[jira] [Commented] (KARAF-4306) karaf-maven-plugin is not assembling the correct version of dependencies

["Grzegorz Grzybek (JIRA)" <ji...@apache.org>]

    [ https://issues.apache.org/jira/browse/KARAF-4306?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=16280362#comment-16280362 ] 

Grzegorz Grzybek commented on KARAF-4306:
-----------------------------------------

Works fine with 4.0.7, fixed with KARAF-4712. When I used 4.0.7 in your example, I got only Spring versions:
* {{3.1.4.RELEASE}} from {{org.springframework}} groupId as dependencies of {{spring-dm}}
* {{3.2.17.RELEASE_1}} from {{org.apache.servicemix.bundles}} groupId as dependencies of {{spring-dm}} (included in range) and of your {{feature-with-spring-dm}}

> karaf-maven-plugin is not assembling the correct version of dependencies
> ------------------------------------------------------------------------
>
>                 Key: KARAF-4306
>                 URL: https://issues.apache.org/jira/browse/KARAF-4306
>             Project: Karaf
>          Issue Type: Bug
>          Components: karaf-tooling
>    Affects Versions: 4.0.4
>            Reporter: Raman Gupta
>            Assignee: Jean-Baptiste Onofré
>             Fix For: 4.0.7, 4.1.4, 4.2.0
>
>
> This is similar to KARAF-3994.
> I see that the commit for that issue added the following TODO:
> * TODO Need to also check for version ranges. Currently ranges are ignored and all features matching the name
> I have a similar problem -- the generated system repo contains all versions of a feature that is matched by a range, not just the highest one that fulfills all of the requirements of the boot features. This is an issue because the generated repo may contain older (or newer) versions of libraries that have CVEs against them, which is then flagged by ops.
> For example:
> My feature depends on spring-dm which depends on spring range [2.5.6,4). At runtime, Karaf only needs and uses Spring 3.2.14, but my system repo contains Spring 3.1.4 (as well as three versions of Spring 4), all of which are defined in the Karaf Spring repo. And of course, Spring 3.1.4 has CVEs against it, so the system is flagged by ops as using jars with security problems (even though those jars are not actually used by the app).
> Shouldn't the Builder apply the same resolution logic as is used by Karaf itself, and assemble only those jars?



--
This message was sent by Atlassian JIRA
(v6.4.14#64029)