flowable-app-nes

A minimal Spring Boot app with one REST endpoint, built on org.flowable:flowable-common-rest:7.2.0. Every Spring artifact comes from HeroDevs NES, not from the end-of-life OSS releases.

Flowable 7.2.0 is built against Spring Framework 6.2.10 and Spring Boot 3.5.4. Left alone, flowable-common-rest pulls in spring-beans, spring-context, spring-core, spring-tx, spring-web and spring-webmvc at 6.2.10. This project overrides those versions so they resolve to the NES builds instead.

How the override works

The pom.xml does two things:

1. It uses the NES Spring Boot parent, org.springframework.boot:spring-boot-starter-parent:3.5.16-spring-boot-3.5.20. Its spring-boot-dependencies BOM imports the NES spring-framework-bom at 6.2.19-spring-framework-6.2.21. Maven's dependency management wins over the versions Flowable declares, so the Spring jars Flowable pulls in transitively get the NES version too.
2. It runs maven-enforcer-plugin with a bannedDependencies rule. The build fails if any org.springframework:* artifact isn't ${spring-framework.version}, or any org.springframework.boot:* artifact isn't the parent's version.

Why a Spring Boot parent

Flowable doesn't need Spring Boot. The project uses it because it's the shortest route to a runnable REST endpoint: embedded Tomcat, autoconfigured Spring MVC and Jackson, and an executable jar. The parent brings in Boot's dependency management (so starters need no version), the spring-boot-maven-plugin repackage setup, and properties such as java.version.

The parent isn't required. You could import spring-boot-dependencies as a BOM and configure the plugin yourself, or drop Boot and start an embedded Tomcat with a DispatcherServlet from plain spring-webmvc. Without the parent, you'd import the NES spring-framework-bom in dependencyManagement yourself to keep the override. You'd do the same to run a newer NES Spring Framework than the NES Boot release pins.

Group IDs

NES artifacts keep the upstream org.springframework group IDs. Only the version changes, so no exclusions or coordinate swaps are needed.

Prerequisites

• JDK 17 or later.

• An NES access token. Export it as NES_TOKEN in the shell you build from.

• A server entry in ~/.m2/settings.xml whose id matches the repository in pom.xml, as described in the HeroDevs Spring Boot 3.5 setup guide:

  <servers>
    <server>
      <id>herodevs-nes-registry</id>
      <username>any_text_here_not_used</username>
      <password>${env.NES_TOKEN}</password>
    </server>
  </servers>

The pom.xml already declares https://registry.nes.herodevs.com/maven as a repository and plugin repository with that id.

Build and run

The project includes the Maven wrapper, so you don't need a local Maven install.

./mvnw clean package
java -jar target/flowable-app-nes-0.0.1-SNAPSHOT.jar

The build log should include Rule 0: org.apache.maven.enforcer.rules.dependency.BannedDependencies passed. That line confirms no non-NES Spring artifact got onto the classpath.

Then call the endpoint:

curl localhost:8080/hello

{"data":["Hello World","Spring Framework 6.2.19-spring-framework-6"],"total":2,"start":0,"sort":null,"order":null,"size":2}

The response body is a Flowable DataResponse from flowable-common-rest. The second entry reports the Spring version at runtime and comes out cut short. The spring-core jar's manifest has the full value, Implementation-Version: 6.2.19-spring-framework-6.2.21, and the dependency tree below shows the version Maven resolved.

Dependency tree

Output of ./mvnw dependency:tree:

com.herodevs.example:flowable-app-nes:jar:0.0.1-SNAPSHOT
+- org.springframework.boot:spring-boot-starter-web:jar:3.5.16-spring-boot-3.5.20:compile
|  +- org.springframework.boot:spring-boot-starter:jar:3.5.16-spring-boot-3.5.20:compile
|  |  +- org.springframework.boot:spring-boot:jar:3.5.16-spring-boot-3.5.20:compile
|  |  +- org.springframework.boot:spring-boot-autoconfigure:jar:3.5.16-spring-boot-3.5.20:compile
|  |  +- org.springframework.boot:spring-boot-starter-logging:jar:3.5.16-spring-boot-3.5.20:compile
|  |  |  +- ch.qos.logback:logback-classic:jar:1.5.38:compile
|  |  |  |  \- ch.qos.logback:logback-core:jar:1.5.38:compile
|  |  |  +- org.apache.logging.log4j:log4j-to-slf4j:jar:2.24.3:compile
|  |  |  |  \- org.apache.logging.log4j:log4j-api:jar:2.24.3:compile
|  |  |  \- org.slf4j:jul-to-slf4j:jar:2.0.20:compile
|  |  +- jakarta.annotation:jakarta.annotation-api:jar:2.1.1:compile
|  |  \- org.yaml:snakeyaml:jar:2.4:compile
|  +- org.springframework.boot:spring-boot-starter-json:jar:3.5.16-spring-boot-3.5.20:compile
|  |  +- com.fasterxml.jackson.datatype:jackson-datatype-jdk8:jar:2.21.7:compile
|  |  +- com.fasterxml.jackson.datatype:jackson-datatype-jsr310:jar:2.21.7:compile
|  |  \- com.fasterxml.jackson.module:jackson-module-parameter-names:jar:2.21.7:compile
|  +- org.springframework.boot:spring-boot-starter-tomcat:jar:3.5.16-spring-boot-3.5.20:compile
|  |  +- org.apache.tomcat.embed:tomcat-embed-core:jar:10.1.60:compile
|  |  +- org.apache.tomcat.embed:tomcat-embed-el:jar:10.1.60:compile
|  |  \- org.apache.tomcat.embed:tomcat-embed-websocket:jar:10.1.60:compile
|  +- org.springframework:spring-web:jar:6.2.19-spring-framework-6.2.21:compile
|  |  \- io.micrometer:micrometer-observation:jar:1.15.12:compile
|  |     \- io.micrometer:micrometer-commons:jar:1.15.12:compile
|  \- org.springframework:spring-webmvc:jar:6.2.19-spring-framework-6.2.21:compile
|     +- org.springframework:spring-aop:jar:6.2.19-spring-framework-6.2.21:compile
|     \- org.springframework:spring-expression:jar:6.2.19-spring-framework-6.2.21:compile
\- org.flowable:flowable-common-rest:jar:7.2.0:compile
   +- org.flowable:flowable-engine-common-api:jar:7.2.0:compile
   +- com.fasterxml.jackson.core:jackson-core:jar:2.21.7:compile
   +- com.fasterxml.jackson.core:jackson-databind:jar:2.21.7:compile
   |  \- com.fasterxml.jackson.core:jackson-annotations:jar:2.21:compile
   +- org.slf4j:slf4j-api:jar:2.0.20:compile
   +- joda-time:joda-time:jar:2.14.0:compile
   +- org.apache.commons:commons-lang3:jar:3.17.0:compile
   +- org.springframework:spring-beans:jar:6.2.19-spring-framework-6.2.21:compile
   +- org.springframework:spring-context:jar:6.2.19-spring-framework-6.2.21:compile
   +- org.springframework:spring-core:jar:6.2.19-spring-framework-6.2.21:compile
   |  \- org.springframework:spring-jcl:jar:6.2.19-spring-framework-6.2.21:compile
   +- org.springframework:spring-tx:jar:6.2.19-spring-framework-6.2.21:compile
   +- io.swagger:swagger-annotations:jar:1.6.2:compile
   \- io.swagger:swagger-models:jar:1.6.2:compile

All org.springframework and org.springframework.boot artifacts carry NES versions. Without the override, the org.springframework jars under flowable-common-rest would be 6.2.10.