Maven check for updated dependencies in repository

Question

Is there a Maven plugin that allows you to check if there are newer versions of dependencies available in the repository?

Say, you are using dependency X with version 1.2. Now a new version of X is released with version 1.3. I'd like to know, based on the dependencies used in my project, which dependencies have newer versions available.

Solution 1

The Maven Versions plugin and it's display-dependency-updates mojo are what you're looking for:

mvn versions:display-dependency-updates

Here is what the output looks like:

[INFO] ------------------------------------------------------------------------
[INFO] Building Build Helper Maven Plugin
[INFO]    task-segment: [versions:display-dependency-updates]
[INFO] ------------------------------------------------------------------------
[INFO] [versions:display-dependency-updates]
[INFO]
[INFO] The following dependency updates are available:
[INFO]   org.apache.maven:maven-artifact ........................ 2.0 -> 2.0.9
[INFO]   org.apache.maven:maven-plugin-api ...................... 2.0 -> 2.0.9
[INFO]   org.apache.maven:maven-project ....................... 2.0.2 -> 2.0.9
[INFO]   org.codehaus.plexus:plexus-utils ....................... 1.1 -> 1.5.6
[INFO]
[INFO] ------------------------------------------------------------------------
[INFO] BUILD SUCCESSFUL
[INFO] ------------------------------------------------------------------------
[INFO] Total time: 17 seconds
[INFO] Finished at: Fri Aug 15 10:46:03 IST 2008
[INFO] Final Memory: 10M/167M
[INFO] ------------------------------------------------------------------------

Solution 2

If you want to receive email notifications when newer artifacts versions are available on Maven Central you can create an account on artifact-listener and choose which artifact you want to follow.
You can either search manually for artifacts or directly upload your pom.xml.

You will periodically received notifications like this one (available in english and french for now) :

Solution 3

The VersionEye Maven Plugin is doing the same: versioneye_maven_plugin.

VersionEye can notify you about new versions on Maven Repositories, too. It is a language agnostic tool and beside Java it supports 7 other languages. Beside the simple follow/notify feature it can also directly monitor GitHub and BitBucket repositories and notify your about out-dated dependencies in your projects.

There is also a REST JSON API, for tool integrations.

By the way, I'm the dude who started this project. Let me know if you have questions.

Solution 4

In projects with a large number of dependancies, you sometimes keep your versions in a properties section.

    <properties>
        <assertj.version>3.15.0</assertj.version>
        <aws-sdk.version>1.11.763</aws-sdk.version>
        <cxf.version>3.3.6</cxf.version>

In the case where you are only interested in updates to those versions, you can use the following command

mvn versions:display-property-updates

This gives a more condensed view and only returns the versions you need to update in the properties section.

Solution 5

The ideal way to do it is to set dependency versions as properties in pom.xml and then running the below command to get the updated versions for your specific/custom dependencies.

<properties>
    <java.version>1.8</java.version>
    <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
    <project.reporting.outputEncoding>UTF-8</project.reporting.outputEncoding>
    <skip.tests>true</skip.tests>
    <spring-cloud-gcp.version>1.2.3.RELEASE</spring-cloud-gcp.version>
    <spring-cloud.version>Hoxton.SR6</spring-cloud.version>
    <spring-cloud-stream-schema.version>2.2.1.RELEASE</spring-cloud-stream-schema.version>
    <confluent.version>5.5.1</confluent.version>
    <avro.version>1.10.0</avro.version>
    <janino.version>3.1.2</janino.version>
    <swagger.version>2.9.2</swagger.version>
    <google-cloud-logging-logback.version>0.118.1-alpha</google-cloud-logging-logback.version>
    <spring-cloud-stream-binder-kafka.version>3.0.6.RELEASE</spring-cloud-stream-binder-kafka.version>
</properties>

mvn versions:display-property-updates


[INFO] The following version properties are referencing the newest available version:
[INFO]   ${avro.version} .............................................. 1.10.0
[INFO]   ${spring-cloud-stream-schema.version} ................. 2.2.1.RELEASE
[INFO]   ${janino.version} ............................................. 3.1.2
[INFO] The following version property updates are available:
[INFO]   ${spring-cloud-gcp.version} .......... 1.2.3.RELEASE -> 1.2.5.RELEASE
[INFO]   ${google-cloud-logging-logback.version}  0.118.1-alpha -> 0.118.2-alpha
[INFO]   ${spring-cloud-stream-binder-kafka.version}  3.0.6.RELEASE -> 3.0.8.RELEASE
[INFO]   ${confluent.version} ................................. 5.5.1 -> 6.0.0
[INFO]   ${swagger.version} ................................... 2.9.2 -> 3.0.0
[INFO]   ${spring-cloud.version} .................... Hoxton.SR6 -> Hoxton.SR8
[INFO] 
[INFO] ------------------------------------------------------------------------
[INFO] BUILD SUCCESS
[INFO] ------------------------------------------------------------------------
[INFO] Total time:  3.572 s
[INFO] Finished at: 2020-10-06T09:35:08-07:00
[INFO] ------------------------------------------------------------------------

Another way to achieve this is by executing the command mvn versions:display-dependency-updates but the problem I face with this approach is that it also shows me updates for the nested dependencies which are not too useful for me.

View more solutions

Comments

[Sergey Vyacheslavovich Brunov]

Related question: stackoverflow.com/questions/431332.

[froethen]

Thanks Pascal. That's what I was looking for. Though, for Spring version 3.0.1.RELEASE it reports a newer version of 2.5.6. Maybe a bug in the plugin?

[Devanshu Mevada]

@Felix You're welcome. Regarding the Spring artifact, I wonder if the problem is not due to the fact that Spring is not following "the rule": version should be 3.0.1-RELEASE, not 3.0.1.RELEASE. In other words, I'm not sure it's a bug (I mean, sure, I'd expect the plugin to report 3.0.1.RELEASE as newer too, but I'm not sure this would be accepted as a bug).

[Zarathustra]

could you provide an example?

[Tunaki]

Checking updates maven-plugin-api can also be used to check newer versions of Maven itself since a new version of this dependency is released for every Maven releases.

[Alireza Fattahi]

The project is closed :(

[Frederic]

That's good to know. However, is there a way to have this report when we build a project instead of having to type that command explicitely ?

[ROMANIA_engineer]

Underrated answer.

[ArtOfWarfare]

How would I have it only tell me about direct dependencies that can be updated? I don't want to be told about all the transitive dependencies I could update...

[ArtOfWarfare]

This seemed to miss 90% of the properties I have that define versions.