Hacker News Reader

Comment by tonsky | Hacker News Reader

It’s totally fine in Maven, no need to rebuild or repackage anything. You just override version of libinsecure in your pom.xml and it uses the version you told it to

View on HN

So you... manually re-lock the parts you need to?

Don't forget the part where Maven silently picks one version for you when there are transitive dependency conflicts (and no, it's not always the newest one).

Sure, I'm happy with locking the parts I need to lock. Why would I lock the parts I don't need to lock?

Because you can’t know which ones you “need” to lock.

You can definitely know this. Use

    mvn dependency:tree -Dverbose

Or use maven-enforcer-plugin to fail the build on conflicts.

Reply on news.ycombinator.com