Software Update Announcements
- Ian Young
Because everything has a million dependencies (and transitive dependencies) these days, we have a general need to keep the java-parent-project's dependencies up to date. We are by policy extremely conservative on the maintenance branches used for patches, normally only making revisions when we have to, e.g., because of observed bugs or security issues.
On the development branch, though, we normally try to stay a little closer to "current" on our dependencies. This means doing a sweep of all of them (using mvn versions:display-dependency-updates and mvn versions:display-plugin-updates) just before a new minor or major release (x.0.0 or x.y.0). It's also wise to update to new versions of significant managed dependencies when we become aware of them, so that we find any incompatibilities earlier and they are given longer to "cook" before the next significant release.
I've been doing this for a while, using a number of techniques:
I subscribe to the Apache announcements list (see https://apache.org/foundation/mailinglists.html )
I subscribe to the
jetty-announcemailing list (see https://accounts.eclipse.org/mailing-list/jetty-announce ). This requires aneclipse.orgaccount.I use CodeRelease.io tied to my GitHub account to give me announcements automatically on releases of any repository I've starred. If you log in to CodeRelease.io using your GitHub account, you can manage these, for example by suppressing announcements for some repositories. As more and more projects move to GitHub, this becomes more dominant. Note that as well as associating CodeRelease.io with your GitHub account, you can also tell it to send announcements ad hoc for a given repository to a given e-mail address. That's simpler to start, but harder to maintain.
I follow the
@springframeworkaccount on Twitter. I use a Twitter client that doesn't reorder the timeline, so this usually works but it's very easy to miss things.
There are probably a number of other routes by which I get notifications, but I no longer remember them. I will add to this list when I get notifications that aren't covered by the above.