Fix the version io.micrometer mismatch between libs.versions.toml and the lib versions in the binary distribution

[flyrain]

Describe the bug

The version mismatch is confusing and make it hard to update the license. It doesn't impact the runtime though, as their versions are consistent.

libs.versions.toml:

micrometer-bom = { module = "io.micrometer:micrometer-bom", version = "1.15.1" }

For both polaris-admin and polaris-server, the final resolved versions are 1.14.7 for the main branch. (It's 14.6 for the branch release/1.0.x, which aligns with @jbonofre 's observation.)

ygu@FM4LQ4GJ90 polaris-bin-1.1.0-incubating-SNAPSHOT % ls admin/lib/main | grep io.micrometer
io.micrometer.micrometer-commons-1.14.7.jar
io.micrometer.micrometer-core-1.14.7.jar
io.micrometer.micrometer-observation-1.14.7.jar
ygu@FM4LQ4GJ90 polaris-bin-1.1.0-incubating-SNAPSHOT % ls server/lib/main | grep io.micrometer
io.micrometer.micrometer-commons-1.14.7.jar
io.micrometer.micrometer-core-1.14.7.jar
io.micrometer.micrometer-observation-1.14.7.jar
io.micrometer.micrometer-registry-prometheus-simpleclient-1.14.7.jar

cc @dimas-b @jbonofre

[dimas-b]

Micrometer might be downgraded because of Quarkus dependencies (BOM).

I personally do not see it as a problem that the version in the toml file does not match the version in the binary artifacts.

License updates are harder, indeed, because of this.

[flyrain]

Micrometer might be downgraded because of Quarkus dependencies (BOM).
I personally do not see it as a problem that the version in the toml file does not match the version in the binary artifacts.

Can we remove the following item from the file libs.versions.toml, as they will be overwritten anyways?

micrometer-bom = { module = "io.micrometer:micrometer-bom", version = "1.15.1" }

[dimas-b]

We use annotations in the API (#527), which does not depend (and should not depend) on Quarkus.

I suppose we could apply the Quarkus BOM (only) as "platform" enforcement to the API module and avoid a direct version declaration for Micrometer. I hope Quarkus BOM will not leak into API module dependencies. I do not like this, but I do not have a better solution ATM 🤔

@snazy WDYT?

[dimas-b]

@flyrain : As far as I can tell, micrometer needs to be mentioned only in the binary dist LICENSE, where its version is controlled by gradle dependency resolution and is predictable. The version from the toml file does not affect license files.

Could you add a bit more details about your license file concern?

[flyrain]

The license concern is just a side effect. The other side effect is that, renovate bot will keep updating a version never used. The question we need to ask here is that, what's the point of having this config if the version here(1.15.1) does't take effect?

micrometer-bom = { module = "io.micrometer:micrometer-bom", version = "1.15.1" }

[dimas-b]

The version from the toml file is used as a compile-only dependency by generated API classes (for annotations).