[jira] [Created] (MNG-6283) [regression] resolution of nested import-scoped transitive dependencies ignores repositories overwriting 'central'

["Stefan Dellmuth (JIRA)" <ji...@apache.org>]

Stefan Dellmuth created MNG-6283:
------------------------------------

             Summary: [regression] resolution of nested import-scoped transitive dependencies ignores repositories overwriting 'central'
                 Key: MNG-6283
                 URL: https://issues.apache.org/jira/browse/MNG-6283
             Project: Maven
          Issue Type: Bug
          Components: Artifacts and Repositories, Dependencies
    Affects Versions: 3.5.0, 3.2.2
            Reporter: Stefan Dellmuth


We have one occurrence a "nested BOM", i.e. an import-scoped dependency which is transitively resolved as part of another import-scoped dependency. Moreover, as we are behind a company proxy, our only way of downloading dependencies is via a repository in our Maven settings called {{central}} and thus overwriting the default Maven Central repository.

Maven 3.2.2 introduced a regression which breaks the resolution of such nested BOM dependencies. Maven tries to resolve them against the Maven Central repository instead of our own.

So:
{code:xml}
<project xmlns="http://maven.apache.org/POM/4.0.0"
         xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
    <modelVersion>4.0.0</modelVersion>

    <groupId>de.msg.maven</groupId>
    <artifactId>nested-import-scope-example</artifactId>
    <version>1.0</version>
    <packaging>pom</packaging>

    <dependencyManagement>
        <dependencies>
            <dependency>
                <groupId>de.msg.maven</groupId>
                <artifactId>nested-import-scope-bom</artifactId>
                <version>1.0</version>
                <type>pom</type>
                <scope>import</scope>
            </dependency>
        </dependencies>
    </dependencyManagement>
</project>
{code}

...which in turn leads to...

{code:xml}
<project xmlns="http://maven.apache.org/POM/4.0.0"
         xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
    <modelVersion>4.0.0</modelVersion>

    <groupId>de.msg.maven</groupId>
    <artifactId>nested-import-scope-bom</artifactId>
    <version>1.0</version>
    <packaging>pom</packaging>

    <dependencyManagement>
        <dependencies>
            <dependency>
                <groupId>org.jboss.bom.wfk</groupId>
                <artifactId>jboss-javaee-6.0-with-tools</artifactId>
                <version>2.4.0-redhat-2</version>
                <type>pom</type>
                <scope>import</scope>
            </dependency>
        </dependencies>
    </dependencyManagement>

</project>
{code}

Maven settings contain:
{code:xml}
<profiles>
    <profile>
   	<repositories>
            <repository>
            	<id>central</id>
           	<url>http://maven.repository.redhat.com/techpreview/all/</url>
            </repository>
    	</repositories>
	<id>jboss</id>
    </profile>
</profiles>
<activeProfiles>
    <activeProfile>jboss</activeProfile>
</activeProfiles>
{code}

In this case, if I want to resolve the dependencies of {{nested-import-scope-example}} (while having {{nested-import-scope-bom}} available in my local or company's repository) fails because Maven tries to download the JBoss BOM from Maven Central.

Workaround: Renaming our company repository's ID to something other than {{central}} works as expected.

Disclaimer:
As I can't use our company repository's address here, I've reproduced the problem with the example of MNG-5663 which I've found during my research.



--
This message was sent by Atlassian JIRA
(v6.4.14#64029)