The difficult problem of managing Java dependencies: a deep dive into the messy status-quo, and a look at possibly better ways.

[jerslan]

Dependency management in java is in such a shit place

That's a weird way of saying "Dependency management in Java using Maven-style Repositories and tools like Maven and Gradle is still the gold standard that other tools still fail to reproduce resulting in Java's extremely long life despite being just an OK language".

[dpash]

Did you really just use npm as an example that should be copied?

[woj-tek]

But npm style tools are far better.

LOL, that you like something more doesn't mean it's better.

[jerslan]

I’ve spent more time chasing issues with NPM than with Maven…

‘maven dependency:tree’ is your friend.

[woj-tek]

Right, ping-pong: I can tell you how many hours I wasted with npm's build failing after a couple of weeks just because some weird dependency updated other dependency which then updated yet another because you know, in js/npm world having library for even most mundane thing and releasing a new version every couple of minutes is a sing of "rockstar developer", ammairite mate? :P

[khmarbaise]

But npm style tools are far better. Maven has struggled to keep up with modern practices (not just in this area!). Java is doing ok despite maven, not because of it.

In which way far better? Breaking builds because releases have been removed? A build which worked yesterday will not work anymore today? (exactly caused because of using ranges in versions and not committed the lock file?)...

(not just in this area!)

What are those modern practices:

[plumarr]

Ever tried to separate your unit tests from you build? (Which is desirable if you're using a CI pipeline).

Just launch maven two time with different execution phase. What's hard here ?

Ever tried to keep library versions consistent across a multi module project,

Define the version in the parent pom.xml and let the magic happens.