Getting more out of Maven

by Marit van Dijk

Embed

Start on current slide

Slide 1

Slide 1 text

Getting more out of Maven

Slide 2

Slide 2 text

Getting more out of Maven Andres Almiray 🐘 @aalmiray 🦋 @andresalmiray.com 🌐 www.andresalmiray.com Seasoned Sourceror Marit van Dijk @maritvandijk.bsky.social 🦋 @MaritvanDijk77 🐦 www.maritvandijk.com 🌐 Senior Developer Advocate

Slide 3

Slide 3 text

Agenda ● Getting started ● Maven wrapper ● Maven Lifecycle & Goals ● Inheritance ● Effective pom ● Profiles ● Enforcer plugin ● Dependency & plugin management ● Dealing with vulnerabilities

Slide 4

Slide 4 text

Getting started ● Creating a new project ○ From scratch ○ Using a framework starter ○ Using an archetype https://www.jetbrains.com/help/idea/maven-support.html ▶

Slide 5

Slide 5 text

New Java project ● Select Build system: Maven https://www.jetbrains.com/help/idea/maven-support.html#create_new_maven_project

Slide 6

Slide 6 text

Spring boot project ● Uses start.spring.io ● Default: Gradle - Groovy ● Select Build system: Maven

Slide 7

Slide 7 text

Maven archetype https://www.jetbrains.com/help/idea/maven-support.html#maven_archetype

Slide 8

Slide 8 text

Maven wrapper ● Provision a specific version of Maven ● Reduce build variance ● Increase reproducibility mvn wrapper:wrapper -Dmaven=3.9.14 ▶

Slide 9

Slide 9 text

How do you build your project?

Slide 10

Slide 10 text

mvn verify FTW

Slide 11

Slide 11 text

mvn verify FTW

Slide 12

Slide 12 text

mvn verify FTW

Slide 13

Slide 13 text

Maven Lifecycle & Goals ● Maven runs a build by executing steps in order ● Maven has a set of predefined lifecycle phases: e.g. clean, verify, install, … ● Goals are provided by plugins ● Goals are typically bound to a phase The maven-compiler-plugin provides a `compile` goal that’s bound to the `compile` phase.

Slide 14

Slide 14 text

No content

Slide 15

Slide 15 text

Running goals - Run goals directly from the terminal - Run goals in the IDE - From the Maven tool window - From Run Configurations - From Run Anything (⌃⌃ on macOS) / Ctrl+Ctrl on Windows/Linux) ▶

Slide 16

Slide 16 text

Terminal

Slide 17

Slide 17 text

Maven tool window ● Run lifecycle phases ● Basic phases only

Slide 18

Slide 18 text

Maven tool window ● Options

Slide 19

Slide 19 text

Maven tool window ● All phases

Slide 20

Slide 20 text

Run Configurations ● Right-click lifecycle phase ● Modify Run Configuration… https://www.jetbrains.com/help/idea/run-debug-configuration.html

Slide 21

Slide 21 text

Run Configurations ● Store as project file (to save) ● Modify Options

Slide 22

Slide 22 text

Run Anything ● Run Anything (⌃⌃ on macOS / Ctrl+Ctrl on Windows/Linux) https://www.jetbrains.com/help/idea/running-anything.html

Slide 23

Slide 23 text

Run Anything ● Maven Goals

Slide 24

Slide 24 text

Maven in IntelliJ IDEA ● IntelliJ IDEA support Maven 3.1 and up ● Default bundled Maven version is 3.9.11 ● Use bundled version, wrapper, or point to installed version. ● Maven 4 support is available from IntelliJ IDEA 2025.1 https://www.jetbrains.com/help/idea/maven-support.html

Slide 25

Slide 25 text

No content

Slide 26

Slide 26 text

No content

Slide 27

Slide 27 text

No content

Slide 28

Slide 28 text

No content

Slide 29

Slide 29 text

mvn verify FTW

Slide 30

Slide 30 text

No content

Slide 31

Slide 31 text

No content

Slide 32

Slide 32 text

Inheritance ● Super pom ● Parent / child ● Order of resolution ● How values are propagated down the chain

Slide 33

Slide 33 text

No content

Slide 34

Slide 34 text

Effective pom ● Full project object model result for your project ● Generate effective pom on command line: ○ mvn help:effective-pom -Dverbose=true https://maven.apache.org/plugins/maven-help-plugin/effective-pom-mojo.html ▶

Slide 35

Slide 35 text

Profiles ● Can enhance default configuration of your build ● Add new sections, or override existing ones ● When you have plugins that should not be part of the main execution, e.g. ○ Generate JavaDoc and sources jars ○ Running quality gate checks ○ Enable/disable a test module under certain conditions ○ Publish to Maven Central https://maven.apache.org/guides/introduction/introduction-to-profiles.html ▶

