Managing maven dependancies - New Versions and Non

问题:

Warning: I have just picked up Maven, so things mentioned might be wrong or not best practice.

I have a medium size open source project that I am migrating to Maven from the basic NetBeans project management. This is not a developer team sharing the same room, this is 1-5 people over the internet sharing a SVN repo. Reading over the how-tos on dependencies, it seems that the only way to get dependencies is to get them from an online repo or install them locally.

This is not what I was looking for. I want to keep all dependencies in the SVN for many reasons including portability (anybody can pass by, check out the repo, build, and use; all that simply without manual adding to local repo's and whatnot), getting newer versions (discussed below), and manual versioning.

The other issue I have with the maven repository is that they are quite behind in versions. Logback for example is 0.9.18 in mvnbrowser but 0.9.24 officially. PircBot is 1.4.6 in mvnbrowser but 1.5.0 officially. Why such old versions?

Issue 3 is that I have dependencies that don't even exist in the repos, like Easier Java Persistence.

So

1. How can I force all dependencies to come from /lib for example
2. On a related note, can mvn build from library's SVN repo directly? Just curious
3. Is there an automatic way to get the newest version directly from a dependencies site/svn repo if they also use Maven? IE libraries like commons-lang or logback
4. Is there a better way of managing dependencies? (IE Ivy or some weird POM option I'm missing)

FYI, this is a Java project with 3 modules, project global dependencies and module specific dependencies.

Bonus points if it can work with the bundled version of Maven that comes with NetBeans.

Not a duplicate of

• Maven: add a dependency to a jar by relative path - Not wanting to install to local repository
• maven compile fails because i have a non-maven jar - Don't think a System dependency is the right answer
• maven look for new versions of dependencies - Still uses(?) repository, just the latest (old) version

回答1:

This is not what I was looking for. I want to keep all dependencies in the SVN for many reasons (...)

I will come back on this but the solution I described in Maven: add a dependency to a jar by relative path (using a file-based repository) allows to implement such a solution.

The other issue I have with the maven repository is that they are quite behind in versions. Logback for example is 0.9.18 in mvnbrowser but 0.9.24 officially. PircBot is 1.4.6 in mvnbrowser but 1.5.0 officially. Why such old versions?

It looks like mvnbrowser indices are totally out of date (making it useless as repository search engine) because the maven central repository does have logback-core-0.9.24.jar (the logback project is doing what has to be done to make this happen) but only has an old pircbot-1.4.2.jar. Why? Ask the pircbot team. Anyway, you're right, the central repository might not always have ultimate versions.

Issue 3 is that I have dependencies that don't even exist in the repos, like Easier Java Persistence.

Yeah, this happens too.

How can I force all dependencies to come from /lib for example

As previously hinted, you should re-read carefully the solution suggested in Maven: add a dependency to a jar by relative path. This solution is not about installing libraries to the local repository but is about using a file-based repository (that could thus be stored in SVN). You might have missed the point, this matches your use case. And also check Brett's answer for a variation.

On a related note, can mvn build from library's SVN repo directly? Just curious

Didn't get that one. Can you clarify?

Is there an automatic way to get the newest version directly from a dependencies site/svn repo if they also use Maven? IE libraries like commons-lang or logback

Maven supports version ranges and you could use a syntax allowing to use "any version greater than X". But I do NOT recommend using version ranges at all, for the sake of build reproducibility. You don't want the build to suddenly fail because of some automatic update that happened on your back. Only upgrade if you need bug fixes or new features, but do it explicitly (if it ain't broke, don't fix it).

You might also find mentions of the LATEST and RELEASE version markers. I don't recommend them neither for the same reasons as above and even less since they're removed from Maven 3.x.

Is there a better way of managing dependencies? (IE Ivy or some weird POM option I'm missing)

Can't say for Ivy. But in the Maven land, if you can't host up a "corporate" repository for your project (Nexus, Archiva, Artifactory), then the file-based repository is IMO the best approach.

回答2:

Setup your own Maven repository.

http://archiva.apache.org/