You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@maven.apache.org by sj...@apache.org on 2026/09/14 18:37:19 UTC
(maven-enforcer) branch master updated: fix: correct enforceBytecodeVersion excludes filtering (#990)
This is an automated email from the ASF dual-hosted git repository.
slawekjaranowski pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/maven-enforcer.git
The following commit(s) were added to refs/heads/master by this push:
new 4991d9c0 fix: correct enforceBytecodeVersion excludes filtering (#990)
4991d9c0 is described below
commit 4991d9c001c332e9011476950e4a3d31764d80e5
Author: Nikulin Nikita <42...@users.noreply.github.com>
AuthorDate: Mon Sep 14 21:37:14 2026 +0300
fix: correct enforceBytecodeVersion excludes filtering (#990)
* Fix enforceBytecodeVersion excludes filtering
Invert the ArtifactMatcher result so excluded dependencies are skipped while include overrides remain eligible for bytecode checks. Add regression coverage for excludes with and without include overrides.
* Cover enforceBytecodeVersion excludes and includes in integration tests
The enforce-bytecode-version-excluded-deps project excluded every
dependency with *:* at maxJdkVersion 1.4, so it passed just as well when
filterDependencies() returned nothing at all.
Narrow the exclude to commons-lang3, the only dependency targeting a JDK
above the threshold, and keep jsr305 as a dependency that is really
analysed and passes.
Add enforce-bytecode-version-included-deps for the case where an include
overrides a wide exclude - there the build has to fail on commons-lang3
alone.
Co-Authored-By: Claude Opus 5 (1M context) <no...@anthropic.com>
---------
Signed-off-by: w3lld1 <42...@users.noreply.github.com>
Co-authored-by: Slawomir Jaranowski <s....@gmail.com>
Co-authored-by: Claude Opus 5 (1M context) <no...@anthropic.com>
---
.../rules/dependency/EnforceBytecodeVersion.java | 34 ++++---
.../enforce-bytecode-version-excluded-deps/pom.xml | 107 ++++++++++-----------
.../verify.groovy | 4 +-
.../invoker.properties | 18 ++++
.../enforce-bytecode-version-included-deps/pom.xml | 79 +++++++++++++++
.../verify.groovy | 6 +-
6 files changed, 172 insertions(+), 76 deletions(-)
diff --git a/enforcer-rules/src/main/java/org/apache/maven/enforcer/rules/dependency/EnforceBytecodeVersion.java b/enforcer-rules/src/main/java/org/apache/maven/enforcer/rules/dependency/EnforceBytecodeVersion.java
index 0010e5c8..fdae9e55 100644
--- a/enforcer-rules/src/main/java/org/apache/maven/enforcer/rules/dependency/EnforceBytecodeVersion.java
+++ b/enforcer-rules/src/main/java/org/apache/maven/enforcer/rules/dependency/EnforceBytecodeVersion.java
@@ -525,24 +525,26 @@ public class EnforceBytecodeVersion extends AbstractStandardEnforcerRule {
}
private List<Dependency> filterDependencies(List<Dependency> dependencies) {
- Predicate<Dependency> includeExcludeMatcher = d -> true;
+ ArtifactMatcher excludedArtifactMatcher = null;
if (includes != null || excludes != null) {
- ArtifactMatcher artifactMatcher = new ArtifactMatcher(excludes, includes);
- includeExcludeMatcher = d -> artifactMatcher.match(ArtifactUtils.toArtifact(d));
+ // ArtifactMatcher returns true for artifacts selected by excludes unless an
+ // include overrides that exclusion. Those artifacts must be skipped here.
+ excludedArtifactMatcher = new ArtifactMatcher(excludes, includes);
}
- Predicate<Dependency> scopeMatcher = d -> true;
- if (scopes != null) {
- scopeMatcher = d -> {
- if (scopes.contains(d.getScope())) {
- return true;
- } else {
- getLog().debug("Skipping {} due to scope");
- return false;
- }
- };
+
+ List<Dependency> filteredDependencies = new ArrayList<>();
+ for (Dependency dependency : dependencies) {
+ if (excludedArtifactMatcher != null
+ && excludedArtifactMatcher.match(ArtifactUtils.toArtifact(dependency))) {
+ getLog().debug("Skipping excluded dependency " + dependency);
+ continue;
+ }
+ if (scopes != null && !scopes.contains(dependency.getScope())) {
+ getLog().debug("Skipping " + dependency + " due to scope");
+ continue;
+ }
+ filteredDependencies.add(dependency);
}
- return dependencies.stream()
- .filter(includeExcludeMatcher.and(scopeMatcher))
- .collect(Collectors.toList());
+ return filteredDependencies;
}
}
diff --git a/maven-enforcer-plugin/src/it/projects/enforce-bytecode-version-excluded-deps/pom.xml b/maven-enforcer-plugin/src/it/projects/enforce-bytecode-version-excluded-deps/pom.xml
index a359b971..abec3504 100644
--- a/maven-enforcer-plugin/src/it/projects/enforce-bytecode-version-excluded-deps/pom.xml
+++ b/maven-enforcer-plugin/src/it/projects/enforce-bytecode-version-excluded-deps/pom.xml
@@ -18,62 +18,59 @@ specific language governing permissions and limitations
under the License.
