How to check pom.xml for updated dependencies - maven

I am fairly new to Maven and pom.xml. Is there a way I can find out which of my dependencies that are outdated, so that I can update version numbers in my pom.xml.
In other languages, for instance, Ruby has the command gem list outdated that gives me a list of dependencies (rubygems) I can update
I am using IntelliJ Idea if that can help.

You can do this with the Versions Maven Plugin. Check the following goals:
versions:display-dependency-updates scans a project's dependencies and produces a report of those dependencies which have newer versions available.
versions:display-plugin-updates scans a project's plugins and produces a report of those plugins which have newer versions available.
Here is a sample output (taken from the examples):
Checking for new dependency updates
The display-dependency-updates goal will check all the dependencies used in your project and display a list of those dependencies with newer versions available.
Here are some examples of what this looks like:
svn checkout http://svn.codehaus.org/mojo/trunk/mojo/build-helper-maven-plugin build-helper-maven-plugin
cd build-helper-maven-plugin
Run
mvn versions:display-dependency-updates
Which produces the following output:
[INFO] ------------------------------------------------------------------------
[INFO] Building Build Helper Maven Plugin
[INFO] task-segment: [versions:display-dependency-updates]
[INFO] ------------------------------------------------------------------------
[INFO] [versions:display-dependency-updates]
[INFO]
[INFO] The following dependency updates are available:
[INFO] org.apache.maven:maven-artifact ........................ 2.0 -> 2.0.9
[INFO] org.apache.maven:maven-plugin-api ...................... 2.0 -> 2.0.9
[INFO] org.apache.maven:maven-project ....................... 2.0.2 -> 2.0.9
[INFO] org.codehaus.plexus:plexus-utils ....................... 1.1 -> 1.5.6
[INFO]
[INFO] ------------------------------------------------------------------------
[INFO] BUILD SUCCESSFUL
[INFO] ------------------------------------------------------------------------
[INFO] Total time: 17 seconds
[INFO] Finished at: Fri Aug 15 10:46:03 IST 2008
[INFO] Final Memory: 10M/167M
[INFO] ------------------------------------------------------------------------
Pom install
<plugin>
<groupId>org.codehaus.mojo</groupId>
<artifactId>versions-maven-plugin</artifactId>
<version>2.5</version>
</plugin>

If you want to do it fast you can use www.versioneye.com site.
There you can define your project and upload project pom.xml, the site will also send you regular emails which notify you about new updates.
You can also mention which libraries do you want to check for update.
I don't know if it automatically fully sync with maven repo or not, but I always find its lib versions are update.
Update:
After 6 years the project switched off :(
So the mvn versions:display-dependency-updates seems to be the choice.

It isn't obvious what the POM dependency is for this.
For your convenience:
<dependency>
<groupId>org.codehaus.mojo</groupId>
<artifactId>versions-maven-plugin</artifactId>
<version>2.1</version>
</dependency>
and the Repository:
<repository>
<id>Codehaus Mojo</id>
<name>Codehaus Mojo</name>
<url>https://nexus.codehaus.org/content/repositories/releases/</url>
</repository>

Related

Understanding Maven plugins

I created a simple maven project.
I want to turn in into a eclipse project.
So I use mvn eclipse:eclipse
But I did not specify anything in my POM about eclipse plugin.
When I use another plugins'goal, for example : mvn jetty:run
It does not work :
Downloaded from central: https://repo.maven.apache.org/maven2/org/codehaus/mojo/maven-metadata.xml (20 kB at 59 kB/s)
[INFO] ------------------------------------------------------------------------
[INFO] BUILD FAILURE
[INFO] ------------------------------------------------------------------------
[INFO] Total time: 1.302 s
[INFO] Finished at: 2019-01-19T09:43:13+01:00
[INFO] ------------------------------------------------------------------------
[ERROR] No plugin found for prefix 'jetty' in the current project and in the plugin groups [org.apache.maven.plugins, org.codehaus.mojo] available from the repositories [local (C:\Users\Anthony\.m2\repository), central (https://repo.maven.apache.org/maven2)] -> [Help 1]
I don't understand why in the first case (eclipse:eclipse) it works just fine whereas for the other it does not.
However when I add the plugin in my POM it works :
<groupId>org.eclipse.jetty</groupId>
<artifactId>jetty-maven-plugin</artifactId>
<version>9.4.12.v20180830</version
So yes I don't understand why for eclipse plugin I need nothing whereas for the other one, I need to specidy the plugin in my POM
Thank you

