You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@maven.apache.org by Slawomir Jaranowski <s....@gmail.com> on 2022/06/13 21:08:56 UTC
collectDependencies - artifact with runtime scope
Hi,
Project with one dependency:
<dependencies>
<dependency>
<groupId>jakarta.transaction</groupId>
<artifactId>jakarta.transaction-api</artifactId>
<version>2.0.1</version>
<scope>compile</scope>
</dependency>
</dependencies>
dependency:tree -D verbose
org.apache.maven.its.dependency-tree:verbose:jar:1.0-SNAPSHOT
\- jakarta.transaction:jakarta.transaction-api:jar:2.0.1:compile
+- jakarta.enterprise:jakarta.enterprise.cdi-api:jar:3.0.1:provided
| +- jakarta.el:jakarta.el-api:jar:4.0.0:provided
| +- (jakarta.interceptor:jakarta.interceptor-api:jar:2.0.1:provided -
omitted for duplicate)
| +- jakarta.inject:jakarta.inject-api:jar:2.0.1:provided
| \- jakarta.ejb:jakarta.ejb-api:jar:4.0.0:provided
\- jakarta.interceptor:jakarta.interceptor-api:jar:2.0.1:provided
\- jakarta.annotation:jakarta.annotation-api:jar:2.0.0:provided
When change dependency to runtime:
<dependencies>
<dependency>
<groupId>jakarta.transaction</groupId>
<artifactId>jakarta.transaction-api</artifactId>
<version>2.0.1</version>
<scope>runtime</scope>
</dependency>
</dependencies>
I have:
org.apache.maven.its.dependency-tree:verbose:jar:1.0-SNAPSHOT
\- jakarta.transaction:jakarta.transaction-api:jar:2.0.1:runtime
+- jakarta.enterprise:jakarta.enterprise.cdi-api:jar:3.0.1:runtime
| +- jakarta.el:jakarta.el-api:jar:4.0.0:runtime
| +- (jakarta.interceptor:jakarta.interceptor-api:jar:2.0.1:runtime -
omitted for duplicate)
| +- jakarta.inject:jakarta.inject-api:jar:2.0.1:runtime
| \- jakarta.ejb:jakarta.ejb-api:jar:4.0.0:runtime
\- jakarta.interceptor:jakarta.interceptor-api:jar:2.0.1:runtime
\- jakarta.annotation:jakarta.annotation-api:jar:2.0.0:runtime
so transitive dependencies with scope provided are lost and changed to
runtime.
Is it correct behavior?
It is cause for problem described in [1], [2]
dependency:tree - without verbose mode show in both case:
org.apache.maven.its.dependency-tree:verbose:jar:1.0-SNAPSHOT
\- jakarta.transaction:jakarta.transaction-api:jar:2.0.1:compile
or
org.apache.maven.its.dependency-tree:verbose:jar:1.0-SNAPSHOT
\- jakarta.transaction:jakarta.transaction-api:jar:2.0.1:runtime
Logic responsible for it is in resolver-util (old eather-util) [3]
[1] https://issues.apache.org/jira/browse/MENFORCER-394
[2] https://issues.apache.org/jira/browse/MENFORCER-402
[3]
https://github.com/apache/maven-resolver/blob/master/maven-resolver-util/src/main/java/org/eclipse/aether/util/graph/transformer/JavaScopeDeriver.java#L48
--
Sławomir Jaranowski
Re: collectDependencies - artifact with runtime scope
Posted by Slawomir Jaranowski <s....@gmail.com>.
Ok, sorry but I don't still understand difference:
Given project dependencies:
<dependencies>
<dependency>
<groupId>jakarta.transaction</groupId>
<artifactId>jakarta.transaction-api</artifactId>
<version>2.0.1</version>
<scope>runtime</scope>
</dependency>
</dependencies>
mvn dependency:tree - give me
org.apache.maven.its.dependency-tree:verbose:jar:1.0-SNAPSHOT
\- jakarta.transaction:jakarta.transaction-api:jar:2.0.1:runtime
as I know such dependency list I will have in project after dependencies
resolving
but, mvn dependency:tree -Dverbose - give me
org.apache.maven.its.dependency-tree:verbose:jar:1.0-SNAPSHOT
\- jakarta.transaction:jakarta.transaction-api:jar:2.0.1:runtime
+- jakarta.enterprise:jakarta.enterprise.cdi-api:jar:3.0.1:runtime
| +- jakarta.el:jakarta.el-api:jar:4.0.0:runtime
| +- (jakarta.interceptor:jakarta.interceptor-api:jar:2.0.1:runtime -
omitted for duplicate)
| +- jakarta.inject:jakarta.inject-api:jar:2.0.1:runtime
| \- jakarta.ejb:jakarta.ejb-api:jar:4.0.0:runtime
\- jakarta.interceptor:jakarta.interceptor-api:jar:2.0.1:runtime
\- jakarta.annotation:jakarta.annotation-api:jar:2.0.0:runtime
according to the above project should have a different dependency list ...
