search

vandmo / dependency-lock-maven-plugin

Maven plugin that makes sure that Maven dependency are not accidentaly changed.
https://github.com/vandmo/dependency-lock-maven-plugin
Apache License 2.0
64 stars 10 forks source link

Using the lockfile as dependencyManagement #72

Closed ia3andy closed 10 months ago

ia3andy commented 10 months ago

Currently the lockfile is just acting as a check, did you consider using it as dependencyManagement from the Maven plugin?

In our case (mvnpm.org), just checking is not enough as the versions synced on the mvnpm repo and central are different leading to different Maven resolutions.

Also locking the bom mean a quicker resolution on CI.

vandmo commented 10 months ago

In principle I think it would be good if dependency-lock-maven-plugin in could have the lock file as the input to dependency resolution instead of just doing a check.

I have experimented with using the lock file instead of dependencyManagement. The "issues" i ran into was how I would create the lock file in those cases. Since I wanted the same versions of spring, netty etc I wanted to use their BOM as input to the locking mechanism and then I ended up with realizing that since I needed an exhaustive dependencyManagement section to generate the lock file I could just as well continue to use that for dependency resolution.

Another thing I have noticed is that Maven likes to downgrade versions of transitive dependencies due to seemingly arbitrary and unrelated changes. So I would need to add guava etc to dependencyManagement as well to stop it from being downgraded.

I don't mind making it possible to be able to use the lock file for dependency management in dependency-lock-maven-plugin but for it to be really useful then the creating of the creating of the lock file would probably need some more input than the dependencies section.

ia3andy commented 10 months ago

Hello @vandmo thanks for your answer!

I've played with generated BOM used as depMngt for a few days and it's really tricky to have something consistant.

I ended up using part of you code for our own limited purpose (I've kept you as developer in the pom.xml since it's strongly inspired copied from your sources), it scopes to org.mvnpm dependencies by default: https://github.com/mvnpm/mvnpm-locker

The main problem I met is when there are other boms in a project, the exclusions get overridden by the locker bom which is not ok. In the mnvpm case we shouldn't have this problem but I created an issue https://github.com/mvnpm/mvnpm-locker/issues/1.

Thanks a lot for your plugin and let me know if at some point there are some concept that would benefit from being ported back to you plugin :)