You are viewing a plain text version of this content. The canonical link for it is here.

Posted to issues@maven.apache.org by "gnodet (via GitHub)" <gi...@apache.org> on 2026/06/18 17:41:29 UTC

[PR] [#12302] Add RED IT for TransitiveDependencyManager version downgrade [maven]

gnodet opened a new pull request, #12316:
URL: https://github.com/apache/maven/pull/12316

   ## Draft — RED IT only (no fix yet)
   
   Adds an integration test that reproduces the `TransitiveDependencyManager` version downgrade bug.
   
   ### Dependency chain
   ```
   root → module-a:1.0 (parent=parent-a) → module-b:1.0 → lib-c:2.0
   parent-a has <dependencyManagement> managing lib-c to 1.0
   ```
   
   **Expected:** `lib-c` resolves to `2.0` (declared by `module-b`).
   **Actual (bug):** `lib-c` is downgraded to `1.0` because `TransitiveDependencyManager` has `deriveUntil = Integer.MAX_VALUE`, collecting managed versions from every POM in the graph (vs Maven 3's `ClassicDependencyManager` with `deriveUntil = 2`).
   
   ### Root cause
   `TransitiveDependencyManager.manageDependency()` applies `<dependencyManagement>` at all depths during collection. Maven 3's `ClassicDependencyManager` only used the root project's `<dependencyManagement>`.
   
   Reproduces #12302


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: issues-unsubscribe@maven.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] [#12302] Fix TransitiveDependencyManager version downgrade from parent-inherited depMgmt [maven]

Posted by "gnodet (via GitHub)" <gi...@apache.org>.

gnodet closed pull request #12316: [#12302] Fix TransitiveDependencyManager version downgrade from parent-inherited depMgmt
URL: https://github.com/apache/maven/pull/12316


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: issues-unsubscribe@maven.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] [#12302] Fix TransitiveDependencyManager version downgrade from parent-inherited depMgmt [maven]

Posted by "gnodet (via GitHub)" <gi...@apache.org>.

gnodet commented on PR #12316:
URL: https://github.com/apache/maven/pull/12316#issuecomment-4751500121

   Closing this PR — after discussion with Tamas, the current behavior is correct.
   
   `TransitiveDependencyManager` applies depMgmt "down the tree" within the same branch. When module-a inherits `lib-c:1.0` management from parent-a, that management correctly applies to `lib-c` at depth 3 in module-a's subtree. This is by design, not a bug.
   
   The fix for consumers who need a different version is to explicitly declare the dependency in their own `<dependencyManagement>` — root's depMgmt is collected at depth 0 and wins via `putIfAbsent` semantics.
   
   _Claude Code on behalf of Guillaume Nodet_


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: issues-unsubscribe@maven.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org