You are viewing a plain text version of this content. The canonical link for it is here.
Posted to notifications@logging.apache.org by "askoog (via GitHub)" <gi...@apache.org> on 2023/05/30 12:38:22 UTC
[I] Dependency convergence errors when using log4j-core-test (logging-log4j2)
askoog opened a new issue, #1494:
URL: https://github.com/apache/logging-log4j2/issues/1494
## Description
`org.apache.logging.log4j:log4j-core-test:2.20.0` uses dependencies with convergence errors.
## Configuration
**Version:** 2.20.0
**Operating system:** n/a
**JDK:** n/a
## Logs
Running `mvn install` on the attached pom file produces the following output:
```
[INFO] ------------------------------------------------------------------------
[INFO] BUILD FAILURE
[INFO] ------------------------------------------------------------------------
[INFO] Total time: 0.960 s
[INFO] Finished at: 2023-05-30T14:29:19+02:00
[INFO] ------------------------------------------------------------------------
[ERROR] Failed to execute goal org.apache.maven.plugins:maven-enforcer-plugin:3.3.0:enforce (enforce) on project my-artifact:
[ERROR] Rule 0: org.apache.maven.enforcer.rules.dependency.DependencyConvergence failed with message:
[ERROR] Failed while enforcing releasability.
[ERROR]
[ERROR] Dependency convergence error for org.codehaus.plexus:plexus-component-annotations:jar:1.5.5 paths to dependency are:
[ERROR] +-testgroup:my-artifact:jar:0.0.1-SNAPSHOT
[ERROR] +-org.apache.logging.log4j:log4j-core-test:jar:2.20.0:compile
[ERROR] +-org.apache.logging.log4j:log4j-api-test:jar:2.20.0:compile
[ERROR] +-org.apache.maven:maven-core:jar:3.8.6:compile
[ERROR] +-org.eclipse.sisu:org.eclipse.sisu.plexus:jar:0.3.5:compile
[ERROR] +-org.codehaus.plexus:plexus-component-annotations:jar:1.5.5:compile
[ERROR] and
[ERROR] +-testgroup:my-artifact:jar:0.0.1-SNAPSHOT
[ERROR] +-org.apache.logging.log4j:log4j-core-test:jar:2.20.0:compile
[ERROR] +-org.apache.logging.log4j:log4j-api-test:jar:2.20.0:compile
[ERROR] +-org.apache.maven:maven-core:jar:3.8.6:compile
[ERROR] +-org.codehaus.plexus:plexus-component-annotations:jar:2.1.0:compile
[ERROR]
...
```
Dependency convergence errors also for the following artifacts:
* org.slf4j:slf4j-api:jar:1.7.30/1.7.36
* org.codehaus.plexus:plexus-utils:jar:3.3.1/3.4.1
* com.google.guava:guava:jar:25.1-android/28.1-android
* javax.annotation:javax.annotation-api:jar:1.2/1.3.2
* org.codehaus.plexus:plexus-classworlds:jar:2.6.0/2.5.2
* commons-io:commons-io:jar:2.6/2.11.0
* org.junit.jupiter:junit-jupiter-api:jar:5.9.1/5.9.0
* org.apache.commons:commons-lang3:jar:3.12.0/3.8.1
* org.junit.platform:junit-platform-commons:jar:1.9.0/1.9.1
## Reproduction
Run `mvn install` for the attached pom file
[pom.xml.txt](https://github.com/apache/logging-log4j2/files/11599937/pom.xml.txt)
## Proposed solution
manage the above dependencies correctly in log4j-core-test
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@logging.apache.org.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] Dependency convergence errors when using log4j-core-test (logging-log4j2)
Posted by "ppkarwasz (via GitHub)" <gi...@apache.org>.
ppkarwasz commented on issue #1494:
URL: https://github.com/apache/logging-log4j2/issues/1494#issuecomment-1569480597
Hi @askoog,
Dependency convergence is rather a myth every project would like to have instead than a real goal. As you can see `maven-core` itself depends on different versions of the same artifact.
If you can propose an algorithm to achieve dependency convergence, I am all in. Fixing the versions of transitive dependencies in our parent POM is **not** a viable solution (we force our dependencies to work with libraries they were never tested with). We do it to pass the [`RequireUpperBoundDeps` enforcer rule](https://maven.apache.org/enforcer/enforcer-rules/requireUpperBoundDeps.html), but I wouldn't go as far as to enforce dependency convergence, especially on test artifacts.
Since more and more projects on Github use [Dependabot](https://github.com/dependabot) these days, you should open a feature request with them. They are probably one of the few entities that can coordinate a dependency convergence effort in such a way that:
* newer versions are preferred over older ones (end user applications should have deps more recent than 4 years, so upstream libraries like Log4j should probably have deps more recent than 1 year),
* Dependabot suggestions take into account not only the release date of a library, but the usage of the version in other projects.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@logging.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] Dependency convergence errors when using log4j-core-test (logging-log4j2)
Posted by "vy (via GitHub)" <gi...@apache.org>.
vy commented on issue #1494:
URL: https://github.com/apache/logging-log4j2/issues/1494#issuecomment-1587934211
@askoog, I agree with @ppkarwasz assessment. I take the incentive to close the issue, please let us know if you think otherwise.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@logging.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] Dependency convergence errors when using log4j-core-test (logging-log4j2)
Posted by "vy (via GitHub)" <gi...@apache.org>.
vy closed issue #1494: Dependency convergence errors when using log4j-core-test
URL: https://github.com/apache/logging-log4j2/issues/1494
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@logging.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org