versionAlignment = versionAlignment;
 		this.bomAlignment = bomAlignment;
 		this.linkRootName = (linkRootName != null) ? linkRootName : generateLinkRootName(name);
@@ -152,8 +152,12 @@ public class Library {
 		return this.prohibitedVersions;
 	}
 
-	public boolean isConsiderSnapshots() {
-		return this.considerSnapshots;
+	public FirstParty getFirstParty() {
+		return this.firstParty;
+	}
+
+	public boolean isFirstParty() {
+		return this.firstParty != null;
 	}
 
 	public VersionAlignment getVersionAlignment() {
@@ -193,8 +197,8 @@ public class Library {
 
 	public Library withVersion(LibraryVersion version) {
 		return new Library(this.name, this.calendarName, version, this.groups, this.upgradePolicy,
-				this.prohibitedVersions, this.considerSnapshots, this.versionAlignment, this.bomAlignment,
-				this.linkRootName, this.links);
+				this.prohibitedVersions, this.firstParty, this.versionAlignment, this.bomAlignment, this.linkRootName,
+				this.links);
 	}
 
 	/**
@@ -698,6 +702,20 @@ public class Library {
 
 	}
 
+	public static class FirstParty {
+
+		private final String releaseTrainId;
+
+		public FirstParty(String releaseTrainId) {
+			this.releaseTrainId = releaseTrainId;
+		}
+
+		public String getReleaseTrainId() {
+			return this.releaseTrainId;
+		}
+
+	}
+
 	public record Link(String rootName, Function<LibraryVersion, String> factory, List<String> packages) {
 
 		private static final Pattern PACKAGE_EXPAND = Pattern.compile("^(.*)\\[(.*)\\]$");

buildSrc/src/main/java/org/springframework/boot/build/bom/bomr/MavenMetadataVersionResolver.java

@@ -34,6 +34,7 @@ import org.gradle.internal.artifacts.repositories.AuthenticationSupportedInterna
 import org.w3c.dom.Document;
 import org.w3c.dom.NodeList;
 
+import org.springframework.boot.build.bom.Library;
 import org.springframework.boot.build.bom.bomr.version.DependencyVersion;
 import org.springframework.boot.build.xml.XmlDocument;
 import org.springframework.http.HttpStatus;
@@ -67,7 +68,7 @@ final class MavenMetadataVersionResolver implements VersionResolver {
 	}
 
 	@Override
-	public SortedSet<DependencyVersion> resolveVersions(String groupId, String artifactId) {
+	public SortedSet<DependencyVersion> resolveVersions(String groupId, String artifactId, Library library) {
 		Set<String> versions = new HashSet<>();
 		for (MavenArtifactRepository repository : this.repositories) {
 			versions.addAll(resolveVersions(groupId, artifactId, repository));

buildSrc/src/main/java/org/springframework/boot/build/bom/bomr/MoveToSnapshots.java

@@ -66,14 +66,17 @@ public abstract class MoveToSnapshots extends UpgradeDependencies {
 	}
 
 	@Override
-	protected String commitMessage(Upgrade upgrade, int issueNumber) {
-		return "Start building against " + upgrade.toRelease().getNameAndVersion() + " snapshots" + "\n\nSee gh-"
-				+ issueNumber;
+	protected String commitMessage(Upgrade upgrade, Integer issueNumber) {
+		String message = "Start building against " + upgrade.toRelease().getNameAndVersion() + " snapshots";
+		if (issueNumber != null) {
+			message += "\n\nSee gh-" + issueNumber;
+		}
+		return message;
 	}
 
 	@Override
 	protected boolean eligible(Library library) {
-		return library.isConsiderSnapshots() && super.eligible(library);
+		return library.isFirstParty() && super.eligible(library);
 	}
 
 	@Override

buildSrc/src/main/java/org/springframework/boot/build/bom/bomr/ReleaseTrainVersionResolver.java

