Add dependency:add, dependency:remove, and dependency:search goals by brunoborges · Pull Request #1599 · apache/maven-dependency-plugin

brunoborges · 2026-04-01T14:51:06Z

Summary

This PR adds three new goals to the Maven Dependency Plugin: dependency:add, dependency:remove, and dependency:search. These goals bring Maven's CLI experience closer to what npm, Cargo, pip, and NuGet offer — a single command to manage dependencies without manually editing XML.

Motivation

Every major dependency management ecosystem provides a single-command way to add a dependency:

Python: pip install google-adk
Node: npm install @google/adk
Rust: cargo add google-adk
.NET: dotnet add package Google.Adk
Maven: (manual XML editing required)

This friction is a barrier for developers coming from other ecosystems, and for AI coding agents where a CLI invocation is not only significantly cheaper (in token usage) than instructing an XML edit, but more importantly safer and guaranteed — different models and agent harnesses produce inconsistent results when manipulating pom.xml directly.

New Goals

`dependency:add`

Adds a dependency to the project's pom.xml:

mvn dependency:add -Dgav="com.google.adk:google-adk:1.0.0"
mvn dependency:add -DgroupId=com.google.adk -DartifactId=google-adk -Dversion=1.0.0 -Dscope=test
mvn dependency:add -Dgav="com.google.adk:google-adk:1.0.0" -Dmanaged   # into <dependencyManagement>
mvn dependency:add -Dgav="org.springframework.boot:spring-boot-dependencies:3.2.0" -Dbom  # BOM import

Features:

GAV shorthand or explicit -DgroupId/-DartifactId/-Dversion parameters
-Dmanaged flag for <dependencyManagement> section
-Dbom shorthand for BOM imports (type=pom, scope=import)
-Dprofile to target a specific Maven profile (profile must already exist)
Use Maven's -pl flag to target a specific child module in multi-module projects
Auto-updates existing dependencies (like cargo add) — no flag needed
Version inference from parent <dependencyManagement>
NONE sentinel to clear scope/type/classifier during updates
Duplicate detection with type/classifier-aware matching
Property-interpolation cross-reference (blocks add when coords use property references)
Parent POM inheritance warning in multi-module projects

Convention auto-detection (`-Dalign`, enabled by default)

When adding a dependency, the goal automatically detects and follows the project's existing dependency management conventions:

Managed dependency detection: if most existing <dependencies> entries are version-less (delegated to <dependencyManagement>), the new dependency is added the same way — managed dep to the nearest parent POM, version-less dep to the child
Version property detection: if most existing versions use ${...} property references, a version property is automatically created
Property naming convention: recognizes .version (e.g., guava.version), -version (e.g., guava-version), Version (camelCase), and version. prefix patterns

Parameter	Default	Description
`align`	`true`	Enable convention auto-detection
`useProperty`	(auto)	Force/prevent version property creation
`propertyName`	(auto)	Explicit property name (overrides pattern detection)

Explicit flags (managed, useProperty, propertyName, align=false) always override detected conventions.

Example — in a multi-module project where the parent POM uses -version suffix properties:

mvn dependency:add -Dgav=com.google.guava:guava:33.0.0-jre

Automatically produces:

parent/pom.xml: <guava-version>33.0.0-jre</guava-version> property + managed dep with ${guava-version}
child/pom.xml: version-less <dependency> entry

`dependency:remove`

Removes a dependency from the project's pom.xml:

mvn dependency:remove -Dgav=com.google.adk:google-adk
mvn dependency:remove -DgroupId=com.google.adk -DartifactId=google-adk -Dmanaged

Features:

Same parameter surface as dependency:add (-Dmanaged, -Dprofile, -Dbom)
Use Maven's -pl flag to target a specific child module
Type/classifier-aware matching for precise removal
Child module safety check (warns when removing a managed dependency that child modules depend on without explicit version)
Comment cleanup (removes associated XML comments)

