You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@maven.apache.org by gn...@apache.org on 2026/06/18 17:41:20 UTC
(maven) 01/01: [#12302] Add RED IT for TransitiveDependencyManager version downgrade
This is an automated email from the ASF dual-hosted git repository.
gnodet pushed a commit to branch it-gh12302
in repository https://gitbox.apache.org/repos/asf/maven.git
commit 0174254d8398f92b86098d3a47f713125a908de6
Author: Guillaume Nodet <gn...@gmail.com>
AuthorDate: Thu Jun 18 17:41:05 2026 +0000
[#12302] Add RED IT for TransitiveDependencyManager version downgrade
Adds integration test that verifies TransitiveDependencyManager does not
silently downgrade dependency versions when an intermediate POM's
<dependencyManagement> declares a lower version of a transitive dependency.
Dependency chain:
root → module-a:1.0 (parent=parent-a) → module-b:1.0 → lib-c:2.0
parent-a manages lib-c to 1.0
Expected: lib-c resolves to 2.0 (declared by module-b)
Actual (bug): lib-c downgraded to 1.0 by parent-a's dependencyManagement
because TransitiveDependencyManager has deriveUntil=MAX_VALUE.
This test is expected to FAIL (RED) until the fix is applied.
---
...12302TransitiveDepMgmtVersionDowngradeTest.java | 84 +++++++++++++++++++++
.../pom.xml | 62 +++++++++++++++
.../repo/.gitattributes | 2 +
.../maven/its/gh12302/lib-c/1.0/lib-c-1.0.jar | Bin 0 -> 322 bytes
.../maven/its/gh12302/lib-c/1.0/lib-c-1.0.pom | 9 +++
.../maven/its/gh12302/lib-c/2.0/lib-c-2.0.jar | Bin 0 -> 322 bytes
.../maven/its/gh12302/lib-c/2.0/lib-c-2.0.pom | 9 +++
.../its/gh12302/module-a/1.0/module-a-1.0.jar | Bin 0 -> 322 bytes
.../its/gh12302/module-a/1.0/module-a-1.0.pom | 22 ++++++
.../its/gh12302/module-b/1.0/module-b-1.0.jar | Bin 0 -> 322 bytes
.../its/gh12302/module-b/1.0/module-b-1.0.pom | 17 +++++
.../its/gh12302/parent-a/1.0/parent-a-1.0.pom | 19 +++++
.../settings-template.xml | 41 ++++++++++
13 files changed, 265 insertions(+)
diff --git a/its/core-it-suite/src/test/java/org/apache/maven/it/MavenITgh12302TransitiveDepMgmtVersionDowngradeTest.java b/its/core-it-suite/src/test/java/org/apache/maven/it/MavenITgh12302TransitiveDepMgmtVersionDowngradeTest.java
new file mode 100644
index 0000000000..6ba89c4df6
--- /dev/null
+++ b/its/core-it-suite/src/test/java/org/apache/maven/it/MavenITgh12302TransitiveDepMgmtVersionDowngradeTest.java
@@ -0,0 +1,84 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.apache.maven.it;
+
+import java.io.File;
+import java.util.List;
+
+import org.junit.jupiter.api.Test;
+
+import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+
+/**
+ * Integration test for <a href="https://github.com/apache/maven/issues/12302">gh-12302</a>.
+ *
+ * <p>Verifies that {@code TransitiveDependencyManager} does not silently downgrade
+ * dependency versions when an intermediate POM's {@code <dependencyManagement>}
+ * declares a lower version of a transitive dependency.
+ *
+ * <p>Dependency graph:
+ * <pre>
+ * root (test project)
+ * └── module-a:1.0 (parent = parent-a:1.0)
+ * └── module-b:1.0
+ * └── lib-c:2.0
+ *
+ * parent-a has <dependencyManagement> managing lib-c to 1.0
+ * </pre>
+ *
+ * <p>Expected: lib-c resolves to 2.0 (declared by module-b).
+ * <br>Actual (bug): lib-c is downgraded to 1.0 by parent-a's dependencyManagement
+ * because {@code TransitiveDependencyManager} has {@code deriveUntil = Integer.MAX_VALUE},
+ * collecting managed versions from every POM in the graph.