but it is not true ... I miss something
wt., 14 cze 2022 o 10:14 Tamás Cservenák <ta...@cservenak.net> napisał(a):
> Howdy,
>
> so, scopes are always from "this" (being built, the
> org.apache.maven.its.dependency-tree:verbose:jar:1.0-SNAPSHOT) project
> perspective.
> Hence your observation:
> "The most strange thing for me is that if I have an artifact with
> transitive provided dependencies and put it as runtime dependency"
> is wrong. If you put your 1st level dependency to runtime (must not enter
> compilation),
> then its 1st level dependencies (so "this" 2nd level deps) are also put to
> runtime, otherwise you could
> compile against 2nd level siblings, and that's not something you want.
>
> IF YOU WANT to code against its 2nd level sibling, then that dependency
> should be your FIRST LEVEL dependency (and in a different scope than
> runtime).
>
> This is many times source of confusion and problems (coding against
> transitive dep, not having it declared as 1st level dependency),
> and just for example sake, this is one of the features i love from takari
> lifecycle as documented here:
>
> http://takari.io/book/40-lifecycle.html#enforcing-dependency-usage-during-compilation
>
> HTH
> T
>
> On Mon, Jun 13, 2022 at 11:54 PM Slawomir Jaranowski <
> s.jaranowski@gmail.com>
> wrote:
>
> > The most strange thing for me is that if I have an artifact with
> > transitive provided dependencies and put it as runtime dependency -
> > provided scopes are changed to runtime.
> >
> > If it was true when I define dependency in runtime scope I will have all
> > transitive dependencies on classpath even provided ones. But it did not
> > happen in such a way.
> >
> > I've added some test [1]
> >
> > [1]
> >
> >
> https://github.com/apache/maven-dependency-tree/tree/runtime-provided-verbose
> >
> >
> > pon., 13 cze 2022 o 23:25 Tamás Cservenák <ta...@cservenak.net>
> > napisał(a):
> >
> > > Yes, this is the correct behaviour. Provided dependencies are "end
> > stops",
> > > at least should be. Will take a peek more, but i'd bet that scopes of
> dep
> > > are wrong.
> > >
> > > T
> > >
> > > On Mon, Jun 13, 2022, 23:10 Slawomir Jaranowski <
> s.jaranowski@gmail.com>
> > > wrote:
> > >
> > > > Hi,
> > > >
> > > > Project with one dependency:
> > > >
> > > > <dependencies>
> > > > <dependency>
> > > > <groupId>jakarta.transaction</groupId>
> > > > <artifactId>jakarta.transaction-api</artifactId>
> > > > <version>2.0.1</version>
> > > > <scope>compile</scope>
> > > > </dependency>
> > > > </dependencies>
> > > >
> > > > dependency:tree -D verbose
> > > >
> > > > org.apache.maven.its.dependency-tree:verbose:jar:1.0-SNAPSHOT
> > > > \- jakarta.transaction:jakarta.transaction-api:jar:2.0.1:compile
> > > > +-
> jakarta.enterprise:jakarta.enterprise.cdi-api:jar:3.0.1:provided
> > > > | +- jakarta.el:jakarta.el-api:jar:4.0.0:provided
> > > > | +-
> > (jakarta.interceptor:jakarta.interceptor-api:jar:2.0.1:provided
> > > -
> > > > omitted for duplicate)
> > > > | +- jakarta.inject:jakarta.inject-api:jar:2.0.1:provided
> > > > | \- jakarta.ejb:jakarta.ejb-api:jar:4.0.0:provided
> > > > \- jakarta.interceptor:jakarta.interceptor-api:jar:2.0.1:provided
> > > > \- jakarta.annotation:jakarta.annotation-api:jar:2.0.0:provided
> > > >
> > > >
> > > > When change dependency to runtime:
> > > > <dependencies>
> > > > <dependency>
> > > > <groupId>jakarta.transaction</groupId>
> > > > <artifactId>jakarta.transaction-api</artifactId>
> > > > <version>2.0.1</version>