Maven update versions goal builds old version in Jenkins

I've got a Jenkins/maven build where we need to be able to produce release artifacts with arbitrary version numbers. The version number is passed in as a parameter to the build job. I'm using versions:set to update the version from what is in the pom.xml to the $VERSION parameter. When the build is run, it appears that maven does in fact update the version in the working copy of the pom.xml, however it builds the artifact with the old version number.
pom.xml:
<project xmlns="http://maven.apache.org/POM/4.0.0"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
<modelVersion>4.0.0</modelVersion>
<name>someservice</name>
<groupId>com.domain.group</groupId>
<artifactId>someservice</artifactId>
<version>1.0.0-SNAPSHOT</version>
Invoke top-level maven targets in Jenkins job:
-V
-B
-e
-U
clean
versions:set
-DnewVersion=${VERSION}
package
deploy
-Dmaven.test.skip=true
My build output looks something like this (with a $VERSION of 0.1.2)
[INFO] ------------------------------------------------------------------------
[INFO] Building someservice 1.0.0-SNAPSHOT
[INFO] ------------------------------------------------------------------------
[INFO]
[INFO] --- versions-maven-plugin:2.2:set (default-cli) # someservice ---
[INFO] Searching for local aggregator root...
[INFO] Local aggregation root: /svn/group/someservice/trunk
[INFO] Processing change of com.domain.group:someservice:1.0.0-SNAPSHOT -> 0.1.2
[INFO] Processing com.domain.group:someservice
[INFO] Updating project com.domain.group:someservice
[INFO] from version 1.0.0-SNAPSHOT to 0.1.2
[INFO]
[INFO] ------------------------------------------------------------------------
[INFO] BUILD SUCCESS
[INFO] ------------------------------------------------------------------------
[INFO] Total time: 5.147s
[INFO] Finished at: Wed May 20 11:40:46 PDT 2015
[INFO] Final Memory: 10M/180M
[INFO] ------------------------------------------------------------------------
I've noticed that while the initial run will build with the old version, if the working dir is not reverted, subsequent runs will correctly build with the new version in the updated pom.xml. How can I get the pom file updated with the new version before the artifacts are built?
Constraints:
While it may be possible for us to have changes made to the pom.xml, it's not directly under our control and is a less practical solution. In an ideal world the pom would already be updated with the correct version and we wouldn't be doing this at all.
I know I can just add a shell step prior to the maven build and do a sed replace on pom.xml or something similar. That does work, but it's ugly and won't scale well with more complex poms. A native maven solution is greatly preferred.
I've tested this independently of jenkins, (i.e. mvn versions:set -DnewVersion=0.1.2) and the behavior is the same
What you want to achieve is not possible with current maven versions, as stated in the Usage section of the versions-maven-plugin:
Maven 2.0, 2.1, 2.2 and 3.0 do not currently support re-reading modifications of the pom.xml within one invocation of Maven.
How about adding another build step here?

Tycho build fails on Jenkins only for SCM Trigger

I have a little bit of strange Problem with Jenkins, Maven and Tycho and it is hard to find out who is the culprit.
All SCM Triggered Builds fail but all manually triggered builds succeed.
Jenkins Version : Jenkins ver. 1.527
Maven Version : 3.05
I have a modularized tycho build:
<modules>
<module>../main.plugin.test</module>
<module>../main.plugin.internationalization.at</module>
<module>../crud.plugin</module>
<module>../rest.plugin</module>
<module>../main.plugin</module>
<module>../main.feature</module>
<module>../product</module>
<module>../target-definition</module>
<module>../rest.plugin.test</module>
</modules>
Jenkins is configured as a simple maven build with modules.
It just executes:
-X clean deploy
When an SCM-Build is triggered some modules are not build.
When I build it manually everything is fine:
This behaviour is consistent. I already tried
switching to a different Maven version (3.05 / 3.04)
deleting the whole workspace prior to building
clean checkout of all sources
running of -X deploy (without clean)
Any amount of manual invocations succeeds. And any amount of scm triggers fails.
Both Maven logs look exactly the same until (working):
[INFO] Reactor Build Order:
[INFO]
[INFO] client-master
[INFO] crud-plugin
[INFO] main-plugin
[INFO] ------------.main.plugin.test
[INFO] ------------.main.plugin.internationalization.at
[INFO] rest-plugin
[INFO] main-plugin
[INFO] ------------.product
[INFO] target-definition
[INFO] ------------.rest.plugin.test
and (failing):
[INFO] ------------------------------------------------------------------------
[INFO] Reactor Build Order:
[INFO]
[INFO] main-plugin
[INFO] ------------.plugin.test
[INFO] ------------.main.plugin.internationalization.at
[INFO] rest-plugin
[INFO] main-plugin
[INFO] ------------.product
[INFO] ------------.rest.plugin.test
The final error message therefore is:
Caused by: java.lang.IllegalStateException: ------------..client:------------..crud.plugin:eclipse-plugin:1.0.0-SNAPSHOT does not provide an artifact with classifier 'null'
Customer specific module names are replaced with ------------. in this question.
I have heard repeatedly of vague problems with Tycho builds on Jenkins. The reason for these problems seems to be that some Jenkins plugin triggering these builds hooks into the Maven lifecycle and this somehow collides with what Tycho does in the Maven internals.
For the problem that you are describing, it seems that the Jenkins plugin that you are using is changing the module build order. This may be okay for a normal Maven build (where all dependencies are declared in the POMs), but may fail for a Maven/Tycho build, where dependencies are computed by Tycho during the build.
To avoid this problem, you should trigger the Maven build in a way that is closer to a normal command line build. I found that the Invoke top-level Maven targets build step from the Maven Integration plugin works without problems.

