Java 如何从 Maven 存储库中清除旧的依赖项？

How to clean old dependencies from maven repositories?

提问by Cherry

I have too many files in .m2 folder where maven stores downloaded dependencies. Is there a way to clean all old dependencies? For example, if there is a dependency with 3 different versions: 1, 2 and 3, after cleaning there must be only 3rd. How I can do it for all dependencies in .m2 folder?

我在 maven 存储下载的依赖项的 .m2 文件夹中有太多文件。有没有办法清理所有旧的依赖项？例如，如果有 3 个不同版本的依赖项：1、2 和 3，则清理后必须只有第 3 个。我该如何处理 .m2 文件夹中的所有依赖项？

回答by Gyanendra Dwivedi

Short answer- Deleted .m2 folder in {user.home}. E.g. in windows 10 user home is C:\Users\user1. Re-build your project using mvn clean package. Only those dependencies would remain, which are required by the projects.

简短回答- 删除了 .m2 文件夹{user.home}。例如，在 Windows 10 用户家中是C:\Users\user1. 使用mvn clean package. 只有那些项目需要的依赖项才会保留。

Long Answer- .m2 folder is just like a normal folder and the content of the folder is built from different projects. I think there is no way to figure out automatically that which library is "old". In fact old is a vague word. There could be so many reasons when a previous version of a library is used in a project, hence determining which one is unused is not possible.

Long Answer- .m2 文件夹就像一个普通文件夹，文件夹的内容是从不同的项目构建的。我认为没有办法自动找出哪个库是“旧的”。其实老是一个含糊的词。在项目中使用库的先前版本时可能有很多原因，因此无法确定哪个未使用。

All you could do, is to delete the .m2 folder and re-build all of your projects and then the folder would automatically build with all the required library.

您所能做的就是删除 .m2 文件夹并重新构建所有项目，然后该文件夹将使用所有必需的库自动构建。

If you are concern about only a particular version of a library to be used in all the projects; it is important that the project's pom should also update to latest version. i.e. if different POMs refer different versions of the library, all will get downloaded in .m2.

如果您只关心要在所有项目中使用的库的特定版本；重要的是项目的 pom 也应该更新到最新版本。即，如果不同的 POM 引用不同版本的库，则所有内容都将以 .m2 格式下载。

回答by Juanjo Marron

Given a POM file for a maven project you can remove all its dependencies in the local repository (by default ~/.m2/respository) using the Apache Maven Dependency Plugin.

给定 Maven 项目的 POM 文件，您可以使用Apache Maven Dependency Plugin删除本地存储库中的所有依赖项（默认为 ~/.m2/respository）。

It includes the dependency:purge-local-repositoryfunctionality that removes the project dependencies from the local repository, and optionally re-resolve them.

它包括dependency:purge-local-repository从本地存储库中删除项目依赖项的功能，并可选择重新解析它们。

To clean the local dependencies you just have to used the optional parameter reResolveand set it to false since it is set to true by default.

要清理本地依赖项，您只需使用可选参数reResolve并将其设置为 false，因为它默认设置为 true。

This command line call should work:

这个命令行调用应该可以工作：

mvn dependency:purge-local-repository -DreResolve=false

回答by Florian

If you are on Unix, you could use the access time of the files in there. Just enable access time for your filesystem, then run a clean build of all your projects you would like to keep dependencies for and then do something like this (UNTESTED!):

如果您使用的是 Unix，则可以使用其中文件的访问时间。只需为您的文件系统启用访问时间，然后运行您想要保留依赖项的所有项目的干净构建，然后执行以下操作（未测试！）：

find ~/.m2 -amin +5 -iname '*.pom' | while read pom; do parent=`dirname "$pom"`; rm -Rf "$parent"; done

This will find all *.pom files which have last been accessed more than 5 minutes ago (assuming you started your builds max 5 minutes ago) and delete their directories.

这将找到所有上次访问超过 5 分钟前的 *.pom 文件（假设您在最多 5 分钟前开始构建）并删除它们的目录。

Add "echo " before the rm to do a 'dry-run'.

在 rm 之前添加“echo”以进行“试运行”。

回答by Geoffrey Wiseman

I wanted to remove old dependencies from my Maven repository as well. I thought about just running Florian's answer, but I wanted something that I could run over and over without remembering a long linux snippet, and I wanted something with a little bit of configurability -- more of a program, less of a chain of unix commands, so I took the base idea and made it into a (relatively small) Ruby program, which removes old dependencies based on their last access time.

我也想从我的 Maven 存储库中删除旧的依赖项。我想只运行 Florian 的答案，但我想要一些我可以一遍又一遍地运行而不记得很长的 linux 代码片段的东西，而且我想要一些具有一点可配置性的东西——更多的是一个程序，而不是一个 unix 命令链，所以我采用了基本思想并将其制作成一个（相对较小的）Ruby 程序，它根据上次访问时间删除旧的依赖项。

It doesn't remove "old versions" but since you might actually have two different active projects with two different versions of a dependency, that wouldn't have done what I wanted anyway. Instead, like Florian's answer, it removes dependencies that haven't been accessed recently.

