Minimum Non-BOM Plugin Versions Recipe

[sghill]

Non-BOM plugins, such as job-dsl, should have a way to specify a minimum version with a comment. This needs to work with property-driven versions as well.

Property-Driven Before:

<properties>
    <plugins.job-dsl.version>1.52</plugins.job-dsl.version>
</properties>
<dependencies>
    <dependency>
        <groupId>org.jenkins-ci.plugins</groupId>
        <artifactId>job-dsl</artifactId>
        <version>${plugins.job-dsl.version}</version>
        <optional>true</optional>
    </dependency>
</dependencies>

Property-Driven After:

<properties>
    <!-- <= 1.71 vulnerable: https://www.jenkins.io/security/advisory/2019-03-06/#SECURITY-1342 -->
    <plugins.job-dsl.version>1.72</plugins.job-dsl.version>
</properties>
<dependencies>
    <dependency>
        <groupId>org.jenkins-ci.plugins</groupId>
        <artifactId>job-dsl</artifactId>
        <version>${plugins.job-dsl.version}</version>
        <optional>true</optional>
    </dependency>
</dependencies>

Inline Before:

<dependencies>
    <dependency>
        <groupId>org.jenkins-ci.plugins</groupId>
        <artifactId>job-dsl</artifactId>
        <version>1.52</version>
        <optional>true</optional>
    </dependency>
</dependencies>

Inline After:

<dependencies>
    <dependency>
        <groupId>org.jenkins-ci.plugins</groupId>
        <artifactId>job-dsl</artifactId>
        <!-- <= 1.71 vulnerable: https://www.jenkins.io/security/advisory/2019-03-06/#SECURITY-1342 -->
        <version>1.72</version>
        <optional>true</optional>
    </dependency>
</dependencies>

For an example, see jenkinsci/applitools-eyes-plugin#9