You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@maven.apache.org by Jochen Wiedmann <jo...@gmail.com> on 2024/12/04 20:10:25 UTC
Scope of transitive dependencies.
Hi,
a Maven plugin of mine has the following dependency:
<dependency>
<groupId>org.apache.maven</groupId>
<artifactId>maven-core</artifactId>
<version>3.9.9</version>
<scope>provided</scope>
</dependency>
As you can see. the dependency has scope "provided". Now upon building
the plugin I get the warning below. As fars as I can tell, these are
transitive dependencies of the Maven core. Now, I am wondering how to
get rid of these warnings. The only idea, that comes to mind, would be
to declare all of these as explicit dependencies with scope
"provided". but doesn't sound good.
Are there any better ideas?
Thanks,
Jochen
[WARNING]
Some dependencies of Maven Plugins are expected to be in provided scope.
Please make sure that dependencies listed below declared in POM
have set '<scope>provided</scope>' as well.
The following dependencies are in wrong scope:
* org.apache.maven:maven-model:jar:3.9.9:compile
* org.apache.maven:maven-settings:jar:3.9.9:compile
* org.apache.maven:maven-settings-builder:jar:3.9.9:compile
* org.apache.maven:maven-builder-support:jar:3.9.9:compile
* org.apache.maven:maven-repository-metadata:jar:3.9.9:compile
* org.apache.maven:maven-artifact:jar:3.9.9:compile
* org.apache.maven:maven-model-builder:jar:3.9.9:compile
* org.apache.maven:maven-resolver-provider:jar:3.9.9:compile
* org.apache.maven:maven-compat:jar:3.9.9:compile
--
The woman was born in a full-blown thunderstorm. She probably told it
to be quiet. It probably did. (Robert Jordan, Winter's heart)
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@maven.apache.org
For additional commands, e-mail: users-help@maven.apache.org
Re: Scope of transitive dependencies.
Posted by Tamás Cservenák <ta...@cservenak.net>.
TBH, you should use
$ mvn toolbox:tree -Dscope=compile -DverboseTree
as then it is visible.
Without it, it is really strange. Problem is that maven-compat depends
on ALL of Maven, so due it's own scope makes all of maven "compile"
scope.
Thanks
T
On Thu, Dec 5, 2024 at 8:32 PM Tamás Cservenák <ta...@cservenak.net> wrote:
>
> Yes, that's it.
>
> So, here it is
> https://gist.github.com/cstamas/e9449f2a295132767027bfb85288f0ca
>
> Problem is
> https://github.com/jochenw/jwi-maven-plugins/blob/706a7aed52320fceb3ff096c83c19021c66f2d0b/jwigrv-maven-plugin/pom.xml#L64-L68
>
> T
>
> On Thu, Dec 5, 2024 at 8:11 PM Jochen Wiedmann
> <jo...@gmail.com> wrote:
> >
> > Hi, Tamas,
> >
> > is that what you are asking for?
> >
> > Jochen
> >
> >
> > wi@laptop-jochen-hplx:~/git/github.com/jochenw/jwi-maven-plugins/jwigrv-maven-plugin$
> > mvn dependency:tree
> > [INFO] Scanning for projects...
> > [INFO]
> > [INFO] --------------------------------------<
> > com.github.jochenw.jmp:jwigrv-maven-plugin
> > >--------------------------------------
> > [INFO] Building JWI Groovy Maven plugin 0.3-SNAPSHOT
> > [INFO] from pom.xml
> > [INFO] -----------------------------------------------------[
> > maven-plugin ]-----------------------------------------------------
> > [INFO]
> > [INFO] --- dependency:3.8.1:tree (default-cli) @ jwigrv-maven-plugin ---
> > [INFO] com.github.jochenw.jmp:jwigrv-maven-plugin:maven-plugin:0.3-SNAPSHOT
> > [INFO] +- org.apache.maven:maven-core:jar:3.9.9:provided
> > [INFO] | +- org.apache.maven:maven-model:jar:3.9.9:compile
> > [INFO] | +- org.apache.maven:maven-settings:jar:3.9.9:compile
> > [INFO] | +- org.apache.maven:maven-settings-builder:jar:3.9.9:compile
> > [INFO] | | \- org.codehaus.plexus:plexus-sec-dispatcher:jar:2.0:compile
> > [INFO] | | \- org.codehaus.plexus:plexus-cipher:jar:2.0:compile
> > [INFO] | +- org.apache.maven:maven-builder-support:jar:3.9.9:compile
> > [INFO] | +- org.apache.maven:maven-repository-metadata:jar:3.9.9:compile
> > [INFO] | +- org.apache.maven:maven-artifact:jar:3.9.9:compile
> > [INFO] | +- org.apache.maven:maven-model-builder:jar:3.9.9:compile
> > [INFO] | +- org.apache.maven:maven-resolver-provider:jar:3.9.9:compile
> > [INFO] | +- org.apache.maven.resolver:maven-resolver-impl:jar:1.9.22:compile
> > [INFO] | | \-
> > org.apache.maven.resolver:maven-resolver-named-locks:jar:1.9.22:compile
> > [INFO] | +- org.apache.maven.resolver:maven-resolver-api:jar:1.9.22:compile
> > [INFO] | +- org.apache.maven.resolver:maven-resolver-spi:jar:1.9.22:compile
> > [INFO] | +- org.apache.maven.resolver:maven-resolver-util:jar:1.9.22:compile
> > [INFO] | +- org.apache.maven.shared:maven-shared-utils:jar:3.4.2:provided
> > [INFO] | +- org.eclipse.sisu:org.eclipse.sisu.plexus:jar:0.9.0.M3:compile
> > [INFO] | | \- org.codehaus.plexus:plexus-xml:jar:3.0.1:compile
> > [INFO] | +- org.eclipse.sisu:org.eclipse.sisu.inject:jar:0.9.0.M3:compile
> > [INFO] | +- com.google.inject:guice:jar:5.1.0:provided
> > [INFO] | | \- aopalliance:aopalliance:jar:1.0:provided
> > [INFO] | +- com.google.guava:guava:jar:33.2.1-jre:provided
> > [INFO] | +- com.google.guava:failureaccess:jar:1.0.2:provided
> > [INFO] | +- javax.inject:javax.inject:jar:1:compile
> > [INFO] | +- org.codehaus.plexus:plexus-utils:jar:3.5.1:compile
> > [INFO] | +- org.codehaus.plexus:plexus-classworlds:jar:2.8.0:compile
> > [INFO] | +- org.codehaus.plexus:plexus-interpolation:jar:1.27:compile
> > [INFO] | +- org.codehaus.plexus:plexus-component-annotations:jar:2.1.0:compile
> > [INFO] | \- org.slf4j:slf4j-api:jar:1.7.36:compile
> > [INFO] +- org.apache.maven:maven-plugin-api:jar:3.9.9:provided
> > [INFO] +- org.apache.maven.plugin-tools:maven-plugin-annotations:jar:3.9.0:provided
> > [INFO] +- org.apache.groovy:groovy:jar:4.0.24:compile
> > [INFO] +- org.apache.maven.plugin-testing:maven-plugin-testing-harness:jar:3.3.0:test
> > [INFO] | +- commons-io:commons-io:jar:2.2:test
> > [INFO] | \- org.codehaus.plexus:plexus-archiver:jar:2.2:test
> > [INFO] | +-
> > org.codehaus.plexus:plexus-container-default:jar:1.0-alpha-9-stable-1:test
> > [INFO] | | +- junit:junit:jar:4.11:provided
> > [INFO] | | | \- org.hamcrest:hamcrest-core:jar:1.3:provided
> > [INFO] | | \- classworlds:classworlds:jar:1.1-alpha-2:test
> > [INFO] | \- org.codehaus.plexus:plexus-io:jar:2.0.4:test
> > [INFO] +- org.junit.jupiter:junit-jupiter-engine:jar:5.11.3:test
> > [INFO] | +- org.junit.platform:junit-platform-engine:jar:1.11.3:test
> > [INFO] | | +- org.opentest4j:opentest4j:jar:1.3.0:test
> > [INFO] | | \- org.junit.platform:junit-platform-commons:jar:1.11.3:test
> > [INFO] | +- org.junit.jupiter:junit-jupiter-api:jar:5.11.3:test
> > [INFO] | \- org.apiguardian:apiguardian-api:jar:1.1.2:test
> > [INFO] \- org.apache.maven:maven-compat:jar:3.9.9:compile
> > [INFO] \- org.apache.maven.wagon:wagon-provider-api:jar:3.5.3:compile
> >
> > On Thu, Dec 5, 2024 at 5:33 PM Tamás Cservenák <ta...@cservenak.net> wrote:
> > >
> > > And... Can you tell us how these dependencies come into play?
> > >
> > > Can you paste the (in color or in bw -- for Manfred) output of the
> > > tree command?
> > >
> > > Thanks
> > > T
> > >
> > > On Thu, Dec 5, 2024 at 2:41 PM Jochen Wiedmann
> > > <jo...@gmail.com> wrote:
> > > >
> > > > On Wed, Dec 4, 2024 at 10:10 PM Slawomir Jaranowski
> > > > <s....@gmail.com> wrote:
> > > >
> > > > > It can be transitive dependencies from other dependencies in compile scope.
> > > > >
> > > > > look at output of dependency:tree
> > > >
> > > > I did, and it they are not.
> > > >
> > > > Jochen
> > > >
> > > > > On Wed, 4 Dec 2024 at 21:11, Jochen Wiedmann <jo...@gmail.com> wrote:
> > > > > >
> > > > > > Hi,
> > > > > >
> > > > > > a Maven plugin of mine has the following dependency:
> > > > > >
> > > > > > <dependency>
> > > > > > <groupId>org.apache.maven</groupId>
> > > > > > <artifactId>maven-core</artifactId>
> > > > > > <version>3.9.9</version>
> > > > > > <scope>provided</scope>
> > > > > > </dependency>
> > > > > >
> > > > > > As you can see. the dependency has scope "provided". Now upon building
> > > > > > the plugin I get the warning below. As fars as I can tell, these are
> > > > > > transitive dependencies of the Maven core. Now, I am wondering how to
> > > > > > get rid of these warnings. The only idea, that comes to mind, would be
> > > > > > to declare all of these as explicit dependencies with scope
> > > > > > "provided". but doesn't sound good.
> > > > > >
> > > > > > Are there any better ideas?
> > > > > >
> > > > > > Thanks,
> > > > > >
> > > > > > Jochen
> > > > > >
> > > > > >
> > > > > > [WARNING]
> > > > > >
> > > > > > Some dependencies of Maven Plugins are expected to be in provided scope.
> > > > > > Please make sure that dependencies listed below declared in POM
> > > > > > have set '<scope>provided</scope>' as well.
> > > > > >
> > > > > > The following dependencies are in wrong scope:
> > > > > > * org.apache.maven:maven-model:jar:3.9.9:compile
> > > > > > * org.apache.maven:maven-settings:jar:3.9.9:compile
> > > > > > * org.apache.maven:maven-settings-builder:jar:3.9.9:compile
> > > > > > * org.apache.maven:maven-builder-support:jar:3.9.9:compile
> > > > > > * org.apache.maven:maven-repository-metadata:jar:3.9.9:compile
> > > > > > * org.apache.maven:maven-artifact:jar:3.9.9:compile
> > > > > > * org.apache.maven:maven-model-builder:jar:3.9.9:compile
> > > > > > * org.apache.maven:maven-resolver-provider:jar:3.9.9:compile
> > > > > > * org.apache.maven:maven-compat:jar:3.9.9:compile
> > > > > >
> > > > > >
> > > > > > --
> > > > > > The woman was born in a full-blown thunderstorm. She probably told it
> > > > > > to be quiet. It probably did. (Robert Jordan, Winter's heart)
> > > > > >
> > > > > > ---------------------------------------------------------------------
> > > > > > To unsubscribe, e-mail: users-unsubscribe@maven.apache.org
> > > > > > For additional commands, e-mail: users-help@maven.apache.org
> > > > > >
> > > > >
> > > > >
> > > > > --
> > > > > Sławomir Jaranowski
> > > > >
> > > > > ---------------------------------------------------------------------
> > > > > To unsubscribe, e-mail: users-unsubscribe@maven.apache.org
> > > > > For additional commands, e-mail: users-help@maven.apache.org
> > > > >
> > > >
> > > >
> > > > --
> > > > The woman was born in a full-blown thunderstorm. She probably told it
> > > > to be quiet. It probably did. (Robert Jordan, Winter's heart)
> > > >
> > > > ---------------------------------------------------------------------
> > > > To unsubscribe, e-mail: users-unsubscribe@maven.apache.org
> > > > For additional commands, e-mail: users-help@maven.apache.org
> > > >
> > >
> > > ---------------------------------------------------------------------
> > > To unsubscribe, e-mail: users-unsubscribe@maven.apache.org
> > > For additional commands, e-mail: users-help@maven.apache.org
> > >
> >
> >
> > --
> > The woman was born in a full-blown thunderstorm. She probably told it
> > to be quiet. It probably did. (Robert Jordan, Winter's heart)
> >
> > ---------------------------------------------------------------------
> > To unsubscribe, e-mail: users-unsubscribe@maven.apache.org
> > For additional commands, e-mail: users-help@maven.apache.org
> >
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@maven.apache.org
For additional commands, e-mail: users-help@maven.apache.org
Re: Scope of transitive dependencies.
Posted by Tamás Cservenák <ta...@cservenak.net>.
Yes, that's it.
