My contrib is using a newer third party library version as providey by Nuxeo. How can I upgrade the dependencies?

[Edgar_]

Hi,

my first attempt was to adjust the version number in the corresponding dependency of Nuxeo's root pom.xml. But after rebuilding the Nuxeo distribution nothing has changed, i.e. my contribution compiles with the 'old' library version and throws a NoSuchMethodException when using this library.

My second attempt was to change the assembly.xml in the tomcat distribution folder:

[..]

<target name="reorganize-libs">
{..]
    <!-- Replace 'old' versions of the Apache POI libraries -->
    <delete>
      <fileset dir="${distribution.dir}/nxserver/lib">
        <include name="poi-*" />
      </fileset>
    </delete>
    <copy todir="${distribution.dir}/nxserver/lib">
        <artifact:resolveFile key="org.apache.poi:poi:3.9:jar::compile"/>
        <artifact:resolveFile key="org.apache.poi:poi-ooxml:3.9:jar::compile"/>
        <artifact:resolveFile key="org.apache.poi:poi-scratchpad:3.9:jar::compile"/>
    </copy>

[..]

</target>

[..]

This time my contribution compiles with the 'new' library version and the exception isn't thrown anymore.

But I'm wondering whether this is the way I should go?

Where are Nuxeo's relevant dependencies to the 'old' version of the third party library (here: poi:3.5-beta6)?

How can I change them according to my needs?

Thanks.

[Julien_Carsique · Accepted solution]

You don't need to change Nuxeo source code unless you want to contribute a global version upgrade but it's not a trivial task and a lot of tests are required.
/> You can look at the Nuxeo dependencies on org.apache.poi libraries at https://sonar.nuxeo.org/dependencies.

In your addon's POM, set your preferred versions in a dependencyManagement section.
/> Then, if you deploy your addon within a Marketplace package, those libraries will be automatically upgraded. See nuxeo-marketplace-sample.

About your assembly, you should not have to explicitly list the third-parties: this must be automatically pulled from the Maven dependency tree. Also, there's a simpler method than delete+copy: use <nx:rmdups dir="${distribution.dir}/nxserver/lib" /> to remove the duplicated libraries, keeping only the latest versions.

[Edgar_]

Thanks for your advice.

[Julien_Carsique]

Look at the dependency-tree.log file generated by the `artifact