+ */
+public class MavenITgh12302TransitiveDepMgmtVersionDowngradeTest extends AbstractMavenIntegrationTestCase {
+
+ MavenITgh12302TransitiveDepMgmtVersionDowngradeTest() {
+ super("[4.0.0-rc-3,)");
+ }
+
+ @Test
+ public void testTransitiveDependencyManagerDoesNotDowngradeVersions() throws Exception {
+ File testDir = extractResources("/gh-12302-transitive-dep-mgmt-version-downgrade");
+
+ Verifier verifier = newVerifier(testDir.getAbsolutePath());
+ verifier.setAutoclean(false);
+ verifier.deleteDirectory("target");
+ verifier.deleteArtifacts("org.apache.maven.its.gh12302");
+ verifier.filterFile("settings-template.xml", "settings.xml");
+ verifier.addCliArgument("--settings");
+ verifier.addCliArgument("settings.xml");
+ verifier.addCliArgument("validate");
+ verifier.execute();
+ verifier.verifyErrorFreeLog();
+
+ List<String> classpath = verifier.loadLines("target/classpath.txt");
+
+ // lib-c should resolve to 2.0 (as declared by module-b), not 1.0
+ // (managed by parent-a's dependencyManagement).
+ // With the TransitiveDependencyManager bug, lib-c gets downgraded to 1.0.
+ assertTrue(
+ classpath.contains("lib-c-2.0.jar"),
+ "lib-c should be version 2.0 (declared by module-b), not downgraded: " + classpath);
+ assertFalse(
+ classpath.contains("lib-c-1.0.jar"),
+ "lib-c should NOT be downgraded to 1.0 by parent-a's dependencyManagement: " + classpath);
+ }
+}
diff --git a/its/core-it-suite/src/test/resources/gh-12302-transitive-dep-mgmt-version-downgrade/pom.xml b/its/core-it-suite/src/test/resources/gh-12302-transitive-dep-mgmt-version-downgrade/pom.xml
new file mode 100644
index 0000000000..eb2f79c4a8
--- /dev/null
+++ b/its/core-it-suite/src/test/resources/gh-12302-transitive-dep-mgmt-version-downgrade/pom.xml
@@ -0,0 +1,62 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!--
+Licensed to the Apache Software Foundation (ASF) under one
+or more contributor license agreements. See the NOTICE file
+distributed with this work for additional information
+regarding copyright ownership. The ASF licenses this file
+to you under the Apache License, Version 2.0 (the
+"License"); you may not use this file except in compliance
+with the License. You may obtain a copy of the License at
+
+ http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing,
+software distributed under the License is distributed on an
+"AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+KIND, either express or implied. See the License for the
+specific language governing permissions and limitations
+under the License.
+-->
+<project>
+ <modelVersion>4.0.0</modelVersion>
+
+ <groupId>org.apache.maven.its.gh12302</groupId>
+ <artifactId>test</artifactId>
+ <version>1.0</version>
+ <packaging>jar</packaging>
+
+ <name>Maven Integration Test :: gh-12302</name>
+ <description>Verify that TransitiveDependencyManager does not downgrade dependency versions
+ when an intermediate POM's dependencyManagement declares a lower version.</description>
+
+ <dependencies>
+ <dependency>
+ <groupId>org.apache.maven.its.gh12302</groupId>
+ <artifactId>module-a</artifactId>
+ <version>1.0</version>
+ </dependency>
+ </dependencies>
+
+ <build>
+ <plugins>
+ <plugin>
+ <groupId>org.apache.maven.its.plugins</groupId>
+ <artifactId>maven-it-plugin-dependency-resolution</artifactId>
+ <version>2.1-SNAPSHOT</version>
+ <configuration>
+ <compileClassPath>target/classpath.txt</compileClassPath>
+ <significantPathLevels>1</significantPathLevels>
+ </configuration>
+ <executions>
+ <execution>
+ <id>resolve</id>
+ <goals>
+ <goal>compile</goal>
+ </goals>
+ <phase>validate</phase>
+ </execution>
+ </executions>
+ </plugin>
+ </plugins>
+ </build>
+</project>
diff --git a/its/core-it-suite/src/test/resources/gh-12302-transitive-dep-mgmt-version-downgrade/repo/.gitattributes b/its/core-it-suite/src/test/resources/gh-12302-transitive-dep-mgmt-version-downgrade/repo/.gitattributes
new file mode 100644
index 0000000000..6d6420ce59
--- /dev/null
+++ b/its/core-it-suite/src/test/resources/gh-12302-transitive-dep-mgmt-version-downgrade/repo/.gitattributes
@@ -0,0 +1,2 @@
+*.pom text eol=lf
+maven-metadata.xml text eol=lf