How to avoid the deploy of sources from Jenkins (to Nexus) in deploy phase?

I have a Jenkins+Nexus installation, and some project there that are automated.
Jenkins deploy the sources and javadocs to nexus in the deploy phase (I am using Maven Release) -- Javadoc could be ok but I don't want to have any sources in Nexus.
I was searching and googling and I don't know how to skip this step.
Thanks a lot
Output from jenkins
[INFO] [INFO]
[INFO] [INFO] --- maven-install-plugin:2.3.1:install (default-install) # projectA ---
[INFO] [INFO] Installing /var/lib/jenkins/jobs/MyBuild/workspace/target/checkout/MyProject/projectA/target/projectA-1227.jar to .../projectA-1227.jar
[INFO] [INFO] Installing /var/lib/jenkins/jobs/MyBuild/workspace/target/checkout/MyProject/projectA/pom.xml to .../projectA-1227.pom
[INFO] [INFO] Installing /var/lib/jenkins/jobs/MyBuild/workspace/target/checkout/MyProject/projectA/target/projectA-1227-sources.jar to .../projectA-1227-sources.jar
[INFO] [INFO] Installing /var/lib/jenkins/jobs/MyBuild/workspace/target/checkout/MyProject/projectA/target/projectA-1227-javadoc.jar to .../projectA-1227-javadoc.jar
[INFO] [INFO]
Try adding : -Darguments="-Dsource.skip=true -Dmaven.javadoc.skip=true"
to your maven release plugin config (Jenkins > your build configuration > Maven release build > Release goals and options
By default this actually does not happen automatically. Most likely you have configured a release profile somewhere in your pom hierarchy that adds the Maven Source Plugin execution.
You could remove that if you never want to use it or otherwise change the release plugin config to use a different profile or skip source creation or invoke the build with parameters to skip as Guilame has answered