So, here it is
https://gist.github.com/cstamas/e9449f2a295132767027bfb85288f0ca
Problem is
https://github.com/jochenw/jwi-maven-plugins/blob/706a7aed52320fceb3ff096c83c19021c66f2d0b/jwigrv-maven-plugin/pom.xml#L64-L68
T
On Thu, Dec 5, 2024 at 8:11 PM Jochen Wiedmann
<jo...@gmail.com> wrote:
>
> Hi, Tamas,
>
> is that what you are asking for?
>
> Jochen
>
>
> wi@laptop-jochen-hplx:~/git/github.com/jochenw/jwi-maven-plugins/jwigrv-maven-plugin$
> mvn dependency:tree
> [INFO] Scanning for projects...
> [INFO]
> [INFO] --------------------------------------<
> com.github.jochenw.jmp:jwigrv-maven-plugin
> >--------------------------------------
> [INFO] Building JWI Groovy Maven plugin 0.3-SNAPSHOT
> [INFO] from pom.xml
> [INFO] -----------------------------------------------------[
> maven-plugin ]-----------------------------------------------------
> [INFO]
> [INFO] --- dependency:3.8.1:tree (default-cli) @ jwigrv-maven-plugin ---
> [INFO] com.github.jochenw.jmp:jwigrv-maven-plugin:maven-plugin:0.3-SNAPSHOT
> [INFO] +- org.apache.maven:maven-core:jar:3.9.9:provided
> [INFO] | +- org.apache.maven:maven-model:jar:3.9.9:compile
> [INFO] | +- org.apache.maven:maven-settings:jar:3.9.9:compile
> [INFO] | +- org.apache.maven:maven-settings-builder:jar:3.9.9:compile
> [INFO] | | \- org.codehaus.plexus:plexus-sec-dispatcher:jar:2.0:compile
> [INFO] | | \- org.codehaus.plexus:plexus-cipher:jar:2.0:compile
> [INFO] | +- org.apache.maven:maven-builder-support:jar:3.9.9:compile
> [INFO] | +- org.apache.maven:maven-repository-metadata:jar:3.9.9:compile
> [INFO] | +- org.apache.maven:maven-artifact:jar:3.9.9:compile
> [INFO] | +- org.apache.maven:maven-model-builder:jar:3.9.9:compile
> [INFO] | +- org.apache.maven:maven-resolver-provider:jar:3.9.9:compile
> [INFO] | +- org.apache.maven.resolver:maven-resolver-impl:jar:1.9.22:compile
> [INFO] | | \-
> org.apache.maven.resolver:maven-resolver-named-locks:jar:1.9.22:compile
> [INFO] | +- org.apache.maven.resolver:maven-resolver-api:jar:1.9.22:compile
> [INFO] | +- org.apache.maven.resolver:maven-resolver-spi:jar:1.9.22:compile
> [INFO] | +- org.apache.maven.resolver:maven-resolver-util:jar:1.9.22:compile
> [INFO] | +- org.apache.maven.shared:maven-shared-utils:jar:3.4.2:provided
> [INFO] | +- org.eclipse.sisu:org.eclipse.sisu.plexus:jar:0.9.0.M3:compile
> [INFO] | | \- org.codehaus.plexus:plexus-xml:jar:3.0.1:compile
> [INFO] | +- org.eclipse.sisu:org.eclipse.sisu.inject:jar:0.9.0.M3:compile
> [INFO] | +- com.google.inject:guice:jar:5.1.0:provided
> [INFO] | | \- aopalliance:aopalliance:jar:1.0:provided
> [INFO] | +- com.google.guava:guava:jar:33.2.1-jre:provided
> [INFO] | +- com.google.guava:failureaccess:jar:1.0.2:provided
> [INFO] | +- javax.inject:javax.inject:jar:1:compile
> [INFO] | +- org.codehaus.plexus:plexus-utils:jar:3.5.1:compile
> [INFO] | +- org.codehaus.plexus:plexus-classworlds:jar:2.8.0:compile
> [INFO] | +- org.codehaus.plexus:plexus-interpolation:jar:1.27:compile
> [INFO] | +- org.codehaus.plexus:plexus-component-annotations:jar:2.1.0:compile
> [INFO] | \- org.slf4j:slf4j-api:jar:1.7.36:compile
> [INFO] +- org.apache.maven:maven-plugin-api:jar:3.9.9:provided
> [INFO] +- org.apache.maven.plugin-tools:maven-plugin-annotations:jar:3.9.0:provided
> [INFO] +- org.apache.groovy:groovy:jar:4.0.24:compile
> [INFO] +- org.apache.maven.plugin-testing:maven-plugin-testing-harness:jar:3.3.0:test
> [INFO] | +- commons-io:commons-io:jar:2.2:test
> [INFO] | \- org.codehaus.plexus:plexus-archiver:jar:2.2:test
> [INFO] | +-
> org.codehaus.plexus:plexus-container-default:jar:1.0-alpha-9-stable-1:test
> [INFO] | | +- junit:junit:jar:4.11:provided
> [INFO] | | | \- org.hamcrest:hamcrest-core:jar:1.3:provided
> [INFO] | | \- classworlds:classworlds:jar:1.1-alpha-2:test
> [INFO] | \- org.codehaus.plexus:plexus-io:jar:2.0.4:test
> [INFO] +- org.junit.jupiter:junit-jupiter-engine:jar:5.11.3:test
> [INFO] | +- org.junit.platform:junit-platform-engine:jar:1.11.3:test
> [INFO] | | +- org.opentest4j:opentest4j:jar:1.3.0:test
> [INFO] | | \- org.junit.platform:junit-platform-commons:jar:1.11.3:test
> [INFO] | +- org.junit.jupiter:junit-jupiter-api:jar:5.11.3:test
> [INFO] | \- org.apiguardian:apiguardian-api:jar:1.1.2:test
> [INFO] \- org.apache.maven:maven-compat:jar:3.9.9:compile
> [INFO] \- org.apache.maven.wagon:wagon-provider-api:jar:3.5.3:compile
>
> On Thu, Dec 5, 2024 at 5:33 PM Tamás Cservenák <ta...@cservenak.net> wrote:
> >
> > And... Can you tell us how these dependencies come into play?
> >
> > Can you paste the (in color or in bw -- for Manfred) output of the
> > tree command?
> >
> > Thanks
> > T
> >
> > On Thu, Dec 5, 2024 at 2:41 PM Jochen Wiedmann
> > <jo...@gmail.com> wrote:
> > >
> > > On Wed, Dec 4, 2024 at 10:10 PM Slawomir Jaranowski
> > > <s....@gmail.com> wrote:
> > >
> > > > It can be transitive dependencies from other dependencies in compile scope.
> > > >
> > > > look at output of dependency:tree
> > >
> > > I did, and it they are not.
> > >
> > > Jochen
> > >
> > > > On Wed, 4 Dec 2024 at 21:11, Jochen Wiedmann <jo...@gmail.com> wrote:
> > > > >
> > > > > Hi,
> > > > >
> > > > > a Maven plugin of mine has the following dependency:
> > > > >
> > > > > <dependency>
> > > > > <groupId>org.apache.maven</groupId>
> > > > > <artifactId>maven-core</artifactId>
> > > > > <version>3.9.9</version>
> > > > > <scope>provided</scope>
> > > > > </dependency>
> > > > >
> > > > > As you can see. the dependency has scope "provided". Now upon building
> > > > > the plugin I get the warning below. As fars as I can tell, these are
> > > > > transitive dependencies of the Maven core. Now, I am wondering how to
> > > > > get rid of these warnings. The only idea, that comes to mind, would be
> > > > > to declare all of these as explicit dependencies with scope
> > > > > "provided". but doesn't sound good.
> > > > >
> > > > > Are there any better ideas?
> > > > >
> > > > > Thanks,
> > > > >
> > > > > Jochen
> > > > >
> > > > >
> > > > > [WARNING]
> > > > >
> > > > > Some dependencies of Maven Plugins are expected to be in provided scope.
> > > > > Please make sure that dependencies listed below declared in POM
> > > > > have set '<scope>provided</scope>' as well.
> > > > >
> > > > > The following dependencies are in wrong scope:
> > > > > * org.apache.maven:maven-model:jar:3.9.9:compile
> > > > > * org.apache.maven:maven-settings:jar:3.9.9:compile
> > > > > * org.apache.maven:maven-settings-builder:jar:3.9.9:compile
> > > > > * org.apache.maven:maven-builder-support:jar:3.9.9:compile
> > > > > * org.apache.maven:maven-repository-metadata:jar:3.9.9:compile
> > > > > * org.apache.maven:maven-artifact:jar:3.9.9:compile
> > > > > * org.apache.maven:maven-model-builder:jar:3.9.9:compile
> > > > > * org.apache.maven:maven-resolver-provider:jar:3.9.9:compile
> > > > > * org.apache.maven:maven-compat:jar:3.9.9:compile
> > > > >
> > > > >
> > > > > --
> > > > > The woman was born in a full-blown thunderstorm. She probably told it
> > > > > to be quiet. It probably did. (Robert Jordan, Winter's heart)
> > > > >
> > > > > ---------------------------------------------------------------------
> > > > > To unsubscribe, e-mail: users-unsubscribe@maven.apache.org
> > > > > For additional commands, e-mail: users-help@maven.apache.org
> > > > >
> > > >
> > > >
> > > > --
> > > > Sławomir Jaranowski
> > > >
> > > > ---------------------------------------------------------------------
> > > > To unsubscribe, e-mail: users-unsubscribe@maven.apache.org
> > > > For additional commands, e-mail: users-help@maven.apache.org
> > > >
> > >
> > >
> > > --
> > > The woman was born in a full-blown thunderstorm. She probably told it
> > > to be quiet. It probably did. (Robert Jordan, Winter's heart)
> > >
> > > ---------------------------------------------------------------------
> > > To unsubscribe, e-mail: users-unsubscribe@maven.apache.org
> > > For additional commands, e-mail: users-help@maven.apache.org
> > >
> >
> > ---------------------------------------------------------------------
> > To unsubscribe, e-mail: users-unsubscribe@maven.apache.org
> > For additional commands, e-mail: users-help@maven.apache.org
> >
>
>
> --
> The woman was born in a full-blown thunderstorm. She probably told it
> to be quiet. It probably did. (Robert Jordan, Winter's heart)
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: users-unsubscribe@maven.apache.org
> For additional commands, e-mail: users-help@maven.apache.org
>
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@maven.apache.org
For additional commands, e-mail: users-help@maven.apache.org
Re: Scope of transitive dependencies.
Posted by Jochen Wiedmann <jo...@gmail.com>.
Hi, Tamas,
is that what you are asking for?
Jochen
wi@laptop-jochen-hplx:~/git/github.com/jochenw/jwi-maven-plugins/jwigrv-maven-plugin$
mvn dependency:tree
[INFO] Scanning for projects...
[INFO]
[INFO] --------------------------------------<
com.github.jochenw.jmp:jwigrv-maven-plugin
>--------------------------------------
[INFO] Building JWI Groovy Maven plugin 0.3-SNAPSHOT
[INFO] from pom.xml
[INFO] -----------------------------------------------------[
maven-plugin ]-----------------------------------------------------
[INFO]
[INFO] --- dependency:3.8.1:tree (default-cli) @ jwigrv-maven-plugin ---
[INFO] com.github.jochenw.jmp:jwigrv-maven-plugin:maven-plugin:0.3-SNAPSHOT
[INFO] +- org.apache.maven:maven-core:jar:3.9.9:provided
[INFO] | +- org.apache.maven:maven-model:jar:3.9.9:compile
[INFO] | +- org.apache.maven:maven-settings:jar:3.9.9:compile
[INFO] | +- org.apache.maven:maven-settings-builder:jar:3.9.9:compile
[INFO] | | \- org.codehaus.plexus:plexus-sec-dispatcher:jar:2.0:compile
[INFO] | | \- org.codehaus.plexus:plexus-cipher:jar:2.0:compile
[INFO] | +- org.apache.maven:maven-builder-support:jar:3.9.9:compile
[INFO] | +- org.apache.maven:maven-repository-metadata:jar:3.9.9:compile
[INFO] | +- org.apache.maven:maven-artifact:jar:3.9.9:compile
[INFO] | +- org.apache.maven:maven-model-builder:jar:3.9.9:compile
[INFO] | +- org.apache.maven:maven-resolver-provider:jar:3.9.9:compile
[INFO] | +- org.apache.maven.resolver:maven-resolver-impl:jar:1.9.22:compile
[INFO] | | \-
org.apache.maven.resolver:maven-resolver-named-locks:jar:1.9.22:compile
[INFO] | +- org.apache.maven.resolver:maven-resolver-api:jar:1.9.22:compile
[INFO] | +- org.apache.maven.resolver:maven-resolver-spi:jar:1.9.22:compile
[INFO] | +- org.apache.maven.resolver:maven-resolver-util:jar:1.9.22:compile
[INFO] | +- org.apache.maven.shared:maven-shared-utils:jar:3.4.2:provided
[INFO] | +- org.eclipse.sisu:org.eclipse.sisu.plexus:jar:0.9.0.M3:compile
[INFO] | | \- org.codehaus.plexus:plexus-xml:jar:3.0.1:compile
[INFO] | +- org.eclipse.sisu:org.eclipse.sisu.inject:jar:0.9.0.M3:compile
[INFO] | +- com.google.inject:guice:jar:5.1.0:provided
[INFO] | | \- aopalliance:aopalliance:jar:1.0:provided
[INFO] | +- com.google.guava:guava:jar:33.2.1-jre:provided
[INFO] | +- com.google.guava:failureaccess:jar:1.0.2:provided
[INFO] | +- javax.inject:javax.inject:jar:1:compile
[INFO] | +- org.codehaus.plexus:plexus-utils:jar:3.5.1:compile
[INFO] | +- org.codehaus.plexus:plexus-classworlds:jar:2.8.0:compile
[INFO] | +- org.codehaus.plexus:plexus-interpolation:jar:1.27:compile
[INFO] | +- org.codehaus.plexus:plexus-component-annotations:jar:2.1.0:compile
[INFO] | \- org.slf4j:slf4j-api:jar:1.7.36:compile
[INFO] +- org.apache.maven:maven-plugin-api:jar:3.9.9:provided
[INFO] +- org.apache.maven.plugin-tools:maven-plugin-annotations:jar:3.9.0:provided
[INFO] +- org.apache.groovy:groovy:jar:4.0.24:compile
[INFO] +- org.apache.maven.plugin-testing:maven-plugin-testing-harness:jar:3.3.0:test
[INFO] | +- commons-io:commons-io:jar:2.2:test
[INFO] | \- org.codehaus.plexus:plexus-archiver:jar:2.2:test
[INFO] | +-
org.codehaus.plexus:plexus-container-default:jar:1.0-alpha-9-stable-1:test
[INFO] | | +- junit:junit:jar:4.11:provided
[INFO] | | | \- org.hamcrest:hamcrest-core:jar:1.3:provided
[INFO] | | \- classworlds:classworlds:jar:1.1-alpha-2:test
[INFO] | \- org.codehaus.plexus:plexus-io:jar:2.0.4:test
[INFO] +- org.junit.jupiter:junit-jupiter-engine:jar:5.11.3:test
[INFO] | +- org.junit.platform:junit-platform-engine:jar:1.11.3:test
[INFO] | | +- org.opentest4j:opentest4j:jar:1.3.0:test
[INFO] | | \- org.junit.platform:junit-platform-commons:jar:1.11.3:test
[INFO] | +- org.junit.jupiter:junit-jupiter-api:jar:5.11.3:test
[INFO] | \- org.apiguardian:apiguardian-api:jar:1.1.2:test
[INFO] \- org.apache.maven:maven-compat:jar:3.9.9:compile
[INFO] \- org.apache.maven.wagon:wagon-provider-api:jar:3.5.3:compile
On Thu, Dec 5, 2024 at 5:33 PM Tamás Cservenák <ta...@cservenak.net> wrote:
>
> And... Can you tell us how these dependencies come into play?
