You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@maven.apache.org by Florian Schmaus <fl...@geekplace.eu> on 2019/02/24 20:04:51 UTC
Maven resolves wrong dynamic (transitive) dependency version
Assume a project which declares a dependency on libFoo version 1.0.0,
now libFoo also declares a dependency on libBar using a dynamic version
specifier [1.0, 2.0).
Now what I expect to happen is that Maven pulls in any, ideally the
latest available release, libBar 1.0 version artifact. What actually
happens is that Maven pulls in libBar 2.0-alpha5, which causes dynamic
linking issues. Gradle, OTOH, pulls in libBar 1.3 when it is used to
build the project.
I have created an example project, using the actual artifacts I
experience this issue with, to demonstrate the different behavior
between Maven and Gradle:
https://github.com/Flowdalic/maven-transitive-dynamic-dependency
The example project is configured to depend on Smack, an FOSS XMPP
client library, version 4.3.2. This Smack version declares jxmpp [0.6,
0.7) as a dependency.
$ mvn exec:java
…
Smack version: 4.3.2 (4.3.2-4.3 2019-02-22)
jxmpp version: 0.7.0-alpha5
ERROR: jxmpp version does not start with '0.6' as expected. :(
$ gradle run
…
Smack version: 4.3.2 (4.3.2-4.3 2019-02-22)
jxmpp version: 0.6.3
Is that by design or a (known) Maven issue?
Thanks
- Florian
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@maven.apache.org
For additional commands, e-mail: users-help@maven.apache.org
Re: Maven resolves wrong dynamic (transitive) dependency version
Posted by Florian Schmaus <fl...@geekplace.eu>.
On 2/24/19 9:15 PM, Michael Osipov wrote:
> Am 2019-02-24 um 21:04 schrieb Florian Schmaus:
>> Assume a project which declares a dependency on libFoo version 1.0.0,
>> now libFoo also declares a dependency on libBar using a dynamic
>> version specifier [1.0, 2.0).
>>
>> Now what I expect to happen is that Maven pulls in any, ideally the
>> latest available release, libBar 1.0 version artifact. What actually
>> happens is that Maven pulls in libBar 2.0-alpha5, which causes
>> dynamic linking issues. Gradle, OTOH, pulls in libBar 1.3 when it is
>> used to build the project.
>>
>> I have created an example project, using the actual artifacts I
>> experience this issue with, to demonstrate the different behavior
>> between Maven and Gradle:
>>
>> https://github.com/Flowdalic/maven-transitive-dynamic-dependency
>>
>> The example project is configured to depend on Smack, an FOSS XMPP
>> client library, version 4.3.2. This Smack version declares jxmpp
>> [0.6, 0.7) as a dependency.
>>
>> $ mvn exec:java
>> …
>> Smack version: 4.3.2 (4.3.2-4.3 2019-02-22)
>> jxmpp version: 0.7.0-alpha5
>> ERROR: jxmpp version does not start with '0.6' as expected. :(
>>
>> $ gradle run
>> …
>> Smack version: 4.3.2 (4.3.2-4.3 2019-02-22)
>> jxmpp version: 0.6.3
>>
>> Is that by design or a (known) Maven issue?
>
> This looks similar to MNG-6567. The issue is likely rooted in
> org.apache.maven.artifact.versioning.ComparableVersion, but I cannot
> tell wether this is by design or a bug. I think the whole issue is
> that ComparableVersion does not know that these wellknown qualifiers
> do denote non-GA versions.
>
> This would require a change in behavior which will likely *not* happen
> in Maven 3.x,
Thanks for you reply.
Any recommendations how to workaround this with Maven 3.x?
Shall I create an issue?
- Florian
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@maven.apache.org
For additional commands, e-mail: users-help@maven.apache.org
Re: Maven resolves wrong dynamic (transitive) dependency version
Posted by Michael Osipov <mi...@apache.org>.
Am 2019-02-24 um 21:04 schrieb Florian Schmaus:
> Assume a project which declares a dependency on libFoo version 1.0.0,
> now libFoo also declares a dependency on libBar using a dynamic version
> specifier [1.0, 2.0).
>
> Now what I expect to happen is that Maven pulls in any, ideally the
> latest available release, libBar 1.0 version artifact. What actually
> happens is that Maven pulls in libBar 2.0-alpha5, which causes dynamic
> linking issues. Gradle, OTOH, pulls in libBar 1.3 when it is used to
> build the project.
