versions:dependency-updates-report

Note:

This goal should be used as a Maven report.

Full name:

org.codehaus.mojo:versions-maven-plugin:2.25.1:dependency-updates-report

Description:

Generates a report of available updates for the dependencies of a project.

Attributes:

Requires a Maven project to be executed.
Requires dependency resolution of artifacts in scope: runtime.
The goal is thread-safe and supports parallel builds.
Since version: 1.0-beta-1.

Required Parameters

Name	Type	Since	Description
`<outputDirectory>`	`File`	`-`	The shared output directory for the report. Note that this parameter is only evaluated if the goal is run directly from the command line. If the goal is run indirectly as part of a site generation, the shared output directory configured in the Maven Site Plugin is used instead. A plugin may use any subdirectory structure (either using a hard-coded name or, ideally, an additional user-defined mojo parameter with a default value) to generate multi-page reports or external reports with the main output file (entry point) denoted by `#getOutputName()`. Default: `${project.build.directory}/reports`

Optional Parameters

Name	Type	Since	Description
`<allowPreReleases>`	`boolean`	`2.25.0 (2.20.0 for <code>use-latest-versions</code>)`	Whether to offer pre-release versions: alpha, beta, milestone, release candidate, preview and early-access versions, such as `4.0.0-beta-4` or `3.34.0.CR1`. When `false`, a pre-release is still offered if the current version is itself a pre-release or a snapshot of the same release line, so `4.0.0-beta-3` is offered `4.0.0-beta-4` but not `4.1.0-M1`. Snapshots are governed by `allowSnapshots`, and `ignoredVersions` and rules still apply on top. Default: `false` User Property: `allowPreReleases`
`<allowSnapshots>`	`boolean`	`1.0-alpha-3`	Whether to allow snapshots when searching for the latest version of an artifact. Default: `false` User Property: `allowSnapshots`
`<dependabotConfig>`	`String`	`2.25.0`	A Dependabot configuration file whose `ignore` entries are applied as version rules, on top of `ruleSet`, `rulesUri` and `ignoredVersions`. Only the `package-ecosystem: maven` entries for `dependabotTargetBranch` are read. Each `versions` item may be a Maven version range, a comparator requirement such as `">= 5.0.0"`, or a single version. Items that only use `update-types` are skipped with a warning. A relative path is resolved against the multi-module project directory. Example: `-Dversions.dependabotConfig=.github/dependabot.yml` User Property: `versions.dependabotConfig`
`<dependabotTargetBranch>`	`String`	`2.25.0`	The `target-branch` whose entries in `dependabotConfig` apply. Defaults to the branch checked out in the git working tree holding that file; the entries without a `target-branch` are used when no entry names the branch. User Property: `versions.dependabotTargetBranch`
`<formats>`	`String[]`	`-`	Report formats (html and/or xml). HTML by default. Default: `html` User Property: `dependencyUpdatesReportFormats`
`<ignoredVersions>`	`Set<String>`	`2.13.0`	Allows specifying ignored versions directly as an alternative to providing the ruleSet parameter; mainly created for `-D` property usage. Example: `"1\.0\.1,.+-M.,.-SNAPSHOT"` Currently, this parameter will override the defined `ruleSet`* User Property: `maven.version.ignore`
`<locale>`	`String`	`-`	The locale to use when the report generation is invoked directly as a standalone Mojo. See also: SiteTool#DEFAULT_LOCALE, SiteTool#getSiteLocales(String) Default: `default`
`<minimumReleaseAge>`	`int`	`2.25.0`	Minimum number of days a release must have been published before it is offered as an update. This keeps a very recent release, which may be faulty or compromised, out of the update candidates; Renovate calls the same idea `minimumReleaseAge`, and Dependabot calls it `cooldown`. A version older than or equal to the current one is not affected. The publication date is read through Maven's own transport, so the proxy, mirror and server settings apply. If the date cannot be determined, the version is offered and a warning says so. `0`, the default, switches the filter off. Default: `0` User Property: `versions.minimumReleaseAge`
`<minimumReleaseAgeExcludes>`	`String[]`	`2.25.0`	`groupId:artifactId` patterns of the artifacts that are exempt from `minimumReleaseAge`, for artifacts whose sources you trust. `` matches any run of characters, and an `artifactId` may be left out to match the whole group, for example `com.example:` or `com.example`. On the command line, separate the patterns with commas. User Property: `versions.minimumReleaseAgeExcludes`
`<onlyProjectDependencies>`	`boolean`	`2.12`	If `true`, only shows the subsection of the `dependencyManagement` artifacts that are actually used in the project's `dependency` graph. `false` by default. Default: `false` User Property: `onlyProjectDependencies`
`<onlyUpgradable>`	`boolean`	`2.12`	If `true`, only shows upgradable dependencies in the report. `false` by default. Default: `false` User Property: `onlyUpgradable`
`<outputFormat>`	`String`	`-`	The report output format: null by default, to represent a site, but can be configured to a Doxia Sink id. User Property: `output.format`
`<outputTimestamp>`	`String`	`-`	Timestamp for reproducible output archive entries, either formatted as ISO 8601 `yyyy-MM-dd'T'HH:mm:ssXXX` or as an int representing seconds since the epoch (like SOURCE_DATE_EPOCH). Default: `${project.build.outputTimestamp}`
`<processDependencyManagement>`	`boolean`	`2.5`	Whether to process the `dependencyManagement` in pom or not. Default: `true` User Property: `processDependencyManagement`
`<processDependencyManagementTransitive>`	`boolean`	`2.5 Note: Currently in experimental state.`	Whether to process the dependencyManagement part transitive or not. In case of `<type>pom</type>`and `<scope>import</scope>` this means by default to report also the imported dependencies. If processTransitive is set to `false` the report will only show updates of the imported pom itself. Default: `true` User Property: `processDependencyManagementTransitive`
`<ruleSet>`	`RuleSet`	`2.13.0`	Allows specifying the org.codehaus.mojo.versions.model.RuleSet object describing rules on artifact versions to ignore when considering updates. See also: Using the ruleSet element in the POM
`<rulesUri>`	`String`	`1.0-alpha-3`	URI of a ruleSet file containing the rules that control how to compare version numbers. The URI could be either a URI served by a Maven Resolver transport (e.g. `file:` or `https:`) or a classpath URI (e.g. `classpath:///package/sub/package/rules.xml`). User Property: `maven.version.rules`
`<serverId>`	`String`	`1.0-alpha-3`	settings.xml's server id for the URL. This is used when the server hosting the rules needs authentication. Default: `serverId` User Property: `maven.version.rules.serverId`
`<showVersionless>`	`boolean`	`2.19.0`	Include dependencies with version set in a parent or in a BOM. This is similar to `processDependencyManagementTransitive`, but will report updates on dependencies. Default: `true` User Property: `showVersionless`
`<siteDirectory>`	`File`	`-`	Directory containing the `site.xml` file. Default: `${basedir}/src/site`
`<skip>`	`boolean`	`1.0-alpha-3`	Skip entire check. User Property: `versions.skip`