@@ -0,0 +1,75 @@
+/*
+ * Copyright 2012-present the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.springframework.boot.build.bom.bomr;
+
+import java.util.ArrayList;
+import java.util.Collections;
+import java.util.List;
+import java.util.Map;
+import java.util.SortedSet;
+import java.util.TreeMap;
+import java.util.TreeSet;
+import java.util.stream.Collectors;
+
+import tools.jackson.databind.json.JsonMapper;
+import tools.jackson.databind.type.TypeFactory;
+
+import org.springframework.boot.build.bom.Library;
+import org.springframework.boot.build.bom.bomr.github.GitHub;
+import org.springframework.boot.build.bom.bomr.version.DependencyVersion;
+
+/**
+ * A {@link VersionResolver version resolver} that resolves versions from a release train.
+ *
+ * @author Andy Wilkinson
+ */
+public class ReleaseTrainVersionResolver implements VersionResolver {
+
+	private final Map<String, SortedSet<DependencyVersion>> versions;
+
+	ReleaseTrainVersionResolver(GitHub gitHub, String releaseTrain) {
+		this.versions = parseVersions(getRawVersions(gitHub, releaseTrain));
+	}
+
+	private static Map<String, List<String>> getRawVersions(GitHub gitHub, String releaseTrain) {
+		String content = gitHub.getRepository("spring-io", "release-train")
+			.getContent("release-versions.json", releaseTrain);
+		TypeFactory typeFactory = TypeFactory.createDefaultInstance();
+		return JsonMapper.shared()
+			.readerFor(typeFactory.constructMapLikeType(TreeMap.class, typeFactory.constructType(String.class),
+					typeFactory.constructCollectionLikeType(ArrayList.class, String.class)))
+			.readValue(content);
+	}
+
+	private static Map<String, SortedSet<DependencyVersion>> parseVersions(Map<String, List<String>> rawVersions) {
+		Map<String, SortedSet<DependencyVersion>> parsedVersions = new TreeMap<>();
+		rawVersions.forEach((project, versions) -> parsedVersions.put(project,
+				new TreeSet<>(versions.stream().map(DependencyVersion::parse).collect(Collectors.toSet()))));
+		return parsedVersions;
+	}
+
+	@Override
+	public SortedSet<DependencyVersion> resolveVersions(String groupId, String artifactId, Library library) {
+		if (!library.isFirstParty()) {
+			return Collections.emptySortedSet();
+		}
+		SortedSet<DependencyVersion> result = this.versions.getOrDefault(library.getFirstParty().getReleaseTrainId(),
+				Collections.emptySortedSet());
+		return result;
+	}
+
+}

buildSrc/src/main/java/org/springframework/boot/build/bom/bomr/StandardLibraryUpdateResolver.java

@@ -110,15 +110,13 @@ class StandardLibraryUpdateResolver implements LibraryUpdateResolver {
 		for (Group group : library.getGroups()) {
 			for (Module module : group.getModules()) {
 				moduleVersions.put(group.getId() + ":" + module.getName(),
-						getLaterVersionsForModule(group.getId(), module.getName(), library));
+						getVersionsForModule(group.getId(), module.getName(), library));
 			}
 			for (ImportedBom bom : group.getBoms()) {
-				moduleVersions.put(group.getId() + ":" + bom,
-						getLaterVersionsForModule(group.getId(), bom.name(), library));
+				moduleVersions.put(group.getId() + ":" + bom, getVersionsForModule(group.getId(), bom.name(), library));
 			}
 			for (String plugin : group.getPlugins()) {
-				moduleVersions.put(group.getId() + ":" + plugin,
-						getLaterVersionsForModule(group.getId(), plugin, library));
+				moduleVersions.put(group.getId() + ":" + plugin, getVersionsForModule(group.getId(), plugin, library));
 			}
 		}
 		List<VersionOption> versionOptions = new ArrayList<>();
@@ -146,8 +144,8 @@ class StandardLibraryUpdateResolver implements LibraryUpdateResolver {
 		return missingModules;
 	}
 
-	private SortedSet<DependencyVersion> getLaterVersionsForModule(String groupId, String artifactId, Library library) {
-		return this.versionResolver.resolveVersions(groupId, artifactId);
+	private SortedSet<DependencyVersion> getVersionsForModule(String groupId, String artifactId, Library library) {
+		return this.versionResolver.resolveVersions(groupId, artifactId, library);
 	}
 
