BOM projects

A Bill of Materials (BOM) is a POM-only artifact that centralises managed dependency versions for a family of libraries. curie build produces a ready-to-deploy .pom file — no compilation, no JAR, no tests.

What is a BOM?

In Maven's dependency model a BOM is a POM with <packaging>pom</packaging> and a <dependencyManagement> block. Consumers import it via their own [bom-imports] table and then omit versions when declaring the managed artifacts — Maven resolves the version from the BOM at build time.

Curie has always been able to consume BOMs. The [bom] project type lets you author one and publish it to a Maven repository so your whole organisation can benefit from a single source of truth for library versions.

Configuration

Declare the project with a [bom] section instead of [application] or [library]. List the artifacts and their versions in [dependencies]. Nested BOMs go in [bom-imports]:

[bom]
name    = "my-platform-bom"
version = "1.0.0"
groupId = "com.example"

# Artifacts whose versions this BOM manages.
# Every version must be explicit — empty strings are not allowed.
[dependencies]
"com.google.guava:guava"         = "33.4.8-jre"
"org.slf4j:slf4j-api"            = "2.0.17"
"ch.qos.logback:logback-classic" = "1.5.18"

# Nest another BOM — re-exported inside <dependencyManagement>.
[bom-imports]
"com.fasterxml.jackson:jackson-bom" = "2.17.2"

Building

curie build short-circuits immediately — no resolver pass, no compiler invocation, no test run. It writes a single POM to target/:

  Done  my-platform-bom 1.0.0

The output POM:

<?xml version="1.0" encoding="UTF-8"?>
<project xmlns="http://maven.apache.org/POM/4.0.0"
         xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0
           http://maven.apache.org/xsd/maven-4.0.0.xsd">
  <modelVersion>4.0.0</modelVersion>
  <groupId>com.example</groupId>
  <artifactId>my-platform-bom</artifactId>
  <version>1.0.0</version>
  <packaging>pom</packaging>
  <dependencyManagement>
    <dependencies>
      <!-- nested BOM import -->
      <dependency>
        <groupId>com.fasterxml.jackson</groupId>
        <artifactId>jackson-bom</artifactId>
        <version>2.17.2</version>
        <type>pom</type>
        <scope>import</scope>
      </dependency>
      <!-- managed versions -->
      <dependency>
        <groupId>ch.qos.logback</groupId>
        <artifactId>logback-classic</artifactId>
        <version>1.5.18</version>
      </dependency>
      …
    </dependencies>
  </dependencyManagement>
</project>

Directory layout

A BOM project has no source files — just a config file:

my-platform-bom/
├── Curie.toml          # [bom] config — the only required file
└── target/             # created by curie build
    └── my-platform-bom-1.0.0.pom

Publishing

Publishing a BOM works exactly like publishing a library — add [publish] config and run curie publish. The difference is that only the POM is uploaded; there is no JAR, sources jar, or javadoc jar:

Building my-platform-bom v1.0.0
  POM             my-platform-bom-1.0.0.pom
  Signed          1 artifact(s)
  Publishing to   https://nexus.internal/repository/releases/com/example/my-platform-bom/1.0.0
    → my-platform-bom-1.0.0.pom  (.sha1 .sha256 .sha512 .asc)
  Uploaded        5 file(s)

See the Publishing page for credentials configuration, GPG signing, and dry-run mode.

Restrictions

A [bom] project is POM-only — sections that imply compilation or runtime are not allowed:

• [test], [test-dependencies], [test-bom-imports] — BOM projects have no tests
• [annotation-processors], [test-annotation-processors] — no compilation step
• [docker], [native-image] — no runnable artifact
• Every entry in [dependencies] must have an explicit, non-empty version — BOM-delegated "" versions are not permitted

Curie validates these constraints when loading Curie.toml and reports a clear error if any are violated.

Consuming a BOM

Once published, other Curie projects import the BOM via [bom-imports] and omit versions for the managed artifacts:

[library]
name    = "my-service"
version = "0.1.0"
groupId = "com.example"

[bom-imports]
"com.example:my-platform-bom" = "1.0.0"

[dependencies]
"com.google.guava:guava"         = ""  # version from the BOM
"org.slf4j:slf4j-api"            = ""  # version from the BOM
"ch.qos.logback:logback-classic" = ""  # version from the BOM

Scaffolding

Use curie new bom to generate a minimal project skeleton — just a Curie.toml with a [bom] section and a commented-out example dependency:

Created my-platform-bom/Curie.toml

Run `curie build` inside my-platform-bom/ to generate the POM.

Workspace member

A BOM project can live alongside application and library members in a workspace. The workspace-level [bom-imports] is not re-exported into the generated BOM POM — only the entries declared directly in the member's own Curie.toml are written to <dependencyManagement>. See Workspaces for the full inheritance rules.