You are viewing a plain text version of this content. The canonical link for it is here.
Posted to issues@maven.apache.org by "JackPGreen (via GitHub)" <gi...@apache.org> on 2026/03/28 23:42:28 UTC
[I] `analyze-exclusions` returns false positive `unnecessary excludes` [maven-dependency-plugin]
JackPGreen opened a new issue, #1598:
URL: https://github.com/apache/maven-dependency-plugin/issues/1598
### Affected version
3.10
### Bug description
Take the following `pom.xml`:
```
<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 https://maven.apache.org/xsd/maven-4.0.0.xsd">
<modelVersion>4.0.0</modelVersion>
<groupId>com.example</groupId>
<artifactId>reproducer</artifactId>
<version>0.0.1-SNAPSHOT</version>
<dependencyManagement>
</dependencyManagement>
<dependencies>
<dependency>
<groupId>org.apache.hadoop</groupId>
<artifactId>hadoop-client</artifactId>
<version>3.4.3</version>
<exclusions>
<exclusion>
<groupId>org.slf4j</groupId>
<artifactId>slf4j-reload4j</artifactId>
</exclusion>
</exclusions>
</dependency>
</dependencies>
</project>
```
The output of `mvn dependency:3.10.0:analyze-exclusions dependency:3.10.0:tree` is:
```
[INFO] --- dependency:3.10.0:analyze-exclusions (default-cli) @ reproducer ---
[WARNING] reproducer defines following unnecessary excludes
[WARNING] org.apache.hadoop:hadoop-client:3.4.3
[WARNING] - org.slf4j:slf4j-reload4j @ line: 14
[INFO]
[INFO] --- dependency:3.10.0:tree (default-cli) @ reproducer ---
[INFO] com.example:reproducer:jar:0.0.1-SNAPSHOT
[INFO] \- org.apache.hadoop:hadoop-client:jar:3.4.3:compile
[INFO] +- org.apache.hadoop:hadoop-common:jar:3.4.3:compile
[INFO] | +- org.apache.hadoop.thirdparty:hadoop-shaded-protobuf_3_25:jar:1.5.0:compile
[INFO] | +- org.apache.hadoop.thirdparty:hadoop-shaded-guava:jar:1.5.0:compile
[INFO] | +- com.google.guava:guava:jar:32.0.1-jre:compile
[INFO] | | +- com.google.guava:failureaccess:jar:1.0.1:compile
[INFO] | | +- com.google.guava:listenablefuture:jar:9999.0-empty-to-avoid-conflict-with-guava:compile
[INFO] | | +- org.checkerframework:checker-qual:jar:3.33.0:compile
[INFO] | | \- com.google.j2objc:j2objc-annotations:jar:2.8:compile
[INFO] | +- commons-cli:commons-cli:jar:1.9.0:compile
[INFO] | +- org.apache.commons:commons-math3:jar:3.6.1:compile
[INFO] | +- org.apache.httpcomponents:httpclient:jar:4.5.13:compile
[INFO] | | \- commons-logging:commons-logging:jar:1.2:compile
[INFO] | +- commons-codec:commons-codec:jar:1.15:compile
[INFO] | +- commons-io:commons-io:jar:2.16.1:compile
[INFO] | +- commons-net:commons-net:jar:3.9.0:compile
[INFO] | +- org.apache.commons:commons-collections4:jar:4.4:compile
[INFO] | +- jakarta.activation:jakarta.activation-api:jar:1.2.1:compile
[INFO] | +- org.eclipse.jetty:jetty-servlet:jar:9.4.57.v20241219:compile
[INFO] | | +- org.eclipse.jetty:jetty-security:jar:9.4.57.v20241219:compile
[INFO] | | \- org.eclipse.jetty:jetty-util-ajax:jar:9.4.57.v20241219:compile
[INFO] | +- org.eclipse.jetty:jetty-webapp:jar:9.4.57.v20241219:compile
[INFO] | | \- org.eclipse.jetty:jetty-xml:jar:9.4.57.v20241219:compile
[INFO] | +- javax.servlet.jsp:jsp-api:jar:2.1:runtime
[INFO] | +- com.sun.jersey:jersey-servlet:jar:1.19.4:compile
[INFO] | +- ch.qos.reload4j:reload4j:jar:1.2.22:compile
