You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@maven.apache.org by Nils Breunese <ni...@breun.nl> on 2021/08/17 11:44:28 UTC
plexus-cipher missing from transitive dependencies of maven-core 3.8.2
Hi,
I have a project that uses org.apache.maven.plugin-testing:maven-plugin-testing-harness:3.3.0 for testing a Maven plugin.
After upgrading the project’s Maven dependencies to Maven 3.8.2 I got this error message when running tests:
----
Error injecting: org.sonatype.plexus.components.sec.dispatcher.DefaultSecDispatcher
java.lang.NoClassDefFoundError: org/sonatype/plexus/components/cipher/PlexusCipher ... 117 more
----
PlexusCipher is a class in the plexus-cipher artifact, which is a transitive dependency of maven-core 3.8.1:
----
[INFO] org.example:plexus-cipher-mystery:jar:1.0-SNAPSHOT
[INFO] \- org.apache.maven:maven-core:jar:3.8.1:compile
[INFO] +- org.apache.maven:maven-model:jar:3.8.1:compile
[INFO] +- org.apache.maven:maven-settings:jar:3.8.1:compile
[INFO] +- org.apache.maven:maven-settings-builder:jar:3.8.1:compile
[INFO] | +- org.codehaus.plexus:plexus-interpolation:jar:1.25:compile
[INFO] | \- org.sonatype.plexus:plexus-sec-dispatcher:jar:1.4:compile
[INFO] | \- org.sonatype.plexus:plexus-cipher:jar:1.4:compile
[INFO] +- org.apache.maven:maven-builder-support:jar:3.8.1:compile
(…snip…)
----
But plexus-cipher is not a transitive dependency of maven-core 3.8.2:
----
[INFO] org.example:plexus-cipher-mystery:jar:1.0-SNAPSHOT
[INFO] \- org.apache.maven:maven-core:jar:3.8.2:compile
[INFO] +- org.apache.maven:maven-model:jar:3.8.2:compile
[INFO] +- org.apache.maven:maven-settings:jar:3.8.2:compile
[INFO] +- org.apache.maven:maven-settings-builder:jar:3.8.2:compile
[INFO] | +- org.codehaus.plexus:plexus-interpolation:jar:1.25:compile
[INFO] | \- org.sonatype.plexus:plexus-sec-dispatcher:jar:1.4:compile
[INFO] +- org.apache.maven:maven-builder-support:jar:3.8.2:compile
(…snip…)
----
Both maven-core 3.8.1 and 3.8.2 have a transitive dependency on org.sonatype.plexus:plexus-sec-dispatcher:jar:1.4. The weird this is that when using maven-core 3.8.1 plexus-sec-dispatcher has a dependency on plexus-cipher, but when using maven-core 3.8.2 it doesn’t. How can this be?
The pom.xml of plexus-sec-dispatcher:1.4 (https://search.maven.org/artifact/org.sonatype.plexus/plexus-sec-dispatcher/1.4/jar) indeed declares a dependency on plexus-cipher 1.4, but it’s not there when depending on maven-core 3.8.2.
How can this be? And is this intentional? Is there an exclusion somewhere?
Nils Breunese.
Re: plexus-cipher missing from transitive dependencies of maven-core
3.8.2
Posted by Michael Osipov <mi...@apache.org>.
Am 2021-08-18 um 22:13 schrieb Nils Breunese:
> Michael Osipov <mi...@apache.org> wrote:
>
>> Please file an issue. I will add this to the known issues list then.
>
> Thanks for confirming this regression, I’ve filed it as a bug here: https://issues.apache.org/jira/browse/MNG-7219
Thanks, will take care soon. This one should be straight forward.
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@maven.apache.org
For additional commands, e-mail: users-help@maven.apache.org
Re: plexus-cipher missing from transitive dependencies of maven-core
3.8.2
Posted by Nils Breunese <ni...@breun.nl>.
Michael Osipov <mi...@apache.org> wrote:
> Please file an issue. I will add this to the known issues list then.
Thanks for confirming this regression, I’ve filed it as a bug here: https://issues.apache.org/jira/browse/MNG-7219
Nils.
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@maven.apache.org
For additional commands, e-mail: users-help@maven.apache.org
Re: plexus-cipher missing from transitive dependencies of maven-core
3.8.2
Posted by Michael Osipov <mi...@apache.org>.
Am 2021-08-17 um 13:44 schrieb Nils Breunese:
> Hi,
>
> I have a project that uses org.apache.maven.plugin-testing:maven-plugin-testing-harness:3.3.0 for testing a Maven plugin.
