How to find where a library is used across multiple pom files

Question

We have multiple maven projects depending on on our own common libraries.

When we upgrade a library it would be useful to quickly find out which projects have a dependency on the library (and might need to use the new version)

Obviously I can manually look in all the pom files or write a script to do it but this is less than ideal.

Are there any tools that provide this functionality. e.g. a hudson plugin, Nexus, artifactory etc?

EDIT:

Some clarifications:

I don't want to upgrade all projects at once. The regression testing and release effort makes this impractical and often unnecessary (even with automated testing and releasing). I just want a report showing me what may projects may need to have the library upgraded...

Many answers focus around the project itself flagging what version is used. Ideally the solution would work so that for a given library I can ask what uses this. This looks like what the Nexus issue below is talking about.

Hudson does something similar with automated downstream maven builds. I may look into extending this with a hudson plugin.

Answer 1

I know that albeit being a good tool for managing poms and jars, Artifactory has no such feature you're asking :(

You might want to check this StackOverflow question: http://stackoverflow.com/questions/431332/maven-look-for-new-versions-of-dependencies

Alternatively you might want to check Versions Maven Plugin. Among other things, it allows you to scan trough project's dependencies and produce a report of those dependencies which have newer versions available.

Answer 2

A quite usual practice is to declare all the versions in dependencyManagement of the parent module and reference dependencies without versions everywhere else. In this case you'll only need to update only one POM.

Answer 3

Not exactly what you're asking for but the Dependency Convergence report might be helpful. Here are some examples.

Update: I'm aware that I'm not exactly answering the question with my suggestion but doing it the other way (finding all projects that reference a given artifact) would require gathering all POMs of all projects and I'm not aware of a solution currently offering such a referenced by feature (a corporate repository would be the perfect candidate to implement this though).

Answer 4

I solved this issue by using dependency version ranges to fetch the newest versions automatically.

  <dependency>
      <groupId>foo.xyzzy</groupId>
      <artifactId>bar</artifactId>
      <version>[1.0.0,2.0.0)</version>
  </dependency>

It might make sense to use a version range such as [1.0,) to include the newest version after 1.0.

The trick to make this work is to have dev and prod profiles that include and exclude the snapshot repos for your commons and to use hudson to automatically build projects when a dependency is re-built.

Answer 5

My search is over: http://www.sonarsource.org/sonar-2-1-in-screenshots/

Sonar now provides this.