spotify / missinglink

Build time tool for detecting link problems in java projects

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

Warn about snapshot dependencies

pettermahlen opened this issue · comments

This is probably not a core feature, but could be added as a plugin. Or maybe it's core. The idea is that even though you think that you're using a consistent set of released dependencies, some transitive dependency might be packaged with a SNAPSHOT dependency. This could mean that problems get introduced, seemingly at random depending on, for instance, where an artifact is built.

There is a rule for maven-enforcer-plugin that can enforce this: http://maven.apache.org/enforcer/enforcer-rules/requireReleaseDeps.html

Ah, nice - to confirm, does that work if the dependency chain is

  1. A depends on B, B depends on C
  2. B is a released version that depends on a snapshot of C
  3. The enforcer plugin is run for project A

If so, we should close this issue.

as far as I can tell, the link for the rule says

searchTransitive - if transitive dependencies should be checked. Default: true