How to hide inherited dependencies in Versions Maven Plugin?

Question

I'm trying to use Versions Maven Plugin, together with spring-boot.

Problem: when running versions:display-dependency-updates to autoecheck for latest dependencies, I'm not only getting the updates defined in my pom.xml, but also all inherited dependencies from spring-boot-starter-parent.

Question: how can I prevent inheritance and just show the self-defined dependencies?

<project>
    <parent>
        <groupId>org.springframework.boot</groupId>
        <artifactId>spring-boot-starter-parent</artifactId>
        <version>2.0.0.RELEASE</version>
    </parent>


    <properties>
    <cxf.version>3.0.0</cxf.version>
    </properties>

    <dependencies>
    <dependency>
        <groupId>org.apache.cxf</groupId>
        <artifactId>cxf-rt-frontend-jaxws</artifactId>
        <version>${cxf.version}</version>
    </dependency>
    </dependencies>
</project>

At best, the plugin would inform me of updates similar to:

spring-boot-starter-parent.....2.0.0 -> 2.0.3
cxf-rt-frontend-jaxws..........3.0.0 -> 3.2.6

But instead, I'm getting output an all dependencies inherited from the spring parent.

Glauconite

Answer 1

You can use the versions:display-property-updates goal instead. This goal only considers the dependency versions that are given as properties, so it will not show the transitive dependencies. You'll have to add a few more version properties to your pom, but that's not a bad thing in general.

The documentation for the versions:display-dependency-updates goal does not include a flag to exclude transitive dependencies. So I assume it's not possible using that goal. I couldn't find any relevant open issues on issues.apache.org either, so it doesn't seem to be on the roadmap.

Gratification

It seems that since versions-maven-plugin version 2.13.0 this solution is no longer valid as the parent pom is included in property resolution according to github.com/mojohaus/versions-maven-plugin/commit/… So far I didn't find a setting to get back the previous behavior. – Melody

My comment above as been confirmed and default behavior will be back to pre-2.13.0 with the publication of version 2.14.0. – Melody

Answer 2

Using dependencyManagementExcludes config option helped me a lot with that. Setting it to *:*:*:*:*:* will prevent showing any updates in dependency management.

mvn -DdependencyManagementExcludes=*:*:*:*:*:* versions:display-dependency-updates

Pathan