Parameter Details

<allowPreReleases>

Whether to offer pre-release versions: alpha, beta, milestone, release candidate, preview and early-access versions, such as 4.0.0-beta-4 or 3.34.0.CR1. When false, a pre-release is still offered if the current version is itself a pre-release or a snapshot of the same release line, so 4.0.0-beta-3 is offered 4.0.0-beta-4 but not 4.1.0-M1. Snapshots are governed by allowSnapshots, and ignoredVersions and rules still apply on top.

Type: boolean
Since: 2.25.0 (2.20.0 for <code>use-latest-versions</code>)
Required: No
User Property: allowPreReleases
Default: false

<allowSnapshots>

Whether to allow snapshots when searching for the latest version of an artifact.

Type: boolean
Since: 1.0-alpha-3
Required: No
User Property: allowSnapshots
Default: false

<dependabotConfig>

A Dependabot configuration file whose ignore entries are applied as version rules, on top of ruleSet, rulesUri and ignoredVersions.

Only the package-ecosystem: maven entries for dependabotTargetBranch are read. Each versions item may be a Maven version range, a comparator requirement such as ">= 5.0.0", or a single version. Items that only use update-types are skipped with a warning. A relative path is resolved against the multi-module project directory.

Example: -Dversions.dependabotConfig=.github/dependabot.yml

Type: java.lang.String
Since: 2.25.0
Required: No
User Property: versions.dependabotConfig

<dependabotTargetBranch>

The target-branch whose entries in dependabotConfig apply. Defaults to the branch checked out in the git working tree holding that file; the entries without a target-branch are used when no entry names the branch.

Type: java.lang.String
Since: 2.25.0
Required: No
User Property: versions.dependabotTargetBranch

<formats>

Report formats (html and/or xml). HTML by default.

Type: java.lang.String[]
Required: No
User Property: dependencyUpdatesReportFormats
Default: html

<ignoredVersions>

Allows specifying ignored versions directly as an alternative to providing the ruleSet parameter; mainly created for -D property usage.