>
> Can you paste the (in color or in bw -- for Manfred) output of the
> tree command?
>
> Thanks
> T
>
> On Thu, Dec 5, 2024 at 2:41 PM Jochen Wiedmann
> <jo...@gmail.com> wrote:
> >
> > On Wed, Dec 4, 2024 at 10:10 PM Slawomir Jaranowski
> > <s....@gmail.com> wrote:
> >
> > > It can be transitive dependencies from other dependencies in compile scope.
> > >
> > > look at output of dependency:tree
> >
> > I did, and it they are not.
> >
> > Jochen
> >
> > > On Wed, 4 Dec 2024 at 21:11, Jochen Wiedmann <jo...@gmail.com> wrote:
> > > >
> > > > Hi,
> > > >
> > > > a Maven plugin of mine has the following dependency:
> > > >
> > > > <dependency>
> > > > <groupId>org.apache.maven</groupId>
> > > > <artifactId>maven-core</artifactId>
> > > > <version>3.9.9</version>
> > > > <scope>provided</scope>
> > > > </dependency>
> > > >
> > > > As you can see. the dependency has scope "provided". Now upon building
> > > > the plugin I get the warning below. As fars as I can tell, these are
> > > > transitive dependencies of the Maven core. Now, I am wondering how to
> > > > get rid of these warnings. The only idea, that comes to mind, would be
> > > > to declare all of these as explicit dependencies with scope
> > > > "provided". but doesn't sound good.
> > > >
> > > > Are there any better ideas?
> > > >
> > > > Thanks,
> > > >
> > > > Jochen
> > > >
> > > >
> > > > [WARNING]
> > > >
> > > > Some dependencies of Maven Plugins are expected to be in provided scope.
> > > > Please make sure that dependencies listed below declared in POM
> > > > have set '<scope>provided</scope>' as well.
> > > >
> > > > The following dependencies are in wrong scope:
> > > > * org.apache.maven:maven-model:jar:3.9.9:compile
> > > > * org.apache.maven:maven-settings:jar:3.9.9:compile
> > > > * org.apache.maven:maven-settings-builder:jar:3.9.9:compile
> > > > * org.apache.maven:maven-builder-support:jar:3.9.9:compile
> > > > * org.apache.maven:maven-repository-metadata:jar:3.9.9:compile
> > > > * org.apache.maven:maven-artifact:jar:3.9.9:compile
> > > > * org.apache.maven:maven-model-builder:jar:3.9.9:compile
> > > > * org.apache.maven:maven-resolver-provider:jar:3.9.9:compile
> > > > * org.apache.maven:maven-compat:jar:3.9.9:compile
> > > >
> > > >
> > > > --
> > > > The woman was born in a full-blown thunderstorm. She probably told it
> > > > to be quiet. It probably did. (Robert Jordan, Winter's heart)
> > > >
> > > > ---------------------------------------------------------------------
> > > > To unsubscribe, e-mail: users-unsubscribe@maven.apache.org
> > > > For additional commands, e-mail: users-help@maven.apache.org
> > > >
> > >
> > >
> > > --
> > > Sławomir Jaranowski
> > >
> > > ---------------------------------------------------------------------
> > > To unsubscribe, e-mail: users-unsubscribe@maven.apache.org
> > > For additional commands, e-mail: users-help@maven.apache.org
> > >
> >
> >
> > --
> > The woman was born in a full-blown thunderstorm. She probably told it
> > to be quiet. It probably did. (Robert Jordan, Winter's heart)
> >
> > ---------------------------------------------------------------------
> > To unsubscribe, e-mail: users-unsubscribe@maven.apache.org
> > For additional commands, e-mail: users-help@maven.apache.org
> >
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: users-unsubscribe@maven.apache.org
> For additional commands, e-mail: users-help@maven.apache.org
>
--
The woman was born in a full-blown thunderstorm. She probably told it
to be quiet. It probably did. (Robert Jordan, Winter's heart)
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@maven.apache.org
For additional commands, e-mail: users-help@maven.apache.org
Re: Scope of transitive dependencies.
Posted by Hans Aikema <ha...@aikebah.net.INVALID>.
> On 5 Dec 2024, at 20:48, Tamás Cservenák <ta...@cservenak.net> wrote:
>
> Culprit is here
> https://gist.github.com/cstamas/de07501f64597343e3e9030b36450ad6#file-gistfile1-txt-L244
>
> Also, that library should be tossed away:
> https://cwiki.apache.org/confluence/display/MAVEN/Maven+Ecosystem+Cleanup#MavenEcosystemCleanup-MavenArtifactTransfer
Yeah, already spotted those before and made a mental note to dive deeper into how to fulfull the ODC needs without using the maven-artifact-transfer library
The verbose tree of the toolbox plugin is indeed a nice tool to add to my maven toolbox
>
> On Thu, Dec 5, 2024 at 8:47 PM Tamás Cservenák <ta...@cservenak.net> wrote:
>>
>> Sorry, we are juggling with two plugins, so the verbose tree for
>> dependency check is:
>> https://gist.github.com/cstamas/de07501f64597343e3e9030b36450ad6
>>
>>
>> On Thu, Dec 5, 2024 at 8:41 PM Hans Aikema
>> <ha...@aikebah.net.invalid> wrote:
>>>
>>>
>>>
>>>> On 5 Dec 2024, at 19:03, Tamás Cservenák <ta...@cservenak.net> wrote:
>>>>
>>>> Howdy,
>>>>
>>>> ok, color or not :) here are the paths in tree that leads to maven artifacts:
>>>> https://gist.github.com/cstamas/697999008c0b8b2968c97cd327ec752b
>>>>
>>>> Thanks
>>>> T
>>>
>>> The thing is: all the paths listed in your result as leading up to compile-scoped maven artifacts are dependencies that are explicitly declared provided in the pom-file of the plugin
>>>
>>> [INFO] Paths found in project org.owasp:dependency-check-maven:jar:11.1.2-SNAPSHOT
>>> [INFO] -> org.owasp:dependency-check-maven:jar:11.1.2-SNAPSHOT
>>> [INFO] -> org.apache.maven:maven-plugin-api:jar:3.6.3
>>> https://github.com/jeremylong/DependencyCheck/blob/main/maven/pom.xml#L120-L123
>>>
>>> [INFO] -> org.owasp:dependency-check-maven:jar:11.1.2-SNAPSHOT
>>> [INFO] -> org.apache.maven:maven-settings:jar:3.6.3
>>> https://github.com/jeremylong/DependencyCheck/blob/main/maven/pom.xml#L124-L128
>>>
>>> [INFO] -> org.owasp:dependency-check-maven:jar:11.1.2-SNAPSHOT
>>> [INFO] -> org.apache.maven:maven-core:jar:3.6.3
>>>
>>> https://github.com/jeremylong/DependencyCheck/blob/main/maven/pom.xml#L129-L133
>>>
>>>
>>> [INFO] -> org.owasp:dependency-check-maven:jar:11.1.2-SNAPSHOT
>>> [INFO] -> org.apache.maven:maven-model:jar:3.6.3
>>>
>>> https://github.com/jeremylong/DependencyCheck/blob/main/maven/pom.xml#L172-L176
>>>
>>>
>>> [INFO] -> org.owasp:dependency-check-maven:jar:11.1.2-SNAPSHOT
>>> [INFO] -> org.apache.maven:maven-artifact:jar:3.6.3
>>>
>>> https://github.com/jeremylong/DependencyCheck/blob/main/maven/pom.xml#L177-L181
>>>
>>>
>>>>
>>>> On Thu, Dec 5, 2024 at 6:02 PM Hans Aikema
>>>> <ha...@aikebah.net.invalid> wrote:
>>>>>
>>>>>
>>>>>
>>>>>> On 5 Dec 2024, at 17:30, Tamás Cservenák <ta...@cservenak.net> wrote:
>>>>>>
>>>>>> And... Can you tell us how these dependencies come into play?
>>>>>>
>>>>>> Can you paste the (in color or in bw -- for Manfred) output of the
>>>>>> tree command?
>>>>>>
>>>>>> Thanks
>>>>>> T
>>>>>
>>>>> Tamás, I’ve observed the same in Owasp Dependency Check maven plugin (though nowadays only for libraries that the plugin-plugin does not complain about as the items getting complained about have been explicitly added to the pom.xml to make them provided scoped)… a single example from that to reduce the noice of a large dependency tree:
>>>>>
>>>>> aikebah@rajah maven % mvn dependency:tree -Dincludes=org.apache.maven.resolver:maven-resolver-api
>>>>> [INFO] Scanning for projects...
>>>>> [INFO] Inspecting build with total of 1 modules...
>>>>> [INFO] Installing Nexus Staging features:
>>>>> [INFO] ... total of 1 executions of maven-deploy-plugin replaced with nexus-staging-maven-plugin
>>>>> [INFO]
>>>>> [INFO] ------------------< org.owasp:dependency-check-maven >------------------
>>>>> [INFO] Building Dependency-Check Maven Plugin 11.1.1-SNAPSHOT
>>>>> [INFO] from pom.xml
>>>>> [INFO] ----------------------------[ maven-plugin ]----------------------------
>>>>> [INFO]
>>>>> [INFO] --- dependency:3.8.1:tree (default-cli) @ dependency-check-maven ---
>>>>> [INFO] org.owasp:dependency-check-maven:maven-plugin:11.1.1-SNAPSHOT
>>>>> [INFO] \- org.apache.maven:maven-core:jar:3.6.3:provided
>>>>> [INFO] \- org.apache.maven.resolver:maven-resolver-api:jar:1.4.1:compile
>>>>> [INFO] ------------------------------------------------------------------------
>>>>> [INFO] BUILD SUCCESS
>>>>> [INFO] ------------------------------------------------------------------------
>>>>> [INFO] Total time: 1.625 s
>>>>> [INFO] Finished at: 2024-12-05T17:44:26+01:00
>>>>> [INFO] ------------------------------------------------------------------------
>>>>>
>>>>> Maven does not give me any reason in the depedency-tree why the resolver API would be compile-scoped.
>>>>>
>>>>> A a sidenote: your colorized toolbox command does not list it as a dependency (but then again, it appears to skip all provided deps, it’s not even listing maven-core as a dependency.
>>>>>
>>>>>
>>>>>>
>>>>>> On Thu, Dec 5, 2024 at 2:41 PM Jochen Wiedmann
>>>>>> <jo...@gmail.com> wrote:
>>>>>>>
>>>>>>> On Wed, Dec 4, 2024 at 10:10 PM Slawomir Jaranowski
>>>>>>> <s....@gmail.com> wrote:
>>>>>>>
>>>>>>>> It can be transitive dependencies from other dependencies in compile scope.
>>>>>>>>
>>>>>>>> look at output of dependency:tree
>>>>>>>
>>>>>>> I did, and it they are not.
