Maven

在Java 9之前，Java项目没有官方的模块系统，开发者主要依赖Maven或Gradle等构建工具的多模块项目结构来实现模块划分

Dependency management ensures that the third-party libraries the project needs are correctly installed on the server with compatible versions; common tools include Python's pip/conda, Node.js's npm, and Java's Maven.

OpenRewrite's Recipes are a set of code transformation rules distributed as Maven artifacts, which developers can use by declaring the dependency in their build scripts.

A Maven artifact coordinate consists of three parts: groupId, artifactId, and version, and the repository address together with the coordinate jointly determines whether a dependency can be resolved.

A BOM (Bill of Materials) is a special POM used only to centrally declare the versions of a group of dependencies; downstream projects that import it via dependencyManagement or Gradle's platform can then omit specific version numbers.

Dependency locking mechanisms (such as Gradle's lockfile and Maven's dependency lock) persist resolution results along with source information into files; after a repository change, checksums or source records may no longer match, and the lock files need to be regenerated.

The Maven coordinates for RagLeap Graph Java are io.github.antonyrag:ragleap-graph:0.2.0.

The team resolved the Maven artifact in a clean project and ran health checks, upserts, backfills, and pure graph retrieval against a real Neo4j.

Maven is the most mainstream build and dependency management tool in the Java ecosystem, and the GAV coordinates (groupId:artifactId:version) uniquely identify an artifact.

The key to verifying a published artifact is that the tests passing in the source tree are not necessarily consistent with the final published binary, and there may be problems such as resource files missed during the packaging stage, misconfigured dependency scopes in pom.xml, behavioral differences between SNAPSHOT and release versions, or missing signatures and metadata.

CompileLoop is an open-source Java tool that takes a project with a failed Maven build, sends the compilation errors to a local code model, obtains fix suggestions, applies the patch in a temporary copy and rebuilds to verify, leaving the original source code unchanged.

In tests on 20 Maven projects with deliberate defects, Qwen2.5-Coder 7B successfully fixed 9/20 (45%, average latency 29 seconds), Qwen2.5-Coder 1.5B successfully fixed 4/20 (20%, average latency 12 seconds), and DeepSeek-Coder 6.7B successfully fixed 1/20 (5%, average latency 39 seconds).

CompileLoop's temporary copy is not a secure sandbox, build scripts can execute arbitrary commands, and container isolation is an important next step.

A Maven build executes the plugins declared in pom.xml, including exec-maven-plugin, annotation processors, arbitrary Java code in the test phase, and even shell calls via maven-antrun-plugin, so accepting a malicious patch is equivalent to executing arbitrary commands on the host.

The course project is built on OpenJDK 21 and Maven, adopting a pure backend development approach with no frontend development involved.