How do you keep track of maven dependency versions?
Let's say you are using version
1.0.5 of an library.
<dependency> <groupId>groupIdName</groupId> <artifactId>artecfact-id</artifactId> <version>1.0.5</version> </dependency>
But some people find a very bad security bug in version
1.0.5 and they release version
1.0.6 with a bugfix for this security vulnerability.
How do you manage in your project to know that there is a new important version, where it's very important to update?
I'm sure, no one is looking every week: Is there a new update to all the projects?
Even with watching the github projects, it will end up in a mess, because there are too many dependencies to watch in big projects.
We are using
Jenkins in our environment, so if there are good plugins for that tools, or something else like
Sonar can help here, let me know.
Looking forward for this discussion!
(I hope the softwareengineering on stackexchange is the right place for this discussion)