> > > > <scope>runtime</scope>
> > > > </dependency>
> > > > </dependencies>
> > > >
> > > > I have:
> > > > org.apache.maven.its.dependency-tree:verbose:jar:1.0-SNAPSHOT
> > > > \- jakarta.transaction:jakarta.transaction-api:jar:2.0.1:runtime
> > > > +- jakarta.enterprise:jakarta.enterprise.cdi-api:jar:3.0.1:runtime
> > > > | +- jakarta.el:jakarta.el-api:jar:4.0.0:runtime
> > > > | +-
> > (jakarta.interceptor:jakarta.interceptor-api:jar:2.0.1:runtime -
> > > > omitted for duplicate)
> > > > | +- jakarta.inject:jakarta.inject-api:jar:2.0.1:runtime
> > > > | \- jakarta.ejb:jakarta.ejb-api:jar:4.0.0:runtime
> > > > \- jakarta.interceptor:jakarta.interceptor-api:jar:2.0.1:runtime
> > > > \- jakarta.annotation:jakarta.annotation-api:jar:2.0.0:runtime
> > > >
> > > > so transitive dependencies with scope provided are lost and changed
> to
> > > > runtime.
> > > >
> > > > Is it correct behavior?
> > > >
> > > > It is cause for problem described in [1], [2]
> > > >
> > > > dependency:tree - without verbose mode show in both case:
> > > >
> > > > org.apache.maven.its.dependency-tree:verbose:jar:1.0-SNAPSHOT
> > > > \- jakarta.transaction:jakarta.transaction-api:jar:2.0.1:compile
> > > >
> > > > or
> > > >
> > > > org.apache.maven.its.dependency-tree:verbose:jar:1.0-SNAPSHOT
> > > > \- jakarta.transaction:jakarta.transaction-api:jar:2.0.1:runtime
> > > >
> > > > Logic responsible for it is in resolver-util (old eather-util) [3]
> > > >
> > > > [1] https://issues.apache.org/jira/browse/MENFORCER-394
> > > > [2] https://issues.apache.org/jira/browse/MENFORCER-402
> > > > [3]
> > > >
> > > >
> > >
> >
> https://github.com/apache/maven-resolver/blob/master/maven-resolver-util/src/main/java/org/eclipse/aether/util/graph/transformer/JavaScopeDeriver.java#L48
> > > >
> > > >
> > > >
> > > >
> > > > --
> > > > Sławomir Jaranowski
> > > >
> > >
> >
> >
> > --
> > Sławomir Jaranowski
> >
>
--
Sławomir Jaranowski
Re: collectDependencies - artifact with runtime scope
Posted by Tamás Cservenák <ta...@cservenak.net>.
Howdy,
so, scopes are always from "this" (being built, the
org.apache.maven.its.dependency-tree:verbose:jar:1.0-SNAPSHOT) project
perspective.
Hence your observation:
"The most strange thing for me is that if I have an artifact with
transitive provided dependencies and put it as runtime dependency"
is wrong. If you put your 1st level dependency to runtime (must not enter
compilation),
then its 1st level dependencies (so "this" 2nd level deps) are also put to
runtime, otherwise you could
compile against 2nd level siblings, and that's not something you want.
IF YOU WANT to code against its 2nd level sibling, then that dependency
should be your FIRST LEVEL dependency (and in a different scope than
runtime).
This is many times source of confusion and problems (coding against
transitive dep, not having it declared as 1st level dependency),
and just for example sake, this is one of the features i love from takari
lifecycle as documented here:
http://takari.io/book/40-lifecycle.html#enforcing-dependency-usage-during-compilation
HTH
T
On Mon, Jun 13, 2022 at 11:54 PM Slawomir Jaranowski <s....@gmail.com>
wrote:
> The most strange thing for me is that if I have an artifact with
> transitive provided dependencies and put it as runtime dependency -
> provided scopes are changed to runtime.
>
> If it was true when I define dependency in runtime scope I will have all
> transitive dependencies on classpath even provided ones. But it did not
> happen in such a way.