-->
<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
- xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
- <modelVersion>4.0.0</modelVersion>
+ xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
+ <modelVersion>4.0.0</modelVersion>
- <groupId>pim.pam.poum</groupId>
- <artifactId>smoking</artifactId>
- <version>1.0-SNAPSHOT</version>
- <packaging>jar</packaging>
- <name>MOJO-1976 bytecode version excludes</name>
+ <groupId>pim.pam.poum</groupId>
+ <artifactId>smoking</artifactId>
+ <version>1.0-SNAPSHOT</version>
+ <packaging>jar</packaging>
+ <name>MOJO-1976 bytecode version excludes</name>
- <build>
- <plugins>
- <plugin>
- <artifactId>maven-enforcer-plugin</artifactId>
- <version>@project.version@</version>
- <configuration>
- <rules>
- <enforceBytecodeVersion>
- <maxJdkVersion>1.5</maxJdkVersion>
- <excludes>
- <exclude>org.mindrot:jbcrypt:*:*</exclude>
- </excludes>
- </enforceBytecodeVersion>
- </rules>
- </configuration>
- <executions>
- <execution>
- <id>test</id>
- <goals>
- <goal>enforce</goal>
- </goals>
- <phase>validate</phase>
- </execution>
- </executions>
- </plugin>
- </plugins>
- </build>
- <properties>
- <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
- </properties>
+ <properties>
+ <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
+ </properties>
- <dependencies>
- <dependency>
- <groupId>junit</groupId>
- <artifactId>junit</artifactId>
- <version>4.13.2</version>
- <scope>test</scope>
- </dependency>
- <dependency>
- <groupId>org.mindrot</groupId>
- <artifactId>jbcrypt</artifactId>
- <version>0.4</version>
- </dependency>
- <dependency>
- <groupId>com.google.code.findbugs</groupId>
- <artifactId>jsr305</artifactId>
- <version>2.0.1</version>
- </dependency>
- </dependencies>
+ <dependencies>
+ <!-- targets JDK 1.5 - must be analysed and pass -->
+ <dependency>
+ <groupId>com.google.code.findbugs</groupId>
+ <artifactId>jsr305</artifactId>
+ <version>2.0.1</version>
+ </dependency>
+ <!-- targets JDK 1.8 - violates maxJdkVersion unless filtered out -->
+ <dependency>
+ <groupId>org.apache.commons</groupId>
+ <artifactId>commons-lang3</artifactId>
+ <version>3.12.0</version>
+ </dependency>
+ </dependencies>
+
+ <build>
+ <plugins>
+ <plugin>
+ <artifactId>maven-enforcer-plugin</artifactId>
+ <version>@project.version@</version>
+ <configuration>
+ <rules>
+ <enforceBytecodeVersion>
+ <maxJdkVersion>1.5</maxJdkVersion>
+ <excludes>
+ <exclude>org.apache.commons:commons-lang3:*:*</exclude>
+ </excludes>
+ </enforceBytecodeVersion>
+ </rules>
+ </configuration>
+ <executions>
+ <execution>
+ <id>test</id>
+ <goals>
+ <goal>enforce</goal>
+ </goals>
+ <phase>validate</phase>
+ </execution>
+ </executions>
+ </plugin>
+ </plugins>
+ </build>
</project>
diff --git a/maven-enforcer-plugin/src/it/projects/enforce-bytecode-version-excluded-deps/verify.groovy b/maven-enforcer-plugin/src/it/projects/enforce-bytecode-version-excluded-deps/verify.groovy
index a07a78fb..87d29d83 100644
--- a/maven-enforcer-plugin/src/it/projects/enforce-bytecode-version-excluded-deps/verify.groovy
+++ b/maven-enforcer-plugin/src/it/projects/enforce-bytecode-version-excluded-deps/verify.groovy
@@ -22,6 +22,6 @@ assert file.exists();
String text = file.getText("utf-8");
+// commons-lang3 targets JDK 1.8 but is excluded, jsr305 targets JDK 1.5 and is analysed
assert !text.contains("Found Banned Dependency")
-
-return true;
+assert text.contains("BUILD SUCCESS")
diff --git a/maven-enforcer-plugin/src/it/projects/enforce-bytecode-version-included-deps/invoker.properties b/maven-enforcer-plugin/src/it/projects/enforce-bytecode-version-included-deps/invoker.properties
new file mode 100644
index 00000000..58b6526e
--- /dev/null
+++ b/maven-enforcer-plugin/src/it/projects/enforce-bytecode-version-included-deps/invoker.properties
@@ -0,0 +1,18 @@
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements. See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership. The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License. You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied. See the License for the
+# specific language governing permissions and limitations
+# under the License.
