Remix.run Logo
tonsky 4 days ago

It’s totally fine in Maven, no need to rebuild or repackage anything. You just override version of libinsecure in your pom.xml and it uses the version you told it to

zahlman 4 days ago | parent [-]

So you... manually re-lock the parts you need to?

aidenn0 4 days ago | parent | next [-]

Don't forget the part where Maven silently picks one version for you when there are transitive dependency conflicts (and no, it's not always the newest one).

deredede 4 days ago | parent | prev [-]

Sure, I'm happy with locking the parts I need to lock. Why would I lock the parts I don't need to lock?

skywhopper 3 days ago | parent [-]

Because you can’t know which ones you “need” to lock.

lenkite 3 days ago | parent [-]

You can definitely know this. Use

    mvn dependency:tree -Dverbose
Or use maven-enforcer-plugin to fail the build on conflicts.