Freezing transitive maven output dependencies to get fully reproducible

Question

Problem related to basic maven concepts:

Upon release, I would like to be guaranteed that the assembly of the project is fully reproducible. Therefore, all dependencies of the project and the plugin, including transitional ones, should always be solved the same way.

Unfortunately, this is not the case if dependencies are expressed in terms of version ranges. It may happen that even if direct dependencies of the project are specified (using versions: use releases ), transitive dependencies may be resolved in some other way in the future.

How to solve a problem? Is the solution known?

I was thinking (just an idea) about creating a plugin that at the time of release dumped all the project dependencies to a separate file, and then, when it is built in the future, the dependencies read from the file will take precedence over the standard way of using maven to resolve dependencies. But I'm afraid there is no api plugin for this. So this will require some hacking, which I would like to avoid. Is there another way?

Thanks Lukas

Answer 1

Commit the artifact versions using <dependencyManagement> . Even if you do not use version ranges (as you said), but rather third-party libraries (your dependencies), your <dependencyManagement> will have a higher priority when specifying the version of any artifacts.

Answer 2

Simple solution: Do not use version ranges. This is bad practice because it will lead to the described problems.