+
+invoker.buildResult = failure
diff --git a/maven-enforcer-plugin/src/it/projects/enforce-bytecode-version-included-deps/pom.xml b/maven-enforcer-plugin/src/it/projects/enforce-bytecode-version-included-deps/pom.xml
new file mode 100644
index 00000000..6a5f867c
--- /dev/null
+++ b/maven-enforcer-plugin/src/it/projects/enforce-bytecode-version-included-deps/pom.xml
@@ -0,0 +1,79 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!--
+Licensed to the Apache Software Foundation (ASF) under one
+or more contributor license agreements. See the NOTICE file
+distributed with this work for additional information
+regarding copyright ownership. The ASF licenses this file
+to you under the Apache License, Version 2.0 (the
+"License"); you may not use this file except in compliance
+with the License. You may obtain a copy of the License at
+
+ http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing,
+software distributed under the License is distributed on an
+"AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+KIND, either express or implied. See the License for the
+specific language governing permissions and limitations
+under the License.
+-->
+<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+ xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
+ <modelVersion>4.0.0</modelVersion>
+
+ <groupId>pim.pam.poum</groupId>
+ <artifactId>smoking</artifactId>
+ <version>1.0-SNAPSHOT</version>
+ <packaging>jar</packaging>
+ <name>bytecode version includes override excludes</name>
+
+ <properties>
+ <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
+ </properties>
+
+ <dependencies>
+ <!-- targets JDK 1.5 - must be analysed and pass -->
+ <dependency>
+ <groupId>com.google.code.findbugs</groupId>
+ <artifactId>jsr305</artifactId>
+ <version>2.0.1</version>
+ </dependency>
+ <!-- targets JDK 1.8 - violates maxJdkVersion unless filtered out -->
+ <dependency>
+ <groupId>org.apache.commons</groupId>
+ <artifactId>commons-lang3</artifactId>
+ <version>3.12.0</version>
+ </dependency>
+ </dependencies>
+
+ <build>
+ <plugins>
+ <plugin>
+ <artifactId>maven-enforcer-plugin</artifactId>
+ <version>@project.version@</version>
+ <configuration>
+ <rules>
+ <enforceBytecodeVersion>
+ <maxJdkVersion>1.5</maxJdkVersion>
+ <excludes>
+ <exclude>*:*</exclude>
+ </excludes>
+ <includes>
+ <include>org.apache.commons:commons-lang3:*:*</include>
+ </includes>
+ </enforceBytecodeVersion>
+ </rules>
+ </configuration>
+ <executions>
+ <execution>
+ <id>test</id>
+ <goals>
+ <goal>enforce</goal>
+ </goals>
+ <phase>validate</phase>
+ </execution>
+ </executions>
+ </plugin>
+ </plugins>
+ </build>
+</project>
diff --git a/maven-enforcer-plugin/src/it/projects/enforce-bytecode-version-excluded-deps/verify.groovy b/maven-enforcer-plugin/src/it/projects/enforce-bytecode-version-included-deps/verify.groovy
similarity index 77%
copy from maven-enforcer-plugin/src/it/projects/enforce-bytecode-version-excluded-deps/verify.groovy
copy to maven-enforcer-plugin/src/it/projects/enforce-bytecode-version-included-deps/verify.groovy
index a07a78fb..7a570cc4 100644
--- a/maven-enforcer-plugin/src/it/projects/enforce-bytecode-version-excluded-deps/verify.groovy
+++ b/maven-enforcer-plugin/src/it/projects/enforce-bytecode-version-included-deps/verify.groovy
@@ -22,6 +22,6 @@ assert file.exists();
String text = file.getText("utf-8");
-assert !text.contains("Found Banned Dependency")
-
-return true;
+// the wide exclude is overridden by the include, so only commons-lang3 is analysed
+assert text.contains("Found Banned Dependency: org.apache.commons:commons-lang3:jar:3.12.0")
+assert !text.contains("Found Banned Dependency: com.google.code.findbugs:jsr305")