Static dependency analysis

Static dependency analysis

We have a lot of different dependencies that we have to integrate (HBase, Accumulo, Kafka, etc). Due to this, we set a lot of dependency versions in our pom for transitive dependencies (e.g. commons-text, commons-config). But then when we upgrade versions, the transitive dependencies can get out of sync. It would be nice to have some kind of static analysis that would tell us what versions are expected by HBase, Hadoop, etc and compare them to the versions we are actually using. There may be a maven plugin for this already.

Original JIRA Issue: https://geomesa.atlassian.net/browse/GEOMESA-2770

Key: GEOMESA-2770
Type: Story
Priority: Major
Status: To Do
Resolution: Unresolved
Reporter: Emilio Lahr-Vivaz
Created: Mon, 27 Jan 2020 10:00:41 -0500
Updated: Fri, 17 Apr 2020 13:39:18 -0400

Comments:

557058:48912df4-0004-4f90-9915-db26684ec006 (Fri, 17 Apr 2020 13:25:11 -0400):

Emilio Lahr-Vivaz thoughts on how to do this well?

557058:da7f6dfa-f0a1-468b-aec5-2cb61273feb5 (Fri, 17 Apr 2020 13:39:18 -0400):

not really...

Start with the dependency version declarations in the project pom and review how HBase, Hadoop, Kafka, and their transitive dependencies are represented. Investigate whether an existing Maven plugin can compare expected transitive versions with the versions in use. Done means the project has a repeatable static analysis that reports dependency version mismatches.