springboot Dependency version for org.apache.commons:commons-compress is missing from spring-boot-gradle-plugin's pom

Hello, we've got an issue with spring-boot-gradle-plugin when used as a dependency in the project.

Used versions

Spring Boot version used: 2.3.0.RELEASE spring-boot-gradle-plugin version: 2.3.0.RELEASE Gradle version: 5.6.4 (or 6.4 the same issue)

Description

When plugin is added as one of dependencies in build.gradle:

dependencies {
    api "org.springframework.boot:spring-boot-gradle-plugin:2.3.0.RELEASE"
}

we get errors like below:

Error while running gradle dependency task:

compileClasspath - Compile classpath for source set 'main'.
Errors occurred while build effective model from C:\Users\XXXXX\.gradle\caches\modules-2\files-2.1\org.springframework.boot\spring-boot-gradle-plugin\2.3.0.RELEASE\572eb5251f62db76a2c044a7f1d8b80492727cf4\spring-boot-gradle-plugin-2.3.0.RELEASE.pom:
    'dependencies.dependency.version' for org.apache.commons:commons-compress:jar is missing. in org.springframework.boot:spring-boot-gradle-plugin:2.3.0.RELEASE

Error while running gradle compileJava task:

> Task :compileJava
Errors occurred while build effective model from C:\Users\XXXXX\.gradle\caches\modules-2\files-2.1\org.springframework.boot\spring-boot-gradle-plugin\2.3.0.RELEASE\572eb5251f62db76a2c044a7f1d8b80492727cf4\spring-boot-gradle-plugin-2.3.0.RELEASE.pom:
    'dependencies.dependency.version' for org.apache.commons:commons-compress:jar is missing. in org.springframework.boot:spring-boot-gradle-plugin:2.3.0.RELEASE

We have checked the POM of this plugin and we have found that there is a change comparing it to 2.2.x versions:

In version 2.2.7.RELEASE POM we have:

<dependency>
<groupId>org.apache.commons</groupId>
<artifactId>commons-compress</artifactId>
<version>1.19</version>
<scope>compile</scope>
</dependency>

And in version 2.3.0.RELEASE POM we have:

<dependency>
<groupId>org.apache.commons</groupId>
<artifactId>commons-compress</artifactId>
<scope>runtime</scope>
</dependency>

There is a scope change and version property was removed. With version 2.2.7.RELEASE we don't have that error.

Comment From: wilkinsona

Thanks for the report. The runtime scope of the commons-compress dependency is correct. It's an implementation detail of the plugin so it should not leak onto the compile classpath of a consuming project. If your project that is consuming spring-boot-gradle-plugin also uses commons-compress it should declare its own dependency upon it.

The missing version number is unintentional and we will fix it. Thanks for letting us know.