|
| 1 | +title: Locking snapshot dependencies |
| 2 | +author: Stephen Connolly, Paul Gier |
| 3 | +date: 2009-04-20 |
| 4 | + |
| 5 | +<!--- |
| 6 | +Licensed to the Apache Software Foundation (ASF) under one |
| 7 | +or more contributor license agreements. See the NOTICE file |
| 8 | +distributed with this work for additional information |
| 9 | +regarding copyright ownership. The ASF licenses this file |
| 10 | +to you under the Apache License, Version 2.0 (the |
| 11 | +"License"); you may not use this file except in compliance |
| 12 | +with the License. You may obtain a copy of the License at |
| 13 | + https://www.apache.org/licenses/LICENSE-2.0 |
| 14 | +Unless required by applicable law or agreed to in writing, |
| 15 | +software distributed under the License is distributed on an |
| 16 | +"AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY |
| 17 | +KIND, either express or implied. See the License for the |
| 18 | +specific language governing permissions and limitations |
| 19 | +under the License. |
| 20 | +--> |
| 21 | + |
| 22 | +# Locking snapshot dependencies |
| 23 | + |
| 24 | +If your pom contains a lot of -SNAPSHOT dependencies and those -SNAPSHOT dependencies are a moving target, it |
| 25 | +can sometimes be helpful to temporarily replace the -SNAPSHOT with a locked -YYYYMMDD.HHMMSS-NNN snapshot. |
| 26 | +In the long term, you will need to return to the -SNAPSHOT dependencies and then replace them with their |
| 27 | +release version, but if you need a short term semi-reproducible build, locked -SNAPSHOTs can sometimes be a |
| 28 | +useful hack. |
| 29 | + |
| 30 | +A pom will most likely specify -SNAPSHOT versions for certain dependencies. |
| 31 | + |
| 32 | +```xml |
| 33 | +<dependencies> |
| 34 | + |
| 35 | +<dependency> |
| 36 | + <groupId>org.codehaus.cargo</groupId> |
| 37 | + <artifactId>cargo-core-api</artifactId> |
| 38 | + <version>1.0-SNAPSHOT</version> |
| 39 | +</dependency> |
| 40 | + |
| 41 | +</dependencies> |
| 42 | +``` |
| 43 | + |
| 44 | +Using the `lock-snapshots` goal, the version can be locked down to the specific timestamped snapshot version used |
| 45 | +in the build. |
| 46 | + |
| 47 | +```sh |
| 48 | +mvn versions:lock-snapshots |
| 49 | +``` |
| 50 | + |
| 51 | + The pom dependencies are modified to look like the following. |
| 52 | + |
| 53 | +```xml |
| 54 | +<dependencies> |
| 55 | + |
| 56 | +<dependency> |
| 57 | + <groupId>org.codehaus.cargo</groupId> |
| 58 | + <artifactId>cargo-core-api</artifactId> |
| 59 | + <version>1.0-20081117.213112-16</version> |
| 60 | +</dependency> |
| 61 | + |
| 62 | +</dependencies> |
| 63 | +``` |
| 64 | + |
| 65 | +You can restrict which dependencies should have their -SNAPSHOT versions locked down. For example, |
| 66 | +the following will only match dependencies that match the groupId "org.codehaus.plexus" and artifactId |
| 67 | +"plexus-utils" |
| 68 | + |
| 69 | +```sh |
| 70 | +mvn versions:lock-snapshots -Dincludes=org.codehaus.plexus:plexus-utils |
| 71 | +``` |
| 72 | + |
| 73 | +The `includes` and `excludes` parameters follow the format `groupId:artifactId:type:classifier`. |
| 74 | +Use a comma separated list to specify multiple includes. Wildcards (*) can also be used to match |
| 75 | +multiple values. |
| 76 | + |
| 77 | +This example will match anything with the groupId "org.codehaus.plexus" and anything with the groupId and |
| 78 | +artifactId matching "junit". |
| 79 | + |
| 80 | +```sh |
| 81 | +mvn versions:lock-snapshots -Dincludes=org.codehaus.plexus:*,junit:junit |
| 82 | +``` |
| 83 | + |
| 84 | +By default, both the `project/dependencyManagment` and `project/dependencies` sections will be processed. |
| 85 | +You can use the `processDependencies` and `processDependencyManagement` parameters to control which sections |
| 86 | +are processed. |
| 87 | + |
| 88 | +This example will only process the `project/dependencyManagment` section of your pom: |
| 89 | + |
| 90 | +```sh |
| 91 | +mvn versions:lock-snapshots -DprocessDependencies=false |
| 92 | +``` |
| 93 | + |
| 94 | +While this example will only process the `project/dependencies` section of your pom: |
| 95 | + |
| 96 | +```sh |
| 97 | +mvn versions:lock-snapshots -DprocessDependencyManagement=false |
| 98 | +``` |
0 commit comments