[jira] [Resolved] (RANGER-5832) CI build fails on Maven 3.10.0 due to duplicate dependency declarations in audit-dispatcher-hdfs and audit-dispatcher-solr POMs

["Abhishek Kumar (Jira)" <ji...@apache.org>]

     [ https://issues.apache.org/jira/browse/RANGER-5832?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

Abhishek Kumar resolved RANGER-5832.
------------------------------------
    Fix Version/s: 3.0.0
       Resolution: Fixed

Merged in master: [https://github.com/apache/ranger/commit/1a03f65710be5e49168702501e8e617137caf65a]

> CI build fails on Maven 3.10.0 due to duplicate dependency declarations in audit-dispatcher-hdfs and audit-dispatcher-solr POMs
> -------------------------------------------------------------------------------------------------------------------------------
>
>                 Key: RANGER-5832
>                 URL: https://issues.apache.org/jira/browse/RANGER-5832
>             Project: Ranger
>          Issue Type: Bug
>          Components: audit-server, Ranger
>            Reporter: Abhishek Kumar
>            Assignee: Abhishek Kumar
>            Priority: Major
>             Fix For: 3.0.0
>
>          Time Spent: 20m
>  Remaining Estimate: 0h
>
> Problem
> -------
> The Ranger build fails before any module is compiled when it runs on Maven 3.10.0, which GitHub Actions runners now pick up. Two modules declare the same dependencies twice in their <dependencies> section:
>   - audit-server/audit-dispatcher/dispatcher-hdfs/pom.xml
>   - audit-server/audit-dispatcher/dispatcher-solr/pom.xml
> The duplicated dependencies are:
>   - ch.qos.logback:logback-classic
>   - com.fasterxml.jackson.core:jackson-databind
>   - com.google.guava:guava
>   - commons-io:commons-io
>   - javax.servlet:javax.servlet-api
>   - org.apache.commons:commons-lang3
> Each one is declared once near the top of <dependencies> with no scope, and again further down with <scope>provided</scope>. The duplicates were added by RANGER-5520 (commit 3fd46dbef8).
> Maven 3.9.x only logs a warning for this. Maven 3.10.0 treats it as a fatal model-building error:
>   [ERROR] 'dependencies.dependency.(groupId:artifactId:type:classifier)' must be unique:
>           ch.qos.logback:logback-classic:jar -> duplicate declaration of version ${logback.version} @ line 212, column 21
>   ...
>   [ERROR] The build could not read 2 projects -> [Help 1]
>   [ERROR]   The project org.apache.ranger:audit-dispatcher-hdfs:3.0.0-SNAPSHOT (.../dispatcher-hdfs/pom.xml) has 6 errors
>   [ERROR]   The project org.apache.ranger:audit-dispatcher-solr:3.0.0-SNAPSHOT (.../dispatcher-solr/pom.xml) has 6 errors
> As a result, every CI run on a Maven 3.10.0 runner fails, on master and on all open PRs. Example: https://github.com/apache/ranger/actions/runs/37738426735/job/113183220920
> Steps to reproduce
> ------------------
> 1. Install Maven 3.10.0.
> 2. From the repo root, run: mvn -T 8 clean verify
> 3. The build fails during project scanning with the errors above.
> Proposed fix
> ------------
> In both POMs, remove the first, unscoped declaration of each of the six dependencies and keep the <scope>provided</scope> ones. Under Maven 3.9.x the later declaration takes effect, so the effective scope is already "provided" and the packaged artifacts should not change.
> Verification
> ------------
>   - mvn validate passes on Maven 3.9.x and 3.10.0.
>   - mvn clean verify passes, given the RANGER-5759 revert (https://github.com/apache/ranger/pull/1298) is also in place.
>   - The dependency tree for the two modules (mvn dependency:tree -pl <module>) is the same before and after the change.
> Related
> -------
>   - RANGER-5520: introduced the duplicate declarations.
>   - RANGER-5759 revert (https://github.com/apache/ranger/pull/1298): fixes a separate compile failure in ranger-atlas-plugin-shim that is also on master. Both fixes are needed for a green build.



--
This message was sent by Atlassian Jira
(v8.20.10#820010)