Dependency Assistant 1.0 Release Notes

Upgrading from Dependency Assistant 0.5

Dependency Assistant 1.0 is the first general release. It consolidates the 0.5 milestone and release candidate builds and expands the plugin from Maven-focused dependency updates to several common dependency declaration formats.

No manual migration should be required for existing Maven usage. The main visible change is the new menu entry under Tools → Dependency Assistant → Upgrade dependencies….

The plugin no longer requires the Java plugin and installs on any IntelliJ-based IDE, such as WebStorm or PyCharm. Ecosystem support activates with the corresponding IDE plugins. After a plugin update, a notification summarizes what changed since the previously installed version.

The plugin requires IntelliJ IDEA 2025.2 (build 252) or newer. If you build the plugin from source, use JDK 21.

New and Noteworthy

Tip	Dependency Assistant needs release metadata before it can show upgrade suggestions. Use Tools → Dependency Assistant → Refresh dependency release metadata if the cache is empty or stale.

Additional Dependency Files

Dependency Assistant now scans more than pom.xml. The supported inputs include Maven, Gradle, GitHub Actions, NPM, Antora, Maven Wrapper, and Gradle Wrapper files.

pom.xml
.mvn/wrapper/maven-wrapper.properties
build.gradle
build.gradle.kts
settings.gradle
settings.gradle.kts
gradle.properties
gradle/libs.versions.toml and other *.versions.toml catalogs
.github/workflows/*.yml
action.yml / action.yaml
package.json
antora-playbook.yml
gradle/wrapper/gradle-wrapper.properties

The same basic editor workflow is used where possible: completion, upgrade highlighting, release documentation, and selective updates. Some integrations also provide gutter markers. When started from the editor, the upgrade intention and the Upgrade dependencies… action focus the dependency at the caret.

Gradle Support

Gradle Kotlin DSL, Groovy DSL, settings files, properties, plugins, dependencies, and version catalogs are now supported.

For example, Dependency Assistant can inspect dependency and plugin versions declared directly in a build file:

plugins {
	id("org.springframework.boot") version "3.4.4"
}

dependencies {
	implementation("org.springframework:spring-core:6.2.5")
}

Version catalog declarations are also supported, including references through version.ref:

[versions]
spring = "6.2.5"

[libraries]
spring-core = { module = "org.springframework:spring-core", version.ref = "spring" }

Gradle rich versions, version ranges, map-style declarations, and multiple TOML catalogs are handled in common cases. Kotlin plugin helpers such as kotlin("jvm") resolve to their plugin coordinates, and Kotlin val properties are parsed as version sources.

GitHub Actions Support

GitHub Actions workflow files are now scanned for uses: declarations. Release lookup uses GitHub releases and Git tags.

steps:
  - uses: actions/checkout@v4
  - uses: gradle/actions/setup-gradle@v5

Completion, highlighting, and update actions are available when the workflow declaration can be mapped to a repository and ref. An inspection reports uses: references pinned to a mutable tag when the commit SHA is already known and offers a quick-fix to pin the SHA.

NPM Support

package.json dependencies and devDependencies are now scanned and resolved against the npm registry. A practical subset of semver expressions and Git references is supported, including caret and tilde ranges, common comparator ranges, aliases, Git URLs, and GitHub shorthand. Dynamic or non-registry forms such as latest, *, file:, link:, and workspace: are not updated.

{
  "dependencies": {
    "react": "^19.0.0"
  },
  "devDependencies": {
    "typescript": "~5.9.0"
  }
}

Antora Support

Antora playbooks are now scanned for UI bundle URLs. Bundle versions participate in completion, highlighting, and update support where the URL shape is understood.

ui:
  bundle:
    url: https://github.com/example/docs-ui/releases/download/v1.0.0/ui-bundle.zip

Antora content source branch references are not upgraded by this support.

Maven Improvements

Maven support now includes extensions.xml. Property resolution has been refined, including Maven properties and profile-specific properties.