`dependency:search`

Queries Maven Central for artifacts:

mvn dependency:search -Dquery=google-adk
mvn dependency:search -Dquery=jackson -Drows=20

Features:

Interactive TUI mode with artifact browsing, version selection, and copy-paste-ready mvn dependency:add commands
Non-interactive tabular output for CI/scripted use
Structured queries (g:com.google.adk, a:google-adk)

Implementation Details

POM editing: Uses DomTrip for lossless XML editing — preserves formatting, comments, indentation, encoding, BOM markers, and XML declarations
Security: XXE/DOCTYPE protection enabled, scope validation, root element validation
Robustness: Atomic writes (temp file + rename), namespace-aware parsing, BOM character detection
Search: Manual JSON parsing (no additional runtime dependencies), consistent with the hand-rolled JSON approach used by dependency:tree
Extends AbstractDependencyMojo: Add and Remove goals use constructor injection and follow the existing doExecute() pattern. Search extends AbstractMojo directly (requiresProject=false).
Convention detection: Uses a PropertyPattern enum for type-safe pattern matching; convention analysis reuses PomEditor to scan both child and parent POMs

Testing

458+ unit tests pass (30 DependencyCoordinates + 36 PomEditor + 46 AddDependencyMojo (including 27 convention detection tests) + 11 RemoveDependencyMojo + 14 SearchDependencyMojo + 19 SearchDependencyMojoHttp + existing tests)
8 integration test projects (add basic/gav-shorthand/managed/multimodule/multimodule-dash, remove basic/not-found, search basic)
Edge cases covered across 12+ audit rounds: encoding, namespaces, BOM markers, empty collections, property interpolation, concurrent fields, interactive TUI, profile targeting, NONE sentinels, cross-POM resolved-model checks, etc.

Documentation

Goals Overview: all three goals listed in index.apt.vm with descriptions and links
Site page: src/site/apt/examples/managing-dependencies.apt.vm
Usage page: src/site/apt/usage.apt.vm updated with Managing Dependencies section
Full Javadoc on all public classes and methods
@since 3.11.0 annotations on all new classes

Checklist

Following this checklist to help us incorporate your contribution quickly and easily:

Your pull request should address just one issue, without pulling in other changes.
Write a pull request description that is detailed enough to understand what the pull request does, how, and why.
Each commit in the pull request should have a meaningful subject line and body. Note that commits might be squashed by a maintainer on merge.
Write unit tests that match behavioral changes, where the tests fail if the changes to the runtime are not applied.
Run mvn verify to make sure basic checks pass. A more thorough check will be performed on your pull request automatically.
You have run the integration tests successfully (mvn -Prun-its verify).

To make clear that you license your contribution under the Apache License Version 2.0, January 2004 you have to acknowledge this by using the following check-box.

I hereby declare this contribution to be licenced under the Apache License Version 2.0, January 2004
In any other case, please file an Apache Individual Contributor License Agreement.

…cy:search goals Formal specification document proposing three new CLI-based dependency management goals for the Maven Dependency Plugin: - dependency:add — Add/update dependencies in pom.xml from the CLI - dependency:remove — Remove dependencies from pom.xml from the CLI - dependency:search — Query Maven Central for artifacts The spec covers parameter definitions, GAV shorthand format, multi-module behavior, version inference from dependencyManagement, formatting-preserving POM editing strategy, error handling, and a phased implementation plan. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Decisions: - Q1: Include -Dbom flag (BOM import shorthand) in initial scope - Q2: No inline exclusions support (manual POM editing) - Q3: No dry-run mode - Q4: Always append new dependencies to end of list - Q5: Target Maven Central Search v2 REST API only - Q6: Always insert literal version strings (no property creation) Added §3.11 BOM Support section and bom parameter to the add goal. Replaced Open Questions section with Design Decisions table. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