[INFO] | +- org.apache.commons:commons-configuration2:jar:2.10.1:compile
[INFO] | +- org.apache.commons:commons-lang3:jar:3.18.0:compile
[INFO] | +- org.apache.commons:commons-text:jar:1.14.0:compile
[INFO] | +- org.slf4j:slf4j-api:jar:1.7.36:compile
[INFO] | +- org.apache.avro:avro:jar:1.11.4:compile
[INFO] | | \- com.fasterxml.jackson.core:jackson-core:jar:2.14.3:compile
[INFO] | +- com.google.re2j:re2j:jar:1.1:compile
[INFO] | +- com.google.code.gson:gson:jar:2.9.0:compile
[INFO] | +- org.apache.hadoop:hadoop-auth:jar:3.4.3:compile
[INFO] | | +- com.nimbusds:nimbus-jose-jwt:jar:10.4:compile
[INFO] | | +- org.apache.curator:curator-framework:jar:5.2.0:compile
[INFO] | | \- org.apache.kerby:kerb-util:jar:2.0.3:compile
[INFO] | | +- org.apache.kerby:kerby-config:jar:2.0.3:compile
[INFO] | | \- org.apache.kerby:kerb-crypto:jar:2.0.3:compile
[INFO] | +- org.apache.curator:curator-client:jar:5.2.0:compile
[INFO] | +- org.apache.curator:curator-recipes:jar:5.2.0:compile
[INFO] | +- com.google.code.findbugs:jsr305:jar:3.0.2:compile
[INFO] | +- io.netty:netty-handler:jar:4.1.127.Final:compile
[INFO] | | +- io.netty:netty-common:jar:4.1.127.Final:compile
[INFO] | | +- io.netty:netty-resolver:jar:4.1.127.Final:compile
[INFO] | | +- io.netty:netty-buffer:jar:4.1.127.Final:compile
[INFO] | | +- io.netty:netty-transport:jar:4.1.127.Final:compile
[INFO] | | +- io.netty:netty-transport-native-unix-common:jar:4.1.127.Final:compile
[INFO] | | \- io.netty:netty-codec:jar:4.1.127.Final:compile
[INFO] | +- io.netty:netty-transport-native-epoll:jar:4.1.127.Final:compile
[INFO] | | \- io.netty:netty-transport-classes-epoll:jar:4.1.127.Final:compile
[INFO] | +- io.dropwizard.metrics:metrics-core:jar:3.2.4:compile
[INFO] | +- org.apache.commons:commons-compress:jar:1.26.1:compile
[INFO] | +- org.bouncycastle:bcprov-jdk18on:jar:1.82:compile
[INFO] | +- org.apache.kerby:kerb-core:jar:2.0.3:compile
[INFO] | | \- org.apache.kerby:kerby-pkix:jar:2.0.3:compile
[INFO] | | +- org.apache.kerby:kerby-asn1:jar:2.0.3:compile
[INFO] | | \- org.apache.kerby:kerby-util:jar:2.0.3:compile
[INFO] | +- com.fasterxml.jackson.core:jackson-databind:jar:2.12.7.1:compile
[INFO] | +- org.codehaus.woodstox:stax2-api:jar:4.2.1:compile
[INFO] | +- com.fasterxml.woodstox:woodstox-core:jar:5.4.0:compile
[INFO] | +- dnsjava:dnsjava:jar:3.6.1:compile
[INFO] | \- org.xerial.snappy:snappy-java:jar:1.1.10.4:compile
{...}
```
If you follow the advise and then remove the `slf4j-reload4j` `exclusion` and re-execute:
```
[INFO] --- dependency:3.10.0:analyze-exclusions (default-cli) @ reproducer ---
[INFO]
[INFO] --- dependency:3.10.0:tree (default-cli) @ reproducer ---
[INFO] com.example:reproducer:jar:0.0.1-SNAPSHOT
[INFO] \- org.apache.hadoop:hadoop-client:jar:3.4.3:compile
[INFO] +- org.apache.hadoop:hadoop-common:jar:3.4.3:compile
{...}
[INFO] | +- org.slf4j:slf4j-reload4j:jar:1.7.36:compile
```
You can see the `exclusion` wasn't unused after all, as without it the `slf4j-reload4j` dependency appears in the tree
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@maven.apache.org.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] `analyze-exclusions` returns false positive `unnecessary excludes` [maven-dependency-plugin]
Posted by "cstamas (via GitHub)" <gi...@apache.org>.
