java - What about new versions of third party libraries? -
i'm maintaining open source java library has dependencies third party libraries (e.g. commons-beanutils:commons-beanutils-1.8.3). during development added recent version of such libraries pom. did changes library , realized versions no more recent.
i'm wondering strategy best practice such dependencies.
my feeling says run mvn versions:use-latest-releases test
.
i recommend using mvn versions:display-dependency-updates
, updating relevant libraries hand.
it not necessary use latest version of library.
usually, should update dependencies if:
- you need feature of new version (for major , minor releases)
- the update resolves known bug (that affects you)
- the update fixes security problem.
- resolves incompatibility dependency
otherwise, consider staying on current version.
you might, temporarily consider using version ranges commons-beanutils:commons-beanutils:[1.8.0,1.9.0)
use latest bugfix version. note however, results in non-reproducable builds , must changed before releasing project.
Comments
Post a Comment