Enforce managed dependencies in Maven projects

Working with dependencies between project modules or to external libraries is one of Maven’s core features – it’s simply done by declaring the reference to the required artifact in a pom.xml file:

<project ...>
...
  <dependencies>
    <dependency>
      <groupId>com.buschmais.jaxbfx</groupId>
      <artifactId>jaxbfx</artifactId>
      <version>1.1.0</version>
    </dependency>
  <dependencies>
...
</project>

If the project grows it becomes very likely that such an artifact will be used by several modules. In most cases it’s not just a good idea but also necessary to make sure that the same version is used in all cases.

Maven therefore provides a mechanism to manage dependencies, i.e. to declare the version to be used for a specific artifact

• either in a top level pom.xml file
• or in a pom.xml file which acts as a BOM (bill of materials):

<project ...>
...
  <dependencyManagement>
    <dependencies>
      <dependency>
        <groupId>com.buschmais.jaxbfx</groupId>
        <artifactId>jaxbfx</artifactId>
        <version>1.1.0</version>
      </dependency>
    <dependencies>
  <dependencyManagement>
...
</project>

The dependency can now be referenced without the version, this information will be taken from the dependency management section:

<project...>
...
  <dependencies>
    <dependency>
      <groupId>com.buschmais.jaxbfx</groupId>
      <artifactId>jaxbfx</artifactId>
    </dependency>
  <dependencies>
...
</project>

There’s a further benefit of this approach: It becomes very easy to change the version of a required library even for large multi-module projects.

To achieve this it’s necessary that all used dependencies are managed and no dependency with an explicit version is declared.

Such a constraint can be defined and verified using jQAssistant:

<constraint id="maven:DependencyVersionMustBeManaged">
  <description>All dependency versions must be managed.</description>
  <cypher><![CDATA[
    match
     (project:Maven:Project)-[:HAS_MODEL]->(model)-[:DEPENDS_ON]->(dependency:Artifact)
    where
      has(dependency.version)
    return
      project.fqn as MavenProject, dependency.fqn as Dependency
  ]]></cypher>
</constraint>

Another question which may come up is in which pom.xml the management section should be placed. Usually the answer is: take the root project. This rule can also be be enforced by a constraint:

<constraint id="maven:ManageDependencyInRootProject">
  <description>All dependencies must be managed in the root project.</description>
  <cypher><![CDATA[
    match
      (project:Maven:Project)-[:HAS_MODEL]->()-[:MANAGES_DEPENDENCY]->(dependency:Artifact)
    where
      (project)-[:HAS_PARENT]->() // the root module has no parent
    return
      project.fqn as MavenProject, dependency.fqn as Dependency
  ]]></cypher>
</constraint>