 }

buildSrc/src/main/java/org/springframework/boot/build/bom/bomr/UpgradeBom.java

@@ -62,8 +62,12 @@ public abstract class UpgradeBom extends UpgradeDependencies {
 	}
 
 	@Override
-	protected String commitMessage(Upgrade upgrade, int issueNumber) {
-		return issueTitle(upgrade) + "\n\nCloses gh-" + issueNumber;
+	protected String commitMessage(Upgrade upgrade, Integer issueNumber) {
+		String message = issueTitle(upgrade);
+		if (issueNumber != null) {
+			message += "\n\nCloses gh-" + issueNumber;
+		}
+		return message;
 	}
 
 	@Override

buildSrc/src/main/java/org/springframework/boot/build/bom/bomr/UpgradeDependencies.java

@@ -92,6 +92,11 @@ public abstract class UpgradeDependencies extends DefaultTask {
 	@Option(option = "milestone", description = "Milestone to which dependency upgrade issues should be assigned")
 	public abstract Property<String> getMilestone();
 
+	@Input
+	@Optional
+	@Option(option = "release-train", description = "Release train from which dependency versions should be resolved")
+	public abstract Property<String> getReleaseTrain();
+
 	@Input
 	@Optional
 	@Option(option = "threads", description = "Number of Threads to use for update resolution")
@@ -108,12 +113,18 @@ public abstract class UpgradeDependencies extends DefaultTask {
 			description = "Whether to perform a dry run that doesn't open issues or change the bom")
 	public abstract Property<Boolean> getDryRun();
 
+	@Input
+	@Optional
+	@Option(option = "no-issues", description = "Whether to disable issue creation")
+	public abstract Property<Boolean> getNoIssues();
+
 	@Input
 	abstract ListProperty<String> getRepositoryNames();
 
 	@TaskAction
 	void upgradeDependencies() {
-		GitHubRepository repository = createGitHub().getRepository(this.bom.getUpgrade().getGitHub().getOrganization(),
+		GitHub gitHub = createGitHub("bomr.github.password");
+		GitHubRepository repository = gitHub.getRepository(this.bom.getUpgrade().getGitHub().getOrganization(),
 				this.bom.getUpgrade().getGitHub().getRepository());
 		List<String> issueLabels = verifyLabels(repository);
 		Milestone milestone = determineMilestone(repository);
@@ -138,15 +149,18 @@ public abstract class UpgradeDependencies extends DefaultTask {
 			Issue existingUpgradeIssue = findExistingUpgradeIssue(existingUpgradeIssues, upgrade);
 			try {
 				Path modified = this.upgradeApplicator.apply(upgrade);
-				String title = issueTitle(upgrade);
-				String body = issueBody(upgrade, existingUpgradeIssue);
-				int issueNumber = getOrOpenUpgradeIssue(repository, issueLabels, milestone, title, body,
-						existingUpgradeIssue);
-				if (existingUpgradeIssue != null && existingUpgradeIssue.getState() == Issue.State.CLOSED) {
-					existingUpgradeIssue.label(Arrays.asList("type: task", "status: superseded"));
+				Integer issueNumber = null;
+				if (!getNoIssues().getOrElse(Boolean.FALSE)) {
+					String title = issueTitle(upgrade);
+					String body = issueBody(upgrade, existingUpgradeIssue);
+					issueNumber = getOrOpenUpgradeIssue(repository, issueLabels, milestone, title, body,
+							existingUpgradeIssue);
+					if (existingUpgradeIssue != null && existingUpgradeIssue.getState() == Issue.State.CLOSED) {
+						existingUpgradeIssue.label(Arrays.asList("type: task", "status: superseded"));
+					}
+					System.out.println("   Issue: " + issueNumber + " - " + title
+							+ getExistingUpgradeIssueMessageDetails(existingUpgradeIssue));
 				}
-				System.out.println("   Issue: " + issueNumber + " - " + title
-						+ getExistingUpgradeIssueMessageDetails(existingUpgradeIssue));
 				if (new ProcessBuilder().command("git", "add", modified.toFile().getAbsolutePath())
 					.start()
 					.waitFor() != 0) {
@@ -156,7 +170,9 @@ public abstract class UpgradeDependencies extends DefaultTask {
 				if (new ProcessBuilder().command("git", "commit", "-m", commitMessage).start().waitFor() != 0) {
 					throw new IllegalStateException("git commit failed");
 				}
-				System.out.println("  Commit: " + commitMessage.substring(0, commitMessage.indexOf('\n')));
+				int newlineIndex = commitMessage.indexOf('\n');
+				System.out.println("  Commit: "
+						+ ((newlineIndex > -1) ? commitMessage.substring(0, newlineIndex) : commitMessage));
 			}
 			catch (IOException ex) {
 				throw new TaskExecutionException(this, ex);
@@ -198,12 +214,12 @@ public abstract class UpgradeDependencies extends DefaultTask {
 		return issueLabels;
 	}
 