cstamas commented on issue #1598:
URL: https://github.com/apache/maven-dependency-plugin/issues/1598#issuecomment-4230282214
Can you try out Toolbox similar goal?
https://maveniverse.eu/docs/toolbox/plugin-documentation/check-exclusions-mojo.html
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@maven.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] `analyze-exclusions` returns false positive `unnecessary excludes` [maven-dependency-plugin]
Posted by "cstamas (via GitHub)" <gi...@apache.org>.
cstamas commented on issue #1598:
URL: https://github.com/apache/maven-dependency-plugin/issues/1598#issuecomment-4480874032
Still this is bug in Toolbox and in this plugin as well, still looking why.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@maven.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] `analyze-exclusions` returns false positive `unnecessary excludes` [maven-dependency-plugin]
Posted by "cstamas (via GitHub)" <gi...@apache.org>.
cstamas commented on issue #1598:
URL: https://github.com/apache/maven-dependency-plugin/issues/1598#issuecomment-4480903562
Toolbox fixed:
```
[cstamas@angeleyes m-dependency-p-1598]$ mvn -V toolbox:0.15.10-SNAPSHOT:check-exclusions
Apache Maven 3.9.16 (2bdd9fddda4b155ebf8000e807eb73fd829a51d5)
Maven home: /home/cstamas/.sdkman/candidates/maven/3.9.16
Java version: 21.0.11, vendor: Eclipse Adoptium, runtime: /home/cstamas/.sdkman/candidates/java/21.0.11-tem
Default locale: en_US, platform encoding: UTF-8
OS name: "linux", version: "7.0.8-100.fc43.x86_64", arch: "amd64", family: "unix"
[INFO] Scanning for projects...
[INFO]
[INFO] -----------------------< com.example:reproducer >-----------------------
[INFO] Building reproducer v2
[INFO] from pom.xml
[INFO] --------------------------------[ jar ]---------------------------------
[INFO]
[INFO] --- toolbox:0.15.10-SNAPSHOT:check-exclusions (default-cli) @ reproducer ---
[INFO] ------------------------------------------------------------------------
[INFO] BUILD SUCCESS
[INFO] ------------------------------------------------------------------------
[INFO] Total time: 0.288 s
[INFO] Finished at: 2026-05-18T20:53:31+02:00
[INFO] ------------------------------------------------------------------------
[cstamas@angeleyes m-dependency-p-1598]$
```
I bet is the same issue in m-dep-p
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@maven.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] `analyze-exclusions` returns false positive `unnecessary excludes` [maven-dependency-plugin]
Posted by "cstamas (via GitHub)" <gi...@apache.org>.
cstamas commented on issue #1598:
URL: https://github.com/apache/maven-dependency-plugin/issues/1598#issuecomment-4480869009
@slawekjaranowski see this https://gist.github.com/cstamas/8b73ac6e21944e22e48451bf6140e701
And yes, mvn 3.9 by def _ignores_ non-0-level management.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@maven.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] `analyze-exclusions` returns false positive `unnecessary excludes` [maven-dependency-plugin]
Posted by "slawekjaranowski (via GitHub)" <gi...@apache.org>.
slawekjaranowski closed issue #1598: `analyze-exclusions` returns false positive `unnecessary excludes`
URL: https://github.com/apache/maven-dependency-plugin/issues/1598
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@maven.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] `analyze-exclusions` returns false positive `unnecessary excludes` [maven-dependency-plugin]
Posted by "JackPGreen (via GitHub)" <gi...@apache.org>.
JackPGreen commented on issue #1598:
URL: https://github.com/apache/maven-dependency-plugin/issues/1598#issuecomment-4230265830
This appears more difficult to fix than anticipated as the test infrastructure to run the goal against a real (i.e. non-mocked/trivial) dependency is missing.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@maven.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] `analyze-exclusions` returns false positive `unnecessary excludes` [maven-dependency-plugin]
Posted by "JackPGreen (via GitHub)" <gi...@apache.org>.