Example: "1\.0\.1,.+-M.,.*-SNAPSHOT"

Currently, this parameter will override the defined ruleSet

Type: java.util.Set<java.lang.String>
Since: 2.13.0
Required: No
User Property: maven.version.ignore

<locale>

The locale to use when the report generation is invoked directly as a standalone Mojo.
See also: SiteTool#DEFAULT_LOCALE, SiteTool#getSiteLocales(String)

Type: java.lang.String
Required: No
Default: default

<minimumReleaseAge>

Minimum number of days a release must have been published before it is offered as an update. This keeps a very recent release, which may be faulty or compromised, out of the update candidates; Renovate calls the same idea minimumReleaseAge, and Dependabot calls it cooldown.
A version older than or equal to the current one is not affected. The publication date is read through Maven's own transport, so the proxy, mirror and server settings apply. If the date cannot be determined, the version is offered and a warning says so. 0, the default, switches the filter off.

Type: int
Since: 2.25.0
Required: No
User Property: versions.minimumReleaseAge
Default: 0

<minimumReleaseAgeExcludes>

groupId:artifactId patterns of the artifacts that are exempt from minimumReleaseAge, for artifacts whose sources you trust. * matches any run of characters, and an artifactId may be left out to match the whole group, for example com.example:* or com.example.
On the command line, separate the patterns with commas.

Type: java.lang.String[]
Since: 2.25.0
Required: No
User Property: versions.minimumReleaseAgeExcludes

<onlyProjectDependencies>

If true, only shows the subsection of the dependencyManagement artifacts that are actually used in the project's dependency graph. false by default.

Type: boolean
Since: 2.12
Required: No
User Property: onlyProjectDependencies
Default: false

<onlyUpgradable>

If true, only shows upgradable dependencies in the report. false by default.

Type: boolean
Since: 2.12
Required: No
User Property: onlyUpgradable
Default: false

<outputDirectory>

The shared output directory for the report. Note that this parameter is only evaluated if the goal is run directly from the command line. If the goal is run indirectly as part of a site generation, the shared output directory configured in the Maven Site Plugin is used instead.

A plugin may use any subdirectory structure (either using a hard-coded name or, ideally, an additional user-defined mojo parameter with a default value) to generate multi-page reports or external reports with the main output file (entry point) denoted by #getOutputName().

Type: java.io.File
Required: Yes
Default: ${project.build.directory}/reports

<outputFormat>

The report output format: null by default, to represent a site, but can be configured to a Doxia Sink id.

Type: java.lang.String
Required: No
User Property: output.format

<outputTimestamp>

Timestamp for reproducible output archive entries, either formatted as ISO 8601 yyyy-MM-dd'T'HH:mm:ssXXX or as an int representing seconds since the epoch (like SOURCE_DATE_EPOCH).

Type: java.lang.String
Required: No
Default: ${project.build.outputTimestamp}

<processDependencyManagement>

Whether to process the dependencyManagement in pom or not.

Type: boolean
Since: 2.5
Required: No
User Property: processDependencyManagement
Default: true

<processDependencyManagementTransitive>

Whether to process the dependencyManagement part transitive or not. In case of <type>pom</type>and <scope>import</scope> this means by default to report also the imported dependencies. If processTransitive is set to false the report will only show updates of the imported pom itself.

Type: boolean
Since: 2.5 Note: Currently in experimental state.
Required: No
User Property: processDependencyManagementTransitive
Default: true

<ruleSet>

Allows specifying the org.codehaus.mojo.versions.model.RuleSet object describing rules on artifact versions to ignore when considering updates.

Type: org.codehaus.mojo.versions.model.RuleSet
Since: 2.13.0
Required: No

<rulesUri>

URI of a ruleSet file containing the rules that control how to compare version numbers. The URI could be either a URI served by a Maven Resolver transport (e.g. file: or https:) or a classpath URI (e.g. classpath:///package/sub/package/rules.xml).

Type: java.lang.String
Since: 1.0-alpha-3
Required: No
User Property: maven.version.rules

<serverId>

settings.xml's server id for the URL. This is used when the server hosting the rules needs authentication.

Type: java.lang.String
Since: 1.0-alpha-3
Required: No
User Property: maven.version.rules.serverId
Default: serverId

<showVersionless>

Include dependencies with version set in a parent or in a BOM.

This is similar to processDependencyManagementTransitive, but will report updates on dependencies.

Type: boolean
Since: 2.19.0
Required: No
User Property: showVersionless
Default: true

<siteDirectory>

Directory containing the site.xml file.

Type: java.io.File
Required: No
Default: ${basedir}/src/site

<skip>

Skip entire check.

Type: boolean
Since: 1.0-alpha-3
Required: No
User Property: versions.skip