如何确保git存储库中的所有Java项目都具有最新或所需的maven依赖项版本？

Question

I have a git repository that houses a large number of java projects. Some of these are utility libraries and used as maven dependency in other projects and some of them are applications.

Over the period of time, a lot many versions have been released and not all projects have been upgraded to use the latest dependency, which is creating operational problems now. So, how can I find out which project is using an old version of a maven dependency, provided I have the master data, which tells me the right version for a library?

I came across a Java library, JGit. I have not looked much into it, but I was thinking, may be I will be able to pull out the pom.xml of the master branches and run checks against it. Will that be a correct approach? Is there any other/better way of doing this?

Answer 1

When you update the dependencies of a project, you need to build and test that project. The updated dependencies might break something.

Therefore, you cannot consider this a task to be automated unless you have really good unit and integration tests. What you can do, though:

• Check out a project.
• Use versions:use-latest-releases to replace all dependencies by the newest ones.
• Build and test the project.

Answer 2

It depends whether your "right" version is also the latest available version. If yes, then Maven can help you do the task (see versions-maven-plugin ). You would have to repeat this for every project, however, assuming they share no common parent POM. If they do, you may also define your dependency management there and remove any explicit versions in your child POMs. However, this would mean you are actually using these new versions in you projects, which may not be what you want.

Answer 3

So, how can I find out which project is using an old version of a maven dependency, provided I have the master data, which tells me the right version for a library?

To compute dependencies that have newer versions available :

• clone the repository
• use a script or a program to walk the local repository and filter folders containing at the root a pom.xml file and execute the versions:display-dependency-updates-mojo goal on filtered folders and aggregate all results in a file/some files.

To update dependencies :

Execute versions:use-latest-versions for projects that you want to upgrade all or some dependencies.

Some information about these Maven goals :

versions:display-dependency-updates :

Displays all dependencies that have newer versions available. It will also display dependencies which are used by a plugin or defined in the plugin within a pluginManagement.

versions:use-latest-versions :

Replaces any version with the latest version.

These goals have options to filter the dependencies to analyse/update.

Answer 4

I understand your dilemma. I created a stand-along Maven project that has a POM as follows

<project
xmlns="http://maven.apache.org/POM/4.0.0"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">

<modelVersion>4.0.0</modelVersion>

<groupId>com.etc</groupId>
<artifactId>dependency-management</artifactId>
<version>1.0.0</version>
<name>Maven dependency management</name>
<description>Hold version information for referenced artifacts</description>


<properties>
    <spring-boot.version>1.5.3.RELEASE</spring-boot.version>
    <java.version>1.8</java.version>
    <maven.compiler.source>${java.version}</maven.compiler.source>
    <maven.compiler.target>${java.version}</maven.compiler.target>
</properties>

<dependencyManagement>
    <dependencies>
        <dependency>
            <groupId>org.hibernate</groupId>
            <artifactId>hibernate-core</artifactId>
            <version>5.2.10.Final</version>
        </dependency>
    </dependencies>
    ... more dependencies
</dependencyManagement>

I then refer that POM in other Maven projects:

<dependencyManagement>
    <dependencies>
        <dependency>
            <groupId>com.etc</groupId>
            <artifactId>dependency-management</artifactId>
            <version>1.0.0</version>
            <type>pom</type>
            <scope>import</scope>
        </dependency>
    </dependencies>
</dependencyManagement>
<dependencies>
    <dependency>
        <groupId>com.fusionalliance.internal.interview</groupId>
        <artifactId>shared-springboot</artifactId>
        <version>0.0.1-SNAPSHOT</version>
    </dependency>
    </dependency>
</dependencies>
</project>

Note that the version tags are not present in the other projects. The dependency management POM controls the versions.

You can then update the versions. (Testing everything thoroughly, of course.)