What is the correct way to override the AWS SDK version?

[henryju]

Hi,

We sometimes need to update the AWS SDK to solve reported vulnerabilities.
I am aware of the mn-override.versions.toml mechanism, but for some reason this doesn't seem to work to override the version of the AWS BOM.

For example, using currently the Micronaut Platform version 4.9.3, the default AWS SDK version is 2.31.66.
I am trying to override that by putting:

[versions]

aws-java-sdk-v2 = "2.31.78"

in the gradle/mn-override.versions.toml file.

This is supposed to be a managed version, and I can see that the value of mn.versions.aws.java.sdk.v2 is changing, thanks to a task like:

tasks.register("printAwsSdkVersion") {
    val version = mn.versions.aws.java.sdk.v2.get()
    doLast {
        println(version)
    }
}

./gradlew printAwsSdkVersion

> Task :printAwsSdkVersion
2.31.78

But it seems to have no effect on the library versions pulled by the AWS BOM.

./gradlew dependencies --configuration compileClasspath | grep awssdk:bom
|         +--- software.amazon.awssdk:bom:2.31.66
     |    +--- software.amazon.awssdk:bom:2.31.66 (*)

./gradlew dependencies --configuration compileClasspath | grep awssdk:sqs
|    |    +--- software.amazon.awssdk:sqs:2.29.24 -> 2.31.66
|    +--- software.amazon.awssdk:sqs:2.31.6 -> 2.31.66 (*)
|         |    +--- software.amazon.awssdk:sqs:2.31.66 (c

I am aware that this is likely not an issue specific to micronaut-aws, but I can't tell if this is a platform, catalog, or gradle plugin issue.

repro.zip