如何使用Maven命令檢測(cè)重復(fù)的依賴關(guān)系

在我們平時(shí)的開(kāi)發(fā)過(guò)程中，常常會(huì)遇到引入各種不同的 jar 包，然后引發(fā)的 Maven 依賴沖突，今天我們來(lái)學(xué)習(xí)下如何使用 Maven 命令檢測(cè) pom.xml 中的重復(fù)依賴項(xiàng)。

為什么要檢測(cè)重復(fù)的依賴關(guān)系

在pom.xml中, 經(jīng)常引入各種不同的jar 包， 又會(huì)依賴其他的jar。特別是一些常用的工具庫(kù)，比較容易出現(xiàn)版本沖突，例如，讓我們看下這個(gè)pom.xml。

< project >
  [...]
  < dependencies >
    < dependency >
      < groupId >org.apache.commons< /groupId >
      < artifactId >commons-lang3< /artifactId >
      < version >3.12.0< /version >
    < /dependency >
    < dependency >
      < groupId >org.apache.commons< /groupId >
      < artifactId >commons-lang3< /artifactId >
      < version >3.11< /version >
    < /dependency >
  < /dependencies >
   [...]
< /project >

從上面的代碼中，commons-lang3 被引用了兩次，而且版本號(hào)也不一樣?，F(xiàn)在我們就來(lái)看看如何使用Maven命令來(lái)檢測(cè)這些重復(fù)的依賴關(guān)系。

依賴樹(shù)命令

讓我們?cè)诮K端運(yùn)行 mvn dependency:tree的命令，看看輸出結(jié)果

$ mvn dependency:tree
[INFO] Scanning for projects...
[WARNING]
[WARNING] Some problems were encountered while building the effective model for com.javanorth:maven-duplicate-dependencies:jar:0
.0.1-SNAPSHOT
[WARNING] 'dependencies.dependency.(groupId:artifactId:type:classifier)' must be unique: org.apache.commons:commons-lang3:jar -
> version 3.12.0 vs 3.11 @ line 14, column 15
[WARNING]
[WARNING] It is highly recommended to fix these problems because they threaten the stability of your build.
[WARNING]
[WARNING] For this reason, future Maven versions might no longer support building such malformed projects.
[WARNING]
[INFO]
[INFO] -------------< com.javanorth:maven-duplicate-dependencies >--------------
[INFO] Building maven-duplicate-dependencies 0.0.1-SNAPSHOT
[INFO] --------------------------------[ jar ]---------------------------------
[INFO]
[INFO] --- maven-dependency-plugin:2.8:tree (default-cli) @ maven-duplicate-dependencies ---
[WARNING] The artifact xml-apis:xml-apis:jar:2.0.2 has been relocated to xml-apis:xml-apis:jar:1.0.b2
[INFO] com.javanorth:maven-duplicate-dependencies:jar:0.0.1-SNAPSHOT
[INFO] - org.apache.commons:commons-lang3:jar:3.11:compile
[INFO] ------------------------------------------------------------------------
[INFO] BUILD SUCCESS
[INFO] ------------------------------------------------------------------------
[INFO] Total time:  1.136 s
...

我們可以看到，commons-lang3 jar的3.11版和 3.12 版同時(shí)被引入進(jìn)來(lái)了，出現(xiàn)這種情況是因?yàn)镸aven選擇了pom.xml中后來(lái)出現(xiàn)的依賴。

依賴關(guān)系analyze-duplicate命令

現(xiàn)在讓我們運(yùn)行 mvn dependency:analyze-duplicate，看看輸出輸出結(jié)果。

$ mvn dependency:analyze-duplicate
[INFO] Scanning for projects...
[WARNING]
[WARNING] Some problems were encountered while building the effective model for com.javanorth:maven-duplicate-dependencies:jar:0
.0.1-SNAPSHOT
[WARNING] 'dependencies.dependency.(groupId:artifactId:type:classifier)' must be unique: org.apache.commons:commons-lang3:jar -
> version 3.12.0 vs 3.11 @ line 14, column 15
[WARNING]
[WARNING] It is highly recommended to fix these problems because they threaten the stability of your build.
[WARNING]
[WARNING] For this reason, future Maven versions might no longer support building such malformed projects.
[WARNING]
[INFO]
[INFO] -------------< com.javanorth:maven-duplicate-dependencies >--------------
[INFO] Building maven-duplicate-dependencies 0.0.1-SNAPSHOT
[INFO] --------------------------------[ jar ]---------------------------------
[INFO]
[INFO] --- maven-dependency-plugin:2.8:analyze-duplicate (default-cli) @ maven-duplicate-dependencies ---
[WARNING] The artifact xml-apis:xml-apis:jar:2.0.2 has been relocated to xml-apis:xml-apis:jar:1.0.b2
[INFO] List of duplicate dependencies defined in < dependencies/ > in your pom.xml:
        o org.apache.commons:commons-lang3:jar
[INFO] ------------------------------------------------------------------------
[INFO] BUILD SUCCESS
[INFO] ------------------------------------------------------------------------
[INFO] Total time:  0.835 s
。。。