diff --git a/its/core-it-suite/src/test/resources/gh-12302-transitive-dep-mgmt-version-downgrade/repo/org/apache/maven/its/gh12302/lib-c/1.0/lib-c-1.0.jar b/its/core-it-suite/src/test/resources/gh-12302-transitive-dep-mgmt-version-downgrade/repo/org/apache/maven/its/gh12302/lib-c/1.0/lib-c-1.0.jar
new file mode 100644
index 0000000000..ee3ce6555d
Binary files /dev/null and b/its/core-it-suite/src/test/resources/gh-12302-transitive-dep-mgmt-version-downgrade/repo/org/apache/maven/its/gh12302/lib-c/1.0/lib-c-1.0.jar differ
diff --git a/its/core-it-suite/src/test/resources/gh-12302-transitive-dep-mgmt-version-downgrade/repo/org/apache/maven/its/gh12302/lib-c/1.0/lib-c-1.0.pom b/its/core-it-suite/src/test/resources/gh-12302-transitive-dep-mgmt-version-downgrade/repo/org/apache/maven/its/gh12302/lib-c/1.0/lib-c-1.0.pom
new file mode 100644
index 0000000000..c969e383a7
--- /dev/null
+++ b/its/core-it-suite/src/test/resources/gh-12302-transitive-dep-mgmt-version-downgrade/repo/org/apache/maven/its/gh12302/lib-c/1.0/lib-c-1.0.pom
@@ -0,0 +1,9 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<project>
+ <modelVersion>4.0.0</modelVersion>
+
+ <groupId>org.apache.maven.its.gh12302</groupId>
+ <artifactId>lib-c</artifactId>
+ <version>1.0</version>
+ <packaging>jar</packaging>
+</project>
diff --git a/its/core-it-suite/src/test/resources/gh-12302-transitive-dep-mgmt-version-downgrade/repo/org/apache/maven/its/gh12302/lib-c/2.0/lib-c-2.0.jar b/its/core-it-suite/src/test/resources/gh-12302-transitive-dep-mgmt-version-downgrade/repo/org/apache/maven/its/gh12302/lib-c/2.0/lib-c-2.0.jar
new file mode 100644
index 0000000000..ee3ce6555d
Binary files /dev/null and b/its/core-it-suite/src/test/resources/gh-12302-transitive-dep-mgmt-version-downgrade/repo/org/apache/maven/its/gh12302/lib-c/2.0/lib-c-2.0.jar differ
diff --git a/its/core-it-suite/src/test/resources/gh-12302-transitive-dep-mgmt-version-downgrade/repo/org/apache/maven/its/gh12302/lib-c/2.0/lib-c-2.0.pom b/its/core-it-suite/src/test/resources/gh-12302-transitive-dep-mgmt-version-downgrade/repo/org/apache/maven/its/gh12302/lib-c/2.0/lib-c-2.0.pom
new file mode 100644
index 0000000000..5aa08a8cbc
--- /dev/null
+++ b/its/core-it-suite/src/test/resources/gh-12302-transitive-dep-mgmt-version-downgrade/repo/org/apache/maven/its/gh12302/lib-c/2.0/lib-c-2.0.pom
@@ -0,0 +1,9 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<project>
+ <modelVersion>4.0.0</modelVersion>
+
+ <groupId>org.apache.maven.its.gh12302</groupId>
+ <artifactId>lib-c</artifactId>
+ <version>2.0</version>
+ <packaging>jar</packaging>
+</project>
diff --git a/its/core-it-suite/src/test/resources/gh-12302-transitive-dep-mgmt-version-downgrade/repo/org/apache/maven/its/gh12302/module-a/1.0/module-a-1.0.jar b/its/core-it-suite/src/test/resources/gh-12302-transitive-dep-mgmt-version-downgrade/repo/org/apache/maven/its/gh12302/module-a/1.0/module-a-1.0.jar
new file mode 100644
index 0000000000..ee3ce6555d
Binary files /dev/null and b/its/core-it-suite/src/test/resources/gh-12302-transitive-dep-mgmt-version-downgrade/repo/org/apache/maven/its/gh12302/module-a/1.0/module-a-1.0.jar differ
diff --git a/its/core-it-suite/src/test/resources/gh-12302-transitive-dep-mgmt-version-downgrade/repo/org/apache/maven/its/gh12302/module-a/1.0/module-a-1.0.pom b/its/core-it-suite/src/test/resources/gh-12302-transitive-dep-mgmt-version-downgrade/repo/org/apache/maven/its/gh12302/module-a/1.0/module-a-1.0.pom
new file mode 100644
index 0000000000..5c8d0bf728
--- /dev/null
+++ b/its/core-it-suite/src/test/resources/gh-12302-transitive-dep-mgmt-version-downgrade/repo/org/apache/maven/its/gh12302/module-a/1.0/module-a-1.0.pom
@@ -0,0 +1,22 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<project>
+ <modelVersion>4.0.0</modelVersion>
+
+ <parent>
+ <groupId>org.apache.maven.its.gh12302</groupId>
+ <artifactId>parent-a</artifactId>
+ <version>1.0</version>
+ </parent>
+
+ <artifactId>module-a</artifactId>
+ <version>1.0</version>
+ <packaging>jar</packaging>
+
+ <dependencies>
+ <dependency>
+ <groupId>org.apache.maven.its.gh12302</groupId>
+ <artifactId>module-b</artifactId>
+ <version>1.0</version>
+ </dependency>
+ </dependencies>
+</project>