-	private GitHub createGitHub() {
+	private GitHub createGitHub(String passwordProperty) {
 		Properties bomrProperties = new Properties();
 		try (Reader reader = new FileReader(new File(System.getProperty("user.home"), ".bomr.properties"))) {
 			bomrProperties.load(reader);
 			String username = bomrProperties.getProperty("bomr.github.username");
-			String password = bomrProperties.getProperty("bomr.github.password");
+			String password = bomrProperties.getProperty(passwordProperty);
 			return GitHub.withCredentials(username, password);
 		}
 		catch (IOException ex) {
@@ -245,12 +261,19 @@ public abstract class UpgradeDependencies extends DefaultTask {
 	}
 
 	private LibraryUpdateResolver getLibraryUpdateResolver(Milestone milestone) {
-		VersionResolver versionResolver = new MavenMetadataVersionResolver(getRepositories());
+		VersionResolver versionResolver = getVersionResolver();
 		LibraryUpdateResolver libraryResolver = new StandardLibraryUpdateResolver(versionResolver,
 				createVersionOptionResolver(milestone));
 		return new MultithreadedLibraryUpdateResolver(getThreads().get(), libraryResolver);
 	}
 
+	private VersionResolver getVersionResolver() {
+		String releaseTrain = getReleaseTrain().getOrNull();
+		return (releaseTrain != null)
+				? new ReleaseTrainVersionResolver(createGitHub("bomr.github.release-train-token"), releaseTrain)
+				: new MavenMetadataVersionResolver(getRepositories());
+	}
+
 	private Collection<MavenArtifactRepository> getRepositories() {
 		return getRepositoryNames().map(this::asRepositories).get();
 	}
@@ -311,7 +334,7 @@ public abstract class UpgradeDependencies extends DefaultTask {
 		return libraryPredicate.test(library.getName());
 	}
 
-	protected abstract String commitMessage(Upgrade upgrade, int issueNumber);
+	protected abstract String commitMessage(Upgrade upgrade, Integer issueNumber);
 
 	protected String issueTitle(Upgrade upgrade) {
 		return "Upgrade to " + upgrade.toRelease().getNameAndVersion();

buildSrc/src/main/java/org/springframework/boot/build/bom/bomr/VersionResolver.java

@@ -18,6 +18,7 @@ package org.springframework.boot.build.bom.bomr;
 
 import java.util.SortedSet;
 
+import org.springframework.boot.build.bom.Library;
 import org.springframework.boot.build.bom.bomr.version.DependencyVersion;
 
 /**
@@ -32,8 +33,9 @@ interface VersionResolver {
 	 * {@code groupId} and {@code artifactId}.
 	 * @param groupId module's group ID
 	 * @param artifactId module's artifact ID
+	 * @param library the library to which the module belongs
 	 * @return the available versions
 	 */
-	SortedSet<DependencyVersion> resolveVersions(String groupId, String artifactId);
+	SortedSet<DependencyVersion> resolveVersions(String groupId, String artifactId, Library library);
 
 }

buildSrc/src/main/java/org/springframework/boot/build/bom/bomr/github/GitHubRepository.java

@@ -58,4 +58,12 @@ public interface GitHubRepository {
 	 */
 	List<Issue> findIssues(List<String> labels, Milestone milestone);
 
