8

I am writing a Maven plugin which performs analysis of dependencies in Maven projects. For this analysis I need to transitively resolve project dependencies into files. Basically, I need all the JARs which a project uses directly or indirectly as local files so that my plugin could analyze them.

How to do this in modern (~3.3.x) Maven?

What I was doing in earlier versions was:

Inject a lot components and parameters.

@Component
protected ArtifactResolver artifactResolver;

@Component
protected ArtifactMetadataSource artifactMetadataSource;

@Component
protected ArtifactFactory artifactFactory;

@Parameter(defaultValue="${localRepository}", required=true, readonly=true)
protected ArtifactRepository localRepository;

@Component(role=MavenProjectBuilder.class)
protected MavenProjectBuilder mavenProjectBuilder;

@Component
protected ArtifactGraphBuilder artifactGraphBuilder;

@Parameter(defaultValue="${project.remoteArtifactRepositories}", required = true, readonly = true)
protected List<ArtifactRepository> remoteArtifactRepositories;

@Parameter( defaultValue = "${project}", readonly = true)
protected MavenProject project;

Create artifacts from dependencies:

final Set<Artifact> dependencyArtifacts =
    MavenMetadataSource.createArtifacts(artifactFactory,
        project.getDependencies(), "compile", null, project);

Use the ArtifactResolver to transitively resolve artifacts:

artifactResolver.resolveTransitively(artifacts, originatingArtifact,
        managedVersions, localRepository, remoteRepositories,
        artifactMetadataSource, filter, moreListeners);

I'm now trying to move all this to current Maven (3.3.9) and suddenly almost everything (ArtifactMetadataSource, ArtifactFactory, MavenProjectBuilder) is deprecated with zero notice of what should be used instead.

lexicore
  • 42,748
  • 17
  • 132
  • 221
  • analyze to do what? – Kalpesh Soni Dec 19 '16 at 23:18
  • @KalpeshSoni Is this really relevant? I perform bytecode analysis of classes to build dependency graph on the class level. And I need JARs for this (to feed them to javassist). – lexicore Dec 19 '16 at 23:23
  • For what it's worth, it looks like artifact.metadata package was deprecated in the first maven-3 release, and moved into a "legacy" package: `org\apache\maven\repository\legacy\metadata`. I haven't found any useful discussion about the change, but maybe just switching references to the new package will help. The MavenProjectBuilder APIDocs says to use `ProjectBuilder` instead. – Gus Dec 20 '16 at 00:12
  • Can't you just use `requiresDependencyResolution = TEST` and retrieve the JAR files with `project.getArtifacts()`? – Tunaki Dec 20 '16 at 09:12
  • @Tunaki I'm really interested in resolution to see the full dependency graph, not just resolution result. – lexicore Dec 20 '16 at 11:23
  • You can build the dependency tree using the `maven-dependency-tree` component, [take a look at this post](http://stackoverflow.com/a/35380442/1743880). If you add a `requiresDependencyResolution = ResolutionScope.TEST`, the tree will have resolved artifact file for each dependency. – Tunaki Dec 20 '16 at 13:01
  • @Tunaki I don't need a tree, I need a graph. – lexicore Dec 20 '16 at 13:27
  • I'm sorry, I'm not sure the understand the difference between the two. The API in `maven-dependency-tree` is called [`DependencyGraphBuilder`](http://maven.apache.org/shared/maven-dependency-tree/apidocs/org/apache/maven/shared/dependency/graph/DependencyGraphBuilder.html). – Tunaki Dec 20 '16 at 13:31
  • @Tunaki Please see [Difference Between Tree and Graph](https://techdifferences.com/difference-between-tree-and-graph.html#:~:text=Graph%20and%20tree%20are%20the,connected%20and%20free%20from%20loops.). – lexicore Jul 17 '20 at 10:29

0 Answers0