Versions Maven Plugin rules that are inheritable

Question

When running mvn versions:display-dependency-updates for the Version Maven Plugin I see lots of things like this:

[INFO]   org.slf4j:slf4j-api ........................... 1.7.36 -> 2.0.0-alpha7

But just because I'm not using the alpha version of a later version doesn't mean I'm not using the latest available release version. Another Stack Overflow answer indicated that I can set up a rules.xml file to ignore versions like *.-alpha*, putting something like this in my POM:

<configuration>
  <rulesUri>file:///${project.basedir}/rules.xml</rulesUri>
</configuration>

My question: is this rules.xml file inheritable? If I put it in a separate project in a parent POM of <packaging>pom</packaging>, published to Maven Central, will the child POMs pick it up? Or will the child projects look for a rules.xml file in the child project directory?

I want to configure the versions-maven-plugin in the parent POM (as I do already) and run mvn versions:display-dependency-updates on any child POM or descendant POM. How can I set up the ignore rules in the parent POM so that these version ignore rules will be picked up when I check for dependency updates in a child POM? (Is there no way to include the rule within the POM itself?)

Answer 1

Happy this is now available natively in the plugin; see Issue #684. I recommend using at least v2.16.0 because of Issue #959.

Answer 2

Pasting my answer here from Github, because I think it might benefit others.

Provided you have a directory called rules-test in your project containing the rules template file:

<ruleset comparisonMethod="maven"
         xmlns="http://mojo.codehaus.org/versions-maven-plugin/rule/2.0.0"
         xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
         xsi:schemaLocation="http://mojo.codehaus.org/versions-maven-plugin/rule/2.0.0
         https://www.mojohaus.org/versions-maven-plugin/xsd/rule-2.0.0.xsd">
    <ignoreVersions>
        <ignoreVersion type="regex">${ignoredVersions}</ignoreVersion>
    </ignoreVersions>
</ruleset>

Then, in your main project, create the following profile:

<profile>
  <id>rules-test</id>
  <build>
    <plugins>
      <plugin>
        <groupId>org.apache.maven.plugins</groupId>
        <artifactId>maven-resources-plugin</artifactId>
        <version>3.3.0</version>
        <executions>
          <execution>
            <phase>validate</phase>
            <goals>
              <goal>copy-resources</goal>
            </goals>
            <configuration>
              <resources>
                <resource>
                  <directory>rules-test</directory>
                  <filtering>true</filtering>
                </resource>
              </resources>
              <outputDirectory>${project.basedir}</outputDirectory>
            </configuration>
          </execution>
        </executions>
      </plugin>
      <plugin>
        <groupId>org.codehaus.mojo</groupId>
        <artifactId>versions-maven-plugin</artifactId>
        <version>2.12.0</version>
        <executions>
          <execution>
            <phase>validate</phase>
            <goals>
              <goal>display-dependency-updates</goal>
            </goals>
            <configuration>
              <rulesUri>file://${project.basedir}/compiled-rules.xml</rulesUri>
            </configuration>
          </execution>
        </executions>
      </plugin>
    </plugins>
  </build>
</profile>

If you then execute the following Maven target:

mvn -P rules-test "-DignoredVersions=.*-(M\d*|.*-SNAPSHOT)" clean validate

then you will get a dependencies report using the filter in the -DignoredVersions argument (filtering out both *-M* and *-SNAPSHOT).

And if you put your ignoredVerions property in your project instead of passing it as a -D argument, then it will be inheritable!

Answer 3

Or will the child projects look for a rules.xml file in the child project directory?

Yes, if you define the rules.xml file via ${project.basedir} it will resolve to the current local base directory of the child project. I've verified this with a simple parent-child pom setup. So that will not work, unless you duplicate the rules file in every project.

If you wish to include the plugin configuration and ruleset in the parent pom without duplicating the rules file, you have two options:

If you have your ruleset xml file hosted at, for example, http://www.mycompany.com/maven-version-rules.xml then the following configuration in your corporate pom would ensure that all projects use this rule set.

<configuration>
    <rulesUri>http://www.mycompany.com/maven-version-rules.xml</rulesUri>
</configuration>

or

You can provide your ruleset xml file also within a jar, if you want to distribute your ruleset xml as Maven artifact. Therefore you have to declare the containing jar as direct dependency of the versions-maven-plugin and to use classpath as protocol.

<configuration>
  <rulesUri>classpath:///package/foo/bar/rules.xml</rulesUri>
</configuration>
<dependencies>
    <dependency>
        <groupId>com.mycompany</groupId>
        <artifactId>version-rules</artifactId>
        <version>1.0</version>
    </dependency>
</dependencies>

Source:

• https://www.mojohaus.org/versions-maven-plugin/version-rules.html

The configuration in the pom only has rudimentary includes and excludes filters. Those will allow you to exclude any dependency as a whole, but not specific update versions. As far as i can tell from the available documentation there is no way to define version rules in any other way.

See

• https://www.mojohaus.org/versions-maven-plugin/examples/advancing-dependency-versions.html

Update 09-2022

In the github ticket we found in the comments we can see the following update:

It looks like a feature like this has recently been implemented by #369. Please see #318 where it's possible to provide inclusion and exclusion filters for determining which dependency patterns will be considered. Thanks to that, you can rule out patterns such as .*-beta. or .*_ALPHA, albeit not using regexp, but simple asterisk wildcards.

This will land in today's release (2.12.0).

This will add the following features:

Version 2.12.0 will introduce new arguments: dependencyIncluded, dependencyExcludes, dependencyManagementIncludes, dependencyManagementExcludes.

With the following example configuration in pom.xml given:

<profile>
  <id>display-dependency-updates</id>
  <build>
    <plugins>
      <plugin>
        <groupId>${project.groupId}</groupId>
        <artifactId>${project.artifactId}</artifactId>
        <version>${project.version}</version>
        <executions>
          <execution>
            <phase>validate</phase>
            <goals>
              <goal>display-dependency-updates</goal>
            </goals>
            <configuration>
              <dependencyIncludes>org.apache.maven.*:doxia*</dependencyIncludes>
              <dependencyManagementIncludes>com.puppy*:*</dependencyManagementIncludes>
            </configuration>
          </execution>
        </executions>
      </plugin>
    </plugins>
  </build>
</profile>

This will also be implemented for filtering plugin and pluginManagement, but that will probably be added in a later release:

So, I've just added the missing plugin- and plugin management filtering which works likewise. I really doubt it will land into today's release though.