它不会删除“旧版本”，但由于您实际上可能有两个不同的活动项目，它们具有两个不同版本的依赖项，因此无论如何都不会完成我想要的。相反，就像 Florian 的回答一样，它删除了最近未访问过的依赖项。

If you want to try it out, you can:

如果您想尝试一下，您可以：

1. Visit the GitHub repository
2. Clone the repository, or download the source
3. Optionally inspect the code to make sure it's not malicious
4. Run bin/mvnclean

1. 访问GitHub 存储库
2. 克隆存储库，或下载源
3. （可选）检查代码以确保它不是恶意的
4. 跑 bin/mvnclean

There are options to override the default Maven repository, ignore files, set the threshold date, but you can read those in the README on GitHub.

有一些选项可以覆盖默认的 Maven 存储库、忽略文件、设置阈值日期，但您可以在 GitHub 上的自述文件中阅读这些选项。

I'll probably package it as a Ruby gem at some point after I've done a little more work on it, which will simplify matters (gem install mvnclean; mvnclean) if you already have Ruby installed and operational.

在我对它做了更多工作之后，我可能会在某个时候将它打包为 Ruby gem，gem install mvnclean; mvnclean如果您已经安装并运行了 Ruby ，这将简化问题 ( )。

回答by Amandeep Singh Bhatia

Just clean every content under .m2-->repository folder.When you build project all dependencies load here.

只需清理 .m2-->repository 文件夹下的所有内容。当您构建项目时，所有依赖项都会加载到此处。

In your case may be your project earlier was using old version of any dependency and now version is upgraded.So better clean .m2 folder and build your project with mvn clean install.

在您的情况下，您的项目可能之前使用的是任何依赖项的旧版本，现在版本已升级。所以更好地清理 .m2 文件夹并使用 mvn clean install 构建您的项目。

Now dependencies with latest version modules will be downloaded in this folder.

现在将在此文件夹中下载最新版本模块的依赖项。

回答by Sergey B.

1. Download all actual dependencies of your projects

   find your-projects-dir -name pom.xml -exec mvn -f '{}' dependency:resolve
   

2. Move your local maven repository to temporary location

   mv ~/.m2 ~/saved-m2
   

3. Rename all files maven-metadata-central.xml* from saved repository into maven-metadata.xml*

   find . -type f -name "maven-metadata-central.xml*" -exec rename -v -- 's/-central//' '{}' \;
   

4. To setup the modified copy of the local repository as a mirror, create the directory ~/.m2 and the file ~/.m2/settings.xml with the following content (replacing userwith your username):

   <settings>
    <mirrors>
     <mirror>
      <id>mycentral</id>
      <name>My Central</name>
      <url>file:/home/user/saved-m2/</url>
      <mirrorOf>central</mirrorOf>
     </mirror>
    </mirrors>
   </settings>
   

5. Resolve your projects dependencies again:

   find your-projects-dir -name pom.xml -exec mvn -f '{}' dependency:resolve
   

6. Now you have local maven repository with minimal of necessary artifacts. Remove local mirror from config file and from file system.

1. 下载项目的所有实际依赖项

   find your-projects-dir -name pom.xml -exec mvn -f '{}' dependency:resolve
   

2. 将您的本地 Maven 存储库移动到临时位置

   mv ~/.m2 ~/saved-m2
   

3. 将保存的存储库中的所有文件 maven-metadata-central.xml* 重命名为 maven-metadata.xml*

   find . -type f -name "maven-metadata-central.xml*" -exec rename -v -- 's/-central//' '{}' \;
   

4. 要将本地存储库的修改副本设置为镜像，请使用以下内容创建目录 ~/.m2 和文件 ~/.m2/settings.xml（用您的用户名替换user）：

   <settings>
    <mirrors>
     <mirror>
      <id>mycentral</id>
      <name>My Central</name>
      <url>file:/home/user/saved-m2/</url>
      <mirrorOf>central</mirrorOf>
     </mirror>
    </mirrors>
   </settings>
   

5. 再次解决您的项目依赖项：

   find your-projects-dir -name pom.xml -exec mvn -f '{}' dependency:resolve
   

6. 现在您拥有了最少必要工件的本地 Maven 存储库。从配置文件和文件系统中删除本地镜像。

回答by Pavan Kumar

I came up with a utility and hosted on GitHub to clean old versions of libraries in the local Maven repository. The utility, on its default execution removes all older versions of artifacts leaving only the latest ones. Optionally, it can remove all snapshots, sources, javadocs, and also groups or artifacts can be forced / excluded in this process. This cross platform also supports date based removal based on last access / download dates.