我們注意到，WARNING和INFO日志語(yǔ)句都提到了重復(fù)依賴的存在。

如果存在重復(fù)的依賴，則構(gòu)建失敗

在上面的例子中，我們看到了如何檢測(cè)重復(fù)的依賴關(guān)系，但BUILD仍然是成功的，但這可能導(dǎo)致使用了不正確的 jar 版本。

使用[Maven Enforcer Plugin]（https://maven.apache.org/enforcer/maven-enforcer-plugin/index.html），我們可以確保在存在重復(fù)依賴的情況下構(gòu)建不成功。

我們需要在pom.xml中加入這個(gè)Maven插件，并加入banDuplicatePomDependencyVersions規(guī)則。

< project >
  [...]
  < build >
    < plugins >
      < plugin >
        < groupId >org.apache.maven.plugins< /groupId >
        < artifactId >maven-enforcer-plugin< /artifactId >
        < version >3.0.0< /version >
        < executions >
          < execution >
            < id >no-duplicate-declared-dependencies< /id >
            < goals >
              < goal >enforce< /goal >
            < /goals >
            < configuration >
              < rules >
                < banDuplicatePomDependencyVersions/ >
              < /rules >
            < /configuration >
          < /execution >
        < /executions >
      < /plugin >
    < /plugins >
  < /build >
  [...]
< /project >

現(xiàn)在，該規(guī)則約束了我們的Maven構(gòu)建。

$ mvn verify
[INFO] Scanning for projects...
[WARNING]
[WARNING] Some problems were encountered while building the effective model for com.javanorth:maven-duplicate-dependencies:jar:0
.0.1-SNAPSHOT
[WARNING] 'dependencies.dependency.(groupId:artifactId:type:classifier)' must be unique: org.apache.commons:commons-lang3:jar -
> version 3.12.0 vs 3.11 @ line 14, column 14
[WARNING]
[INFO] -------------< com.javanorth:maven-duplicate-dependencies >--------------
[INFO] Building maven-duplicate-dependencies 0.0.1-SNAPSHOT
[INFO] --------------------------------[ jar ]---------------------------------
[INFO]
[INFO] --- maven-enforcer-plugin:3.0.0:enforce (no-duplicate-declared-dependencies) @ maven-duplicate-dependencies ---
[WARNING] Rule 0: org.apache.maven.plugins.enforcer.BanDuplicatePomDependencyVersions failed with message:
Found 1 duplicate dependency declaration in this project:
 - dependencies.dependency[org.apache.commons:commons-lang3:jar] ( 2 times )

[INFO] ------------------------------------------------------------------------
[INFO] BUILD FAILURE
[INFO] ------------------------------------------------------------------------
[ERROR] Failed to execute goal org.apache.maven.plugins:maven-enforcer-plugin:3.0.0:enforce (no-duplicate-declared-dependencies) on project maven-duplicate-dependencie
s: Some Enforcer rules have failed. Look above for specific messages explaining why the rule failed.

刪除重復(fù)的依賴關(guān)系

只要確定了重復(fù)的依賴關(guān)系，我們就需要在 pom.xml中刪除它們，只保留那些我們項(xiàng)目使用的唯一依賴關(guān)系。

總結(jié)

本文中，我們學(xué)習(xí)了如何使用mvn dependency:tree和mvn dependency:analyze-duplicate命令檢測(cè)Maven中的重復(fù)依賴，還學(xué)習(xí)了如何使用Maven Enforcer插件，通過(guò)應(yīng)用內(nèi)置規(guī)則使包含重復(fù)依賴的構(gòu)建失敗。