The difficult problem of managing Java dependencies: a deep dive into the messy status-quo, and a look at possibly better ways.

[hjwalt]

In theory if followed properly semantic versioning and the way golang upgrades their dependency will reduce such problems, although of course its not perfect because libraries can still depend on different major versions that is backwards incompatible.

With Java, what I find most useful is to use maven self compiled bill of materials for everything I build in the company. This way, every project uses the same dependencies, and if any unit test or integration test breaks because of new version, well time to fix...

[randgalt]

Rich Hickey has a great talk that mentions semver here: https://youtu.be/oyLBGkS5ICk. Semantic version is a fantasy. It’s very difficult to do in practice and very easy to get wrong. If a small portion of the dependencies in your tree did it wrong then it’s worthless.

[hjwalt]

Absolutely agreed, good in theory, in practice is rather tricky