22

In my maven project I use dependencies like this:

<dependency>
    <groupId>org.apache.httpcomponents</groupId>
    <artifactId>httpclient</artifactId>
    <version>[4.2.2, 5.0)</version>
</dependency>

Since the next major version (5.0) may change the API, I want my project to use the latest stable version available for branch 4.x.

This morning bug investigation told me this expression [4.2.2, 5.0) grabs any version available. In my case: 4.3-alpha1.

How to make maven use thelatest release version within version range?

snowindy
  • 3,117
  • 9
  • 40
  • 54
  • There is a similar page here: http://stackoverflow.com/questions/30571/how-do-i-tell-maven-to-use-the-latest-version-of-a-dependency – Gavin Xiong Jan 21 '13 at 03:45
  • @Gavin there is no answer to my question at the link. I have seen it before prior to question. – snowindy Jan 21 '13 at 04:13
  • 2
    I assume you use maven2 (given the question tags). Maven strongly discourage this, as this can lead to non reproductible build. AND this will make any future migration to recent maven version a painful process. So, I strongly discourage this, as useful as it may seem. – Samuel EUSTACHI Jan 21 '13 at 10:36
  • @SamuelEUSTACHI Now I've got the point. Thank you. – snowindy Jan 21 '13 at 10:55
  • 1
    You're welcome. I had the same idea, about dependencies between my own projects. I would assume that the risk is not as big as for a dependency from an external provider. But I discovered that this is not a good practice, even in this case. For instance, the pom of a version of your pom can also serve a some kind of "self-documentation" for your project, and then it is useful to be able to know exactly the set of libraries used at compile time and runtime. You might want to know this for later debugging. – Samuel EUSTACHI Jan 21 '13 at 12:32

2 Answers2

18

Looking at the documentation for Maven range selections, I notice the comment:

Resolution of dependency ranges should not resolve to a snapshot (development version) unless it is included as an explicit boundary.

Unless the artifact version ends with -SNAPSHOT, Maven is going to consider it a valid release build. As far as I know, -alpha1 has no special meaning to Maven. It's just another random qualifier.

I would strongly recommend you forgo the version range, anyway. Predictable builds should be the goal of any stable project and version ranges fly in the face of that.

Jakub Bochenski
  • 3,113
  • 4
  • 33
  • 61
Duncan Jones
  • 67,400
  • 29
  • 193
  • 254
  • Thank you for the advice about ranges. Starting with Maven, it's not always clear which option to take. – snowindy Jan 21 '13 at 10:54
  • The linked documentation is a design draft for Maven 2.0. The final implementation actually slightly differ. – Julien Carsique Jan 17 '17 at 10:14
  • 5
    `Predictable builds should be the goal of any stable project and version ranges fly in the face of that.` Unless you care about security more than predictable builds. If a build is broken, everyone sees it and hurries to fix. If a vulnerability is found, no one cares. – Dzmitry Lazerka Apr 13 '17 at 00:48
  • 2
    "It should not" but it will according to this issue: https://issues.apache.org/jira/browse/MNG-3092 – Todor Kolev Sep 08 '17 at 12:49
  • 2
    I use maven 3.5.3, which does opposite to the doc by considering snapshot as a valid version. – flyrain Sep 14 '18 at 20:06
1

Maven 3 supports versioning for alpha, beta and snapshots as well with the following order alpha < beta < snapshot

yugandhar
  • 580
  • 7
  • 16
  • 1
    Any source for that? – J Fabian Meier Sep 07 '16 at 14:25
  • The source code is explicit: https://github.com/apache/maven/blob/maven-3.3.9/maven-artifact/src/main/java/org/apache/maven/artifact/versioning/ComparableVersion.java#L149 (see the method `ComparableVersion.StringItem.comparableQualifier(String)`). And the Javadoc states that: << strings are checked for well-known qualifiers and the qualifier ordering is used for version ordering. Well-known qualifiers (case insensitive) are: alpha or a, beta or b, milestone or m, rc or cr, snapshot, (the empty string) or ga or final, sp >> – Julien Carsique Jan 17 '17 at 10:07
  • As @JulienCarsique, already replied source is https://github.com/apache/maven/blob/maven-3.3.9/maven-artifact/src/main/java/org/apache/maven/artifact/versioning/ComparableVersion.java#L149 – yugandhar Feb 08 '18 at 14:21
  • 1
    And also in the documentation: https://maven.apache.org/pom.html you find the following: `"alpha" < "beta" < "milestone" < "rc" = "cr" < "snapshot" < "" = "final" = "ga" < "sp"` – Yanick Salzmann Oct 31 '19 at 07:49