>
> I've added some test [1]
>
> [1]
>
> https://github.com/apache/maven-dependency-tree/tree/runtime-provided-verbose
>
>
> pon., 13 cze 2022 o 23:25 Tamás Cservenák <ta...@cservenak.net>
> napisał(a):
>
> > Yes, this is the correct behaviour. Provided dependencies are "end
> stops",
> > at least should be. Will take a peek more, but i'd bet that scopes of dep
> > are wrong.
> >
> > T
> >
> > On Mon, Jun 13, 2022, 23:10 Slawomir Jaranowski <s....@gmail.com>
> > wrote:
> >
> > > Hi,
> > >
> > > Project with one dependency:
> > >
> > > <dependencies>
> > > <dependency>
> > > <groupId>jakarta.transaction</groupId>
> > > <artifactId>jakarta.transaction-api</artifactId>
> > > <version>2.0.1</version>
> > > <scope>compile</scope>
> > > </dependency>
> > > </dependencies>
> > >
> > > dependency:tree -D verbose
> > >
> > > org.apache.maven.its.dependency-tree:verbose:jar:1.0-SNAPSHOT
> > > \- jakarta.transaction:jakarta.transaction-api:jar:2.0.1:compile
> > > +- jakarta.enterprise:jakarta.enterprise.cdi-api:jar:3.0.1:provided
> > > | +- jakarta.el:jakarta.el-api:jar:4.0.0:provided
> > > | +-
> (jakarta.interceptor:jakarta.interceptor-api:jar:2.0.1:provided
> > -
> > > omitted for duplicate)
> > > | +- jakarta.inject:jakarta.inject-api:jar:2.0.1:provided
> > > | \- jakarta.ejb:jakarta.ejb-api:jar:4.0.0:provided
> > > \- jakarta.interceptor:jakarta.interceptor-api:jar:2.0.1:provided
> > > \- jakarta.annotation:jakarta.annotation-api:jar:2.0.0:provided
> > >
> > >
> > > When change dependency to runtime:
> > > <dependencies>
> > > <dependency>
> > > <groupId>jakarta.transaction</groupId>
> > > <artifactId>jakarta.transaction-api</artifactId>
> > > <version>2.0.1</version>
> > > <scope>runtime</scope>
> > > </dependency>
> > > </dependencies>
> > >
> > > I have:
> > > org.apache.maven.its.dependency-tree:verbose:jar:1.0-SNAPSHOT
> > > \- jakarta.transaction:jakarta.transaction-api:jar:2.0.1:runtime
> > > +- jakarta.enterprise:jakarta.enterprise.cdi-api:jar:3.0.1:runtime
> > > | +- jakarta.el:jakarta.el-api:jar:4.0.0:runtime
> > > | +-
> (jakarta.interceptor:jakarta.interceptor-api:jar:2.0.1:runtime -
> > > omitted for duplicate)
> > > | +- jakarta.inject:jakarta.inject-api:jar:2.0.1:runtime
> > > | \- jakarta.ejb:jakarta.ejb-api:jar:4.0.0:runtime
> > > \- jakarta.interceptor:jakarta.interceptor-api:jar:2.0.1:runtime
> > > \- jakarta.annotation:jakarta.annotation-api:jar:2.0.0:runtime
> > >
> > > so transitive dependencies with scope provided are lost and changed to
> > > runtime.
> > >
> > > Is it correct behavior?
> > >
> > > It is cause for problem described in [1], [2]
> > >
> > > dependency:tree - without verbose mode show in both case:
> > >
> > > org.apache.maven.its.dependency-tree:verbose:jar:1.0-SNAPSHOT
> > > \- jakarta.transaction:jakarta.transaction-api:jar:2.0.1:compile
> > >
> > > or
> > >
> > > org.apache.maven.its.dependency-tree:verbose:jar:1.0-SNAPSHOT
> > > \- jakarta.transaction:jakarta.transaction-api:jar:2.0.1:runtime
> > >
> > > Logic responsible for it is in resolver-util (old eather-util) [3]
> > >
> > > [1] https://issues.apache.org/jira/browse/MENFORCER-394
> > > [2] https://issues.apache.org/jira/browse/MENFORCER-402
> > > [3]
> > >
> > >
> >
> https://github.com/apache/maven-resolver/blob/master/maven-resolver-util/src/main/java/org/eclipse/aether/util/graph/transformer/JavaScopeDeriver.java#L48
> > >
> > >
> > >
> > >
> > > --
> > > Sławomir Jaranowski
> > >
> >
>
>
> --
> Sławomir Jaranowski
>
Re: collectDependencies - artifact with runtime scope
Posted by Slawomir Jaranowski <s....@gmail.com>.
