[jira] [Created] (MNG-7757) Resolved dependencies are not taking into account dependency management

["Daniel Puiu (Jira)" <ji...@apache.org>]

Daniel Puiu created MNG-7757:
--------------------------------

             Summary: Resolved dependencies are not taking into account dependency management
                 Key: MNG-7757
                 URL: https://issues.apache.org/jira/browse/MNG-7757
             Project: Maven
          Issue Type: Bug
         Environment: Windows 10, Java 17.0.2, Maven 3.8.5
            Reporter: Daniel Puiu
         Attachments: test-maven-dependency-tree-bug.7z

I have the following case:
 * Project C depends on project D (compile scope).
 * Project B depends on project C (compile scope) and declares project D in dependency management as provided.
 * Project A depends on project B (compile scope).

Running dependency:tree on A outputs:
{noformat}
[INFO] --- maven-dependency-plugin:2.8:tree (default-cli) @ test-maven-dependency-tree-bug-A ---
[INFO] org.example:test-maven-dependency-tree-bug-A:jar:1.0-SNAPSHOT
[INFO] \- org.example:test-maven-dependency-tree-bug-B:jar:1.0-SNAPSHOT:compile
[INFO]    \- org.example:test-maven-dependency-tree-bug-C:jar:1.0-SNAPSHOT:compile
[INFO]       \- org.example:test-maven-dependency-tree-bug-D:jar:1.0-SNAPSHOT:compile{noformat}
Also, building a fat jar with maven-assembly-plugin adds the content of D to the jar.

 

Both plugins use org.apache.maven.DefaultProjectDependencyGraph (which is marked as internal and deprecated) to resolve the dependency tree. This is actually the reason for which I am opening the ticket on maven's side and not on maven-dependency-plugin and maven-assembly-plugin sides.

 

From the [documentation|https://maven.apache.org/guides/introduction/introduction-to-dependency-mechanism.html], my understanding is that D should appear as provided in the dependency tree and not be part of the fat jar created by assembly plugin.

 

I have tested both plugins mainly with maven 3.8.5, but have obtained the same results with 4.0.0-alpha5, 3.6.3 and 3.0.5

I have attached a multi module project on which I tested the case.



--
This message was sent by Atlassian Jira
(v8.20.10#820010)