I am wondering if there is a maven enforcer rule or something similar to check my project for any 'opened' (not fixed) version in project (transitive) dependencies.

I would like to archive a stable reproducible build with maven, but I cannot guarantee this if a dependency of mine e.g. declares an open-ended version range for one of its dependencies.

A new release of that transitive dependencies would change the output of my 'otherwise' untouched build.

I haven't found any property or enforcer rule which fits this requirement.

Does anybody know how such a requirement can be done with maven?

CodePudding user response：

Best bet would be to take the mvn dependency:list and fix all those versions in <dependencyManagement>

CodePudding user response：

Short story

it is (still) "possible" to determine whether there are transitive dependencies with open version range:

...
<dependency>
    <groupId>org.assertj</groupId>
    <artifactId>assertj-assertions-generator</artifactId>
    <version>2.1.0</version>
</dependency>
...

...
<plugin>
    <groupId>org.apache.maven.plugins</groupId>
    <artifactId>maven-assembly-plugin</artifactId>
    <!-- version makes sense -->
    <version>2.6</version>
    <configuration>
        <descriptorRefs>
            <descriptorRef>jar-with-dependencies</descriptorRef>
        </descriptorRefs>
    </configuration>
</plugin>
...

% mvn -X assembly:single -Dassembly.dryRun=true| grep 'setting version to'
[DEBUG]     org.assertj:assertj-core:jar:2.9.1:compile 
            (setting version to: 2.9.1 from range: [2.1.0,2.99.0])

Long story

maven 3 had adopted Aether project and, unfortunately, there is no option to intercept or influence on dependency resolution process, basically "project object model" provides information about direct dependencies, but exhaustive information about transitive dependencies is hidden behind aether, that is the reason why you didn't find desired functionality among maven plugins.

I succeeded to get some relevant information from maven-assembly-plugin just because it's old versions are still compatible with modern maven, so, technically it is still possible to implement a plugin with required functionality or even take advantage of gmavenplus-plugin and write groovy scriptlet:

<plugin>
    <groupId>org.codehaus.gmavenplus</groupId>
    <artifactId>gmavenplus-plugin</artifactId>
    <version>1.13.1</version>
    <executions>
        <execution>
            <phase>initialize</phase>
            <goals>
                <goal>execute</goal>
            </goals>
            <configuration>
                <bindAllProjectProperties>true</bindAllProjectProperties>
                <scripts>
                    <script><![CDATA[
def resolver = session.container.lookup(org.apache.maven.artifact.resolver.ArtifactResolver.class)
def artifacts = resolver.resolveTransitively(
    project.dependencyArtifacts,
    project.artifact,
    project.managedVersionMap,
    session.getLocalRepository(),
    project.remoteArtifactRepositories,
    null
).artifacts.findAll {
    it.versionRange && it.versionRange.restrictions
    && !it.versionRange.recommendedVersion
    && (it.versionRange.restrictions.size() > 1
        || it.versionRange.restrictions[0].lowerBound
        || it.versionRange.restrictions[0].upperBound
    )
}.each {
    println "Found bad guy: $it -> $it.versionRange"
}
                    ]]></script>
                </scripts>
            </configuration>
        </execution>
    </executions>
    <dependencies>
        <dependency>
            <groupId>org.codehaus.groovy</groupId>
            <artifactId>groovy-all</artifactId>
            <version>3.0.9</version>
            <type>pom</type>
            <scope>runtime</scope>
        </dependency>
    </dependencies>
</plugin>

% mvn initialize
[INFO] Scanning for projects...
...
[INFO] Using plugin classloader, includes GMavenPlus and project classpath.
[INFO] Using Groovy 3.0.9 to perform execute.
Found bad guy: org.assertj:assertj-core:jar:2.9.1:compile -> [2.1.0,2.99.0]