New Mojo goals for CLI-based dependency management: - AddDependencyMojo (dependency:add): Adds/updates dependencies in pom.xml with support for GAV shorthand, -Dmanaged, -Dbom, -Dmodule, -DupdateExisting, and version inference from dependencyManagement. - RemoveDependencyMojo (dependency:remove): Removes dependencies from pom.xml with child module safety checks when removing managed deps. - SearchDependencyMojo (dependency:search): Queries Maven Central Search API and displays results in tabular format. No project context required. Infrastructure classes: - DependencyCoordinates: GAV parsing and validation - PomEditor: DOM-based formatting-preserving POM read/write Unit tests: 34 new tests covering coordinate parsing, POM editing (add/remove/update/comments preservation/BOM), and JSON response parsing. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Bugs fixed: - #1 -Doptional=true now correctly emits <optional>true</optional> (was declared but never passed to PomEditor) - #2 XML namespace-aware parsing: PomEditor now uses setNamespaceAware(true) and localName() matching, so POMs with xmlns="http://maven.apache.org/POM/4.0.0" work correctly Robustness improvements: - apache#3 Atomic file writes: save() writes to a temp file then renames, preventing corruption from concurrent POM modifications - apache#4 GAV trailing colons: split(":", -1) preserves trailing empties; empty groupId/artifactId now rejected with clear error messages - apache#5 JSON escaped quotes: extractStringField() now handles \" and \\ in JSON string values instead of using a naive regex Formatting preservation: - apache#6 XML declaration preserved: POMs without <?xml?> no longer get one added; standalone="no" attribute no longer injected - apache#7 Indent detection improved: GCD-based analysis across all indented lines instead of using only the first indented line - apache#8 UTF-8 BOM preserved: BOM marker detected on load and re-emitted on save - apache#9 Comment cleanup on remove: preceding XML comments associated with a removed dependency are now also removed 48 tests (14 new), all passing. Full existing test suite unaffected. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

…User-Agent, enriched toString - findDependency/removeDependency now match on type and classifier, preventing wrong-entry updates when multiple variants exist (e.g., jar vs test-jar, different classifiers) - Guard against null session.getProjects() in -Dmodule resolution for both AddDependencyMojo and RemoveDependencyMojo - User-Agent version derived from package manifest instead of hardcoded - DependencyCoordinates.toString() now includes scope, type, classifier - Simplified AddDependencyMojo log messages (no redundant scope append) - Added 8 new tests (56 total) Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

…details - Validate Content-Type header is JSON before parsing response - Check response body starts with '{' to detect HTML error pages - Read error stream on non-200 responses, include in error message - Special-case HTTP 429 (rate limit) with user-friendly message - Truncate error body to 500 chars to keep messages readable - Added 2 new tests (58 total) Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

…ference When POM dependencies use property references (e.g., ${project.groupId}), PomEditor's literal XML matching can't find them. Both AddDependencyMojo and RemoveDependencyMojo now cross-reference Maven's resolved model: - dependency:add: if not found in raw XML but exists in resolved model, blocks with a clear error (or warns and adds literal entry with -DupdateExisting) - dependency:remove: if not found in raw XML but exists in resolved model, tells user to edit manually since property references can't be safely removed automatically Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

…root element check - Block DOCTYPE declarations in PomEditor to prevent entity-expansion DoS attacks; enable FEATURE_SECURE_PROCESSING - Validate root element is <project> to reject non-POM XML files - Validate scope values against Maven's known set (compile, provided, runtime, test, system, import) - Change property-interpolation cross-reference to always block instead of allowing duplicate entries with -DupdateExisting - Added 5 new tests (63 total) Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

…erited deps existsInResolvedModel() now queries project.getOriginalModel() instead of project.getDependencies()/getDependencyManagement(). The original model contains only what is declared in the POM (after interpolation but before inheritance merging), so inherited parent dependencies no longer incorrectly block dependency:add or cause misleading errors in dependency:remove on child modules. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