>>>>>>>
>>>>>>> Jochen
>>>>>>>
>>>>>>>> On Wed, 4 Dec 2024 at 21:11, Jochen Wiedmann <jo...@gmail.com> wrote:
>>>>>>>>>
>>>>>>>>> Hi,
>>>>>>>>>
>>>>>>>>> a Maven plugin of mine has the following dependency:
>>>>>>>>>
>>>>>>>>> <dependency>
>>>>>>>>> <groupId>org.apache.maven</groupId>
>>>>>>>>> <artifactId>maven-core</artifactId>
>>>>>>>>> <version>3.9.9</version>
>>>>>>>>> <scope>provided</scope>
>>>>>>>>> </dependency>
>>>>>>>>>
>>>>>>>>> As you can see. the dependency has scope "provided". Now upon building
>>>>>>>>> the plugin I get the warning below. As fars as I can tell, these are
>>>>>>>>> transitive dependencies of the Maven core. Now, I am wondering how to
>>>>>>>>> get rid of these warnings. The only idea, that comes to mind, would be
>>>>>>>>> to declare all of these as explicit dependencies with scope
>>>>>>>>> "provided". but doesn't sound good.
>>>>>>>>>
>>>>>>>>> Are there any better ideas?
>>>>>>>>>
>>>>>>>>> Thanks,
>>>>>>>>>
>>>>>>>>> Jochen
>>>>>>>>>
>>>>>>>>>
>>>>>>>>> [WARNING]
>>>>>>>>>
>>>>>>>>> Some dependencies of Maven Plugins are expected to be in provided scope.
>>>>>>>>> Please make sure that dependencies listed below declared in POM
>>>>>>>>> have set '<scope>provided</scope>' as well.
>>>>>>>>>
>>>>>>>>> The following dependencies are in wrong scope:
>>>>>>>>> * org.apache.maven:maven-model:jar:3.9.9:compile
>>>>>>>>> * org.apache.maven:maven-settings:jar:3.9.9:compile
>>>>>>>>> * org.apache.maven:maven-settings-builder:jar:3.9.9:compile
>>>>>>>>> * org.apache.maven:maven-builder-support:jar:3.9.9:compile
>>>>>>>>> * org.apache.maven:maven-repository-metadata:jar:3.9.9:compile
>>>>>>>>> * org.apache.maven:maven-artifact:jar:3.9.9:compile
>>>>>>>>> * org.apache.maven:maven-model-builder:jar:3.9.9:compile
>>>>>>>>> * org.apache.maven:maven-resolver-provider:jar:3.9.9:compile
>>>>>>>>> * org.apache.maven:maven-compat:jar:3.9.9:compile
>>>>>>>>>
>>>>>>>>>
>>>>>>>>> --
>>>>>>>>> The woman was born in a full-blown thunderstorm. She probably told it
>>>>>>>>> to be quiet. It probably did. (Robert Jordan, Winter's heart)
>>>>>>>>>
>>>>>>>>> ---------------------------------------------------------------------
>>>>>>>>> To unsubscribe, e-mail: users-unsubscribe@maven.apache.org
>>>>>>>>> For additional commands, e-mail: users-help@maven.apache.org
>>>>>>>>>
>>>>>>>>
>>>>>>>>
>>>>>>>> --
>>>>>>>> Sławomir Jaranowski
>>>>>>>>
>>>>>>>> ---------------------------------------------------------------------
>>>>>>>> To unsubscribe, e-mail: users-unsubscribe@maven.apache.org
>>>>>>>> For additional commands, e-mail: users-help@maven.apache.org
>>>>>>>>
>>>>>>>
>>>>>>>
>>>>>>> --
>>>>>>> The woman was born in a full-blown thunderstorm. She probably told it
>>>>>>> to be quiet. It probably did. (Robert Jordan, Winter's heart)
>>>>>>>
>>>>>>> ---------------------------------------------------------------------
>>>>>>> To unsubscribe, e-mail: users-unsubscribe@maven.apache.org
>>>>>>> For additional commands, e-mail: users-help@maven.apache.org
>>>>>>>
>>>>>>
>>>>>> ---------------------------------------------------------------------
>>>>>> To unsubscribe, e-mail: users-unsubscribe@maven.apache.org
>>>>>> For additional commands, e-mail: users-help@maven.apache.org
>>>>>>
>>>>>
>>>>
>>>> ---------------------------------------------------------------------
>>>> To unsubscribe, e-mail: users-unsubscribe@maven.apache.org
>>>> For additional commands, e-mail: users-help@maven.apache.org
>>>>
>>>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: users-unsubscribe@maven.apache.org
> For additional commands, e-mail: users-help@maven.apache.org
>
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@maven.apache.org
For additional commands, e-mail: users-help@maven.apache.org
Re: Scope of transitive dependencies.
Posted by Tamás Cservenák <ta...@cservenak.net>.
Culprit is here
https://gist.github.com/cstamas/de07501f64597343e3e9030b36450ad6#file-gistfile1-txt-L244
Also, that library should be tossed away:
https://cwiki.apache.org/confluence/display/MAVEN/Maven+Ecosystem+Cleanup#MavenEcosystemCleanup-MavenArtifactTransfer
On Thu, Dec 5, 2024 at 8:47 PM Tamás Cservenák <ta...@cservenak.net> wrote:
>
> Sorry, we are juggling with two plugins, so the verbose tree for
> dependency check is:
> https://gist.github.com/cstamas/de07501f64597343e3e9030b36450ad6
>
>
> On Thu, Dec 5, 2024 at 8:41 PM Hans Aikema
> <ha...@aikebah.net.invalid> wrote:
> >
> >
> >
> > > On 5 Dec 2024, at 19:03, Tamás Cservenák <ta...@cservenak.net> wrote:
> > >
> > > Howdy,
> > >
> > > ok, color or not :) here are the paths in tree that leads to maven artifacts:
> > > https://gist.github.com/cstamas/697999008c0b8b2968c97cd327ec752b
> > >
> > > Thanks
> > > T
> >
> > The thing is: all the paths listed in your result as leading up to compile-scoped maven artifacts are dependencies that are explicitly declared provided in the pom-file of the plugin
> >
> > [INFO] Paths found in project org.owasp:dependency-check-maven:jar:11.1.2-SNAPSHOT
> > [INFO] -> org.owasp:dependency-check-maven:jar:11.1.2-SNAPSHOT
> > [INFO] -> org.apache.maven:maven-plugin-api:jar:3.6.3
> > https://github.com/jeremylong/DependencyCheck/blob/main/maven/pom.xml#L120-L123
> >
> > [INFO] -> org.owasp:dependency-check-maven:jar:11.1.2-SNAPSHOT
> > [INFO] -> org.apache.maven:maven-settings:jar:3.6.3
> > https://github.com/jeremylong/DependencyCheck/blob/main/maven/pom.xml#L124-L128
> >
> > [INFO] -> org.owasp:dependency-check-maven:jar:11.1.2-SNAPSHOT
> > [INFO] -> org.apache.maven:maven-core:jar:3.6.3
> >
> > https://github.com/jeremylong/DependencyCheck/blob/main/maven/pom.xml#L129-L133
> >
> >
> > [INFO] -> org.owasp:dependency-check-maven:jar:11.1.2-SNAPSHOT
> > [INFO] -> org.apache.maven:maven-model:jar:3.6.3
> >
> > https://github.com/jeremylong/DependencyCheck/blob/main/maven/pom.xml#L172-L176
> >
> >
> > [INFO] -> org.owasp:dependency-check-maven:jar:11.1.2-SNAPSHOT
> > [INFO] -> org.apache.maven:maven-artifact:jar:3.6.3
> >
> > https://github.com/jeremylong/DependencyCheck/blob/main/maven/pom.xml#L177-L181
> >
> >
> > >
> > > On Thu, Dec 5, 2024 at 6:02 PM Hans Aikema
> > > <ha...@aikebah.net.invalid> wrote:
> > >>
> > >>
> > >>
> > >>> On 5 Dec 2024, at 17:30, Tamás Cservenák <ta...@cservenak.net> wrote:
> > >>>
> > >>> And... Can you tell us how these dependencies come into play?
> > >>>
> > >>> Can you paste the (in color or in bw -- for Manfred) output of the
> > >>> tree command?
> > >>>
> > >>> Thanks
> > >>> T
> > >>
> > >> Tamás, I’ve observed the same in Owasp Dependency Check maven plugin (though nowadays only for libraries that the plugin-plugin does not complain about as the items getting complained about have been explicitly added to the pom.xml to make them provided scoped)… a single example from that to reduce the noice of a large dependency tree:
> > >>
> > >> aikebah@rajah maven % mvn dependency:tree -Dincludes=org.apache.maven.resolver:maven-resolver-api
> > >> [INFO] Scanning for projects...
> > >> [INFO] Inspecting build with total of 1 modules...
> > >> [INFO] Installing Nexus Staging features:
> > >> [INFO] ... total of 1 executions of maven-deploy-plugin replaced with nexus-staging-maven-plugin
> > >> [INFO]
> > >> [INFO] ------------------< org.owasp:dependency-check-maven >------------------
> > >> [INFO] Building Dependency-Check Maven Plugin 11.1.1-SNAPSHOT
> > >> [INFO] from pom.xml
> > >> [INFO] ----------------------------[ maven-plugin ]----------------------------
> > >> [INFO]
> > >> [INFO] --- dependency:3.8.1:tree (default-cli) @ dependency-check-maven ---
> > >> [INFO] org.owasp:dependency-check-maven:maven-plugin:11.1.1-SNAPSHOT
> > >> [INFO] \- org.apache.maven:maven-core:jar:3.6.3:provided
> > >> [INFO] \- org.apache.maven.resolver:maven-resolver-api:jar:1.4.1:compile
> > >> [INFO] ------------------------------------------------------------------------
> > >> [INFO] BUILD SUCCESS
> > >> [INFO] ------------------------------------------------------------------------
> > >> [INFO] Total time: 1.625 s
> > >> [INFO] Finished at: 2024-12-05T17:44:26+01:00
> > >> [INFO] ------------------------------------------------------------------------
> > >>
> > >> Maven does not give me any reason in the depedency-tree why the resolver API would be compile-scoped.
> > >>
> > >> A a sidenote: your colorized toolbox command does not list it as a dependency (but then again, it appears to skip all provided deps, it’s not even listing maven-core as a dependency.
> > >>
> > >>
> > >>>
> > >>> On Thu, Dec 5, 2024 at 2:41 PM Jochen Wiedmann
> > >>> <jo...@gmail.com> wrote:
> > >>>>
> > >>>> On Wed, Dec 4, 2024 at 10:10 PM Slawomir Jaranowski
> > >>>> <s....@gmail.com> wrote:
> > >>>>
> > >>>>> It can be transitive dependencies from other dependencies in compile scope.
> > >>>>>
> > >>>>> look at output of dependency:tree
> > >>>>
> > >>>> I did, and it they are not.
> > >>>>
> > >>>> Jochen
> > >>>>
> > >>>>> On Wed, 4 Dec 2024 at 21:11, Jochen Wiedmann <jo...@gmail.com> wrote:
> > >>>>>>
> > >>>>>> Hi,
> > >>>>>>
> > >>>>>> a Maven plugin of mine has the following dependency:
> > >>>>>>
> > >>>>>> <dependency>
> > >>>>>> <groupId>org.apache.maven</groupId>
> > >>>>>> <artifactId>maven-core</artifactId>
> > >>>>>> <version>3.9.9</version>
> > >>>>>> <scope>provided</scope>
> > >>>>>> </dependency>
> > >>>>>>
> > >>>>>> As you can see. the dependency has scope "provided". Now upon building
> > >>>>>> the plugin I get the warning below. As fars as I can tell, these are
> > >>>>>> transitive dependencies of the Maven core. Now, I am wondering how to
> > >>>>>> get rid of these warnings. The only idea, that comes to mind, would be
> > >>>>>> to declare all of these as explicit dependencies with scope
> > >>>>>> "provided". but doesn't sound good.
> > >>>>>>
> > >>>>>> Are there any better ideas?
> > >>>>>>
> > >>>>>> Thanks,
> > >>>>>>
> > >>>>>> Jochen
> > >>>>>>
> > >>>>>>
> > >>>>>> [WARNING]
> > >>>>>>
> > >>>>>> Some dependencies of Maven Plugins are expected to be in provided scope.
> > >>>>>> Please make sure that dependencies listed below declared in POM
> > >>>>>> have set '<scope>provided</scope>' as well.