>
> I have created an example project, using the actual artifacts I
> experience this issue with, to demonstrate the different behavior
> between Maven and Gradle:
>
> https://github.com/Flowdalic/maven-transitive-dynamic-dependency
>
> The example project is configured to depend on Smack, an FOSS XMPP
> client library, version 4.3.2. This Smack version declares jxmpp [0.6,
> 0.7) as a dependency.
>
> $ mvn exec:java
> …
> Smack version: 4.3.2 (4.3.2-4.3 2019-02-22)
> jxmpp version: 0.7.0-alpha5
> ERROR: jxmpp version does not start with '0.6' as expected. :(
>
> $ gradle run
> …
> Smack version: 4.3.2 (4.3.2-4.3 2019-02-22)
> jxmpp version: 0.6.3
>
> Is that by design or a (known) Maven issue?
This looks similar to MNG-6567. The issue is likely rooted in
org.apache.maven.artifact.versioning.ComparableVersion, but I cannot
tell wether this is by design or a bug. I think the whole issue is that
ComparableVersion does not know that these wellknown qualifiers do
denote non-GA versions.
This would require a change in behavior which will likely *not* happen
in Maven 3.x,
Michael
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@maven.apache.org
For additional commands, e-mail: users-help@maven.apache.org
Re: Maven resolves wrong dynamic (transitive) dependency version
Posted by Florian Schmaus <fl...@geekplace.eu>.
On 2/24/19 9:27 PM, Karl Heinz Marbaise wrote:
> Hi Florian,
>
> On 24.02.19 21:04, Florian Schmaus wrote:
>> Assume a project which declares a dependency on libFoo version 1.0.0,
>> now libFoo also declares a dependency on libBar using a dynamic
>> version specifier [1.0, 2.0).
>>
>> Now what I expect to happen is that Maven pulls in any, ideally the
>> latest available release, libBar 1.0 version artifact. What actually
>> happens is that Maven pulls in libBar 2.0-alpha5, which causes
>> dynamic linking issues. Gradle, OTOH, pulls in libBar 1.3 when it is
>> used to build the project.
>>
>> I have created an example project, using the actual artifacts I
>> experience this issue with, to demonstrate the different behavior
>> between Maven and Gradle:
>>
>> https://github.com/Flowdalic/maven-transitive-dynamic-dependency
>>
>> The example project is configured to depend on Smack, an FOSS XMPP
>> client library, version 4.3.2. This Smack version declares jxmpp
>> [0.6, 0.7) as a dependency.
>>
>> $ mvn exec:java
>> …
>> Smack version: 4.3.2 (4.3.2-4.3 2019-02-22)
>> jxmpp version: 0.7.0-alpha5
>> ERROR: jxmpp version does not start with '0.6' as expected. :(
>
> maven-transitive-dynamic-dependency (master)$
> ~/tools/jdk8u202-b08/Contents/Home/bin/java -jar
> ~/tools/apache-maven-3.6.0/lib/maven-artifact-3.6.0.jar 0.7 0.7.0-alpha7
> Display parameters as parsed by Maven (in canonical form) and
> comparison result:
> 1. 0.7 == 0.7
> 0.7 > 0.7.0-alpha7
> 2. 0.7.0-alpha7 == 0.7-alpha-7
>
> That is based on the behaviour in ComparableVersion which handles non
> GA as before the final release which is exactly here the case.
Thanks for your reply. I also found
https://issues.apache.org/jira/browse/MNG-6232
which is what am I running into (the issue title could be more precise).
You probably don't have to change the behavior if there is a way to
specify all versions of a version series *without* pulling in
alpha/beta/… releases of the following version (Which is probably the
intention of all people running into MNG-6232).
Is there such a way?
I could possibly workaround that using something like
[0.6, 0.6.1000]
but that does not look very elegant… :(
- Florian
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@maven.apache.org
For additional commands, e-mail: users-help@maven.apache.org
Re: Maven resolves wrong dynamic (transitive) dependency version
Posted by Karl Heinz Marbaise <kh...@gmx.de>.
Hi Florian,
On 24.02.19 21:04, Florian Schmaus wrote:
> Assume a project which declares a dependency on libFoo version 1.0.0,
> now libFoo also declares a dependency on libBar using a dynamic version
> specifier [1.0, 2.0).