New test classes: - AddDependencyMojoTest (6 tests): NPE guard on null/empty reactor, property-interpolated dep blocks add, inherited dep doesn't block child, always-block even with updateExisting, managed section cross-reference - RemoveDependencyMojoTest (4 tests): NPE guard on null/empty reactor, property-interpolated dep shows clear error, non-existent dep gives not-found error - SearchDependencyMojoHttpTest (6 tests): HTTP 500 includes body, 429 rate-limit message, HTML-200 rejected via Content-Type, non-JSON body rejected, valid response accepted, dynamic User-Agent Total: 79 tests (was 63), all passing. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

…Ts, README Documentation updates: - specification.md: Updated 11 sections to reflect all edge case fixes (XXE hardening, type/classifier matching, scope validation, property- interpolation detection, atomic writes, search error handling) - README.md: Added 'New: CLI Dependency Management Goals' section with quick-start examples - Mojo Javadoc: Fixed incorrect RemoveDependencyMojo.gav docs, enhanced all three class-level and field Javadocs - Site: New APT example page covering all 3 goals with practical examples; added menu entry to site.xml Integration tests (6 projects): - add-dependency/basic: explicit coordinates - add-dependency/gav-shorthand: GAV with scope - add-dependency/managed: dependencyManagement target - remove-dependency/basic: remove existing dependency - remove-dependency/not-found: expected failure - search-dependency/basic: search Maven Central Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

- Strip Unicode BOM character (U+FEFF) before checking for XML declaration; Java's trim() only removes ASCII whitespace, so BOM-prefixed POMs had their XML declaration dropped on save - Validate rows parameter is positive (>= 1) before sending to API; negative/zero values now fail fast with a clear error - Added 3 new tests (82 total) Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Similar to archetype:generate, the search goal now presents results as a numbered list when a console is available. Users can: - Select an artifact by number to browse available versions - Type free text to refine the search with a new query - Press Enter to quit, or 'b' to go back from version selection After selecting an artifact and version, the goal prints ready-to-use dependency:add commands for regular, scoped, and managed dependencies. Interactive mode is enabled by default and automatically disabled when: - No console is available (piped output, IDE) - Maven runs in batch mode (-B) - User passes -Dinteractive=false Non-interactive mode preserves the original tabular output behavior. Implementation details: - performSearch() refactored to accept query/rows/gavMode parameters - Version lookup uses core=gav Solr parameter for per-version results - New extractVersionList() parses the GAV response format (v field) - readLine() is package-private and overridable for testing - 8 new tests (6 interactive + 2 extractVersionList) Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

- Empty latestVersion no longer produces invalid GAV: falls back to first version from the GAV query; if both are unavailable, warns and returns to artifact list instead of printing broken command - Version list shows paging hint when more versions exist than the 20 returned (e.g., '... and 30 older version(s) not shown') - Support 'q' and 'quit' as quit commands at all interactive prompts, matching common TUI conventions - 5 new tests (empty latestVersion, no versions at all, q to quit, version paging hint, q from version prompt) Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

…pdate Fix #1: dependency:remove now has explicit -Dtype, -Dclassifier, and -Dbom parameters, matching dependency:add's parameter parity. The -Dbom flag is shorthand for -Dmanaged -Dtype=pom, making BOM removal as simple as: mvn dependency:remove -Dgav=g:a -Dbom Fix #2: dependency:add -DupdateExisting can now clear fields: - -Dscope=NONE removes the <scope> element - -Dtype=NONE removes the <type> element - -Dclassifier=NONE removes the <classifier> element - -Doptional=false removes the <optional> element The 'optional' parameter changed from boolean to Boolean so null (not specified) is distinguishable from false (explicitly clear). PomEditor.updateDependency() treats empty strings as remove signals. Fix apache#3: Interactive search re-query behavior is by design (documented in code comments) — more powerful than local filtering since it leverages the full Maven Central search index. 6 new tests, 404 total pass. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

