Here is a script that checks if the maven build system needs updates. By running this script, you will get all the updates (but none of them will be applied). This lets you change all, some or none, as you see fit.
mvn versions:display-plugin-updates
mvn versions:display-parent-updates
mvn versions:display-dependency-updates
I typically save this script in a top-level check-versions.sh
or check-versions.cmd
(adjusting for the scripting language).
For this script to work, in /project/build/plugins
you'll need the org.codehaus.mojo:versions-maven-plugin:2.7
or greater. I typically configure the plugin like so
<plugin>
<groupId>org.codehaus.mojo</groupId>
<artifactId>versions-maven-plugin</artifactId>
<version>2.7</version>
<configuration>
<generateBackupPoms>false</generateBackupPoms>
</configuration>
</plugin>
As this doesn't make backup pom.xml files which pollute my git
history.
The first few times you run this, you might notice that the inherited plugins show themselves to be out of date (as they are effectively built-in to the defaults in the maven default parent pom.xml). You will have to explicitly define the defaults to a newer release to get them to stop reporting.
In addition, you will find that a lot of the plugins will still report because it isn't clear what is the minimum required version of Java and the minimum required version of Apache Maven. To encode these requirements into the pom.xml, you will use the Maven Enforcer plugin. An example of mine that forces Maven version 3.5.4 and Java version 11 is
<plugin>
<groupId>org.apache.maven.plugins</groupId>
<artifactId>maven-enforcer-plugin</artifactId>
<version>3.0.0-M3</version>
<executions>
<execution>
<id>enforce-maven</id>
<goals>
<goal>enforce</goal>
</goals>
<configuration>
<rules>
<requireMavenVersion>
<version>3.5.4</version>
</requireMavenVersion>
<requireJavaVersion>
<version>11</version>
</requireJavaVersion>
</rules>
</configuration>
</execution>
</executions>
</plugin>
With these tools in place, I currently get the output on one of my projects
[INFO] Scanning for projects...
[INFO]
[INFO] ---------------< com.edwbuck.parserhelp:pascal-adapter >----------------
[INFO] Building pascal-adapter 1.0.0
[INFO] --------------------------------[ jar ]---------------------------------
[INFO]
[INFO] --- versions-maven-plugin:2.7:display-plugin-updates (default-cli) @ pascal-adapter ---
[INFO] artifact com.github.sevntu-checkstyle:dsm-maven-plugin: checking for updates from central
[INFO] artifact net.nicoulaj.maven.plugins:checksum-maven-plugin: checking for updates from central
[INFO]
[INFO] The following plugin updates are available:
[INFO] maven-project-info-reports-plugin .................... 2.6 -> 3.0.0
[INFO]
[INFO] All plugins have a version specified.
[INFO]
[INFO] Project inherits minimum Maven version as: 3.5.4
[INFO] Plugins require minimum Maven version of: 3.2.1
[INFO]
[INFO] No plugins require a newer version of Maven than specified by the pom.
[INFO]
[INFO] ------------------------------------------------------------------------
[INFO] BUILD SUCCESS
[INFO] ------------------------------------------------------------------------
[INFO] Total time: 2.976 s
[INFO] Finished at: 2020-04-16T07:52:12-05:00
[INFO] ------------------------------------------------------------------------
[INFO] Scanning for projects...
[INFO]
[INFO] ---------------< com.edwbuck.parserhelp:pascal-adapter >----------------
[INFO] Building pascal-adapter 1.0.0
[INFO] --------------------------------[ jar ]---------------------------------
[INFO]
[INFO] --- versions-maven-plugin:2.7:display-parent-updates (default-cli) @ pascal-adapter ---
[INFO] Project does not have a parent.
[INFO] ------------------------------------------------------------------------
[INFO] BUILD SUCCESS
[INFO] ------------------------------------------------------------------------
[INFO] Total time: 1.325 s
[INFO] Finished at: 2020-04-16T07:52:15-05:00
[INFO] ------------------------------------------------------------------------
[INFO] Scanning for projects...
[INFO]
[INFO] ---------------< com.edwbuck.parserhelp:pascal-adapter >----------------
[INFO] Building pascal-adapter 1.0.0
[INFO] --------------------------------[ jar ]---------------------------------
[INFO]
[INFO] --- versions-maven-plugin:2.7:display-dependency-updates (default-cli) @ pascal-adapter ---
[INFO] artifact com.edwbuck.parserhelp:pascal_client: checking for updates from central
[INFO] artifact org.junit.jupiter:junit-jupiter-engine: checking for updates from central
[INFO] artifact org.junit.jupiter:junit-jupiter-api: checking for updates from central
[INFO] artifact org.influxdb:influxdb-java: checking for updates from central
[INFO] The following dependencies in Dependencies have newer versions:
[INFO] org.junit.jupiter:junit-jupiter-api ................... 5.6.0 -> 5.6.2
[INFO] org.junit.jupiter:junit-jupiter-engine ................ 5.6.0 -> 5.6.2
[INFO]
[INFO] ------------------------------------------------------------------------
[INFO] BUILD SUCCESS
[INFO] ------------------------------------------------------------------------
[INFO] Total time: 1.848 s
[INFO] Finished at: 2020-04-16T07:52:18-05:00
[INFO] ------------------------------------------------------------------------
which indicates I need to update my maven-project-info-reports-plugin
and my org.junit.jupiter:junit-jupiter-api
and org.junit.jupiter:junit-jupiter-engine
plugins.
Normally I don't use the maven versions plugin to actually do the update in the pom.xml file, because text editors are fast, if you're doing all the updates you want to do in the pom.xml at one time.
Currently the maven versions plugin offered by codehaus doesn't have an command line option to automatically update more than one version at a time. The reasons it is not there is simple. To use the versions:update-properties
plugin, one needs to either:
- Define the update policy (what to update / what not to update) in the pom.xml.
- Define the update policy (what to update / what not to update) on the command line.
These policies are verbose as they cover the entire project. Yes, they can use glob matching, but they're still verbose. For my personal projects, I notice that for them to give me proper handling, I update them too often, so I leave them out of the picture, instead deciding what to update or not update at the time I work on the output of my check-updates
script.
That's because it is not always safe to automatically update plugins and dependencies. Sometimes the next version of a plugin requires code changes to the project. For example, projects shifting from Java 8 to Java 9 require alterations to how they are built and linked. The same goes for dependencies, if you want to keep the code bound to non-deprecated APIs.