Uploaded image for project: 'Maven Shared Components'
  1. Maven Shared Components
  2. MSHARED-1016

Transitive provided dependencies are not removed from collected dependency graph

    XMLWordPrintableJSON

Details

    Description

      DependencyCollectorBuilder#collectDependencyGraph returns a dependency graph containing transitive provided scope dependencies. This is inconsistent with Maven behavior, which removes transitive provided scope dependencies from the dependency graph:

      https://github.com/apache/maven/blob/706d9319f14b507f3c3deeba4eeda1a51a531c9b/maven-resolver-provider/src/main/java/org/apache/maven/repository/internal/MavenRepositorySystemUtils.java#L80

      This might be the root cause of https://issues.apache.org/jira/browse/MENFORCER-402 and https://issues.apache.org/jira/browse/MENFORCER-394

      Note that transitive test scope dependencies are correctly filtered out using a dependency selector.

      It seems to me that we can add another dependency selector to also filter out transitive provided scope dependencies:

      https://github.com/apache/maven-dependency-tree/blob/7a1a12533ac6898fcb3dacbcf2466ef71d11c43a/src/main/java/org/apache/maven/shared/dependency/graph/internal/Maven31DependencyCollectorBuilder.java#L108

      https://github.com/apache/maven-dependency-tree/blob/7a1a12533ac6898fcb3dacbcf2466ef71d11c43a/src/main/java/org/apache/maven/shared/dependency/graph/internal/Maven3DependencyCollectorBuilder.java#L108

      I have submitted a PR to do this: https://github.com/apache/maven-dependency-tree/pull/9

       

       

       

       

      Attachments

        Issue Links

          fixes

          Bug - A problem which impairs or prevents the functions of the product. MENFORCER-394 DependencyConvergence in 3.0.0 fails on provided scoped dependencies

          • Major - Major loss of function.
          • Closed

          Bug - A problem which impairs or prevents the functions of the product. MENFORCER-402 RequireUpperBoundDeps now follow scope provided transitive dependencies

          • Major - Major loss of function.
          • Closed
          relates to

          Bug - A problem which impairs or prevents the functions of the product. MENFORCER-407 Enforcer 3.0.0 breaks with Maven 3.8.4

          • Major - Major loss of function.
          • Closed
          links to

          Web Link GitHub Pull Request #9

          Web Link GitHub Pull Request #21

          Web Link Pull Request

          Activity

            People

              sjaranowski Slawomir Jaranowski
              danielnorberg Daniel Norberg
              Votes:
              1 Vote for this issue
              Watchers:
              7 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved: