dependencyManagement vs version properties about egeria

[mandy-chessell]

What would the flags look like ?

[planetf1]

See example in https://github.com/GaianRangerPlugin/ranger-gaian-plugin/blob/master/pom.xml

Basically this uses the 'DependencyManagement' to express the version that should be used in all modules, without actually pulling in as a dependency. In the 'Dependency' section the version is then omitted. A similar pattern applies to the plugins with 'PluginManagement'. This is the 'standard' maven mechanism

One main difference is the effective on transitive dependencies - the maven scheme arguably provides a little more assurance as to what is used.

There's some further docs at https://maven.apache.org/guides/introduction/introduction-to-dependency-mechanism.html

[mandy-chessell]

I think we should do this - as the code gets bigger, dependency management is going to become more important. I would like to take you up on your offer to code the patch (when you are back from vacation :)

[planetf1]

Updating top level pom.
Removing any DependencyManagement elsewhere
Added validation - as an example if an inconsistent version is used we now fail the build with

[INFO] --- maven-dependency-plugin:3.1.1:analyze-dep-mgt (depmgmt) @ access-services-user-interface ---
[INFO] Found Resolved Dependency/DependencyManagement mismatches:
[INFO] 	Dependency: org.springframework.security:spring-security-web:jar
[INFO] 		DepMgt  : 5.1.4.RELEASE
[INFO] 		Resolved: 5.1.5.RELEASE

There's no exception handling yet - will need to add on a case by case basis (overriding configuration in local pom.

Discrepancies so far

• Janusgraph - 0.3.1 used by graph repo, 0.3.0 by lineage -> updated to 0.3.1
• spring-security-web - 5.1.4 used most places, 5.1.5 in user interface (incorrect version compatibility with spring-web) -> corrected to 5.1.4 (this was caused by using the wrong property)

Local version properties and numbers have NOT been removed in this PR -- though any update that makes them inconsistent will fail the build. These will be cleaned in a subsequent update

[planetf1]

Also not added -- any refactoring of UI build and expression of non-maven dependency versions (npm and polymer components)

[planetf1]

this has been implemented