Managed version of Prometheus Client is not aligned with Micrometer's micrometer-registry-prometheus

[pdeneve]

With Spring Boot 4.1.0, when depending on micrometer-registry-prometheus and when using the requireUpperBoundDeps rule of maven-enforcer-plugin, this triggers a violation as follows:

[ERROR] Rule 0: org.apache.maven.enforcer.rules.dependency.RequireUpperBoundDeps failed with message:
[ERROR] Failed while enforcing RequireUpperBoundDeps. The error(s) are [
[ERROR] Require upper bound dependencies error for io.prometheus:prometheus-metrics-exposition-formats:1.5.1 [runtime]. Paths to dependency are:
[ERROR] +-be.pdn.boot:upperbound-issue:0.0.1
[ERROR]   +-io.micrometer:micrometer-registry-prometheus:1.17.0
[ERROR]     +-io.prometheus:prometheus-metrics-exposition-formats:1.5.1 [runtime] (managed) <-- io.prometheus:prometheus-metrics-exposition-formats:1.7.0 [runtime]
[ERROR] ,
[ERROR] Require upper bound dependencies error for io.prometheus:prometheus-metrics-tracer-common:1.5.1. Paths to dependency are:
[ERROR] +-be.pdn.boot:upperbound-issue:0.0.1
[ERROR]   +-io.micrometer:micrometer-registry-prometheus:1.17.0
[ERROR]     +-io.prometheus:prometheus-metrics-tracer-common:1.5.1 (managed) <-- io.prometheus:prometheus-metrics-tracer-common:1.7.0
[ERROR] ,
[ERROR] Require upper bound dependencies error for io.prometheus:prometheus-metrics-core:1.5.1. Paths to dependency are:
[ERROR] +-be.pdn.boot:upperbound-issue:0.0.1
[ERROR]   +-io.micrometer:micrometer-registry-prometheus:1.17.0
[ERROR]     +-io.prometheus:prometheus-metrics-core:1.5.1 (managed) <-- io.prometheus:prometheus-metrics-core:1.7.0
[ERROR] ]

To reproduce:

git clone https://github.com/pdeneve/spring-boot-upperbound-issue.git
cd spring-boot-upperbound-issue
mvn validate

[wilkinsona]

Thanks for the bringing this to our attention. We'll discuss it with the Micrometer team.