> > >>>>>>
> > >>>>>> The following dependencies are in wrong scope:
> > >>>>>> * org.apache.maven:maven-model:jar:3.9.9:compile
> > >>>>>> * org.apache.maven:maven-settings:jar:3.9.9:compile
> > >>>>>> * org.apache.maven:maven-settings-builder:jar:3.9.9:compile
> > >>>>>> * org.apache.maven:maven-builder-support:jar:3.9.9:compile
> > >>>>>> * org.apache.maven:maven-repository-metadata:jar:3.9.9:compile
> > >>>>>> * org.apache.maven:maven-artifact:jar:3.9.9:compile
> > >>>>>> * org.apache.maven:maven-model-builder:jar:3.9.9:compile
> > >>>>>> * org.apache.maven:maven-resolver-provider:jar:3.9.9:compile
> > >>>>>> * org.apache.maven:maven-compat:jar:3.9.9:compile
> > >>>>>>
> > >>>>>>
> > >>>>>> --
> > >>>>>> The woman was born in a full-blown thunderstorm. She probably told it
> > >>>>>> to be quiet. It probably did. (Robert Jordan, Winter's heart)
> > >>>>>>
> > >>>>>> ---------------------------------------------------------------------
> > >>>>>> To unsubscribe, e-mail: users-unsubscribe@maven.apache.org
> > >>>>>> For additional commands, e-mail: users-help@maven.apache.org
> > >>>>>>
> > >>>>>
> > >>>>>
> > >>>>> --
> > >>>>> Sławomir Jaranowski
> > >>>>>
> > >>>>> ---------------------------------------------------------------------
> > >>>>> To unsubscribe, e-mail: users-unsubscribe@maven.apache.org
> > >>>>> For additional commands, e-mail: users-help@maven.apache.org
> > >>>>>
> > >>>>
> > >>>>
> > >>>> --
> > >>>> The woman was born in a full-blown thunderstorm. She probably told it
> > >>>> to be quiet. It probably did. (Robert Jordan, Winter's heart)
> > >>>>
> > >>>> ---------------------------------------------------------------------
> > >>>> To unsubscribe, e-mail: users-unsubscribe@maven.apache.org
> > >>>> For additional commands, e-mail: users-help@maven.apache.org
> > >>>>
> > >>>
> > >>> ---------------------------------------------------------------------
> > >>> To unsubscribe, e-mail: users-unsubscribe@maven.apache.org
> > >>> For additional commands, e-mail: users-help@maven.apache.org
> > >>>
> > >>
> > >
> > > ---------------------------------------------------------------------
> > > To unsubscribe, e-mail: users-unsubscribe@maven.apache.org
> > > For additional commands, e-mail: users-help@maven.apache.org
> > >
> >
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@maven.apache.org
For additional commands, e-mail: users-help@maven.apache.org
Re: Scope of transitive dependencies.
Posted by Tamás Cservenák <ta...@cservenak.net>.
Sorry, we are juggling with two plugins, so the verbose tree for
dependency check is:
https://gist.github.com/cstamas/de07501f64597343e3e9030b36450ad6
On Thu, Dec 5, 2024 at 8:41 PM Hans Aikema
<ha...@aikebah.net.invalid> wrote:
>
>
>
> > On 5 Dec 2024, at 19:03, Tamás Cservenák <ta...@cservenak.net> wrote:
> >
> > Howdy,
> >
> > ok, color or not :) here are the paths in tree that leads to maven artifacts:
> > https://gist.github.com/cstamas/697999008c0b8b2968c97cd327ec752b
> >
> > Thanks
> > T
>
> The thing is: all the paths listed in your result as leading up to compile-scoped maven artifacts are dependencies that are explicitly declared provided in the pom-file of the plugin
>
> [INFO] Paths found in project org.owasp:dependency-check-maven:jar:11.1.2-SNAPSHOT
> [INFO] -> org.owasp:dependency-check-maven:jar:11.1.2-SNAPSHOT
> [INFO] -> org.apache.maven:maven-plugin-api:jar:3.6.3
> https://github.com/jeremylong/DependencyCheck/blob/main/maven/pom.xml#L120-L123
>
> [INFO] -> org.owasp:dependency-check-maven:jar:11.1.2-SNAPSHOT
> [INFO] -> org.apache.maven:maven-settings:jar:3.6.3
> https://github.com/jeremylong/DependencyCheck/blob/main/maven/pom.xml#L124-L128
>
> [INFO] -> org.owasp:dependency-check-maven:jar:11.1.2-SNAPSHOT
> [INFO] -> org.apache.maven:maven-core:jar:3.6.3
>
> https://github.com/jeremylong/DependencyCheck/blob/main/maven/pom.xml#L129-L133
>
>
> [INFO] -> org.owasp:dependency-check-maven:jar:11.1.2-SNAPSHOT
> [INFO] -> org.apache.maven:maven-model:jar:3.6.3
>
> https://github.com/jeremylong/DependencyCheck/blob/main/maven/pom.xml#L172-L176
>
>
> [INFO] -> org.owasp:dependency-check-maven:jar:11.1.2-SNAPSHOT
> [INFO] -> org.apache.maven:maven-artifact:jar:3.6.3
>
> https://github.com/jeremylong/DependencyCheck/blob/main/maven/pom.xml#L177-L181
>
>
> >
> > On Thu, Dec 5, 2024 at 6:02 PM Hans Aikema
> > <ha...@aikebah.net.invalid> wrote:
> >>
> >>
> >>
> >>> On 5 Dec 2024, at 17:30, Tamás Cservenák <ta...@cservenak.net> wrote:
> >>>
> >>> And... Can you tell us how these dependencies come into play?
> >>>
> >>> Can you paste the (in color or in bw -- for Manfred) output of the
> >>> tree command?
> >>>
> >>> Thanks
> >>> T
> >>
> >> Tamás, I’ve observed the same in Owasp Dependency Check maven plugin (though nowadays only for libraries that the plugin-plugin does not complain about as the items getting complained about have been explicitly added to the pom.xml to make them provided scoped)… a single example from that to reduce the noice of a large dependency tree:
> >>
> >> aikebah@rajah maven % mvn dependency:tree -Dincludes=org.apache.maven.resolver:maven-resolver-api
> >> [INFO] Scanning for projects...
> >> [INFO] Inspecting build with total of 1 modules...
> >> [INFO] Installing Nexus Staging features:
> >> [INFO] ... total of 1 executions of maven-deploy-plugin replaced with nexus-staging-maven-plugin
> >> [INFO]
> >> [INFO] ------------------< org.owasp:dependency-check-maven >------------------
> >> [INFO] Building Dependency-Check Maven Plugin 11.1.1-SNAPSHOT
> >> [INFO] from pom.xml
> >> [INFO] ----------------------------[ maven-plugin ]----------------------------
> >> [INFO]
> >> [INFO] --- dependency:3.8.1:tree (default-cli) @ dependency-check-maven ---
> >> [INFO] org.owasp:dependency-check-maven:maven-plugin:11.1.1-SNAPSHOT
> >> [INFO] \- org.apache.maven:maven-core:jar:3.6.3:provided
> >> [INFO] \- org.apache.maven.resolver:maven-resolver-api:jar:1.4.1:compile
> >> [INFO] ------------------------------------------------------------------------
> >> [INFO] BUILD SUCCESS
> >> [INFO] ------------------------------------------------------------------------
> >> [INFO] Total time: 1.625 s
> >> [INFO] Finished at: 2024-12-05T17:44:26+01:00
> >> [INFO] ------------------------------------------------------------------------
> >>
> >> Maven does not give me any reason in the depedency-tree why the resolver API would be compile-scoped.
> >>
> >> A a sidenote: your colorized toolbox command does not list it as a dependency (but then again, it appears to skip all provided deps, it’s not even listing maven-core as a dependency.
> >>
> >>
> >>>
> >>> On Thu, Dec 5, 2024 at 2:41 PM Jochen Wiedmann
> >>> <jo...@gmail.com> wrote:
> >>>>
> >>>> On Wed, Dec 4, 2024 at 10:10 PM Slawomir Jaranowski
> >>>> <s....@gmail.com> wrote:
> >>>>
> >>>>> It can be transitive dependencies from other dependencies in compile scope.
> >>>>>
> >>>>> look at output of dependency:tree
> >>>>
> >>>> I did, and it they are not.
> >>>>
> >>>> Jochen
> >>>>
> >>>>> On Wed, 4 Dec 2024 at 21:11, Jochen Wiedmann <jo...@gmail.com> wrote:
> >>>>>>
> >>>>>> Hi,
> >>>>>>
> >>>>>> a Maven plugin of mine has the following dependency:
> >>>>>>
> >>>>>> <dependency>
> >>>>>> <groupId>org.apache.maven</groupId>
> >>>>>> <artifactId>maven-core</artifactId>
> >>>>>> <version>3.9.9</version>
> >>>>>> <scope>provided</scope>
> >>>>>> </dependency>
> >>>>>>
> >>>>>> As you can see. the dependency has scope "provided". Now upon building
> >>>>>> the plugin I get the warning below. As fars as I can tell, these are
> >>>>>> transitive dependencies of the Maven core. Now, I am wondering how to
> >>>>>> get rid of these warnings. The only idea, that comes to mind, would be
> >>>>>> to declare all of these as explicit dependencies with scope
> >>>>>> "provided". but doesn't sound good.
> >>>>>>
> >>>>>> Are there any better ideas?
> >>>>>>
> >>>>>> Thanks,
> >>>>>>
> >>>>>> Jochen
> >>>>>>
> >>>>>>
> >>>>>> [WARNING]
> >>>>>>
> >>>>>> Some dependencies of Maven Plugins are expected to be in provided scope.
> >>>>>> Please make sure that dependencies listed below declared in POM
> >>>>>> have set '<scope>provided</scope>' as well.
> >>>>>>
> >>>>>> The following dependencies are in wrong scope:
> >>>>>> * org.apache.maven:maven-model:jar:3.9.9:compile
> >>>>>> * org.apache.maven:maven-settings:jar:3.9.9:compile
> >>>>>> * org.apache.maven:maven-settings-builder:jar:3.9.9:compile
> >>>>>> * org.apache.maven:maven-builder-support:jar:3.9.9:compile
> >>>>>> * org.apache.maven:maven-repository-metadata:jar:3.9.9:compile
> >>>>>> * org.apache.maven:maven-artifact:jar:3.9.9:compile
> >>>>>> * org.apache.maven:maven-model-builder:jar:3.9.9:compile
> >>>>>> * org.apache.maven:maven-resolver-provider:jar:3.9.9:compile
> >>>>>> * org.apache.maven:maven-compat:jar:3.9.9:compile
> >>>>>>
> >>>>>>
> >>>>>> --
> >>>>>> The woman was born in a full-blown thunderstorm. She probably told it
> >>>>>> to be quiet. It probably did. (Robert Jordan, Winter's heart)
> >>>>>>
> >>>>>> ---------------------------------------------------------------------
> >>>>>> To unsubscribe, e-mail: users-unsubscribe@maven.apache.org
> >>>>>> For additional commands, e-mail: users-help@maven.apache.org
> >>>>>>
> >>>>>
> >>>>>
> >>>>> --
> >>>>> Sławomir Jaranowski
> >>>>>
> >>>>> ---------------------------------------------------------------------
> >>>>> To unsubscribe, e-mail: users-unsubscribe@maven.apache.org
> >>>>> For additional commands, e-mail: users-help@maven.apache.org
> >>>>>
> >>>>
> >>>>
> >>>> --
> >>>> The woman was born in a full-blown thunderstorm. She probably told it
> >>>> to be quiet. It probably did. (Robert Jordan, Winter's heart)
> >>>>
> >>>> ---------------------------------------------------------------------
> >>>> To unsubscribe, e-mail: users-unsubscribe@maven.apache.org
> >>>> For additional commands, e-mail: users-help@maven.apache.org
> >>>>
> >>>
> >>> ---------------------------------------------------------------------
> >>> To unsubscribe, e-mail: users-unsubscribe@maven.apache.org
> >>> For additional commands, e-mail: users-help@maven.apache.org
> >>>
> >>
> >
> > ---------------------------------------------------------------------
> > To unsubscribe, e-mail: users-unsubscribe@maven.apache.org
> > For additional commands, e-mail: users-help@maven.apache.org
> >
>
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@maven.apache.org
For additional commands, e-mail: users-help@maven.apache.org
Re: Scope of transitive dependencies.
Posted by Hans Aikema <ha...@aikebah.net.INVALID>.
> On 5 Dec 2024, at 19:03, Tamás Cservenák <ta...@cservenak.net> wrote:
>
> Howdy,
>
> ok, color or not :) here are the paths in tree that leads to maven artifacts:
> https://gist.github.com/cstamas/697999008c0b8b2968c97cd327ec752b
>
> Thanks
> T
The thing is: all the paths listed in your result as leading up to compile-scoped maven artifacts are dependencies that are explicitly declared provided in the pom-file of the plugin
[INFO] Paths found in project org.owasp:dependency-check-maven:jar:11.1.2-SNAPSHOT
[INFO] -> org.owasp:dependency-check-maven:jar:11.1.2-SNAPSHOT
[INFO] -> org.apache.maven:maven-plugin-api:jar:3.6.3
https://github.com/jeremylong/DependencyCheck/blob/main/maven/pom.xml#L120-L123
[INFO] -> org.owasp:dependency-check-maven:jar:11.1.2-SNAPSHOT
[INFO] -> org.apache.maven:maven-settings:jar:3.6.3
https://github.com/jeremylong/DependencyCheck/blob/main/maven/pom.xml#L124-L128
[INFO] -> org.owasp:dependency-check-maven:jar:11.1.2-SNAPSHOT
[INFO] -> org.apache.maven:maven-core:jar:3.6.3
https://github.com/jeremylong/DependencyCheck/blob/main/maven/pom.xml#L129-L133
[INFO] -> org.owasp:dependency-check-maven:jar:11.1.2-SNAPSHOT
[INFO] -> org.apache.maven:maven-model:jar:3.6.3
https://github.com/jeremylong/DependencyCheck/blob/main/maven/pom.xml#L172-L176
[INFO] -> org.owasp:dependency-check-maven:jar:11.1.2-SNAPSHOT
[INFO] -> org.apache.maven:maven-artifact:jar:3.6.3
https://github.com/jeremylong/DependencyCheck/blob/main/maven/pom.xml#L177-L181
>
> On Thu, Dec 5, 2024 at 6:02 PM Hans Aikema
> <ha...@aikebah.net.invalid> wrote:
>>
>>
>>
>>> On 5 Dec 2024, at 17:30, Tamás Cservenák <ta...@cservenak.net> wrote:
>>>
>>> And... Can you tell us how these dependencies come into play?
>>>
>>> Can you paste the (in color or in bw -- for Manfred) output of the
>>> tree command?
