Maven Version Range To Exclude Next Minor Version

Question

I am using Maven 3.3.3 and want to express that I will accept any 2.7.x version of the jackson-core dependency (but am not willing to go to 2.8.x until I've had a chance to assess for backward compatibility, run unit / regression tests, etc.).

This would allow my project to receive bug fixes (under incremental versions), but delay the jump to the next minor version until ready.

I instinctively wrote the following into pom.xml:

<groupId>com.fasterxml.jackson.core</groupId>
<artifactId>jackson-core</artifactId>
<version>[2.7.1,2.8)</version>

However, a mvn dependency:list says that the following version is used:

com.fasterxml.jackson.core:jackson-core:jar:2.8.0.rc2:compile

I was taken aback by that, however dug up this answer which leads to the "official" Maven Javadoc which describes the sort order of Maven dependencies.

Those helped me understand why 2.8.0.rc2 is considered "older" than 2.8.0.

So, I reasoned that the following would (albeit hack-ishly) produce the desired results: [2.7.1,2.8.0.a)

I was wrong. The dependency:list now produces:

com.fasterxml.jackson.core:jackson-core:jar:2.8.0:compile

Same result with (or variations with -a): [2.7.1,2.8.a)

All together, this seems to imply the following orderings:

2.8.0 < 2.8.0.a 
2.8.0.rc2 < 2.8.0 

So ... if everything I learned in school about transitive relationships is correct, then:

2.8.0.rc2 < 2.8.0.a

That seems to contradict the SO answer. At the same time, the Javadoc is ambiguous (i.e. is the qualifier ordering listed the actually implemented ordering) and this Apache Wiki / Confluence page is mildly confusing.

Regardless, it doesn't seem to line up with either String sorting or common sense that a "Release Candidate" (assumed meaning for rc would precede an alpha version specified as a).

Would this be handled differently if there an actual 2.8.0-alpha version had been released?

Bottom line: is there a reasonably transferable way to specify a Maven Version Range which excludes everything in the 2.8.0 version space?

Edit: Even more bottom line... is there a clearly documented and publicly available description of the Maven version ordering algorithm outside of their source code? It's hard to tell if the cwiki page is a desired spec or implemented (and certainly doesn't go to the level of detail we're exploring here) and the Javadoc seems to imply (but isn't unambiguous in stating so) the equality between . and - which comments here demonstrate is not the case.

Answer 1

Maven itself says there is no official documentation until this bug is resolved.

Further, given what is stated in comments on the original question, I am concluding that there is no 100% safe, transferable of stating version numbers in a range for a more permanent solution.

Practically, I suppose making assumptions would render either of these valid for most uses:

[2.7.0,2.8.-alpha.alpha)
[2.7.0,2.7.9999.9999]

But theoretically, there could always be a smaller (in the first case) or larger (in the second) version number of the artifact (note that 2.7.9999.9999.9 > 2.7.9999.9999).

Even with those assumptions, stating the range in either manner leaves a build accepting any 2.7.x version published which might (for example) be 2.7.1-rc2.

I know realize this was an implied premise in my original question. That is, asking to "receive bug fixes (under incremental versions), but delay the jump to the next minor version until ready" assumed that the "incremental versions" are only non-alpha, non-rc, etc. versions.

That premise is invalid. Providing "only unqualified versions (eg. maj.min.inc with no -qualifer)" does not seem to be a use case supported by Maven and is a separate question entirely.

I think I'm now firmly in the "Maven Ranges are Evil" camp... not as much for build reproducibility reasons as much as being able to control the quality / finality of the included artifacts.

Answer 2

You can simply check the ordering by using the following command:

java -jar apache-maven-3.3.3/lib/maven-artifact-3.3.3.jar 2.8.0.rc2 2.8.0.a

Display parameters as parsed by Maven (in canonical form) and comparison result:
1. 2.8.0.rc2 == 2.8.0.rc-2
   2.8.0.rc2 < 2.8.0.a
2. 2.8.0.a == 2.8.0.a

You can also check the other version 2.8.0-alpha via:

java -jar apache-maven-3.3.3/lib/maven-artifact-3.3.3.jar 2.8.0.rc2 2.8.0-alpha
Display parameters as parsed by Maven (in canonical form) and comparison result:
1. 2.8.0.rc2 == 2.8.0.rc-2
   2.8.0.rc2 > 2.8.0-alpha
2. 2.8.0-alpha == 2.8-alpha