buildDependencyElement now guards against empty strings for scope, type, classifier, and version fields. Previously, using -Dscope=NONE on a dependency that didn't exist would create <scope></scope> in the POM. Empty strings are now treated as absent, matching the intended behavior where NONE only removes elements during updates. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Site page (apt.vm): - Document -Dtype and -Dclassifier params for dependency:add - Document NONE sentinel for clearing fields during updates - Document scope validation (6 allowed values) - Document -Dtype, -Dclassifier, -Dbom params for dependency:remove - Add q/quit and b/back interactive commands - Fix output text: 'result found' -> 'result(s) found' - Remove incorrect -B batch mode claim Specification: - Fix comment cleanup: 'no blank line gap' -> contiguous nodes - Fix interactive prompts to match actual code text - Fix interactive commands: add q/quit at all prompts, b/back - Remove batch mode (-B) claim from interactive parameter Javadoc: - Fix SearchDependencyMojo interactive field docs Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

dependency:add and dependency:remove now support a -Dprofile parameter to target dependencies within a specific Maven profile's <dependencies> or <dependencyManagement> section. If the profile does not exist, it is created automatically with the specified <id>. PomEditor changes: - Added profileId field with setProfileId() setter - getDependenciesElement() navigates into <profiles><profile> when set - findOrCreateProfile() finds existing or creates new profile by <id> - Depth calculations offset by +2 when inside a profile 5 new tests: add to new profile, add to existing profile, remove from profile, isolation from top-level, profile-not-found returns null. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

The -Dprofile parameter now fails with MojoFailureException if the specified profile is not found in the POM. This prevents the plugin from becoming a general POM editing tool. PomEditor.findOrCreateProfile replaced with public findProfile() (find-only). Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Tests that AddDependencyMojo and RemoveDependencyMojo throw MojoFailureException with a clear message when -Dprofile targets a profile that does not exist in the POM. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

New tests: - AddDependencyMojoTest: no-profiles-section failure, happy-path add - RemoveDependencyMojoTest: no-profiles-section failure, happy-path remove - PomEditorTest: profile + managed (dependencyManagement in profile) Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

New tests: - basicAddWithGavShorthand: GAV parsing through full mojo flow - duplicateDependencyWithoutUpdateExistingFails: error on duplicate - updateExistingChangesVersion: happy-path update flow - bomFlagSetsTypeAndScopeAndManaged: -Dbom sets pom/import/managed - managedWithoutVersionFails: version required for dependencyManagement Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Moved resolveTargetProject(), existsInResolvedModel(), and getModuleNames() from AddDependencyMojo and RemoveDependencyMojo into the shared AbstractDependencyMojo base class. This eliminates ~40 lines of identical duplicated code and ensures consistent behavior (e.g., RemoveDependencyMojo now includes available modules in its error message, matching AddDependencyMojo). Also cleaned up unused imports in both mojos. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

@SInCE

- Remove dead code: performSearch() no-arg overload, getManagementKey() - Add @SInCE 3.11.0 to DependencyCoordinates and PomEditor - Extract shared calculateColumnWidths() and buildSeparator() helpers in SearchDependencyMojo to deduplicate table rendering logic - Fix detectIndent() to handle bare CR line endings - Trim module parameter in resolveTargetProject() - Fix displayResults() to skip GAV suggestion when version is empty - Fix misleading 'atomic write' comment in PomEditor.save() Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Spec fixes: - GAV footnote: clarify that explicit -D params override gav fields - Remove not-found message: section varies by target (not hardcoded) - Safety warning: remove 'Warning:' prefix to match actual output - DependencyInserter reference: replaced with PomEditor (never existed) - Search API decision: 'Solr-compatible REST API' (not 'newer REST') - rows parameter: document >= 1 validation Code fix: - handleBomFlag() now clears classifier (BOM imports must not have one) New tests (14): - Add: version inferred from parent dependencyManagement (critical) - Add: parent POM warns about inheritance to child modules - Add: missing groupId+artifactId fails with clear message - Add: malformed gav fails - Add: -Dbom clears classifier - Add: explicit -D params override gav fields - Remove: managed removal warns about child modules (critical) - Remove: missing groupId+artifactId fails - Remove: malformed gav fails - Remove: not-found in dependencyManagement shows correct section - Search: empty/blank query fails - Search: rows=0 fails with positive integer message - PomEditor: remove returns false when section is absent - PomEditor: updateDependency sets type, classifier, and optional Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Spec fixes: - Managed-version output: correct log order and bracket format - Search result count: 'result(s)' matches code - Error messages: include full text with context details New tests (3): - Add: successful module targeting via reactor - Add: NONE sentinel clears scope on update - Remove: successful module targeting via reactor Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

