Maven 2.0.9 introduced the ability to override a dependency used by a plugin. This is handy when you want to use a newer checkstyle, pmd, etc jar than is included by default in the plugin.
How you do this actually depends on your use case, because of an oversight in the Maven 4.0.0 model used by the Maven 2.0.x versions.
If you are using a plugin as a normal build plugin (as opposed to a report), then you will have it bound like this:
<plugin>
<groupId>org.apache.maven.plugins</groupId>
<artifactId>maven-checkstyle-plugin</artifactId>
<version>2.1</version>
<executions>
<execution>
<id>check my sources</id>
<goals>
<goal>check</goal>
</goals>
<phase>compile</phase>
</execution>
</executions>
</plugin>
This version of the maven-checkstyle-plugin will use checkstyle 4.1 by default. If I wanted to use version 4.4 instead, I simply add a dependency block inside my plugin block like this:
<plugin>
<groupId>org.apache.maven.plugins</groupId>
<artifactId>maven-checkstyle-plugin</artifactId>
<version>2.1</version>
<executions>
<execution>
<id>check my sources</id>
<goals>
<goal>check</goal>
</goals>
<phase>compile</phase>
</execution>
</executions>
<span style="color: red;"> <dependencies>
<dependency>
<groupId>checkstyle</groupId>
<artifactId>checkstyle</artifactId>
<version>4.4</version>
</dependency>
</dependencies></span>
</plugin>
That was easy, right? As long as the new version you have introduced is API compatible with the version the plugin was linked against, you should be good.
Now, what about reports? Well, unfortunately, the Model used in 2.0.x doesn't allow dependencies to be specified inside the reporting block.
In the process of creating the samples for this how-to, I discovered that the extensions don't override the reporting plugin dependencies, so unfortunately there isn't a way to override them. Stay tuned as we investigate how to deal with this.
Update: There is a way to make this happen with reports. In the example below, I removed the execution from the plugin block and added the plugin as a report. It seems the dependency is inherited when the plugin is used in reporting. Not obvious, but here's what it looks like:
<build>
<plugins>
<plugin>
<groupId>org.apache.maven.plugins</groupId>
<artifactId>maven-checkstyle-plugin>/artifactId>
<version>2.1</version>
<dependencies>
<dependency>
<groupId>checkstyle</groupId>
<artifactId>checkstyle</artifactId>
<version>4.4</version>
</dependency>
</dependencies>
</plugin>
</plugins>
</build>
<reporting>
<plugins>
<plugin>
<groupId>org.apache.maven.plugins</groupId>
<artifactId>maven-checkstyle-plugin</artifactId>
<version>2.1</version>
</plugin>
</plugins>
</reporting>
Checkstyle makes it easy to test this behavior, because it writes out the checkstyle version in the results:
<?xml version="1.0" encoding="UTF-8"?> <checkstyle version="4.4">
Build Faster With Sonatype Nexus Repository
To streamline your dependency management and further optimize your development workflow, consider using Sonatype Nexus Repository. Nexus Repository offers powerful features for storing, managing, and securing your components, making it an essential tool for any Maven project.
.jpg?width=150&height=150&name=fox-2016-1-sq%20(1).jpg)
Brian Fox, CTO and co-founder of Sonatype, is a Governing Board Member for the Open Source Security Foundation (OpenSSF), a Governing Board Member for the Fintech Open Source Foundation (FINOS), a member of the Monetary Authority of Singapore Cyber and Technology Resilience Experts (CTREX) Panel, a member of the Apache Software Foundation and former Chair of the Apache Maven project. Working with OpenSSF, Brian helped create The Open Source Consumption Manifesto, urging organizations to elevate awareness of open source usage. He also chaired efforts to provide official responses to requests for information from the The Office of the National Cybersecurity Directorate (ONCD) and the Cybersecurity and Infrastructure Security Agency (CISA). Within the Atlantic Council's Open Source Policy Network, Brian actively helps shape cybersecurity strategy, offering valuable insights on critical documents, such as ONCD's recent National Cyber Security Strategy. Brian has over 20 years of experience driving the vision behind, as well as developing and leading the development of software for organizations ranging from startups to large enterprises. Brian is a frequent speaker at national and regional events including Java User Groups and other security and development-related conferences.
Explore All Posts by Brian FoxTags
Try Nexus Repository Free Today
Sonatype Nexus Repository is the world’s most trusted artifact repository manager. Experience the difference and download Community Edition for free.