+	/**
+	 * Returns the content of the repository at the given {@code path} and {@code ref}.
+	 * @param path the path in the repository
+	 * @param ref the ref in the repository, typically a branch name
+	 * @return the content, possibly {@code null}
+	 */
+	String getContent(String path, String ref);
+
 }

buildSrc/src/main/java/org/springframework/boot/build/bom/bomr/github/StandardGitHub.java

@@ -16,8 +16,6 @@
 
 package org.springframework.boot.build.bom.bomr.github;
 
-import java.util.Base64;
-
 import org.springframework.http.MediaType;
 import org.springframework.http.converter.json.JacksonJsonHttpMessageConverter;
 import org.springframework.web.client.RestClient;
@@ -50,10 +48,7 @@ final class StandardGitHub implements GitHub {
 				.withJsonConverter(new JacksonJsonHttpMessageConverter()))
 			.requestInterceptor((request, body, execution) -> {
 				request.getHeaders().add("User-Agent", StandardGitHub.this.username);
-				request.getHeaders()
-					.add("Authorization", "Basic " + Base64.getEncoder()
-						.encodeToString(
-								(StandardGitHub.this.username + ":" + StandardGitHub.this.password).getBytes()));
+				request.getHeaders().add("Authorization", "Bearer " + StandardGitHub.this.password);
 				request.getHeaders().add("Accept", MediaType.APPLICATION_JSON_VALUE);
 				return execution.execute(request, body);
 			})

buildSrc/src/main/java/org/springframework/boot/build/bom/bomr/github/StandardGitHubRepository.java

@@ -16,8 +16,10 @@
 
 package org.springframework.boot.build.bom.bomr.github;
 
+import java.nio.charset.StandardCharsets;
 import java.time.Duration;
 import java.time.OffsetDateTime;
+import java.util.Base64;
 import java.util.HashMap;
 import java.util.HashSet;
 import java.util.List;
@@ -94,6 +96,19 @@ final class StandardGitHubRepository implements GitHubRepository {
 						Issue.State.of((String) issue.get("state"))));
 	}
 
+	@Override
+	@SuppressWarnings("rawtypes")
+	public String getContent(String path, String ref) {
+		Map body = this.rest.get().uri("contents/" + path + "?ref=" + ref).retrieve().body(Map.class);
+		return base64Decode((String) body.get("content"));
+
+	}
+
+	private String base64Decode(String encoded) {
+		return new String(Base64.getDecoder().decode(encoded.replace("\n", "").getBytes(StandardCharsets.UTF_8)),
+				StandardCharsets.UTF_8);
+	}
+
 	@SuppressWarnings({ "rawtypes", "unchecked" })
 	private <T> List<T> get(String name, Function<Map<String, Object>, T> mapper) {
 		ResponseEntity<List> response = this.rest.get().uri(name).retrieve().toEntity(List.class);

buildSrc/src/test/java/org/springframework/boot/build/antora/AntoraAsciidocAttributesTests.java

@@ -27,6 +27,7 @@ import org.junit.jupiter.api.Test;
 
 import org.springframework.boot.build.bom.Library;
 import org.springframework.boot.build.bom.Library.BomAlignment;
+import org.springframework.boot.build.bom.Library.FirstParty;
 import org.springframework.boot.build.bom.Library.Group;
 import org.springframework.boot.build.bom.Library.LibraryVersion;
 import org.springframework.boot.build.bom.Library.Link;
@@ -234,11 +235,11 @@ class AntoraAsciidocAttributesTests {
 		LibraryVersion version = new LibraryVersion(DependencyVersion.parse("1.2.3"));
 		List<Group> groups = Collections.emptyList();
 		List<ProhibitedVersion> prohibitedVersion = Collections.emptyList();
-		boolean considerSnapshots = false;
+		FirstParty firstParty = null;
 		VersionAlignment versionAlignment = null;
 		BomAlignment alignsWithBom = null;
 		String linkRootName = null;
-		Library library = new Library(name, calendarName, version, groups, null, prohibitedVersion, considerSnapshots,
+		Library library = new Library(name, calendarName, version, groups, null, prohibitedVersion, firstParty,
 				versionAlignment, alignsWithBom, linkRootName, links);
 		return library;
 	}