Slide 36

Slide 36 text

Enforcer plugin ● Reproducibility ● Verify invariants & restrictions Control environmental constraints: ● Maven version ● JDK version ● Dependencies (semver, duplicates, snapshots, bytecode version, etc) ● and more https://maven.apache.org/enforcer/maven-enforcer-plugin/

Slide 37

Slide 37 text

Enforcer plugin

Slide 38

Slide 38 text

No content

Slide 39

Slide 39 text

extra-enforcer-rules ● Add extra rules ○ EnforceBytecodeVersion ○ BanCircularDependencies ○ BanDuplicateClasses https://www.mojohaus.org/extra-enforcer-rules/

Slide 40

Slide 40 text

Extra rules extra-enforcer-rules ▶

Slide 41

Slide 41 text

No content

Slide 42

Slide 42 text

No content

Slide 43

Slide 43 text

No content

Slide 44

Slide 44 text

Dependency & plugin management ● Adding dependencies ● Managing dependencies ● Finding and resolving conflicts ▶

Slide 45

Slide 45 text

Dependency & plugin management ● Adding dependencies ○ IDE provides code completion for dependencies (resolvable from local cache)

Slide 46

Slide 46 text

Dependency & plugin management ● Managing dependencies & plugins ○ Maven commands for dependencies ■ Overview of dependencies: `./mvnw dependency:tree` ■ Check for dependency updates: `./mvnw versions:display-dependency-updates` ■ Check for plugin updates: `./mvnw versions:display-plugin-updates` ○ IDE: ■ Maven tool window: Dependencies ▶

Slide 47

Slide 47 text

Overview of dependencies: `./mvnw dependency:tree`

Slide 48

Slide 48 text

Check for updates: `./mvnw versions:display-dependency-updates`

Slide 49

Slide 49 text

Check for updates: `./mvnw versions:display-plugin-updates`

Slide 50

Slide 50 text

Dependency & plugin management ● Managing dependencies & plugins ○ Maven commands for dependencies ○ IDE: ■ Maven tool window: Dependencies ▶

Slide 51

Slide 51 text

Dependency conflicts ● Finding and resolving conflicts ○ Maven commands ■ Overview of dependencies: `./mvnw dependency:tree` ■ Show the conflict using the enforcer (if configured): ● ./mvnw -f pom-enforced.xml initialize ● ./mvnw -f pom-enforced.xml enforcer:enforce@check ○ IDE: ■ Finding and resolving conflicts: https://www.jetbrains.com/help/idea/work-with-maven-dependencies.html#dependency_analyzer ▶

Slide 52

Slide 52 text

./mvnw -f pom-enforced.xml initialize ▶

Slide 53

Slide 53 text

./mvnw -f pom-enforced.xml enforcer:enforce@check ▶

Slide 54

Slide 54 text

Dependency conflicts ● Finding and resolving conflicts ○ Maven commands ○ IDE: ■ Finding and resolving conflicts: Dependency analyzer https://www.jetbrains.com/help/idea/work-with-maven-dependencies.html#dependency_analyzer ▶

Slide 55

Slide 55 text

Dependency conflicts ● Finding and resolving conflicts ○ Maven commands ○ IDE: ■ Finding and resolving conflicts: https://www.jetbrains.com/help/idea/work-with-maven-dependencies.html#dependency_analyzer

Slide 56

Slide 56 text

Vulnerabilities ● Scan for known vulnerabilities ● Remediate by upgrading (if available / possible) ● Help in the IDE ○ https://www.jetbrains.com/help/idea/package-analysis.html ▶

Slide 57

Slide 57 text

Vulnerabilities Vulnerabilities are highlighted in the pom.xml ▶

Slide 58

Slide 58 text

Vulnerabilities Quickfix to update to unaffected version - if available ▶

Slide 59

Slide 59 text

Vulnerabilities Usage of vulnerable API is highlighted

Slide 60

Slide 60 text

Vulnerabilities Inspection to Go to file with declared dependency (and update it there to unaffected version - if available)

Slide 61

Slide 61 text

Vulnerabilities Overview of Vulnerable Dependencies ● Problem tool window ● Vulnerable Dependencies tab

Slide 62

Slide 62 text

Vulnerabilities Known vulnerabilities ● Severity ● Details

Slide 63

Slide 63 text

Summary ● Your tools (Maven, IntelliJ IDEA) can make you more productive ● Don’t blindly trust your tools; understand how they work & their limitations ● Provide feedback if something is missing ● Make sure the build works with Maven alone

Slide 64

Slide 64 text

https://m.devoxx.com/events/vdz26/talks/1948/getting-more-out-of-maven

Slide 65

Slide 65 text

Slides & more https://maritvandijk.com/presentations/getting-more-out-of-maven/

Slide 66

Slide 66 text

Thank you! Andres Almiray 🐘 @aalmiray 🦋 @andresalmiray.com 🌐 www.andresalmiray.com Seasoned Sourceror Marit van Dijk @maritvandijk.bsky.social 🦋 @MaritvanDijk77 🐦 www.maritvandijk.com 🌐 Senior Developer Advocate