>
> Now what I expect to happen is that Maven pulls in any, ideally the
> latest available release, libBar 1.0 version artifact. What actually
> happens is that Maven pulls in libBar 2.0-alpha5, which causes dynamic
> linking issues. Gradle, OTOH, pulls in libBar 1.3 when it is used to
> build the project.
>
> I have created an example project, using the actual artifacts I
> experience this issue with, to demonstrate the different behavior
> between Maven and Gradle:
>
> https://github.com/Flowdalic/maven-transitive-dynamic-dependency
>
> The example project is configured to depend on Smack, an FOSS XMPP
> client library, version 4.3.2. This Smack version declares jxmpp [0.6,
> 0.7) as a dependency.
>
> $ mvn exec:java
> …
> Smack version: 4.3.2 (4.3.2-4.3 2019-02-22)
> jxmpp version: 0.7.0-alpha5
> ERROR: jxmpp version does not start with '0.6' as expected. :(
If I take a look via mvn dependency:tree which looks like this:
[INFO] Scanning for projects...
[INFO]
[INFO] ----------------------< com.mycompany.app:my-app
>----------------------
[INFO] Building my-app 1.0-SNAPSHOT
[INFO] --------------------------------[ jar
]---------------------------------
[INFO]
[INFO] --- maven-dependency-plugin:3.1.1:tree (default-cli) @ my-app ---
[INFO] com.mycompany.app:my-app:jar:1.0-SNAPSHOT
[INFO] +- org.igniterealtime.smack:smack-tcp:jar:4.3.2:compile
[INFO] | \- org.igniterealtime.smack:smack-core:jar:4.3.2:compile
[INFO] | +- xpp3:xpp3:jar:1.1.4c:compile
[INFO] | +- org.jxmpp:jxmpp-core:jar:0.7.0-alpha5:compile (version
selected from constraint [0.6,0.7))
[INFO] | | \- org.jxmpp:jxmpp-util-cache:jar:0.7.0-alpha5:compile
[INFO] | +- org.jxmpp:jxmpp-jid:jar:0.7.0-alpha5:compile (version
selected from constraint [0.6,0.7))
[INFO] | \- org.minidns:minidns-core:jar:0.4.0-alpha3:compile
(version selected from constraint [0.3,0.4))
[INFO] \- junit:junit:jar:4.11:test
[INFO] \- org.hamcrest:hamcrest-core:jar:1.3:test
[INFO]
------------------------------------------------------------------------
[INFO] BUILD SUCCESS
[INFO]
------------------------------------------------------------------------
[INFO] Total time: 1.211 s
[INFO] Finished at: 2019-02-24T21:15:40+01:00
[INFO]
------------------------------------------------------------------------
which shows that org.igniterealtime.smack:smack-core:jar:4.3.2:compile
(see
https://search.maven.org/artifact/org.igniterealtime.smack/smack-core/4.3.2/jar)
has dependency to
<dependency>
<groupId>org.jxmpp</groupId>
<artifactId>jxmpp-jid</artifactId>
<version>[0.6, 0.7)</version>
<scope>compile</scope>
</dependency>
this is a version range which means starting with release 0.6 including
the release 0.6 itself. The part 0.7) means not include the final
release 0.7 which is not the case.
maven-transitive-dynamic-dependency (master)$
~/tools/jdk8u202-b08/Contents/Home/bin/java -jar
~/tools/apache-maven-3.6.0/lib/maven-artifact-3.6.0.jar 0.7 0.7.0-alpha7
Display parameters as parsed by Maven (in canonical form) and comparison
result:
1. 0.7 == 0.7
0.7 > 0.7.0-alpha7
2. 0.7.0-alpha7 == 0.7-alpha-7
That is based on the behaviour in ComparableVersion which handles non GA
as before the final release which is exactly here the case.
But as Michael already stated out this would require a change in
behaviour of Maven 3.X which will likely *not* happend.
Kind regards
Karl Heinz Marbaise
>
> $ gradle run
> …
> Smack version: 4.3.2 (4.3.2-4.3 2019-02-22)
> jxmpp version: 0.6.3
>
> Is that by design or a (known) Maven issue?
>
> Thanks
>
> - Florian
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: users-unsubscribe@maven.apache.org
> For additional commands, e-mail: users-help@maven.apache.org
>
>
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@maven.apache.org
For additional commands, e-mail: users-help@maven.apache.org