buildSrc/src/test/java/org/springframework/boot/build/bom/LibraryTests.java

@@ -23,6 +23,7 @@ import java.util.Map;
 import org.junit.jupiter.api.Test;
 
 import org.springframework.boot.build.bom.Library.BomAlignment;
+import org.springframework.boot.build.bom.Library.FirstParty;
 import org.springframework.boot.build.bom.Library.Group;
 import org.springframework.boot.build.bom.Library.LibraryVersion;
 import org.springframework.boot.build.bom.Library.Link;
@@ -46,12 +47,12 @@ class LibraryTests {
 		LibraryVersion version = new LibraryVersion(DependencyVersion.parse("1.2.3"));
 		List<Group> groups = Collections.emptyList();
 		List<ProhibitedVersion> prohibitedVersion = Collections.emptyList();
-		boolean considerSnapshots = false;
+		FirstParty firstParty = null;
 		VersionAlignment versionAlignment = null;
 		BomAlignment alignsWithBom = null;
 		String linkRootName = null;
 		Map<String, List<Link>> links = Collections.emptyMap();
-		Library library = new Library(name, calendarName, version, groups, null, prohibitedVersion, considerSnapshots,
+		Library library = new Library(name, calendarName, version, groups, null, prohibitedVersion, firstParty,
 				versionAlignment, alignsWithBom, linkRootName, links);
 		assertThat(library.getLinkRootName()).isEqualTo("spring-framework");
 	}
@@ -63,12 +64,12 @@ class LibraryTests {
 		LibraryVersion version = new LibraryVersion(DependencyVersion.parse("1.2.3"));
 		List<Group> groups = Collections.emptyList();
 		List<ProhibitedVersion> prohibitedVersion = Collections.emptyList();
-		boolean considerSnapshots = false;
+		FirstParty firstParty = null;
 		VersionAlignment versionAlignment = null;
 		BomAlignment alignsWithBom = null;
 		String linkRootName = "spring-data";
 		Map<String, List<Link>> links = Collections.emptyMap();
-		Library library = new Library(name, calendarName, version, groups, null, prohibitedVersion, considerSnapshots,
+		Library library = new Library(name, calendarName, version, groups, null, prohibitedVersion, firstParty,
 				versionAlignment, alignsWithBom, linkRootName, links);
 		assertThat(library.getLinkRootName()).isEqualTo("spring-data");
 	}

buildSrc/src/test/java/org/springframework/boot/build/bom/bomr/InteractiveUpgradeResolverTests.java

@@ -48,7 +48,7 @@ class InteractiveUpgradeResolverTests {
 		List<Library> libraries = new ArrayList<>();
 		DependencyVersion version = DependencyVersion.parse("1.0.0");
 		LibraryVersion libraryVersion = new LibraryVersion(version);
-		Library library = new Library("test", null, libraryVersion, null, null, null, false, null, null, null, null);
+		Library library = new Library("test", null, libraryVersion, null, null, null, null, null, null, null, null);
 		libraries.add(library);
 		List<Library> librariesToUpgrade = new ArrayList<>();
 		librariesToUpgrade.add(library);

buildSrc/src/test/java/org/springframework/boot/build/bom/bomr/UpgradeApplicatorTests.java

@@ -53,7 +53,7 @@ class UpgradeApplicatorTests {
 		File gradleProperties = new File(this.temp, "gradle.properties");
 		FileCopyUtils.copy(new File("src/test/resources/gradle.properties"), gradleProperties);
 		Library activeMq = new Library("ActiveMQ", null, new LibraryVersion(DependencyVersion.parse("5.15.11")), null,
-				null, null, false, null, null, null, Collections.emptyMap());
+				null, null, null, null, null, null, Collections.emptyMap());
 		new UpgradeApplicator(bom.toPath(), gradleProperties.toPath())
 			.apply(new Upgrade(activeMq, activeMq.withVersion(new LibraryVersion(DependencyVersion.parse("5.16")))));
 		String bomContents = Files.readString(bom.toPath());
@@ -67,7 +67,7 @@ class UpgradeApplicatorTests {
 		File gradleProperties = new File(this.temp, "gradle.properties");
 		FileCopyUtils.copy(new File("src/test/resources/gradle.properties"), gradleProperties);
 		Library kotlin = new Library("Kotlin", null, new LibraryVersion(DependencyVersion.parse("1.3.70")), null, null,
-				null, false, null, null, null, Collections.emptyMap());
+				null, null, null, null, null, Collections.emptyMap());
 		new UpgradeApplicator(bom.toPath(), gradleProperties.toPath())
 			.apply(new Upgrade(kotlin, kotlin.withVersion(new LibraryVersion(DependencyVersion.parse("1.4")))));
 		Properties properties = new Properties();

