10

I have a dependencyManagement section in parent pom like

<dependencyManagement>
    <dependency>
        <groupId>org.apache.httpcomponents</groupId>
        <artifactId>httpclient</artifactId>
        <version>4.2.1</version>
    </dependency>
</dependencyManagement>

and a child pom, having it

<dependencies>
    <dependency>
        <groupId>org.apache.httpcomponents</groupId>
        <artifactId>httpclient</artifactId>
        <version>4.0</version>
    </dependency>
</dependencies>

I've tried to prevent this kind of overriding in child poms using enforcer plugin, allowing these only to be set in parent, but haven't been able to. I'd like this to fail the build. Is that possible, with that plugin or some other way?

There is DependencyCovergence, which forces all versions to be the same, but that's too restrictive as I don't want to control all transitive dependencies - just the ones defined explicitly.

I'd be happy if I could just prevent introducing any new dependencies at all in child poms - everything defined should really be defined in the parent pom, and then just mentioned, if needed, in the child.

2
  • I wonder if anyone knows if there is some way to do this. Personally I can't think of any at the moment. Jan 25, 2013 at 11:57
  • 1
    Writing a new enforcer rule is a possibility. Jan 25, 2013 at 13:28

1 Answer 1

11

You could add a dependency:analyze-dep-mgt execution in your parent pom and configure it to fail on version mismatches:

  <build>
    <plugins>
      <plugin>
        <groupId>org.apache.maven.plugins</groupId>
        <artifactId>maven-dependency-plugin</artifactId>
        <version>2.6</version>
        <executions>
          <execution>
            <id>analyze</id>
            <phase>package</phase>
            <goals>
              <goal>analyze-dep-mgt</goal>
            </goals>
            <configuration>
              <failBuild>true</failBuild>
              <ignoreDirect>false</ignoreDirect>
            </configuration>
          </execution>
        </executions>
      </plugin>
    </plugins>
  </build>
2
  • 2
    Yes. This does prevent overriding the version defined in dependencymanagement, like I asked. Thank you! Now, I only wish I could prevent altogether declaring any dependencies in child poms that are not in dependencymanagement sections. Maybe that's for custom rule, then.
    – eis
    Jan 31, 2013 at 15:45
  • 3
    Though it is manual and hectic but you can still achieve to not have dependency added in child pom if already there in parent pom via bannedDependencies rule of enforcer plugin. You need to mention all dependency here which you have defined in parent.
    – ashah
    Apr 7, 2017 at 12:53

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.