Package lock

The package lock makes it easier to manage and override transitive dependencies. When using a package lock file, dependencies can be updated without modifying the main or other project's CMakeLists.txt. The package lock file should be added to version control.

Usage

After including CPM.cmake, call CPMUsePackageLock(package-lock.cmake) to include package-lock.cmake, if it exists. This file can be created and updated using the target cpm-update-package-lock.

Note that version changes inside the CMakeLists are not registered after declaring packages through a package lock. To update a dependency, change according version in the package-lock.cmake file. Any transitive dependencies will need to be updated there as well and CPM.cmake will emit a warning if a newer version is required.

Example

The following lines should be added before declaring dependencies in the main CMakeLists.txt.

include(cmake/CPM.cmake)
CPMUsePackageLock(package-lock.cmake)

To generate and update the package lock file, run the cpm-update-package-lock target.

cmake -H. -Bbuild
cmake --build build --target cpm-update-package-lock

All CPM.cmake dependencies will now be managed inside the package lock file. Once declared, packages can be added without needing to define version or source info, e.g. using the CPMGetPackage(<dependency name>) command.