<extension>
	<groupId>io.takari.maven</groupId>
	<artifactId>takari-smart-builder</artifactId>
	<version>0.6.1</version>
</extension>

Maven repository credentials declared in settings.xml can be used when they can be resolved by the active Maven installation. Maven mirrors, parent version updates, and reporting plugins are supported as well.

Wrapper Files

Maven Wrapper and Gradle Wrapper files now have dedicated support. The plugin can inspect wrapper URLs, suggest canonical URL fixes, and compute SHA-256 checksums.

distributionUrl=https\://services.gradle.org/distributions/gradle-9.4.1-bin.zip
distributionSha256Sum=...

Wrapper inspections also flag plaintext credentials in URLs.

Release Metadata Cache

Dependency Assistant now tracks release metadata age and reports when cached data is missing or stale. The refresh action can be used without starting a full update flow. The reminder notification offers dismissal options so you can snooze or silence it.

Dependency Rules and Drift

dependencyfile.json descriptors can constrain dependencies to generations, restrict regular upgrade strategies, and group related upgrade rows by a named rule. The plugin also reports dependency rule violations and version or declaration drift. Related upgrades are grouped in the upgrade dialog, either by a named rule or inferred from shared version properties and release history.

Vulnerability Information

When JetBrains Package Checker is available, Dependency Assistant can show vulnerability information for Maven and npm packages. If the current version is vulnerable and a newer checked version is clean, the upgrade suggestions can include a Safe Version target. BOMs are resolved to detect vulnerable managed dependencies.

Release Notes and Issue Tracker

Intentions open the release notes of the declared version or the issue tracker of a dependency in the browser when project metadata (for example POM or npm registry data) provides them.

Dependency Site Search

Dependency Site Search finds all declaration sites of an artifact across the project and lists them in the Usage View, reachable from the upgrade dialog and the Upgrade Plan.

Upgrade Plan

Upgrade Plan lets you select and stage dependency upgrades. This is useful if you want to prepare your dependency upgrade run without actually applying these yet. A staging area allows to preview the upgrades to be applied. Additionally, you can create dependency upgrade tickets (on GitHub) and perform each dependency upgrade in a separate commit using the ticket reference to create a link between your dependency upgrade and ticket.

Create All Tickets creates tickets for every planned upgrade regardless of the current selection. Apply… and Apply and Commit… apply only the selected planned upgrades, optionally followed by a commit. Commit messages use a GitHub-specific template for ticket close references.

Upgrade Notifications

Applying updates ends with a notification that lists the upgraded declarations and distinguishes them from declarations that were already up to date. The notification offers a commit action for the applied updates. Notifications expire once their action has been triggered, after subsequent edits, or after a global undo, so they do not linger beyond their usefulness.

Fixes

This release also includes a number of fixes:

• Maven property-backed updates now write to the property declaration.

• Maven completion has been corrected.

• TOML parsing and Gradle map-style version lookup have been fixed.

• GitHub completion now renders correctly around comments.

• GitHub account resolution now observes IntelliJ trusted-project checks.

• Schemed package specifiers are no longer accepted as Git shorthand.

• Plugin validation and resource bundle issues have been addressed.

• Project state no longer goes stale after build files are removed or renamed. Maven and Gradle project contexts are cached.

• Git versions are restored as expected when an Upgrade Plan is loaded.

• npm Git dependency updates and version expression handling have been improved. Registry responses are parsed down to what is needed, with a fallback for oversized responses.

• Antora dependency highlighting, version handling, and updates have been fixed, along with refined playbook detection.

• Upgrades applied from the documentation panel now use the correct version identifiers.

• Cancellation is handled consistently across services. Parallel background work runs in virtual-thread task scopes.

Dependency Upgrades

The build now uses Gradle 9.4.1, IntelliJ Platform Gradle Plugin 2.19.0, and a JDK 21 toolchain.

Additional IntelliJ Platform integration dependencies have been added for optional ecosystem support:

• Gradle

• Kotlin

• Groovy

• TOML

• YAML

• GitHub

• Git

• JSON

CodeQL scanning, ArchUnit architecture checks, formatter configuration, pinned GitHub Actions, and CI build report capture have also been added.