buildSrc/src/test/java/org/springframework/boot/build/bom/bomr/UpgradeTests.java

@@ -34,7 +34,7 @@ class UpgradeTests {
 	@Test
 	void createToRelease() {
 		Library from = new Library("Test", null, new LibraryVersion(DependencyVersion.parse("1.0.0")), null, null, null,
-				false, null, null, null, null);
+				null, null, null, null, null);
 		Upgrade upgrade = new Upgrade(from, from.withVersion(new LibraryVersion(DependencyVersion.parse("1.0.1"))));
 		assertThat(upgrade.from().getNameAndVersion()).isEqualTo("Test 1.0.0");
 		assertThat(upgrade.to().getNameAndVersion()).isEqualTo("Test 1.0.1");
@@ -44,7 +44,7 @@ class UpgradeTests {
 	@Test
 	void createToSnapshot() {
 		Library from = new Library("Test", null, new LibraryVersion(DependencyVersion.parse("1.0.0")), null, null, null,
-				false, null, null, null, null);
+				null, null, null, null, null);
 		Upgrade upgrade = new Upgrade(from,
 				from.withVersion(new LibraryVersion(DependencyVersion.parse("1.0.1-SNAPSHOT"))),
 				from.withVersion(new LibraryVersion(DependencyVersion.parse("1.0.1"))));