我想出了一个实用程序并托管在 GitHub 上，以清理本地 Maven 存储库中的旧版本库。该实用程序在默认执行时会删除所有旧版本的工件，仅保留最新的工件。或者，它可以删除所有快照、源、javadoc，并且还可以在此过程中强制/排除组或工件。此跨平台还支持基于上次访问/下载日期的基于日期的删除。

https://github.com/techpavan/mvn-repo-cleaner

https://github.com/techpavan/mvn-repo-cleaner

回答by Shubhasish Bhunia

You need to copy the dependency you need for project. Having these in hand please clear all the <dependency>tag embedded into <dependencies>tag from POM.XML file in your project.

您需要复制项目所需的依赖项。有了这些，请清除项目中 POM.XML 文件中<dependency>嵌入到<dependencies>标记中的所有标记。

After saving the file you will not see Maven Dependenciesin your Libraries. Then please paste those <dependency>you have copied earlier.

保存文件后，你将不会看到Maven依赖你Libraries。然后请粘贴<dependency>您之前复制的那些。

The required jars will be automatically downloaded by Maven, you can see that too in the generated Maven DependenciesLibrariesafter saving the file.

Maven会自动下载所需的jar，保存文件后在生成的Maven依赖中也可以看到Libraries。

Thanks.

谢谢。

回答by Andronicus

It's been more than 6 years since the question was asked, but I didn't find any tool to clean up my repository. So I wrote one myself in python to get rid of old jars. Maybe it will be useful for someone:

自从提出这个问题已经 6 年多了，但我没有找到任何工具来清理我的存储库。所以我自己用python写了一个来摆脱旧罐子。也许它对某人有用：

from os.path import isdir
from os import listdir
import re
import shutil

dry_run = False #  change to True to get a log of what will be removed
m2_path = '/home/jb/.m2/repository/' #  here comes your repo path
version_regex = '^\d[.\d]*$'


def check_and_clean(path):
    files = listdir(path)
    for file in files:
        if not isdir('/'.join([path, file])):
            return
    last = check_if_versions(files)
    if last is None:
        for file in files:
            check_and_clean('/'.join([path, file]))
    elif len(files) == 1:
        return
    else:
        print('update ' + path.split(m2_path)[1])
        for file in files:
            if file == last:
                continue
            print(file + ' (newer version: ' + last + ')')
            if not dry_run:
                shutil.rmtree('/'.join([path, file]))


def check_if_versions(files):
    if len(files) == 0:
        return None
    last = ''
    for file in files:
        if re.match(version_regex, file):
            if last == '':
                last = file
            if len(last.split('.')) == len(file.split('.')):
                for (current, new) in zip(last.split('.'), file.split('.')):
                    if int(new) > int(current):
                        last = file
                        break
                    elif int(new) < int(current):
                        break
            else:
                return None
        else:
            return None
    return last


check_and_clean(m2_path)

It recursively searches within the .m2repository and if it finds a catalog where different versions reside it removes all of them but the newest.

它在.m2存储库中递归搜索，如果找到不同版本所在的目录，它将删除所有版本，但最新版本除外。

Say you have the following tree somewhere in your .m2 repo:

假设您的 .m2 存储库中有以下树：

.
└── antlr
    ├── 2.7.2
    │?? ├── antlr-2.7.2.jar
    │?? ├── antlr-2.7.2.jar.sha1
    │?? ├── antlr-2.7.2.pom
    │?? ├── antlr-2.7.2.pom.sha1
    │?? └── _remote.repositories
    └── 2.7.7
        ├── antlr-2.7.7.jar
        ├── antlr-2.7.7.jar.sha1
        ├── antlr-2.7.7.pom
        ├── antlr-2.7.7.pom.sha1
        └── _remote.repositories

Then the script removes version 2.7.2 of antlr and what is left is:

然后脚本删除了 antlr 的 2.7.2 版本，剩下的是：

.
└── antlr
    └── 2.7.7
        ├── antlr-2.7.7.jar
        ├── antlr-2.7.7.jar.sha1
        ├── antlr-2.7.7.pom
        ├── antlr-2.7.7.pom.sha1
        └── _remote.repositories

If any old version, that you actively use, will be removed. It can easily be restored with maven (or other tools that manage dependencies).

如果您正在使用的任何旧版本将被删除。它可以使用 maven（或其他管理依赖项的工具）轻松恢复。

You can get a log of what is going to be removed without actually removing it by setting dry_run = False. The output will go like this:

您可以通过设置dry_run = False. 输出将如下所示：

update /org/projectlombok/lombok
1.18.2 (newer version: 1.18.6)
1.16.20 (newer version: 1.18.6)

This means, that versions 1.16.20 and 1.18.2 of lombok will be removed and 1.18.6 will be left untouched.

这意味着，lombok 的 1.16.20 和 1.18.2 版本将被删除，而 1.18.6 将保持不变。

The file can be found on my github(the latest version).

该文件可以在我的github（最新版本）上找到。