>>>
>>> Thanks
>>> T
>>
>> Tamás, I’ve observed the same in Owasp Dependency Check maven plugin (though nowadays only for libraries that the plugin-plugin does not complain about as the items getting complained about have been explicitly added to the pom.xml to make them provided scoped)… a single example from that to reduce the noice of a large dependency tree:
>>
>> aikebah@rajah maven % mvn dependency:tree -Dincludes=org.apache.maven.resolver:maven-resolver-api
>> [INFO] Scanning for projects...
>> [INFO] Inspecting build with total of 1 modules...
>> [INFO] Installing Nexus Staging features:
>> [INFO] ... total of 1 executions of maven-deploy-plugin replaced with nexus-staging-maven-plugin
>> [INFO]
>> [INFO] ------------------< org.owasp:dependency-check-maven >------------------
>> [INFO] Building Dependency-Check Maven Plugin 11.1.1-SNAPSHOT
>> [INFO] from pom.xml
>> [INFO] ----------------------------[ maven-plugin ]----------------------------
>> [INFO]
>> [INFO] --- dependency:3.8.1:tree (default-cli) @ dependency-check-maven ---
>> [INFO] org.owasp:dependency-check-maven:maven-plugin:11.1.1-SNAPSHOT
>> [INFO] \- org.apache.maven:maven-core:jar:3.6.3:provided
>> [INFO] \- org.apache.maven.resolver:maven-resolver-api:jar:1.4.1:compile
>> [INFO] ------------------------------------------------------------------------
>> [INFO] BUILD SUCCESS
>> [INFO] ------------------------------------------------------------------------
>> [INFO] Total time: 1.625 s
>> [INFO] Finished at: 2024-12-05T17:44:26+01:00
>> [INFO] ------------------------------------------------------------------------
>>
>> Maven does not give me any reason in the depedency-tree why the resolver API would be compile-scoped.
>>
>> A a sidenote: your colorized toolbox command does not list it as a dependency (but then again, it appears to skip all provided deps, it’s not even listing maven-core as a dependency.
>>
>>
>>>
>>> On Thu, Dec 5, 2024 at 2:41 PM Jochen Wiedmann
>>> <jo...@gmail.com> wrote:
>>>>
>>>> On Wed, Dec 4, 2024 at 10:10 PM Slawomir Jaranowski
>>>> <s....@gmail.com> wrote:
>>>>
>>>>> It can be transitive dependencies from other dependencies in compile scope.
>>>>>
>>>>> look at output of dependency:tree
>>>>
>>>> I did, and it they are not.
>>>>
>>>> Jochen
>>>>
>>>>> On Wed, 4 Dec 2024 at 21:11, Jochen Wiedmann <jo...@gmail.com> wrote:
>>>>>>
>>>>>> Hi,
>>>>>>
>>>>>> a Maven plugin of mine has the following dependency:
>>>>>>
>>>>>> <dependency>
>>>>>> <groupId>org.apache.maven</groupId>
>>>>>> <artifactId>maven-core</artifactId>
>>>>>> <version>3.9.9</version>
>>>>>> <scope>provided</scope>
>>>>>> </dependency>
>>>>>>
>>>>>> As you can see. the dependency has scope "provided". Now upon building
>>>>>> the plugin I get the warning below. As fars as I can tell, these are
>>>>>> transitive dependencies of the Maven core. Now, I am wondering how to
>>>>>> get rid of these warnings. The only idea, that comes to mind, would be
>>>>>> to declare all of these as explicit dependencies with scope
>>>>>> "provided". but doesn't sound good.
>>>>>>
>>>>>> Are there any better ideas?
>>>>>>
>>>>>> Thanks,
>>>>>>
>>>>>> Jochen
>>>>>>
>>>>>>
>>>>>> [WARNING]
>>>>>>
>>>>>> Some dependencies of Maven Plugins are expected to be in provided scope.
>>>>>> Please make sure that dependencies listed below declared in POM
>>>>>> have set '<scope>provided</scope>' as well.
>>>>>>
>>>>>> The following dependencies are in wrong scope:
>>>>>> * org.apache.maven:maven-model:jar:3.9.9:compile
>>>>>> * org.apache.maven:maven-settings:jar:3.9.9:compile
>>>>>> * org.apache.maven:maven-settings-builder:jar:3.9.9:compile
>>>>>> * org.apache.maven:maven-builder-support:jar:3.9.9:compile
>>>>>> * org.apache.maven:maven-repository-metadata:jar:3.9.9:compile
>>>>>> * org.apache.maven:maven-artifact:jar:3.9.9:compile
>>>>>> * org.apache.maven:maven-model-builder:jar:3.9.9:compile
>>>>>> * org.apache.maven:maven-resolver-provider:jar:3.9.9:compile
>>>>>> * org.apache.maven:maven-compat:jar:3.9.9:compile
>>>>>>
>>>>>>
>>>>>> --
>>>>>> The woman was born in a full-blown thunderstorm. She probably told it
>>>>>> to be quiet. It probably did. (Robert Jordan, Winter's heart)
>>>>>>
>>>>>> ---------------------------------------------------------------------
>>>>>> To unsubscribe, e-mail: users-unsubscribe@maven.apache.org
>>>>>> For additional commands, e-mail: users-help@maven.apache.org
>>>>>>
>>>>>
>>>>>
>>>>> --
>>>>> Sławomir Jaranowski
>>>>>
>>>>> ---------------------------------------------------------------------
>>>>> To unsubscribe, e-mail: users-unsubscribe@maven.apache.org
>>>>> For additional commands, e-mail: users-help@maven.apache.org
>>>>>
>>>>
>>>>
>>>> --
>>>> The woman was born in a full-blown thunderstorm. She probably told it
>>>> to be quiet. It probably did. (Robert Jordan, Winter's heart)
>>>>
>>>> ---------------------------------------------------------------------
>>>> To unsubscribe, e-mail: users-unsubscribe@maven.apache.org
>>>> For additional commands, e-mail: users-help@maven.apache.org
>>>>
>>>
>>> ---------------------------------------------------------------------
>>> To unsubscribe, e-mail: users-unsubscribe@maven.apache.org
>>> For additional commands, e-mail: users-help@maven.apache.org
>>>
>>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: users-unsubscribe@maven.apache.org
> For additional commands, e-mail: users-help@maven.apache.org
>
Re: Scope of transitive dependencies.
Posted by Tamás Cservenák <ta...@cservenak.net>.
Howdy,
ok, color or not :) here are the paths in tree that leads to maven artifacts:
https://gist.github.com/cstamas/697999008c0b8b2968c97cd327ec752b
Thanks
T
On Thu, Dec 5, 2024 at 6:02 PM Hans Aikema
<ha...@aikebah.net.invalid> wrote:
>
>
>
> > On 5 Dec 2024, at 17:30, Tamás Cservenák <ta...@cservenak.net> wrote:
> >
> > And... Can you tell us how these dependencies come into play?
> >
> > Can you paste the (in color or in bw -- for Manfred) output of the
> > tree command?
> >
> > Thanks
> > T
>
> Tamás, I’ve observed the same in Owasp Dependency Check maven plugin (though nowadays only for libraries that the plugin-plugin does not complain about as the items getting complained about have been explicitly added to the pom.xml to make them provided scoped)… a single example from that to reduce the noice of a large dependency tree:
>
> aikebah@rajah maven % mvn dependency:tree -Dincludes=org.apache.maven.resolver:maven-resolver-api
> [INFO] Scanning for projects...
> [INFO] Inspecting build with total of 1 modules...
> [INFO] Installing Nexus Staging features:
> [INFO] ... total of 1 executions of maven-deploy-plugin replaced with nexus-staging-maven-plugin
> [INFO]
> [INFO] ------------------< org.owasp:dependency-check-maven >------------------
> [INFO] Building Dependency-Check Maven Plugin 11.1.1-SNAPSHOT
> [INFO] from pom.xml
> [INFO] ----------------------------[ maven-plugin ]----------------------------
> [INFO]
> [INFO] --- dependency:3.8.1:tree (default-cli) @ dependency-check-maven ---
> [INFO] org.owasp:dependency-check-maven:maven-plugin:11.1.1-SNAPSHOT
> [INFO] \- org.apache.maven:maven-core:jar:3.6.3:provided
> [INFO] \- org.apache.maven.resolver:maven-resolver-api:jar:1.4.1:compile
> [INFO] ------------------------------------------------------------------------
> [INFO] BUILD SUCCESS
> [INFO] ------------------------------------------------------------------------
> [INFO] Total time: 1.625 s
> [INFO] Finished at: 2024-12-05T17:44:26+01:00
> [INFO] ------------------------------------------------------------------------
>
> Maven does not give me any reason in the depedency-tree why the resolver API would be compile-scoped.
>
> A a sidenote: your colorized toolbox command does not list it as a dependency (but then again, it appears to skip all provided deps, it’s not even listing maven-core as a dependency.
>
>
> >
> > On Thu, Dec 5, 2024 at 2:41 PM Jochen Wiedmann
> > <jo...@gmail.com> wrote:
> >>
> >> On Wed, Dec 4, 2024 at 10:10 PM Slawomir Jaranowski
> >> <s....@gmail.com> wrote:
> >>
> >>> It can be transitive dependencies from other dependencies in compile scope.
> >>>
> >>> look at output of dependency:tree
> >>
> >> I did, and it they are not.
> >>
> >> Jochen
> >>
> >>> On Wed, 4 Dec 2024 at 21:11, Jochen Wiedmann <jo...@gmail.com> wrote:
> >>>>
> >>>> Hi,
> >>>>
> >>>> a Maven plugin of mine has the following dependency:
> >>>>
> >>>> <dependency>
> >>>> <groupId>org.apache.maven</groupId>
> >>>> <artifactId>maven-core</artifactId>
> >>>> <version>3.9.9</version>
> >>>> <scope>provided</scope>
> >>>> </dependency>
> >>>>
> >>>> As you can see. the dependency has scope "provided". Now upon building
> >>>> the plugin I get the warning below. As fars as I can tell, these are
> >>>> transitive dependencies of the Maven core. Now, I am wondering how to
> >>>> get rid of these warnings. The only idea, that comes to mind, would be
> >>>> to declare all of these as explicit dependencies with scope
> >>>> "provided". but doesn't sound good.
> >>>>
> >>>> Are there any better ideas?
> >>>>
> >>>> Thanks,
> >>>>
> >>>> Jochen
> >>>>
> >>>>
> >>>> [WARNING]
> >>>>
> >>>> Some dependencies of Maven Plugins are expected to be in provided scope.
> >>>> Please make sure that dependencies listed below declared in POM
> >>>> have set '<scope>provided</scope>' as well.
> >>>>
> >>>> The following dependencies are in wrong scope:
> >>>> * org.apache.maven:maven-model:jar:3.9.9:compile
> >>>> * org.apache.maven:maven-settings:jar:3.9.9:compile
> >>>> * org.apache.maven:maven-settings-builder:jar:3.9.9:compile
> >>>> * org.apache.maven:maven-builder-support:jar:3.9.9:compile
> >>>> * org.apache.maven:maven-repository-metadata:jar:3.9.9:compile
> >>>> * org.apache.maven:maven-artifact:jar:3.9.9:compile
> >>>> * org.apache.maven:maven-model-builder:jar:3.9.9:compile
> >>>> * org.apache.maven:maven-resolver-provider:jar:3.9.9:compile
> >>>> * org.apache.maven:maven-compat:jar:3.9.9:compile
> >>>>
> >>>>
> >>>> --
> >>>> The woman was born in a full-blown thunderstorm. She probably told it
> >>>> to be quiet. It probably did. (Robert Jordan, Winter's heart)
> >>>>
> >>>> ---------------------------------------------------------------------
> >>>> To unsubscribe, e-mail: users-unsubscribe@maven.apache.org
> >>>> For additional commands, e-mail: users-help@maven.apache.org
> >>>>
> >>>
> >>>
> >>> --
> >>> Sławomir Jaranowski
> >>>
> >>> ---------------------------------------------------------------------
> >>> To unsubscribe, e-mail: users-unsubscribe@maven.apache.org
> >>> For additional commands, e-mail: users-help@maven.apache.org
> >>>
> >>
> >>
> >> --
> >> The woman was born in a full-blown thunderstorm. She probably told it
> >> to be quiet. It probably did. (Robert Jordan, Winter's heart)
> >>
> >> ---------------------------------------------------------------------
> >> To unsubscribe, e-mail: users-unsubscribe@maven.apache.org
> >> For additional commands, e-mail: users-help@maven.apache.org
> >>
> >
> > ---------------------------------------------------------------------
> > To unsubscribe, e-mail: users-unsubscribe@maven.apache.org
> > For additional commands, e-mail: users-help@maven.apache.org
> >
>
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@maven.apache.org
For additional commands, e-mail: users-help@maven.apache.org
Re: Scope of transitive dependencies.
Posted by Tamás Cservenák <ta...@cservenak.net>.
Hans,
just figured what you wrote, two important remarks:
- toolbox _by default_ uses "runtime" scope! (unlike
m-dependency-p:tree!), so you want -Dscope=compile
See
https://github.com/maveniverse/toolbox/blob/main/toolbox/src/main/java/eu/maveniverse/maven/toolbox/plugin/mp/TreeMojo.java#L27
https://github.com/maveniverse/toolbox/blob/main/toolbox/src/main/java/eu/maveniverse/maven/toolbox/plugin/gav/GavTreeMojo.java#L40
Reason is that I usually use tree to display ANY artifact runtime tree
(hence the gav-tree, that unlike the tree mojo does NOT need a
project, just point it at any resolvable artifact with -Dgav=g:a:v).
