Note that there are some explanatory texts on larger screens.

plurals
  1. PO
    primarykey
    data
    text
    <blockquote> <p>Should I bother checking for, say, security updates for these libraries? </p> </blockquote> <p>In general, it is probably a good idea to do this. But then so should everyone upstream and downstream of you.</p> <p>In your particular case, we are talking about test code. If potential security flaws in libraries used only in testing are significant, your downstream users are doing something strange ... </p> <blockquote> <p>Finally (and most importantly, actually what I'm most concerned about): What if I want to include another library which depends on the same libraries as this library, but with different versions? That is, what if for instance HtmlUnit depends on one version of xalan and another library I need, depends on a different version of xalan?</p> </blockquote> <p>Ah yes. Assuming that you are building your own classpaths, etc by hand, you need to make a decision about which version of the dependent libraries you should use. It is usually safe to just pick the most recent of the versions used. But if the older version is not backwards incompatible with the new (for your use case) then you've got a problem.</p> <blockquote> <p>Should I be concerned about this?</p> </blockquote> <p>IMO, for your particular example (where we are talking about test code), no. </p> <blockquote> <p>What are the best practices in situations like these?</p> </blockquote> <p>Use Maven! It explicitly exposes the dependencies to the folks who download your code, making it possible for them to deal with the issue. It also tells you when you've got dependency version conflicts and provides a simple "exclude" mechanism for dealing with it.</p> <p>Maven also removes the need to create distributions. You publish just <em>your</em> artifacts with <em>references</em> to their dependents. The Maven command then downloads the dependent artifacts from wherever they have been published.</p> <p><strong>EDIT</strong></p> <p>Obviously, if you are using HtmlUnit for production code (rather than just tests), then you need to pay more attention to security issues.</p>
    singulars
    1. This table or related slice is empty.
    plurals
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. VO
      singulars
      1. This table or related slice is empty.
    2. VO
      singulars
      1. This table or related slice is empty.
 

Querying!

 
Guidance

SQuiL has stopped working due to an internal error.

If you are curious you may find further information in the browser console, which is accessible through the devtools (F12).

Reload