0

There are Maven plugins:

  • org.apache.maven.plugins:maven-dependency-plugin:3.1.2
  • org.apache.maven.plugins:maven-site-plugin:3.9.1

that indirectly use commons-beanutils:commons-beanutils:jar:1.7.0. According to this the dependencies are:

org.apache.maven.plugins:maven-site-plugin:maven-plugin:3.9.1 [Information]
    org.apache.maven.doxia:doxia-site-renderer:jar:1.9.2 (compile) [Information]
        org.apache.velocity:velocity-tools:jar:2.0 (compile) [Information]
            commons-beanutils:commons-beanutils:jar:1.7.0 (compile)

How to change the dependency version from 1.7.0 to 1.9.4 for these plugins?

Here's an example POM and my solution that doesn't work:

<?xml version="1.0" encoding="UTF-8"?>
<project xmlns="http://maven.apache.org/POM/4.0.0"
         xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
    <modelVersion>4.0.0</modelVersion>

    <groupId>org.example</groupId>
    <artifactId>freaking-beanutils</artifactId>
    <version>1.0-SNAPSHOT</version>

    <properties>
        <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
        <maven.compiler.source>8</maven.compiler.source>
        <maven.compiler.target>8</maven.compiler.target>
    </properties>

    <build>
        <plugins>
            <plugin>
                <groupId>org.apache.maven.plugins</groupId>
                <artifactId>maven-dependency-plugin</artifactId>
                <version>3.1.2</version>
                <dependencies>
                    <dependency>
                        <groupId>commons-beanutils</groupId>
                        <artifactId>commons-beanutils</artifactId>
                        <version>1.9.4</version>
                    </dependency>

                    <dependency>
                        <groupId>org.apache.maven.doxia</groupId>
                        <artifactId>doxia-site-renderer</artifactId>
                        <version>1.9.2</version>
                        <exclusions>
                            <exclusion>
                                <groupId>org.apache.velocity</groupId>
                                <artifactId>velocity-tools</artifactId>
                            </exclusion>
                        </exclusions>
                    </dependency>

                    <dependency>
                        <groupId>org.apache.velocity</groupId>
                        <artifactId>velocity-tools</artifactId>
                        <version>2.0</version>
                        <exclusions>
                            <exclusion>
                                <groupId>commons-beanutils</groupId>
                                <artifactId>commons-beanutils</artifactId>
                            </exclusion>
                        </exclusions>
                    </dependency>
                </dependencies>
            </plugin>

            <plugin>
                <groupId>org.apache.maven.plugins</groupId>
                <artifactId>maven-site-plugin</artifactId>
                <version>3.9.1</version>
                <dependencies>
                    <dependency>
                        <groupId>commons-beanutils</groupId>
                        <artifactId>commons-beanutils</artifactId>
                        <version>1.9.4</version>
                    </dependency>

                    <dependency>
                        <groupId>org.apache.maven.doxia</groupId>
                        <artifactId>doxia-site-renderer</artifactId>
                        <version>1.9.2</version>
                        <exclusions>
                            <exclusion>
                                <groupId>org.apache.velocity</groupId>
                                <artifactId>velocity-tools</artifactId>
                            </exclusion>
                        </exclusions>
                    </dependency>

                    <dependency>
                        <groupId>org.apache.velocity</groupId>
                        <artifactId>velocity-tools</artifactId>
                        <version>2.0</version>
                        <exclusions>
                            <exclusion>
                                <groupId>commons-beanutils</groupId>
                                <artifactId>commons-beanutils</artifactId>
                            </exclusion>
                        </exclusions>
                    </dependency>
                </dependencies>
            </plugin>
        </plugins>

    </build>
</project>

Then execute

mvn -X dependency:resolve-plugins > 11111.txt

to see something like this:

.  .  .
[DEBUG] org.apache.maven.plugins:maven-dependency-plugin:jar:3.1.2:
[DEBUG]    commons-beanutils:commons-beanutils:jar:1.9.4:runtime
.  .  .
[DEBUG] Populating class realm plugin>org.apache.maven.plugins:maven-dependency-plugin:3.1.2
[DEBUG]   Included: org.apache.maven.plugins:maven-dependency-plugin:jar:3.1.2
[DEBUG]   Included: commons-beanutils:commons-beanutils:jar:1.9.4
.  .  .
[INFO]    org.apache.maven.plugins:maven-site-plugin:maven-plugin:3.9.1:runtime
.  .  .
[INFO]    org.apache.maven.plugins:maven-dependency-plugin:maven-plugin:3.1.2:runtime
. .  .
[INFO]       commons-beanutils:commons-beanutils:jar:1.7.0
.  .  .

Now we see that commons-beanutils-1.7.0 is a dependency. Need to avoid it.

Nick Legend
  • 789
  • 1
  • 7
  • 21
  • Do you need to change plugin dependency version or do you need the version 1.9.4 of commons-beanutils in your project ? – lubrum Jun 10 '21 at 01:55
  • Actually there are methods like `exclusions` that work for the project's dependencies. I need the plugins itself to use the version 1.9.4 of `commons-beanutils`. And I understand the risk of possible incompatibility. – Nick Legend Jun 10 '21 at 05:48
  • First question: Why do you need to change the dependencies of a plugin? – khmarbaise Jun 10 '21 at 10:10
  • Well, in this case, I think it is not possible to change plugin dependencies itself. Other answers that may help: https://stackoverflow.com/questions/6028534/how-to-exclude-dependency-in-a-maven-plugin/7405917 , https://stackoverflow.com/questions/43630262/how-to-exclude-a-direct-dependency-of-a-maven-plugin – lubrum Jun 10 '21 at 12:25
  • There may be multiple reasons we would want such redefinition, and there are a lot of similar questions on the internet. In the end, Maven functional completeness may be a good point for that. As for my case, version `1.7.0` has known security issues that I want to eliminate. – Nick Legend Jun 10 '21 at 13:45

0 Answers0