The most strange thing for me is that if I have an artifact with
transitive provided dependencies and put it as runtime dependency -
provided scopes are changed to runtime.
If it was true when I define dependency in runtime scope I will have all
transitive dependencies on classpath even provided ones. But it did not
happen in such a way.
I've added some test [1]
[1]
https://github.com/apache/maven-dependency-tree/tree/runtime-provided-verbose
pon., 13 cze 2022 o 23:25 Tamás Cservenák <ta...@cservenak.net> napisał(a):
> Yes, this is the correct behaviour. Provided dependencies are "end stops",
> at least should be. Will take a peek more, but i'd bet that scopes of dep
> are wrong.
>
> T
>
> On Mon, Jun 13, 2022, 23:10 Slawomir Jaranowski <s....@gmail.com>
> wrote:
>
> > Hi,
> >
> > Project with one dependency:
> >
> > <dependencies>
> > <dependency>
> > <groupId>jakarta.transaction</groupId>
> > <artifactId>jakarta.transaction-api</artifactId>
> > <version>2.0.1</version>
> > <scope>compile</scope>
> > </dependency>
> > </dependencies>
> >
> > dependency:tree -D verbose
> >
> > org.apache.maven.its.dependency-tree:verbose:jar:1.0-SNAPSHOT
> > \- jakarta.transaction:jakarta.transaction-api:jar:2.0.1:compile
> > +- jakarta.enterprise:jakarta.enterprise.cdi-api:jar:3.0.1:provided
> > | +- jakarta.el:jakarta.el-api:jar:4.0.0:provided
> > | +- (jakarta.interceptor:jakarta.interceptor-api:jar:2.0.1:provided
> -
> > omitted for duplicate)
> > | +- jakarta.inject:jakarta.inject-api:jar:2.0.1:provided
> > | \- jakarta.ejb:jakarta.ejb-api:jar:4.0.0:provided
> > \- jakarta.interceptor:jakarta.interceptor-api:jar:2.0.1:provided
> > \- jakarta.annotation:jakarta.annotation-api:jar:2.0.0:provided
> >
> >
> > When change dependency to runtime:
> > <dependencies>
> > <dependency>
> > <groupId>jakarta.transaction</groupId>
> > <artifactId>jakarta.transaction-api</artifactId>
> > <version>2.0.1</version>
> > <scope>runtime</scope>
> > </dependency>
> > </dependencies>
> >
> > I have:
> > org.apache.maven.its.dependency-tree:verbose:jar:1.0-SNAPSHOT
> > \- jakarta.transaction:jakarta.transaction-api:jar:2.0.1:runtime
> > +- jakarta.enterprise:jakarta.enterprise.cdi-api:jar:3.0.1:runtime
> > | +- jakarta.el:jakarta.el-api:jar:4.0.0:runtime
> > | +- (jakarta.interceptor:jakarta.interceptor-api:jar:2.0.1:runtime -
> > omitted for duplicate)
> > | +- jakarta.inject:jakarta.inject-api:jar:2.0.1:runtime
> > | \- jakarta.ejb:jakarta.ejb-api:jar:4.0.0:runtime
> > \- jakarta.interceptor:jakarta.interceptor-api:jar:2.0.1:runtime
> > \- jakarta.annotation:jakarta.annotation-api:jar:2.0.0:runtime
> >
> > so transitive dependencies with scope provided are lost and changed to
> > runtime.
> >
> > Is it correct behavior?
