[jira] [Commented] (MENFORCER-385) Enforce that transitive provided dependencies are contained in the runtime Maven classpath

["Robert Scholte (Jira)" <ji...@apache.org>]

    [ https://issues.apache.org/jira/browse/MENFORCER-385?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17352736#comment-17352736 ] 

Robert Scholte commented on MENFORCER-385:
------------------------------------------

I think we first need to discuss the purpose of the scope "provided". The classic example is servlet-api. You will need it to compile your code, but it shouldn't be bundled with the war-file, as the web-container is responsible for it.
Even if servlet-api has transitive dependencies, they should not be part of the war. Again, it is the responsibility of the webcontainer to provide these.
With that in mind it makes sense that you'll get the CNFE, if you try to run the war without webcontainer.
In your abstract example it looks more like your 3rd party B dependency incorrectly marked C as provided.

> Enforce that transitive provided dependencies are contained in the runtime Maven classpath
> ------------------------------------------------------------------------------------------
>
>                 Key: MENFORCER-385
>                 URL: https://issues.apache.org/jira/browse/MENFORCER-385
>             Project: Maven Enforcer Plugin
>          Issue Type: Improvement
>          Components: Standard Rules
>            Reporter: Konrad Windszus
>            Assignee: Robert Scholte
>            Priority: Major
>
> All dependencies with {{provided}} scope are not transitively inherited. While this isn't a problem usually during compile time it is a problem for Maven plugins at run time, as they use the Maven dependency classpath also at run time (https://maven.apache.org/guides/mini/guide-maven-classloading.html#3-plugin-classloaders). At run time they fail if the transitive provided dependency has not been declared explicitly.
> As manually specifying all transitive (but hidden) {{provided}} dependencies is a very error-prone process an enforcer rule for that would be highly beneficial. Especially as the transitive dependencies have to be rechecked once you upgrade to a newer version.
> Example:
> {code:java}
> My Maven Plugin "A" -> 3rd Party Library "B" -> Provided Dependency "C"{code}
> As "B" uses "C" at run time it needs to be declared as dependency of "A" as well otherwise you might see  {{java.lang.ClassNotFoundException}} when executing Maven plugin "A".



--
This message was sent by Atlassian Jira
(v8.3.4#803005)