build: Align SDK modules to one version through sentry-bom

CHANGELOG.md

@@ -13,6 +13,12 @@
 - Quartz `SentryJobListener` can send a monitor config derived from the trigger with check-ins, so Sentry creates or updates the monitor from code. Set the `sentry-upsert-monitor-config` job or trigger data key to `"true"` to send the schedule ([#6216](https://github.com/getsentry/sentry-java/pull/6216))
 - Send a monitor config derived from Spring `@Scheduled` with `@SentryCheckIn` check-ins, so Sentry creates or updates the monitor from code. Set `@SentryCheckIn(upsertMonitorConfig = true)` to send the schedule ([#6215](https://github.com/getsentry/sentry-java/pull/6215))
 
+### Behavioral Changes
+
+- Gradle builds now resolve all Sentry SDK modules to the same version, the highest one present, because every module depends on `sentry-bom` as a platform ([#6466](https://github.com/getsentry/sentry-java/pull/6466))
+  - Before, a build could mix module versions, for example a newer `sentry-android-core` with an older `sentry-android-fragment`, which failed at runtime. Maven builds resolve as before.
+  - `sentry-bom` now also includes `sentry-android-distribution`.
+
 ### Fixes
 
 - Stop marking an OkHttp call span as failed when a connection attempt to one of the host's addresses fails but OkHttp connects on another ([#6472](https://github.com/getsentry/sentry-java/pull/6472))

build-logic/src/main/kotlin/io/sentry/gradle/SentryPublishPlugin.kt

@@ -16,6 +16,9 @@ import org.gradle.kotlin.dsl.configure
 class SentryPublishPlugin : Plugin<Project> {
   override fun apply(project: Project) {
     project.configurePublishing(DistributionContainer::configureForJvm)
+    // the BOMs are java-platform projects, so they do not depend on themselves
+    project.plugins.withId("java-library") { project.alignWithBom("api") }
+    project.plugins.withId("com.android.library") { project.alignWithBom("api") }
   }
 }
 
@@ -26,9 +29,21 @@ class SentryPublishPlugin : Plugin<Project> {
 class SentryMultiplatformPublishPlugin : Plugin<Project> {
   override fun apply(project: Project) {
     project.configurePublishing(DistributionContainer::configureForMultiplatform)
+    project.plugins.withId("org.jetbrains.kotlin.multiplatform") {
+      project.alignWithBom("commonMainApi")
+    }
   }
 }
 
+/**
+ * With sentry-bom as a platform, Gradle resolves all SDK modules of a consumer to one version, the
+ * highest one present.
+ */
+private fun Project.alignWithBom(configuration: String) {
+  val bom = dependencies.project(mapOf("path" to ":sentry-bom"))
+  dependencies.add(configuration, dependencies.platform(bom))
+}
+
 private fun Project.configurePublishing(
   configureDistributions: DistributionContainer.(Project) -> Unit
 ) {

sentry-bom/build.gradle.kts

@@ -13,8 +13,7 @@ dependencies {
         !it.name.startsWith("sentry-samples") &&
           it.name != project.name &&
           !it.name.endsWith("-bom") &&
-          !it.name.contains("test", ignoreCase = true) &&
-          !it.name.contains("sentry-android-distribution")
+          !it.name.contains("test", ignoreCase = true)
       }
       .forEach { project ->
         evaluationDependsOn(project.path)