Is it good practice to define scope of dependencies in Maven BOM (bill of materials)?

Question

I have a pom.xml like this to be used as a BOM (Bill of Materials). One of the defined dependencies is a *-test artifact used for testing your code that uses the libraries from this BOM.

The question is: is it appropriate / good practice to specify that the *-test artifact is just for test scope in the BOM itself, or should this be left for the users of the BOM to specify in their project's POM, if needed?

<?xml version="1.0" encoding="UTF-8"?>
<project xmlns="http://maven.apache.org/POM/4.0.0"
         xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
    <modelVersion>4.0.0</modelVersion>

    <groupId>com.example.mylib</groupId>
    <artifactId>mylib-bom</artifactId>
    <version>1.0.0-SNAPSHOT</version>
    <packaging>pom</packaging>
    <name>MyLib (Bill of Materials)</name>

    <dependencyManagement>
        <dependencies>
            <dependency>
                <groupId>com.example.mylib</groupId>
                <artifactId>mylib-cool-library</artifactId>
                <version>${project.version}</version>
            </dependency>    
            <dependency>
                <groupId>com.example.mylib</groupId>
                <artifactId>mylib-test</artifactId>
                <version>${project.version}</version>
                <scope>test</scope> <!-- === HERE === -->
            </dependency>    
        </dependencies>
    </dependencyManagement>    
</project>

I was looking at how existing projects do this and, for example, the Spring Framework BOM does not, indeed, define any scope explicitly. But I am still wondering if there is some unwritten rule for this or something like that?

Answer 1

Best practice is to let the user decide scope, and not set it in BOM (or parent pom).

When you set scope in BOM (to anything other than compile) you change the default scope for that dependency, as seen from user projects. The default dependency scope in maven is compile, so it's common practice to omit scope for a dependency when you want it to be compile. If the BOM imposes another scope, it can be a nasty surprise for other developers that use the BOM (or even yourself at a later point in time).