Maven check for updated dependencies in repository

Is there a Maven plugin that allows you to check if there are newer versions of dependencies available in the repository?
Say, you are using dependency X with version 1.2. Now a new version of X is released with version 1.3. I'd like to know, based on the dependencies used in my project, which dependencies have newer versions available.
The Maven Versions plugin and it's display-dependency-updates mojo are what you're looking for:
mvn versions:display-dependency-updates
Here is what the output looks like:
[INFO] ------------------------------------------------------------------------
[INFO] Building Build Helper Maven Plugin
[INFO] task-segment: [versions:display-dependency-updates]
[INFO] ------------------------------------------------------------------------
[INFO] [versions:display-dependency-updates]
[INFO]
[INFO] The following dependency updates are available:
[INFO] org.apache.maven:maven-artifact ........................ 2.0 -> 2.0.9
[INFO] org.apache.maven:maven-plugin-api ...................... 2.0 -> 2.0.9
[INFO] org.apache.maven:maven-project ....................... 2.0.2 -> 2.0.9
[INFO] org.codehaus.plexus:plexus-utils ....................... 1.1 -> 1.5.6
[INFO]
[INFO] ------------------------------------------------------------------------
[INFO] BUILD SUCCESSFUL
[INFO] ------------------------------------------------------------------------
[INFO] Total time: 17 seconds
[INFO] Finished at: Fri Aug 15 10:46:03 IST 2008
[INFO] Final Memory: 10M/167M
[INFO] ------------------------------------------------------------------------
If you want to receive email notifications when newer artifacts versions are available on Maven Central you can create an account on artifact-listener and choose which artifact you want to follow.
You can either search manually for artifacts or directly upload your pom.xml.
You will periodically received notifications like this one (available in english and french for now) :
In projects with a large number of dependancies, you sometimes keep your versions in a properties section.
<properties>
<assertj.version>3.15.0</assertj.version>
<aws-sdk.version>1.11.763</aws-sdk.version>
<cxf.version>3.3.6</cxf.version>
In the case where you are only interested in updates to those versions, you can use the following command
mvn versions:display-property-updates
This gives a more condensed view and only returns the versions you need to update in the properties section.
The VersionEye Maven Plugin is doing the same: versioneye_maven_plugin.
VersionEye can notify you about new versions on Maven Repositories, too. It is a language agnostic tool and beside Java it supports 7 other languages. Beside the simple follow/notify feature it can also directly monitor GitHub and BitBucket repositories and notify your about out-dated dependencies in your projects.
There is also a REST JSON API, for tool integrations.
By the way, I'm the dude who started this project. Let me know if you have questions.
The ideal way to do it is to set dependency versions as properties in pom.xml and then running the below command to get the updated versions for your specific/custom dependencies.
<properties>
<java.version>1.8</java.version>
<project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
<project.reporting.outputEncoding>UTF-8</project.reporting.outputEncoding>
<skip.tests>true</skip.tests>
<spring-cloud-gcp.version>1.2.3.RELEASE</spring-cloud-gcp.version>
<spring-cloud.version>Hoxton.SR6</spring-cloud.version>
<spring-cloud-stream-schema.version>2.2.1.RELEASE</spring-cloud-stream-schema.version>
<confluent.version>5.5.1</confluent.version>
<avro.version>1.10.0</avro.version>
<janino.version>3.1.2</janino.version>
<swagger.version>2.9.2</swagger.version>
<google-cloud-logging-logback.version>0.118.1-alpha</google-cloud-logging-logback.version>
<spring-cloud-stream-binder-kafka.version>3.0.6.RELEASE</spring-cloud-stream-binder-kafka.version>
</properties>
mvn versions:display-property-updates
[INFO] The following version properties are referencing the newest available version:
[INFO] ${avro.version} .............................................. 1.10.0
[INFO] ${spring-cloud-stream-schema.version} ................. 2.2.1.RELEASE
[INFO] ${janino.version} ............................................. 3.1.2
[INFO] The following version property updates are available:
[INFO] ${spring-cloud-gcp.version} .......... 1.2.3.RELEASE -> 1.2.5.RELEASE
[INFO] ${google-cloud-logging-logback.version} 0.118.1-alpha -> 0.118.2-alpha
[INFO] ${spring-cloud-stream-binder-kafka.version} 3.0.6.RELEASE -> 3.0.8.RELEASE
[INFO] ${confluent.version} ................................. 5.5.1 -> 6.0.0
[INFO] ${swagger.version} ................................... 2.9.2 -> 3.0.0
[INFO] ${spring-cloud.version} .................... Hoxton.SR6 -> Hoxton.SR8
[INFO]
[INFO] ------------------------------------------------------------------------
[INFO] BUILD SUCCESS
[INFO] ------------------------------------------------------------------------
[INFO] Total time: 3.572 s
[INFO] Finished at: 2020-10-06T09:35:08-07:00
[INFO] ------------------------------------------------------------------------
Another way to achieve this is by executing the command mvn versions:display-dependency-updates but the problem I face with this approach is that it also shows me updates for the nested dependencies which are not too useful for me.
You can use the Versions Maven Plugin[1] to generate reports in your Maven site to get a list of possible updates. With regard to Spring's irregularity, it appears to use the Mercury versioning system[2]. When configuring the Versions plugin, you can add a special rule for Spring stuff:
http://mojo.codehaus.org/versions-maven-plugin/
http://docs.codehaus.org/display/MAVEN/Mercury+Version+Ranges
I might be a bit late to join the party but a more clear way to get more readable html file or a xml file as report which can be taken for further automation using:
mvn versions:dependency-updates-report
This report plugin not just shows more comprehensive details on updates but also has options to update to latest versions. You can find the documentation for it to use various parameters.
You can use Maven Check, a command line tool, which is standalone unlike the Versions Maven Plugin. It also works with Gradle projects.
Output example:
2 build file(s) found, checking for artifact updates
my-gradle-project\build.gradle
[COMPILE ONLY] com.google.guava:guava 31.0-android -> 31.1-android
1 artifact update(s) available
my-maven-project\pom.xml
[DEPENDENCY] org.apache.commons:commons-lang3 3.10 -> 3.12.0
[BUILD PLUGIN] org.apache.maven.plugins:maven-compiler-plugin 3.10.0 -> 3.10.1
2 artifact update(s) available
2/2 build file(s) checked, 3 artifact update(s) available
Disclaimer: I am the author of Maven Check.

Resources