3 ms·
This is not necessarily true, there are version ranges: https://www.baeldung.com/maven-dependency-latest-version https://www.baeldung.com/maven-dependency-lates
by sverhagen 5y ago
This is not necessarily true, there are version ranges: https://www.baeldung.com/maven-dependency-latest-version https://www.baeldung.com/maven-dependency-latest-version
Admittedly, I don't think it has nearly as wide a usage as it has in the NPM world. Dependabot (I know I'm not the first to mention it, here, today) is probably more of a factor.
Still, it strikes me that this sort of "attack" (or mishap) is exceedingly rare in the Java ecosystem, while it's pretty common in the NPM world, and I don't immediately understand why that would be so.
- bombcar 5y agoWe abuse jitpack.io and MASTER-snapshot to keep out Minecraft maven builds up to date.
- xienze 5y agoI was not aware of that feature. To call it rare would be an understatement I think. > while it's pretty common in the NPM world, and I don't immediately understand why that would be so. I think it boils down to Node projects typically specifying dependencies in the form “any version >= X”, effectively “always use the latest.” Dependencies can therefore get bumped silently just by rebuilding, essentially. Whereas in the Java world updating dependencies is a deliberate process.