The custom -Dmodule parameter for targeting child modules is redundant with Maven's built-in -pl (project list) reactor flag. Using -pl is more idiomatic and consistent with how Maven users already work with multi-module projects. Changes: - Remove module field from AddDependencyMojo and RemoveDependencyMojo - Remove resolveTargetProject() and getModuleNames() from AbstractDependencyMojo - Update specification.md to document -pl usage instead of -Dmodule - Update site documentation (cli-dependency-management.apt.vm) - Remove 6 module-targeting tests (moduleWithNullReactor, moduleWithEmptyReactor, moduleTargetingResolvesCorrectProject) Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Keep the file locally for reference but exclude it from the repository. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

brunoborges · 2026-04-03T19:37:11Z

Third audit fixes (`5b43f82`)

Fixed:

🔴 Stale docs in usage.apt.vm — Line 721 still claimed dependency:add "updates automatically" on duplicate. Fixed to say it fails with a descriptive error. Also removed inconsistent quotes from GAV examples to match managing-dependencies.apt.vm style.
🟡 Null check for project.getFile() — Both AddDependencyMojo and RemoveDependencyMojo dereferenced targetProject.getFile() without null check. While requiresProject=true ensures a project exists, it does not guarantee a physical POM file. Added null checks with clear MojoExecutionException messages.
🟡 Null check for parentProject.getBasedir() — checkChildModuleDependencies used getBasedir() without null check when constructing child module paths. Added guard that skips the check gracefully with a debug log.
🟡 Null validation in PomEditor.findDependency() — Public API method would NPE on null groupId/artifactId parameters. Added IllegalArgumentException with clear message.

All 389 tests pass.

brunoborges · 2026-04-03T20:19:21Z

Real-world integration testing

Installed the plugin locally (3.10.1-SNAPSHOT) and ran 30 tests across 4 major open-source Maven projects to verify dependency:add and dependency:remove work correctly in the wild.

Projects tested

Project	Description	POM complexity
Spring Petclinic	Simple Spring Boot app	Standard single-module
Apache Commons Lang	Apache library	Single-module with managed deps
Apache Camel	Large integration framework	4500-line root POM, 539 property interpolations, massive multi-module
Baeldung Tutorials	Hundreds of submodules	Large multi-module

Results: 30/30 pass (1 cosmetic observation)

Test Scenario	Petclinic	Commons Lang	Camel	Tutorials
Basic add	✅	✅	✅	✅
Add with scope	✅	✅	—	—
Add to `<dependencyManagement>`	✅	✅	✅	✅
Add with `-Doptional=true`	✅	—	—	—
Add with `-Dtype` / `-Dclassifier`	✅	—	—	—
Add BOM import (pom + import + managed)	—	—	—	✅
Version inference from managed deps	—	✅	—	—
Remove basic	✅	—	—	—
Remove from `<dependencyManagement>`	—	✅	✅	—
Add then remove round-trip	✅	—	✅	✅
Add to submodule	—	—	✅	✅
Duplicate detection (should fail)	✅	—	—	—
Remove nonexistent (should fail)	✅	—	—	—
Invalid GAV (should fail)	✅	—	—	—
Invalid scope (should fail)	—	✅	—	—
Missing `-Dgav` (should fail)	—	✅	—	—
Formatting preservation	✅	✅	✅	✅
POM with property interpolations	—	—	✅	—

Key findings

Formatting preservation is excellent — round-trip (add then remove) produces zero diff on all projects, including Camel's 4500-line POM with 539 property references.
All error cases handled gracefully — duplicate detection, nonexistent removal, invalid GAV, invalid scope, and missing parameters all produce clear, actionable error messages.
Version inference works — adding without version when a managed version exists correctly omits the <version> element.
BOM import pattern works — dependency:add -Dgav=...dependencies:pom:3.2.0 -Dscope=import -Dmanaged correctly produces <type>pom</type> + <scope>import</scope> inside <dependencyManagement>.
Submodule targeting works — using -f path/to/submodule/pom.xml or running from the submodule directory both work correctly.