I usually use these tools for some quick analysis...
Thanks
T
On Thu, Dec 5, 2024 at 6:02 PM Hans Aikema
<ha...@aikebah.net.invalid> wrote:
>
>
>
> > On 5 Dec 2024, at 17:30, Tamás Cservenák <ta...@cservenak.net> wrote:
> >
> > And... Can you tell us how these dependencies come into play?
> >
> > Can you paste the (in color or in bw -- for Manfred) output of the
> > tree command?
> >
> > Thanks
> > T
>
> Tamás, I’ve observed the same in Owasp Dependency Check maven plugin (though nowadays only for libraries that the plugin-plugin does not complain about as the items getting complained about have been explicitly added to the pom.xml to make them provided scoped)… a single example from that to reduce the noice of a large dependency tree:
>
> aikebah@rajah maven % mvn dependency:tree -Dincludes=org.apache.maven.resolver:maven-resolver-api
> [INFO] Scanning for projects...
> [INFO] Inspecting build with total of 1 modules...
> [INFO] Installing Nexus Staging features:
> [INFO] ... total of 1 executions of maven-deploy-plugin replaced with nexus-staging-maven-plugin
> [INFO]
> [INFO] ------------------< org.owasp:dependency-check-maven >------------------
> [INFO] Building Dependency-Check Maven Plugin 11.1.1-SNAPSHOT
> [INFO] from pom.xml
> [INFO] ----------------------------[ maven-plugin ]----------------------------
> [INFO]
> [INFO] --- dependency:3.8.1:tree (default-cli) @ dependency-check-maven ---
> [INFO] org.owasp:dependency-check-maven:maven-plugin:11.1.1-SNAPSHOT
> [INFO] \- org.apache.maven:maven-core:jar:3.6.3:provided
> [INFO] \- org.apache.maven.resolver:maven-resolver-api:jar:1.4.1:compile
> [INFO] ------------------------------------------------------------------------
> [INFO] BUILD SUCCESS
> [INFO] ------------------------------------------------------------------------
> [INFO] Total time: 1.625 s
> [INFO] Finished at: 2024-12-05T17:44:26+01:00
> [INFO] ------------------------------------------------------------------------
>
> Maven does not give me any reason in the depedency-tree why the resolver API would be compile-scoped.
>
> A a sidenote: your colorized toolbox command does not list it as a dependency (but then again, it appears to skip all provided deps, it’s not even listing maven-core as a dependency.
>
>
> >
> > On Thu, Dec 5, 2024 at 2:41 PM Jochen Wiedmann
> > <jo...@gmail.com> wrote:
> >>
> >> On Wed, Dec 4, 2024 at 10:10 PM Slawomir Jaranowski
> >> <s....@gmail.com> wrote:
> >>
> >>> It can be transitive dependencies from other dependencies in compile scope.
> >>>
> >>> look at output of dependency:tree
> >>
> >> I did, and it they are not.
> >>
> >> Jochen
> >>
> >>> On Wed, 4 Dec 2024 at 21:11, Jochen Wiedmann <jo...@gmail.com> wrote:
> >>>>
> >>>> Hi,
> >>>>
> >>>> a Maven plugin of mine has the following dependency:
> >>>>
> >>>> <dependency>
> >>>> <groupId>org.apache.maven</groupId>
> >>>> <artifactId>maven-core</artifactId>
> >>>> <version>3.9.9</version>
> >>>> <scope>provided</scope>
> >>>> </dependency>
> >>>>
> >>>> As you can see. the dependency has scope "provided". Now upon building
> >>>> the plugin I get the warning below. As fars as I can tell, these are
> >>>> transitive dependencies of the Maven core. Now, I am wondering how to
> >>>> get rid of these warnings. The only idea, that comes to mind, would be
> >>>> to declare all of these as explicit dependencies with scope
> >>>> "provided". but doesn't sound good.
> >>>>
> >>>> Are there any better ideas?
> >>>>
> >>>> Thanks,
> >>>>
> >>>> Jochen
> >>>>
> >>>>
> >>>> [WARNING]
> >>>>
> >>>> Some dependencies of Maven Plugins are expected to be in provided scope.
> >>>> Please make sure that dependencies listed below declared in POM
> >>>> have set '<scope>provided</scope>' as well.
> >>>>
> >>>> The following dependencies are in wrong scope:
> >>>> * org.apache.maven:maven-model:jar:3.9.9:compile
> >>>> * org.apache.maven:maven-settings:jar:3.9.9:compile
> >>>> * org.apache.maven:maven-settings-builder:jar:3.9.9:compile
> >>>> * org.apache.maven:maven-builder-support:jar:3.9.9:compile
> >>>> * org.apache.maven:maven-repository-metadata:jar:3.9.9:compile
> >>>> * org.apache.maven:maven-artifact:jar:3.9.9:compile
> >>>> * org.apache.maven:maven-model-builder:jar:3.9.9:compile
> >>>> * org.apache.maven:maven-resolver-provider:jar:3.9.9:compile
> >>>> * org.apache.maven:maven-compat:jar:3.9.9:compile
> >>>>
> >>>>
> >>>> --
> >>>> The woman was born in a full-blown thunderstorm. She probably told it
> >>>> to be quiet. It probably did. (Robert Jordan, Winter's heart)
> >>>>
> >>>> ---------------------------------------------------------------------
> >>>> To unsubscribe, e-mail: users-unsubscribe@maven.apache.org
> >>>> For additional commands, e-mail: users-help@maven.apache.org
> >>>>
> >>>
> >>>
> >>> --
> >>> Sławomir Jaranowski
> >>>
> >>> ---------------------------------------------------------------------
> >>> To unsubscribe, e-mail: users-unsubscribe@maven.apache.org
> >>> For additional commands, e-mail: users-help@maven.apache.org
> >>>
> >>
> >>
> >> --
> >> The woman was born in a full-blown thunderstorm. She probably told it
> >> to be quiet. It probably did. (Robert Jordan, Winter's heart)
> >>
> >> ---------------------------------------------------------------------
> >> To unsubscribe, e-mail: users-unsubscribe@maven.apache.org
> >> For additional commands, e-mail: users-help@maven.apache.org
> >>
> >
> > ---------------------------------------------------------------------
> > To unsubscribe, e-mail: users-unsubscribe@maven.apache.org
> > For additional commands, e-mail: users-help@maven.apache.org
> >
>
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@maven.apache.org
For additional commands, e-mail: users-help@maven.apache.org
Re: Scope of transitive dependencies.
Posted by Hans Aikema <ha...@aikebah.net.INVALID>.
> On 5 Dec 2024, at 17:30, Tamás Cservenák <ta...@cservenak.net> wrote:
>
> And... Can you tell us how these dependencies come into play?
>
> Can you paste the (in color or in bw -- for Manfred) output of the
> tree command?
>
> Thanks
> T
Tamás, I’ve observed the same in Owasp Dependency Check maven plugin (though nowadays only for libraries that the plugin-plugin does not complain about as the items getting complained about have been explicitly added to the pom.xml to make them provided scoped)… a single example from that to reduce the noice of a large dependency tree:
aikebah@rajah maven % mvn dependency:tree -Dincludes=org.apache.maven.resolver:maven-resolver-api
[INFO] Scanning for projects...
[INFO] Inspecting build with total of 1 modules...
[INFO] Installing Nexus Staging features:
[INFO] ... total of 1 executions of maven-deploy-plugin replaced with nexus-staging-maven-plugin
[INFO]
[INFO] ------------------< org.owasp:dependency-check-maven >------------------
[INFO] Building Dependency-Check Maven Plugin 11.1.1-SNAPSHOT
[INFO] from pom.xml
[INFO] ----------------------------[ maven-plugin ]----------------------------
[INFO]
[INFO] --- dependency:3.8.1:tree (default-cli) @ dependency-check-maven ---
[INFO] org.owasp:dependency-check-maven:maven-plugin:11.1.1-SNAPSHOT
[INFO] \- org.apache.maven:maven-core:jar:3.6.3:provided
[INFO] \- org.apache.maven.resolver:maven-resolver-api:jar:1.4.1:compile
[INFO] ------------------------------------------------------------------------
[INFO] BUILD SUCCESS
[INFO] ------------------------------------------------------------------------
[INFO] Total time: 1.625 s
[INFO] Finished at: 2024-12-05T17:44:26+01:00
[INFO] ------------------------------------------------------------------------
Maven does not give me any reason in the depedency-tree why the resolver API would be compile-scoped.
A a sidenote: your colorized toolbox command does not list it as a dependency (but then again, it appears to skip all provided deps, it’s not even listing maven-core as a dependency.
>
> On Thu, Dec 5, 2024 at 2:41 PM Jochen Wiedmann
> <jo...@gmail.com> wrote:
>>
>> On Wed, Dec 4, 2024 at 10:10 PM Slawomir Jaranowski
>> <s....@gmail.com> wrote:
>>
>>> It can be transitive dependencies from other dependencies in compile scope.
>>>
>>> look at output of dependency:tree
>>
>> I did, and it they are not.
>>
>> Jochen
>>
>>> On Wed, 4 Dec 2024 at 21:11, Jochen Wiedmann <jo...@gmail.com> wrote:
>>>>
>>>> Hi,
>>>>
>>>> a Maven plugin of mine has the following dependency:
>>>>
>>>> <dependency>
>>>> <groupId>org.apache.maven</groupId>
>>>> <artifactId>maven-core</artifactId>
>>>> <version>3.9.9</version>
>>>> <scope>provided</scope>
>>>> </dependency>
>>>>
>>>> As you can see. the dependency has scope "provided". Now upon building
>>>> the plugin I get the warning below. As fars as I can tell, these are
>>>> transitive dependencies of the Maven core. Now, I am wondering how to
>>>> get rid of these warnings. The only idea, that comes to mind, would be
>>>> to declare all of these as explicit dependencies with scope
>>>> "provided". but doesn't sound good.
>>>>
>>>> Are there any better ideas?
>>>>
>>>> Thanks,
>>>>
>>>> Jochen
>>>>
>>>>
>>>> [WARNING]
>>>>
>>>> Some dependencies of Maven Plugins are expected to be in provided scope.
>>>> Please make sure that dependencies listed below declared in POM
>>>> have set '<scope>provided</scope>' as well.
>>>>
>>>> The following dependencies are in wrong scope:
>>>> * org.apache.maven:maven-model:jar:3.9.9:compile
>>>> * org.apache.maven:maven-settings:jar:3.9.9:compile
>>>> * org.apache.maven:maven-settings-builder:jar:3.9.9:compile
>>>> * org.apache.maven:maven-builder-support:jar:3.9.9:compile
>>>> * org.apache.maven:maven-repository-metadata:jar:3.9.9:compile
>>>> * org.apache.maven:maven-artifact:jar:3.9.9:compile
>>>> * org.apache.maven:maven-model-builder:jar:3.9.9:compile
>>>> * org.apache.maven:maven-resolver-provider:jar:3.9.9:compile
>>>> * org.apache.maven:maven-compat:jar:3.9.9:compile
>>>>
>>>>
>>>> --
>>>> The woman was born in a full-blown thunderstorm. She probably told it
>>>> to be quiet. It probably did. (Robert Jordan, Winter's heart)
>>>>
>>>> ---------------------------------------------------------------------
>>>> To unsubscribe, e-mail: users-unsubscribe@maven.apache.org
>>>> For additional commands, e-mail: users-help@maven.apache.org
>>>>
>>>
>>>
>>> --
>>> Sławomir Jaranowski
>>>
>>> ---------------------------------------------------------------------
>>> To unsubscribe, e-mail: users-unsubscribe@maven.apache.org
>>> For additional commands, e-mail: users-help@maven.apache.org
>>>
>>
>>
>> --
>> The woman was born in a full-blown thunderstorm. She probably told it
>> to be quiet. It probably did. (Robert Jordan, Winter's heart)
>>
>> ---------------------------------------------------------------------
>> To unsubscribe, e-mail: users-unsubscribe@maven.apache.org
>> For additional commands, e-mail: users-help@maven.apache.org
>>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: users-unsubscribe@maven.apache.org
> For additional commands, e-mail: users-help@maven.apache.org
>
Re: Scope of transitive dependencies.
Posted by Tamás Cservenák <ta...@cservenak.net>.
And... Can you tell us how these dependencies come into play?
Can you paste the (in color or in bw -- for Manfred) output of the
tree command?
Thanks
T
On Thu, Dec 5, 2024 at 2:41 PM Jochen Wiedmann
<jo...@gmail.com> wrote:
>
> On Wed, Dec 4, 2024 at 10:10 PM Slawomir Jaranowski
> <s....@gmail.com> wrote:
>
> > It can be transitive dependencies from other dependencies in compile scope.
> >
> > look at output of dependency:tree
>
> I did, and it they are not.
>
> Jochen
>
> > On Wed, 4 Dec 2024 at 21:11, Jochen Wiedmann <jo...@gmail.com> wrote:
> > >
> > > Hi,
> > >
> > > a Maven plugin of mine has the following dependency:
> > >
> > > <dependency>
> > > <groupId>org.apache.maven</groupId>
> > > <artifactId>maven-core</artifactId>
> > > <version>3.9.9</version>
> > > <scope>provided</scope>
> > > </dependency>
> > >
> > > As you can see. the dependency has scope "provided". Now upon building
> > > the plugin I get the warning below. As fars as I can tell, these are
> > > transitive dependencies of the Maven core. Now, I am wondering how to
> > > get rid of these warnings. The only idea, that comes to mind, would be
> > > to declare all of these as explicit dependencies with scope
> > > "provided". but doesn't sound good.
