upgrade common-collections / velocity?

[Cantor, Scott]

On 5/13/17, 1:15 PM, "dev on behalf of Brent Putman" <dev-bounces at shibboleth.net on behalf of putmanb at georgetown.edu> wrote:

> I personally did not and would not consider that to be a requirement.  Some other project may have its own internal parent POM
> like us (big projects, companies, etc often do), and because Maven is single inheritance, you see the fundamental problem with
> that proposition.

I didn't realize it was single inheritance, I never looked. I figured there'd be a chain of parents with precedence implied and so forth, but I hadn't thought much about it.
 
> It does unless/until we figure out wtf is going on.  At this point I'm really not sure.  I mean, we in fact may be in the same boat
> wrt our own dependencies.  Have we ever actually looked in detail at all of our dependencies' dependencies to see that we're
> actually getting what we/they think we should?  I personally haven't (b/c we assume it works rationally).

I don't think we would ever know. If we thought to check, it would be to verify something, and if we knew what needed to be used, we'd probably have put it into our parent to lock it, and so we're back where we started. If we don't lock the version of something, we're basically stipulating that the transitively included version must be acceptable.

-- Scott