diff --git a/its/core-it-suite/src/test/resources/gh-12302-transitive-dep-mgmt-version-downgrade/repo/org/apache/maven/its/gh12302/module-b/1.0/module-b-1.0.jar b/its/core-it-suite/src/test/resources/gh-12302-transitive-dep-mgmt-version-downgrade/repo/org/apache/maven/its/gh12302/module-b/1.0/module-b-1.0.jar
new file mode 100644
index 0000000000..ee3ce6555d
Binary files /dev/null and b/its/core-it-suite/src/test/resources/gh-12302-transitive-dep-mgmt-version-downgrade/repo/org/apache/maven/its/gh12302/module-b/1.0/module-b-1.0.jar differ
diff --git a/its/core-it-suite/src/test/resources/gh-12302-transitive-dep-mgmt-version-downgrade/repo/org/apache/maven/its/gh12302/module-b/1.0/module-b-1.0.pom b/its/core-it-suite/src/test/resources/gh-12302-transitive-dep-mgmt-version-downgrade/repo/org/apache/maven/its/gh12302/module-b/1.0/module-b-1.0.pom
new file mode 100644
index 0000000000..40e8134d7e
--- /dev/null
+++ b/its/core-it-suite/src/test/resources/gh-12302-transitive-dep-mgmt-version-downgrade/repo/org/apache/maven/its/gh12302/module-b/1.0/module-b-1.0.pom
@@ -0,0 +1,17 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<project>
+ <modelVersion>4.0.0</modelVersion>
+
+ <groupId>org.apache.maven.its.gh12302</groupId>
+ <artifactId>module-b</artifactId>
+ <version>1.0</version>
+ <packaging>jar</packaging>
+
+ <dependencies>
+ <dependency>
+ <groupId>org.apache.maven.its.gh12302</groupId>
+ <artifactId>lib-c</artifactId>
+ <version>2.0</version>
+ </dependency>
+ </dependencies>
+</project>
diff --git a/its/core-it-suite/src/test/resources/gh-12302-transitive-dep-mgmt-version-downgrade/repo/org/apache/maven/its/gh12302/parent-a/1.0/parent-a-1.0.pom b/its/core-it-suite/src/test/resources/gh-12302-transitive-dep-mgmt-version-downgrade/repo/org/apache/maven/its/gh12302/parent-a/1.0/parent-a-1.0.pom
new file mode 100644
index 0000000000..9d0c192914
--- /dev/null
+++ b/its/core-it-suite/src/test/resources/gh-12302-transitive-dep-mgmt-version-downgrade/repo/org/apache/maven/its/gh12302/parent-a/1.0/parent-a-1.0.pom
@@ -0,0 +1,19 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<project>
+ <modelVersion>4.0.0</modelVersion>
+
+ <groupId>org.apache.maven.its.gh12302</groupId>
+ <artifactId>parent-a</artifactId>
+ <version>1.0</version>
+ <packaging>pom</packaging>
+
+ <dependencyManagement>
+ <dependencies>
+ <dependency>
+ <groupId>org.apache.maven.its.gh12302</groupId>
+ <artifactId>lib-c</artifactId>
+ <version>1.0</version>
+ </dependency>
+ </dependencies>
+ </dependencyManagement>
+</project>
diff --git a/its/core-it-suite/src/test/resources/gh-12302-transitive-dep-mgmt-version-downgrade/settings-template.xml b/its/core-it-suite/src/test/resources/gh-12302-transitive-dep-mgmt-version-downgrade/settings-template.xml
new file mode 100644
index 0000000000..c25336565b
--- /dev/null
+++ b/its/core-it-suite/src/test/resources/gh-12302-transitive-dep-mgmt-version-downgrade/settings-template.xml
@@ -0,0 +1,41 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!--
+Licensed to the Apache Software Foundation (ASF) under one
+or more contributor license agreements. See the NOTICE file
+distributed with this work for additional information
+regarding copyright ownership. The ASF licenses this file
+to you under the Apache License, Version 2.0 (the
+"License"); you may not use this file except in compliance
+with the License. You may obtain a copy of the License at
+
+ http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing,
+software distributed under the License is distributed on an
+"AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+KIND, either express or implied. See the License for the
+specific language governing permissions and limitations
+under the License.
+-->
+<settings>
+ <profiles>
+ <profile>
+ <id>maven-core-it-repo</id>
+ <repositories>
+ <repository>
+ <id>maven-core-it</id>
+ <url>@baseurl@/repo</url>
+ <releases>
+ <checksumPolicy>ignore</checksumPolicy>
+ </releases>
+ <snapshots>
+ <enabled>false</enabled>
+ </snapshots>
+ </repository>
+ </repositories>
+ </profile>
+ </profiles>
+ <activeProfiles>
+ <activeProfile>maven-core-it-repo</activeProfile>
+ </activeProfiles>
+</settings>