> >
> > It is cause for problem described in [1], [2]
> >
> > dependency:tree - without verbose mode show in both case:
> >
> > org.apache.maven.its.dependency-tree:verbose:jar:1.0-SNAPSHOT
> > \- jakarta.transaction:jakarta.transaction-api:jar:2.0.1:compile
> >
> > or
> >
> > org.apache.maven.its.dependency-tree:verbose:jar:1.0-SNAPSHOT
> > \- jakarta.transaction:jakarta.transaction-api:jar:2.0.1:runtime
> >
> > Logic responsible for it is in resolver-util (old eather-util) [3]
> >
> > [1] https://issues.apache.org/jira/browse/MENFORCER-394
> > [2] https://issues.apache.org/jira/browse/MENFORCER-402
> > [3]
> >
> >
> https://github.com/apache/maven-resolver/blob/master/maven-resolver-util/src/main/java/org/eclipse/aether/util/graph/transformer/JavaScopeDeriver.java#L48
> >
> >
> >
> >
> > --
> > Sławomir Jaranowski
> >
>
--
Sławomir Jaranowski
Re: collectDependencies - artifact with runtime scope
Posted by Tamás Cservenák <ta...@cservenak.net>.
Yes, this is the correct behaviour. Provided dependencies are "end stops",
at least should be. Will take a peek more, but i'd bet that scopes of dep
are wrong.
T
On Mon, Jun 13, 2022, 23:10 Slawomir Jaranowski <s....@gmail.com>
wrote:
> Hi,
>
> Project with one dependency:
>
> <dependencies>
> <dependency>
> <groupId>jakarta.transaction</groupId>
> <artifactId>jakarta.transaction-api</artifactId>
> <version>2.0.1</version>
> <scope>compile</scope>
> </dependency>
> </dependencies>
>
> dependency:tree -D verbose
>
> org.apache.maven.its.dependency-tree:verbose:jar:1.0-SNAPSHOT
> \- jakarta.transaction:jakarta.transaction-api:jar:2.0.1:compile
> +- jakarta.enterprise:jakarta.enterprise.cdi-api:jar:3.0.1:provided
> | +- jakarta.el:jakarta.el-api:jar:4.0.0:provided
> | +- (jakarta.interceptor:jakarta.interceptor-api:jar:2.0.1:provided -
> omitted for duplicate)
> | +- jakarta.inject:jakarta.inject-api:jar:2.0.1:provided
> | \- jakarta.ejb:jakarta.ejb-api:jar:4.0.0:provided
> \- jakarta.interceptor:jakarta.interceptor-api:jar:2.0.1:provided
> \- jakarta.annotation:jakarta.annotation-api:jar:2.0.0:provided
>
>
> When change dependency to runtime:
> <dependencies>
> <dependency>
> <groupId>jakarta.transaction</groupId>
> <artifactId>jakarta.transaction-api</artifactId>
> <version>2.0.1</version>
> <scope>runtime</scope>
> </dependency>
> </dependencies>
>
> I have:
> org.apache.maven.its.dependency-tree:verbose:jar:1.0-SNAPSHOT
> \- jakarta.transaction:jakarta.transaction-api:jar:2.0.1:runtime
> +- jakarta.enterprise:jakarta.enterprise.cdi-api:jar:3.0.1:runtime
> | +- jakarta.el:jakarta.el-api:jar:4.0.0:runtime
> | +- (jakarta.interceptor:jakarta.interceptor-api:jar:2.0.1:runtime -
> omitted for duplicate)
> | +- jakarta.inject:jakarta.inject-api:jar:2.0.1:runtime
> | \- jakarta.ejb:jakarta.ejb-api:jar:4.0.0:runtime
> \- jakarta.interceptor:jakarta.interceptor-api:jar:2.0.1:runtime
> \- jakarta.annotation:jakarta.annotation-api:jar:2.0.0:runtime
>
> so transitive dependencies with scope provided are lost and changed to
> runtime.
>
> Is it correct behavior?
>
> It is cause for problem described in [1], [2]
>
> dependency:tree - without verbose mode show in both case:
>
> org.apache.maven.its.dependency-tree:verbose:jar:1.0-SNAPSHOT
> \- jakarta.transaction:jakarta.transaction-api:jar:2.0.1:compile
>
> or
>
> org.apache.maven.its.dependency-tree:verbose:jar:1.0-SNAPSHOT
> \- jakarta.transaction:jakarta.transaction-api:jar:2.0.1:runtime
>
> Logic responsible for it is in resolver-util (old eather-util) [3]
>
> [1] https://issues.apache.org/jira/browse/MENFORCER-394
> [2] https://issues.apache.org/jira/browse/MENFORCER-402
> [3]
>
> https://github.com/apache/maven-resolver/blob/master/maven-resolver-util/src/main/java/org/eclipse/aether/util/graph/transformer/JavaScopeDeriver.java#L48
>
>
>
>
> --
> Sławomir Jaranowski
>