One cosmetic observation

When dependency:add creates a new <dependencies> section (because one didn't exist) and then dependency:remove removes the last entry, the empty container element (<dependencies/>) is left behind. This is valid XML and cosmetic only — not a bug.

gnodet · 2026-04-04T07:12:57Z

@gnodet was domtrip fixed to keep null/empty tags (both cases) and xsd declaration formatting? At some point I got bitten by these 2/3 cases but was in early stages.

I'm not aware of anything that DomTrip would lost at the moment. AFAIK, as long as the XML is syntactically parseable, everything is fully preserved.

Auto-detect managed dependency and version property patterns from existing dependencies. When align=true (the default), dependency:add follows the project's conventions: - Managed deps: if most deps are version-less, add managed dep to parent - Version properties: if versions use ${...} refs, create a property - Property naming: detect .version, -version, Version, version. patterns - Multi-module: walk parent chain, add managed dep + property to parent Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

brunoborges · 2026-04-05T15:42:24Z

How are we feeling about this now?

gnodet · 2026-04-05T22:43:14Z

How are we feeling about this now?

@brunoborges Could you have a look at https://github.com/brunoborges/maven-dependency-plugin/pull/2/changes ?
The goal is to detect managed dep patterns, version property usage, and naming conventions when adding a property in complex scenarios.

Add convention auto-detection for dependency:add (align mode)

- Replace string-based pattern encoding with PropertyPattern enum - Add existsInResolvedModel() check in addCrossPom() to prevent duplicates when dependencies use property interpolation - Add unit tests for PropertyPattern, Conventions, and detectPropertyPattern() covering all patterns, edge cases, and defaults Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

brunoborges · 2026-04-06T17:36:50Z

PR description has been updated to reflect the latest state of the proposed implementation, including the new convention auto-detection feature (-Dalign), updated test counts (458+ unit tests, 8 ITs), and implementation details.

brunoborges · 2026-04-06T17:37:58Z

@gnodet and @rmannibucau PR up to date with all feedback given.

brunoborges · 2026-04-07T15:24:11Z

@rmannibucau time to merge?

brunoborges · 2026-04-14T21:37:16Z

@rmannibucau time to merge?

Wdyt pushing this through this week?

rmannibucau · 2026-04-14T21:44:27Z

@gnodet @cstamas what's the plan with maveniverse work overlapping with that?

@brunoborges is the CI report outdated or did you miss it? 🤔

brunoborges · 2026-04-15T04:48:36Z

I missed it! Fixing tonight. Update coming tomorrow!

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

brunoborges · 2026-04-16T02:08:46Z

Updated, @rmannibucau

rmannibucau · 2026-04-16T06:58:59Z

@gnodet @cstamas looks good to me but I'd like your feedback on the concurrent mojo you did before we integrate that

cstamas · 2026-04-16T17:47:45Z

If you mean Pilot, it is not overlapping IMHO. Or wdym?

rmannibucau · 2026-04-16T18:07:09Z

@cstamas a mix between pilot and #1600, all good for me if we consider this one superseeds it

brunoborges · 2026-04-23T20:58:14Z

Hey all, any update?

Address review feedback from slawekjaranowski: - Replace fragile string contains() checks with proper XmlSlurper XML parsing for structured assertions - Fix version mismatch: verify scripts now check for 3.17.0 to match the version passed in invoker.properties (was incorrectly 2.10.1) Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

brunoborges · 2026-05-06T16:06:32Z

Hey @slawekjaranowski @rmannibucau @gnodet ...