> > >
> > > Are there any better ideas?
> > >
> > > Thanks,
> > >
> > > Jochen
> > >
> > >
> > > [WARNING]
> > >
> > > Some dependencies of Maven Plugins are expected to be in provided scope.
> > > Please make sure that dependencies listed below declared in POM
> > > have set '<scope>provided</scope>' as well.
> > >
> > > The following dependencies are in wrong scope:
> > > * org.apache.maven:maven-model:jar:3.9.9:compile
> > > * org.apache.maven:maven-settings:jar:3.9.9:compile
> > > * org.apache.maven:maven-settings-builder:jar:3.9.9:compile
> > > * org.apache.maven:maven-builder-support:jar:3.9.9:compile
> > > * org.apache.maven:maven-repository-metadata:jar:3.9.9:compile
> > > * org.apache.maven:maven-artifact:jar:3.9.9:compile
> > > * org.apache.maven:maven-model-builder:jar:3.9.9:compile
> > > * org.apache.maven:maven-resolver-provider:jar:3.9.9:compile
> > > * org.apache.maven:maven-compat:jar:3.9.9:compile
> > >
> > >
> > > --
> > > The woman was born in a full-blown thunderstorm. She probably told it
> > > to be quiet. It probably did. (Robert Jordan, Winter's heart)
> > >
> > > ---------------------------------------------------------------------
> > > To unsubscribe, e-mail: users-unsubscribe@maven.apache.org
> > > For additional commands, e-mail: users-help@maven.apache.org
> > >
> >
> >
> > --
> > Sławomir Jaranowski
> >
> > ---------------------------------------------------------------------
> > To unsubscribe, e-mail: users-unsubscribe@maven.apache.org
> > For additional commands, e-mail: users-help@maven.apache.org
> >
>
>
> --
> The woman was born in a full-blown thunderstorm. She probably told it
> to be quiet. It probably did. (Robert Jordan, Winter's heart)
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: users-unsubscribe@maven.apache.org
> For additional commands, e-mail: users-help@maven.apache.org
>
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@maven.apache.org
For additional commands, e-mail: users-help@maven.apache.org
Re: Scope of transitive dependencies.
Posted by Jochen Wiedmann <jo...@gmail.com>.
On Wed, Dec 4, 2024 at 10:10 PM Slawomir Jaranowski
<s....@gmail.com> wrote:
> It can be transitive dependencies from other dependencies in compile scope.
>
> look at output of dependency:tree
I did, and it they are not.
Jochen
> On Wed, 4 Dec 2024 at 21:11, Jochen Wiedmann <jo...@gmail.com> wrote:
> >
> > Hi,
> >
> > a Maven plugin of mine has the following dependency:
> >
> > <dependency>
> > <groupId>org.apache.maven</groupId>
> > <artifactId>maven-core</artifactId>
> > <version>3.9.9</version>
> > <scope>provided</scope>
> > </dependency>
> >
> > As you can see. the dependency has scope "provided". Now upon building
> > the plugin I get the warning below. As fars as I can tell, these are
> > transitive dependencies of the Maven core. Now, I am wondering how to
> > get rid of these warnings. The only idea, that comes to mind, would be
> > to declare all of these as explicit dependencies with scope
> > "provided". but doesn't sound good.
> >
> > Are there any better ideas?
> >
> > Thanks,
> >
> > Jochen
> >
> >
> > [WARNING]
> >
> > Some dependencies of Maven Plugins are expected to be in provided scope.
> > Please make sure that dependencies listed below declared in POM
> > have set '<scope>provided</scope>' as well.
> >
> > The following dependencies are in wrong scope:
> > * org.apache.maven:maven-model:jar:3.9.9:compile
> > * org.apache.maven:maven-settings:jar:3.9.9:compile
> > * org.apache.maven:maven-settings-builder:jar:3.9.9:compile
> > * org.apache.maven:maven-builder-support:jar:3.9.9:compile
> > * org.apache.maven:maven-repository-metadata:jar:3.9.9:compile
> > * org.apache.maven:maven-artifact:jar:3.9.9:compile
> > * org.apache.maven:maven-model-builder:jar:3.9.9:compile
> > * org.apache.maven:maven-resolver-provider:jar:3.9.9:compile
> > * org.apache.maven:maven-compat:jar:3.9.9:compile
> >
> >
> > --
> > The woman was born in a full-blown thunderstorm. She probably told it
> > to be quiet. It probably did. (Robert Jordan, Winter's heart)
> >
> > ---------------------------------------------------------------------
> > To unsubscribe, e-mail: users-unsubscribe@maven.apache.org
> > For additional commands, e-mail: users-help@maven.apache.org
> >
>
>
> --
> Sławomir Jaranowski
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: users-unsubscribe@maven.apache.org
> For additional commands, e-mail: users-help@maven.apache.org
>
--
The woman was born in a full-blown thunderstorm. She probably told it
to be quiet. It probably did. (Robert Jordan, Winter's heart)
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@maven.apache.org
For additional commands, e-mail: users-help@maven.apache.org
Re: Scope of transitive dependencies.
Posted by Manfred Moser <ma...@simpligility.ca>.
Hahah .. now you are showing off Tamas ;-)
On 2024-12-04 13:16, Tamás Cservenák wrote:
> Or try
>
> $ mvn eu.maveniverse.maven.plugins:toolbox:tree
>
> to see the same thing in color :)
>
> T
>
> On Wed, Dec 4, 2024 at 10:10 PM Slawomir Jaranowski
> <s....@gmail.com> wrote:
>>
>> Hi,
>> It can be transitive dependencies from other dependencies in compile scope.
>>
>> look at output of dependency:tree
>>
>> On Wed, 4 Dec 2024 at 21:11, Jochen Wiedmann <jo...@gmail.com> wrote:
>>>
>>> Hi,
>>>
>>> a Maven plugin of mine has the following dependency:
>>>
>>> <dependency>
>>> <groupId>org.apache.maven</groupId>
>>> <artifactId>maven-core</artifactId>
>>> <version>3.9.9</version>
>>> <scope>provided</scope>
>>> </dependency>
>>>
>>> As you can see. the dependency has scope "provided". Now upon building
>>> the plugin I get the warning below. As fars as I can tell, these are
>>> transitive dependencies of the Maven core. Now, I am wondering how to
>>> get rid of these warnings. The only idea, that comes to mind, would be
>>> to declare all of these as explicit dependencies with scope
>>> "provided". but doesn't sound good.
>>>
>>> Are there any better ideas?
>>>
>>> Thanks,
>>>
>>> Jochen
>>>
>>>
>>> [WARNING]
>>>
>>> Some dependencies of Maven Plugins are expected to be in provided scope.
>>> Please make sure that dependencies listed below declared in POM
>>> have set '<scope>provided</scope>' as well.
>>>
>>> The following dependencies are in wrong scope:
>>> * org.apache.maven:maven-model:jar:3.9.9:compile
>>> * org.apache.maven:maven-settings:jar:3.9.9:compile
>>> * org.apache.maven:maven-settings-builder:jar:3.9.9:compile
>>> * org.apache.maven:maven-builder-support:jar:3.9.9:compile
>>> * org.apache.maven:maven-repository-metadata:jar:3.9.9:compile
>>> * org.apache.maven:maven-artifact:jar:3.9.9:compile
>>> * org.apache.maven:maven-model-builder:jar:3.9.9:compile
>>> * org.apache.maven:maven-resolver-provider:jar:3.9.9:compile
>>> * org.apache.maven:maven-compat:jar:3.9.9:compile
>>>
>>>
>>> --
>>> The woman was born in a full-blown thunderstorm. She probably told it
>>> to be quiet. It probably did. (Robert Jordan, Winter's heart)
>>>
>>> ---------------------------------------------------------------------
>>> To unsubscribe, e-mail: users-unsubscribe@maven.apache.org
>>> For additional commands, e-mail: users-help@maven.apache.org
>>>
>>
>>
>> --
>> Sławomir Jaranowski
>>
>> ---------------------------------------------------------------------
>> To unsubscribe, e-mail: users-unsubscribe@maven.apache.org
>> For additional commands, e-mail: users-help@maven.apache.org
>>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: users-unsubscribe@maven.apache.org
> For additional commands, e-mail: users-help@maven.apache.org
>
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@maven.apache.org
For additional commands, e-mail: users-help@maven.apache.org
Re: Scope of transitive dependencies.
Posted by Tamás Cservenák <ta...@cservenak.net>.
Or try
$ mvn eu.maveniverse.maven.plugins:toolbox:tree
to see the same thing in color :)
T
On Wed, Dec 4, 2024 at 10:10 PM Slawomir Jaranowski
<s....@gmail.com> wrote:
>
> Hi,
> It can be transitive dependencies from other dependencies in compile scope.
>
> look at output of dependency:tree
>
> On Wed, 4 Dec 2024 at 21:11, Jochen Wiedmann <jo...@gmail.com> wrote:
> >
> > Hi,
> >
> > a Maven plugin of mine has the following dependency:
> >
> > <dependency>
> > <groupId>org.apache.maven</groupId>
> > <artifactId>maven-core</artifactId>
> > <version>3.9.9</version>
> > <scope>provided</scope>
> > </dependency>
> >
> > As you can see. the dependency has scope "provided". Now upon building
> > the plugin I get the warning below. As fars as I can tell, these are
> > transitive dependencies of the Maven core. Now, I am wondering how to
> > get rid of these warnings. The only idea, that comes to mind, would be
> > to declare all of these as explicit dependencies with scope
> > "provided". but doesn't sound good.
> >
> > Are there any better ideas?
> >
> > Thanks,
> >
> > Jochen
> >
> >
> > [WARNING]
> >
> > Some dependencies of Maven Plugins are expected to be in provided scope.
> > Please make sure that dependencies listed below declared in POM
> > have set '<scope>provided</scope>' as well.
> >
> > The following dependencies are in wrong scope:
> > * org.apache.maven:maven-model:jar:3.9.9:compile
> > * org.apache.maven:maven-settings:jar:3.9.9:compile
> > * org.apache.maven:maven-settings-builder:jar:3.9.9:compile
> > * org.apache.maven:maven-builder-support:jar:3.9.9:compile
> > * org.apache.maven:maven-repository-metadata:jar:3.9.9:compile
> > * org.apache.maven:maven-artifact:jar:3.9.9:compile
> > * org.apache.maven:maven-model-builder:jar:3.9.9:compile
> > * org.apache.maven:maven-resolver-provider:jar:3.9.9:compile
> > * org.apache.maven:maven-compat:jar:3.9.9:compile
> >
> >
> > --
> > The woman was born in a full-blown thunderstorm. She probably told it
> > to be quiet. It probably did. (Robert Jordan, Winter's heart)
> >
> > ---------------------------------------------------------------------
> > To unsubscribe, e-mail: users-unsubscribe@maven.apache.org
> > For additional commands, e-mail: users-help@maven.apache.org
> >
>
>
> --
> Sławomir Jaranowski
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: users-unsubscribe@maven.apache.org
> For additional commands, e-mail: users-help@maven.apache.org
>
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@maven.apache.org
For additional commands, e-mail: users-help@maven.apache.org
Re: Scope of transitive dependencies.
Posted by Slawomir Jaranowski <s....@gmail.com>.
Hi,
It can be transitive dependencies from other dependencies in compile scope.
look at output of dependency:tree
On Wed, 4 Dec 2024 at 21:11, Jochen Wiedmann <jo...@gmail.com> wrote:
>
> Hi,
>
> a Maven plugin of mine has the following dependency:
>
> <dependency>
> <groupId>org.apache.maven</groupId>
> <artifactId>maven-core</artifactId>
> <version>3.9.9</version>
> <scope>provided</scope>
> </dependency>
>
> As you can see. the dependency has scope "provided". Now upon building
> the plugin I get the warning below. As fars as I can tell, these are
> transitive dependencies of the Maven core. Now, I am wondering how to
> get rid of these warnings. The only idea, that comes to mind, would be
> to declare all of these as explicit dependencies with scope
> "provided". but doesn't sound good.
>
> Are there any better ideas?
>
> Thanks,
>
> Jochen
>
>
> [WARNING]
>
> Some dependencies of Maven Plugins are expected to be in provided scope.
> Please make sure that dependencies listed below declared in POM
> have set '<scope>provided</scope>' as well.
>
> The following dependencies are in wrong scope:
> * org.apache.maven:maven-model:jar:3.9.9:compile
> * org.apache.maven:maven-settings:jar:3.9.9:compile
> * org.apache.maven:maven-settings-builder:jar:3.9.9:compile
> * org.apache.maven:maven-builder-support:jar:3.9.9:compile
> * org.apache.maven:maven-repository-metadata:jar:3.9.9:compile
> * org.apache.maven:maven-artifact:jar:3.9.9:compile
> * org.apache.maven:maven-model-builder:jar:3.9.9:compile
> * org.apache.maven:maven-resolver-provider:jar:3.9.9:compile
> * org.apache.maven:maven-compat:jar:3.9.9:compile
>
>
> --
> The woman was born in a full-blown thunderstorm. She probably told it
> to be quiet. It probably did. (Robert Jordan, Winter's heart)
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: users-unsubscribe@maven.apache.org
> For additional commands, e-mail: users-help@maven.apache.org
>
--
Sławomir Jaranowski
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@maven.apache.org
For additional commands, e-mail: users-help@maven.apache.org