platform/spring-boot-dependencies/build.gradle

@@ -1627,7 +1627,7 @@ bom {
 		}
 	}
 	library("Micrometer", "1.17.0") {
-		considerSnapshots()
+		firstParty()
 		group("io.micrometer") {
 			modules = [
 				"micrometer-registry-stackdriver" {
@@ -1650,7 +1650,7 @@ bom {
 		}
 	}
 	library("Micrometer Tracing", "1.7.0") {
-		considerSnapshots()
+		firstParty()
 		group("io.micrometer") {
 			bom("micrometer-tracing-bom")
 		}
@@ -1979,7 +1979,7 @@ bom {
 		}
 	}
 	library("R2DBC H2", "1.1.0.RELEASE") {
-		considerSnapshots()
+		firstParty()
 		group("io.r2dbc") {
 			modules = [
 				"r2dbc-h2"
@@ -2020,7 +2020,7 @@ bom {
 		}
 	}
 	library("R2DBC Pool", "1.0.2.RELEASE") {
-		considerSnapshots()
+		firstParty()
 		group("io.r2dbc") {
 			modules = [
 				"r2dbc-pool"
@@ -2032,7 +2032,7 @@ bom {
 		}
 	}
 	library("R2DBC Postgresql", "1.1.2.RELEASE") {
-		considerSnapshots()
+		firstParty()
 		group("org.postgresql") {
 			modules = [
 				"r2dbc-postgresql"
@@ -2043,7 +2043,7 @@ bom {
 		}
 	}
 	library("R2DBC Proxy", "1.1.6.RELEASE") {
-		considerSnapshots()
+		firstParty()
 		group("io.r2dbc") {
 			modules = [
 				"r2dbc-proxy"
@@ -2054,7 +2054,7 @@ bom {
 		}
 	}
 	library("R2DBC SPI", "1.0.0.RELEASE") {
-		considerSnapshots()
+		firstParty()
 		group("io.r2dbc") {
 			modules = [
 				"r2dbc-spi"
@@ -2109,7 +2109,7 @@ bom {
 		}
 	}
 	library("Reactor Bom", "2026.0.0-SNAPSHOT") {
-		considerSnapshots()
+		firstParty()
 		calendarName = "Reactor"
 		group("io.projectreactor") {
 			bom("reactor-bom")
@@ -2546,7 +2546,7 @@ bom {
 		}
 	}
 	library("Spring AMQP", "4.1.0") {
-		considerSnapshots()
+		firstParty()
 		group("org.springframework.amqp") {
 			bom("spring-amqp-bom")
 		}
@@ -2561,7 +2561,7 @@ bom {
 		}
 	}
 	library("Spring Batch", "6.0.4") {
-		considerSnapshots()
+		firstParty()
 		group("org.springframework.batch") {
 			bom("spring-batch-bom")
 		}
@@ -2576,7 +2576,7 @@ bom {
 		}
 	}
 	library("Spring Data Bom", "2026.0.0") {
-		considerSnapshots()
+		firstParty()
 		calendarName = "Spring Data Release"
 		group("org.springframework.data") {
 			bom("spring-data-bom")
@@ -2588,7 +2588,7 @@ bom {
 		}
 	}
 	library("Spring Framework", "${springFrameworkVersion}") {
-		considerSnapshots()
+		firstParty()
 		group("org.springframework") {
 			bom("spring-framework-bom")
 		}
@@ -2606,7 +2606,7 @@ bom {
 		}
 	}
 	library("Spring GraphQL", "2.0.4") {
-		considerSnapshots()
+		firstParty()
 		group("org.springframework.graphql") {
 			modules = [
 					"spring-graphql",
@@ -2624,7 +2624,7 @@ bom {
 		}
 	}
 	library("Spring gRPC", "${springGrpcVersion}") {
-		considerSnapshots()
+		firstParty()
 		group("org.springframework.grpc") {
 			modules = [
 					"spring-grpc-core"
@@ -2641,7 +2641,7 @@ bom {
 		}
 	}
 	library("Spring HATEOAS", "3.1.1") {
-		considerSnapshots()
+		firstParty()
 		group("org.springframework.hateoas") {
 			modules = [
 				"spring-hateoas"
@@ -2658,7 +2658,7 @@ bom {
 		}
 	}
 	library("Spring Integration", "7.1.0") {
-		considerSnapshots()
+		firstParty()
 		group("org.springframework.integration") {
 			bom("spring-integration-bom")
 		}
@@ -2673,7 +2673,7 @@ bom {
 		}
 	}
 	library("Spring Kafka", "4.1.0") {
-		considerSnapshots()
+		firstParty()
 		group("org.springframework.kafka") {
 			modules = [
 				"spring-kafka",
@@ -2691,7 +2691,7 @@ bom {
 		}
 	}
 	library("Spring LDAP", "4.1.0") {
-		considerSnapshots()
+		firstParty()
 		group("org.springframework.ldap") {
 			modules = [
 				"spring-ldap-core",
@@ -2711,7 +2711,7 @@ bom {
 		}
 	}
 	library("Spring Pulsar", "2.0.6") {
-		considerSnapshots()
+		firstParty()
 		group("org.springframework.pulsar") {
 			bom("spring-pulsar-bom")
 		}
@@ -2726,7 +2726,7 @@ bom {
 		}
 	}
 	library("Spring RESTDocs", "4.0.1") {
-		considerSnapshots()
+		firstParty()
 		group("org.springframework.restdocs") {
 			bom("spring-restdocs-bom")
 		}
@@ -2741,7 +2741,7 @@ bom {
 		}
 	}
 	library("Spring Security", "7.1.0") {
-		considerSnapshots()
+		firstParty()
 		group("org.springframework.security") {
 			bom("spring-security-bom")
 		}
@@ -2756,7 +2756,7 @@ bom {
 		}
 	}
 	library("Spring Session", "4.1.0") {
-		considerSnapshots()
+		firstParty()
 		prohibit {
 			startsWith(["Apple-", "Bean-", "Corn-", "Dragonfruit-"])
 			because "Spring Session switched to numeric version numbers"
@@ -2779,7 +2779,7 @@ bom {
 		}
 	}
 	library("Spring WS", "5.0.2") {
-		considerSnapshots()
+		firstParty()
 		group("org.springframework.ws") {
 			bom("spring-ws-bom")
 		}