Are we good with pushing this through?

slawekjaranowski · 2026-05-07T21:55:08Z

    protected void doExecute() throws MojoExecutionException {
        try {
-            // ideally this should either be DependencyCoordinates or DependencyNode
+            // ideally this should either be DependencyEntry or DependencyNode


slawekjaranowski · 2026-05-07T22:04:01Z

+     * This catches dependencies declared with property references like {@code ${project.groupId}}
+     * without false-positiving on inherited dependencies from a parent POM.
+     */
+    protected static boolean existsInResolvedModel(MavenProject project, DependencyEntry coords, boolean managed) {


I would not like to add a static method to abstract class when it is only used in two specific child ....
I don't have a good idea for it ... next abstract in level or util class ...

If no better idea can be as is.

brunoborges and others added 27 commits March 31, 2026 13:19

Revert README.md to upstream — feature docs belong in site pages

38a7d80

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Add mojo-level tests for profile-not-found failure

f6d1e92

Tests that AddDependencyMojo and RemoveDependencyMojo throw MojoFailureException with a clear message when -Dprofile targets a profile that does not exist in the POM. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

brunoborges marked this pull request as draft April 1, 2026 16:06

brunoborges and others added 2 commits April 1, 2026 12:12

Remove specification.md from version control

03adf21

Keep the file locally for reference but exclude it from the repository. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

rmannibucau approved these changes Apr 3, 2026

View reviewed changes

brunoborges and others added 2 commits April 6, 2026 13:26

Merge pull request #2 from gnodet/feature/convention-detection

80e0a01

Add convention auto-detection for dependency:add (align mode)

This was referenced Apr 7, 2026

feat: convention-aligned dependency addition in PomEditor maveniverse/domtrip#170

Closed

feat: align added dependencies with project conventions maveniverse/pilot#11

Closed

brunoborges requested a review from gnodet April 8, 2026 05:35

Use domtrip-maven PomEditor directly

33a1ffb

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

explicitly list used dependency

d28aa22

slawekjaranowski reviewed May 4, 2026

View reviewed changes

Comment thread src/it/projects/add-dependency/basic/verify.groovy Outdated

slawekjaranowski reviewed May 7, 2026

View reviewed changes

Conversation

brunoborges commented Apr 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Motivation

New Goals

dependency:add

Convention auto-detection (-Dalign, enabled by default)

dependency:remove

dependency:search

Implementation Details

Testing

Documentation

Checklist

Uh oh!

brunoborges commented Apr 3, 2026

Third audit fixes (5b43f82)

Fixed:

Uh oh!

brunoborges commented Apr 3, 2026

Real-world integration testing

Projects tested

Results: 30/30 pass (1 cosmetic observation)

Key findings

One cosmetic observation

Uh oh!

gnodet commented Apr 4, 2026

Uh oh!

brunoborges commented Apr 5, 2026

Uh oh!

gnodet commented Apr 5, 2026

Uh oh!

brunoborges commented Apr 6, 2026

Uh oh!

brunoborges commented Apr 6, 2026

Uh oh!

brunoborges commented Apr 7, 2026

Uh oh!

brunoborges commented Apr 14, 2026

Uh oh!

rmannibucau commented Apr 14, 2026

Uh oh!

brunoborges commented Apr 15, 2026

Uh oh!

brunoborges commented Apr 16, 2026

Uh oh!

rmannibucau commented Apr 16, 2026

Uh oh!

cstamas commented Apr 16, 2026

Uh oh!

rmannibucau commented Apr 16, 2026

Uh oh!

brunoborges commented Apr 23, 2026

Uh oh!

Uh oh!

brunoborges commented May 6, 2026

Uh oh!

slawekjaranowski May 7, 2026

Choose a reason for hiding this comment

Uh oh!

slawekjaranowski May 7, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

brunoborges commented Apr 1, 2026 •

edited

Loading

`dependency:add`

Convention auto-detection (`-Dalign`, enabled by default)

`dependency:remove`

`dependency:search`

Third audit fixes (`5b43f82`)