Comments (2)
In principle I think it would be good if dependency-lock-maven-plugin in could have the lock file as the input to dependency resolution instead of just doing a check.
I have experimented with using the lock file instead of dependencyManagement.
The "issues" i ran into was how I would create the lock file in those cases.
Since I wanted the same versions of spring, netty etc I wanted to use their BOM as input to the locking mechanism and then I ended up with realizing that since I needed an exhaustive dependencyManagement section to generate the lock file I could just as well continue to use that for dependency resolution.
Another thing I have noticed is that Maven likes to downgrade versions of transitive dependencies due to seemingly arbitrary and unrelated changes. So I would need to add guava etc to dependencyManagement as well to stop it from being downgraded.
I don't mind making it possible to be able to use the lock file for dependency management in dependency-lock-maven-plugin but for it to be really useful then the creating of the creating of the lock file would probably need some more input than the dependencies section.
from dependency-lock-maven-plugin.
Hello @vandmo thanks for your answer!
I've played with generated BOM used as depMngt for a few days and it's really tricky to have something consistant.
I ended up using part of you code for our own limited purpose (I've kept you as developer in the pom.xml since it's strongly inspired copied from your sources), it scopes to org.mvnpm
dependencies by default:
https://github.com/mvnpm/mvnpm-locker
The main problem I met is when there are other boms in a project, the exclusions get overridden by the locker bom which is not ok. In the mnvpm case we shouldn't have this problem but I created an issue mvnpm/locker#1.
Thanks a lot for your plugin and let me know if at some point there are some concept that would benefit from being ported back to you plugin :)
from dependency-lock-maven-plugin.
Related Issues (13)
- Make it possible to indicate versions that should be the same as project from the POM. HOT 2
- GitHub Releases still indicate that version 0.13 is the latest release HOT 2
- How to manage snapshot dependencies? HOT 12
- Add dependency checksums HOT 5
- Readme improvements on Dependabot needed HOT 2
- Support patterns for ignore, and my version, lists HOT 8
- Release version 1.0 HOT 3
- dependency-lock-maven-plugin is part of dependencies, security concern
- Exclusion of a dependency from version and integrity check is not working HOT 1
- Make plugin safe for parallel builds HOT 3
- Maven 4 alpha - Plugin has an exception HOT 3
- Add more control over produced lock file HOT 10
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from dependency-lock-maven-plugin.