{"id":16652134,"url":"https://github.com/jdcasey/enforce-managed-deps-rule","last_synced_at":"2025-09-10T18:38:31.480Z","repository":{"id":8575183,"uuid":"10205031","full_name":"jdcasey/enforce-managed-deps-rule","owner":"jdcasey","description":"Enforcer plugin rule to make sure that all dependency versions come from managed dependencies.","archived":false,"fork":false,"pushed_at":"2017-05-31T16:31:32.000Z","size":88,"stargazers_count":6,"open_issues_count":0,"forks_count":4,"subscribers_count":2,"default_branch":"master","last_synced_at":"2025-04-06T23:46:54.256Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":null,"language":"Java","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/jdcasey.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null}},"created_at":"2013-05-21T20:41:58.000Z","updated_at":"2019-04-25T08:56:39.000Z","dependencies_parsed_at":"2022-08-30T03:51:50.983Z","dependency_job_id":null,"html_url":"https://github.com/jdcasey/enforce-managed-deps-rule","commit_stats":null,"previous_names":[],"tags_count":4,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/jdcasey%2Fenforce-managed-deps-rule","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/jdcasey%2Fenforce-managed-deps-rule/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/jdcasey%2Fenforce-managed-deps-rule/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/jdcasey%2Fenforce-managed-deps-rule/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/jdcasey","download_url":"https://codeload.github.com/jdcasey/enforce-managed-deps-rule/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":248080347,"owners_count":21044486,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-10-12T09:27:43.556Z","updated_at":"2025-04-09T17:44:15.347Z","avatar_url":"https://github.com/jdcasey.png","language":"Java","funding_links":[],"categories":[],"sub_categories":[],"readme":"### Managed-Dependency Requirement for maven-enforcer-plugin\n\nThis is a rule implementation for the Apache Maven Enforcer Plugin, version 1.0+. It simply checks that all dependencies in your POM have versions that were specified in a `\u003cdependencyManagement\u003e` section.\n\n### Why??\n\nWhen you have a large project, it's usually good practice to accumulate all the dependency declarations in the top-level POM, in a `\u003cdependencyManagement\u003e` section. This gives you a single place to look to find the version, typical scope, and exclusions for any dependency used anywhere in your project. Of course, you may need to change the scope, or less often, the exclusions in different sub-POMs...but you probably **don't** want to change the version in a sub-POM, at least in 99.999% of cases.\n\nThis rule helps you enforce that best practice. While it doesn't check that only one POM in the build tree contains a `\u003cdependencyManagement\u003e` element, it will verify that all versions for dependencies are managed somewhere.\n\n### How to Use\n\nIn your `pom.xml`, simply specify an enforcer-plugin configuration similar to this:\n\n    \u003cbuild\u003e\n      \u003cplugins\u003e\n        \u003cplugin\u003e\n          \u003cartifactId\u003emaven-enforcer-plugin\u003c/artifactId\u003e\n          \u003cversion\u003e1.0\u003c/version\u003e\n          \u003cdependencies\u003e\n            \u003cdependency\u003e\n              \u003cgroupId\u003eorg.commonjava.maven.enforcer\u003c/groupId\u003e\n              \u003cartifactId\u003eenforce-managed-deps-rule\u003c/artifactId\u003e\n              \u003cversion\u003e1.0\u003c/version\u003e\n            \u003c/dependency\u003e\n          \u003c/dependencies\u003e\n          \u003cexecutions\u003e\n            \u003cexecution\u003e\n              \u003cid\u003eno-managed-deps\u003c/id\u003e\n              \u003cgoals\u003e\n                \u003cgoal\u003eenforce\u003c/goal\u003e\n              \u003c/goals\u003e\n              \u003cphase\u003einitialize\u003c/phase\u003e\n              \u003cconfiguration\u003e\n                \u003crules\u003e\n                  \u003crequireManagedDeps implementation=\"org.commonjava.maven.enforcer.rule.EnforceManagedDepsRule\"\u003e\n                    \u003ccheckProfiles\u003etrue\u003c/checkProfiles\u003e\n                    \u003cfailOnViolation\u003etrue\u003c/failOnViolation\u003e\n                  \u003c/requireManagedDeps\u003e\n                \u003c/rules\u003e\n              \u003c/configuration\u003e\n            \u003c/execution\u003e\n          \u003c/executions\u003e\n        \u003c/plugin\u003e\n      \u003c/plugins\u003e\n    \u003c/build\u003e\n\n### Options\n\nYou may notice the two configuration parameters for the rule: `checkProfiles` and `failOnViolation`. These have the following meanings:\n\n#### `checkProfiles`\n\nIf this is enabled, the rule will not only check the dependencies in the main body of the POM, but also dependencies in all profiles. This is usually a good idea, but sometimes the information in POM profiles can become a bit obsolete. Therefore, it's disabled by default.\n\n#### `failOnViolation`\n\nIf this is disabled, the rule will only print a warning when it comes across a dependency with a locally-specified version. By default, it is enabled...meaning it will actually fail the build if it finds a non-conforming dependency declaration.\n\n#### `regexIgnored`\n\nThis is an optional set of regex that the enforcer will ignore when checking e.g.\n\n    \u003cregexIgnored\u003e\n        \u003cregexIgnored\u003e[{]\u003c/regexIgnored\u003e\n    \u003c/regexIgnored\u003e\n\n### Resources\n\n- [Maven-generated project site](http://jdcasey.github.io/enforce-managed-deps-rule/)\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fjdcasey%2Fenforce-managed-deps-rule","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fjdcasey%2Fenforce-managed-deps-rule","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fjdcasey%2Fenforce-managed-deps-rule/lists"}