JackPGreen commented on issue #1598:
URL: https://github.com/apache/maven-dependency-plugin/issues/1598#issuecomment-4149047328
I _suspect_ the issue is the `exclusion` applies to a dependency of `hadoop-common`, which is a dependency of `hadoop-client` - but this transitive dependency relationship is not fully resolved in the mojo.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@maven.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] `analyze-exclusions` returns false positive `unnecessary excludes` [maven-dependency-plugin]
Posted by "slawekjaranowski (via GitHub)" <gi...@apache.org>.
slawekjaranowski commented on issue #1598:
URL: https://github.com/apache/maven-dependency-plugin/issues/1598#issuecomment-4480356942
by the way:
```
mvn eu.maveniverse.maven.plugins:toolbox:0.15.7:check-exclusions
...
[INFO] Checking dependency org.apache.hadoop:hadoop-client:jar:3.4.3 (compile) exclusion org.slf4j:slf4j-reload4j:*:* paths
[INFO] Is unused
```
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@maven.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] `analyze-exclusions` returns false positive `unnecessary excludes` [maven-dependency-plugin]
Posted by "slawekjaranowski (via GitHub)" <gi...@apache.org>.
slawekjaranowski commented on issue #1598:
URL: https://github.com/apache/maven-dependency-plugin/issues/1598#issuecomment-4480314980
In parent of hadoop projects https://central.sonatype.com/artifact/org.apache.hadoop/hadoop-project/3.4.3 we have:
```xml
<dependencyManagement>
<dependency>
<groupId>org.apache.hadoop</groupId>
<artifactId>hadoop-common</artifactId>
<version>${hadoop.version}</version>
<exclusions>
<exclusion>
<groupId>org.slf4j</groupId>
<artifactId>slf4j-reload4j</artifactId>
</exclusion>
</exclusions>
</dependency>
</dependencyManagement>
```
in standard way dependencyManagement is not transitivy .. so we have (without exclusion):
````
mvn -V dependency:tree -Dincludes=org.slf4j
Apache Maven 3.9.15 (98b2cdbfdb5f1ac8781f537ea9acccaed7922349)
[INFO] --- dependency:3.11.0-SNAPSHOT:tree (default-cli) @ test ---
[INFO] org.apache.maven.its.dependency:test:jar:1.0-SNAPSHOT
[INFO] \- org.apache.hadoop:hadoop-client:jar:3.4.3:compile
[INFO] \- org.apache.hadoop:hadoop-common:jar:3.4.3:compile
[INFO] +- org.slf4j:slf4j-api:jar:1.7.36:compile
[INFO] \- org.slf4j:slf4j-reload4j:jar:1.7.36:compile
````
and with Maven 3.10 (or 4.x default) we can try:
```
mvn -V dependency:tree -Dmaven.resolver.dependencyManagerTransitivity=true -Dincludes=org.slf4j
Apache Maven 3.10.0-SNAPSHOT (128f64b867f55e67cf0e6267507491f655eefa38)
[INFO] --- dependency:3.11.0-SNAPSHOT:tree (default-cli) @ test ---
[INFO] org.apache.maven.its.dependency:test:jar:1.0-SNAPSHOT
[INFO] \- org.apache.hadoop:hadoop-client:jar:3.4.3:compile
[INFO] \- org.apache.hadoop:hadoop-common:jar:3.4.3:compile
[INFO] \- org.slf4j:slf4j-api:jar:1.7.36:compile
```
I dont know why and how code `org.apache.maven.plugins.dependency.utils.ResolverUtil#collectDependencies`
```java
CollectRequest request =
new CollectRequest(root, session.getCurrentProject().getRemoteProjectRepositories());
CollectResult result = repositorySystem.collectDependencies(session.getRepositorySession(), request);
```
respect depManagment from transitive dependencies
only @cstamas can help I think ....
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@maven.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] `analyze-exclusions` returns false positive `unnecessary excludes` [maven-dependency-plugin]
Posted by "cstamas (via GitHub)" <gi...@apache.org>.
cstamas commented on issue #1598:
URL: https://github.com/apache/maven-dependency-plugin/issues/1598#issuecomment-4480876321
Um, I know
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@maven.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] `analyze-exclusions` returns false positive `unnecessary excludes` [maven-dependency-plugin]
Posted by "slawekjaranowski (via GitHub)" <gi...@apache.org>.
slawekjaranowski commented on issue #1598:
URL: https://github.com/apache/maven-dependency-plugin/issues/1598#issuecomment-4480456813
test for reference:
- https://github.com/apache/maven-dependency-plugin/pull/1628
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@maven.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org