[jira] [Comment Edited] (MENFORCER-402) RequireUpperBoundDeps now follow scope provided transitive dependencies

["Thomas Mortagne (Jira)" <ji...@apache.org>]

    [ https://issues.apache.org/jira/browse/MENFORCER-402?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17553654#comment-17553654 ] 

Thomas Mortagne edited comment on MENFORCER-402 at 2/2/23 3:02 PM:
-------------------------------------------------------------------

bq. I guess this is because microprofile-metrics has it defined as a runtime dependency (no scope): https://repo1.maven.org/maven2/org/eclipse/microprofile/metrics/microprofile-metrics-api/3.0/microprofile-metrics-api-3.0.pom

It's probably the trigger, yes, but it's still a bug.


was (Author: tmortagne):
> I guess this is because microprofile-metrics has it defined as a runtime dependency (no scope): https://repo1.maven.org/maven2/org/eclipse/microprofile/metrics/microprofile-metrics-api/3.0/microprofile-metrics-api-3.0.pom

It's probably the trigger, yes, but it's still a bug.

> RequireUpperBoundDeps now follow scope provided transitive dependencies
> -----------------------------------------------------------------------
>
>                 Key: MENFORCER-402
>                 URL: https://issues.apache.org/jira/browse/MENFORCER-402
>             Project: Maven Enforcer Plugin
>          Issue Type: Bug
>          Components: Plugin
>    Affects Versions: 3.0.0
>            Reporter: Thomas Mortagne
>            Assignee: Slawomir Jaranowski
>            Priority: Major
>             Fix For: 3.1.0
>
>
> I have a dependency on org.infinispan:infinispan-core:12.1.7.Final and upgrading to the enforcer plugin 3.0.0 suddenly made my module fail because infinispan-core have conflicting provided dependencies on javax.annotation-api:
> {noformat}
> Require upper bound dependencies error for javax.annotation:javax.annotation-api:1.3.1 [provided] paths to dependency are:
> +-org.xwiki.commons:xwiki-commons-cache-infinispan:13.9-SNAPSHOT
>   +-org.infinispan:infinispan-core:12.1.7.Final
>     +-javax.annotation:javax.annotation-api:1.3.1 [provided]
> and
> +-org.xwiki.commons:xwiki-commons-cache-infinispan:13.9-SNAPSHOT
>   +-org.infinispan:infinispan-core:12.1.7.Final
>     +-org.infinispan:infinispan-commons:12.1.7.Final
>       +-javax.annotation:javax.annotation-api:1.3.1 [provided]
> and
> +-org.xwiki.commons:xwiki-commons-cache-infinispan:13.9-SNAPSHOT
>   +-org.infinispan:infinispan-core:12.1.7.Final
>     +-org.infinispan:infinispan-component-processor:12.1.7.Final [provided]
>       +-javax.annotation:javax.annotation-api:1.3.1 [provided]
> and
> +-org.xwiki.commons:xwiki-commons-cache-infinispan:13.9-SNAPSHOT
>   +-org.infinispan:infinispan-core:12.1.7.Final
>     +-org.infinispan.protostream:protostream-types:4.4.1.Final
>       +-javax.annotation:javax.annotation-api:1.3.2 [provided]
> and
> +-org.xwiki.commons:xwiki-commons-cache-infinispan:13.9-SNAPSHOT
>   +-org.infinispan:infinispan-core:12.1.7.Final
>     +-org.infinispan.protostream:protostream-processor:4.4.1.Final [provided]
>       +-javax.annotation:javax.annotation-api:1.3.2 [provided]
> and
> +-org.xwiki.commons:xwiki-commons-cache-infinispan:13.9-SNAPSHOT
>   +-org.infinispan:infinispan-core:12.1.7.Final
>     +-org.infinispan:infinispan-commons:12.1.7.Final
>       +-org.infinispan:infinispan-commons-jdk11:12.1.7.Final [provided]
>         +-javax.annotation:javax.annotation-api:1.3.1 [provided]
> {noformat}
> It's not clear if this was done on purpose since I cannot find anything about that in the release note, but I might have missed it. Problem is that provided scope dependencies are not necessarily used at runtime (it's often used as a way to avoid making transitive a dependency you only need at build time) and adding an <exclusion> for a non-transitive dependency feels quite weird.
> At least if this is not a bug, it would be nice to make this behavior configurable.



--
This message was sent by Atlassian Jira
(v8.20.10#820010)