>
> After upgrading the project’s Maven dependencies to Maven 3.8.2 I got this error message when running tests:
>
> ----
> Error injecting: org.sonatype.plexus.components.sec.dispatcher.DefaultSecDispatcher
> java.lang.NoClassDefFoundError: org/sonatype/plexus/components/cipher/PlexusCipher ... 117 more
> ----
>
> PlexusCipher is a class in the plexus-cipher artifact, which is a transitive dependency of maven-core 3.8.1:
>
> ----
> [INFO] org.example:plexus-cipher-mystery:jar:1.0-SNAPSHOT
> [INFO] \- org.apache.maven:maven-core:jar:3.8.1:compile
> [INFO] +- org.apache.maven:maven-model:jar:3.8.1:compile
> [INFO] +- org.apache.maven:maven-settings:jar:3.8.1:compile
> [INFO] +- org.apache.maven:maven-settings-builder:jar:3.8.1:compile
> [INFO] | +- org.codehaus.plexus:plexus-interpolation:jar:1.25:compile
> [INFO] | \- org.sonatype.plexus:plexus-sec-dispatcher:jar:1.4:compile
> [INFO] | \- org.sonatype.plexus:plexus-cipher:jar:1.4:compile
> [INFO] +- org.apache.maven:maven-builder-support:jar:3.8.1:compile
> (…snip…)
> ----
>
> But plexus-cipher is not a transitive dependency of maven-core 3.8.2:
>
> ----
> [INFO] org.example:plexus-cipher-mystery:jar:1.0-SNAPSHOT
> [INFO] \- org.apache.maven:maven-core:jar:3.8.2:compile
> [INFO] +- org.apache.maven:maven-model:jar:3.8.2:compile
> [INFO] +- org.apache.maven:maven-settings:jar:3.8.2:compile
> [INFO] +- org.apache.maven:maven-settings-builder:jar:3.8.2:compile
> [INFO] | +- org.codehaus.plexus:plexus-interpolation:jar:1.25:compile
> [INFO] | \- org.sonatype.plexus:plexus-sec-dispatcher:jar:1.4:compile
> [INFO] +- org.apache.maven:maven-builder-support:jar:3.8.2:compile
> (…snip…)
> ----
>
> Both maven-core 3.8.1 and 3.8.2 have a transitive dependency on org.sonatype.plexus:plexus-sec-dispatcher:jar:1.4. The weird this is that when using maven-core 3.8.1 plexus-sec-dispatcher has a dependency on plexus-cipher, but when using maven-core 3.8.2 it doesn’t. How can this be?
>
> The pom.xml of plexus-sec-dispatcher:1.4 (https://search.maven.org/artifact/org.sonatype.plexus/plexus-sec-dispatcher/1.4/jar) indeed declares a dependency on plexus-cipher 1.4, but it’s not there when depending on maven-core 3.8.2.
>
> How can this be? And is this intentional? Is there an exclusion somewhere?
I can confirm that this is a regression caused by:
> commit 41efc134a9067b58a5ab01e9b8b05d2bd84a94f0
> Author: Olivier Lamy <ol...@apache.org>
> Date: 2020-04-10 01:17:25 +0200
>
> [MNG-6886] upgrade plexus-cipher to 1.8 and update changed groupId (#335)
>
> Signed-off-by: olivier lamy <ol...@apache.org>
>
A global exclusion was performed, but not all affected modules were
properly updated (so the change wasn't complete):
> [DEBUG] org.apache.maven:maven-settings-builder:jar:3.8.2
> [DEBUG] org.apache.maven:maven-builder-support:jar:3.8.2:compile
> [DEBUG] javax.inject:javax.inject:jar:1:compile
> [DEBUG] org.codehaus.plexus:plexus-interpolation:jar:1.25:compile
> [DEBUG] org.codehaus.plexus:plexus-utils:jar:3.2.1:compile
> [DEBUG] org.apache.maven:maven-settings:jar:3.8.2:compile
> [DEBUG] org.sonatype.plexus:plexus-sec-dispatcher:jar:1.4:compile (exclusions managed from [org.sonatype.plexus:plexus-cipher:*:*])
> [DEBUG] junit:junit:jar:4.12:test
> [DEBUG] org.hamcrest:hamcrest-core:jar:1.3:test (scope managed from compile) (version managed from 1.3)
> [INFO] org.apache.maven:maven-settings-builder:jar:3.8.2
> [INFO] +- org.apache.maven:maven-builder-support:jar:3.8.2:compile
> [INFO] +- javax.inject:javax.inject:jar:1:compile
> [INFO] +- org.codehaus.plexus:plexus-interpolation:jar:1.25:compile
> [INFO] +- org.codehaus.plexus:plexus-utils:jar:3.2.1:compile
> [INFO] +- org.apache.maven:maven-settings:jar:3.8.2:compile
> [INFO] +- org.sonatype.plexus:plexus-sec-dispatcher:jar:1.4:compile
> [INFO] \- junit:junit:jar:4.12:test
> [INFO] \- org.hamcrest:hamcrest-core:jar:1.3:test
Please file an issue. I will add this to the known issues list then.
Thank you for testing!
Michael
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@maven.apache.org
For additional commands, e-mail: users-help@maven.apache.org
Re: plexus-cipher missing from transitive dependencies of maven-core 3.8.2/3.8.3
Posted by Sr��an ��repfler <sc...@gmail.com>.
Thanks (köszönöm) Tamás!
Much appreciated for the PR, our dependencies were quite old as we haven't touched our plugin internals for ages. Thanks for being a maven community ambassador!
Kind regards,
Srdan
On 2021/10/09 07:57:49, Tamás Cservenák <ta...@cservenak.net> wrote:
> Zdravo Srdjane,
>
> Here is a PR that does what you want:
> https://github.com/schrepfler/jira-maven-plugin/pull/178
>
> With PR, plugins works okay with 3.8.3 but also 3.8.2.
>
> HTH
> Yamas
>
> On Fri, Oct 8, 2021 at 7:56 PM Srđan Šrepfler <sc...@gmail.com> wrote:
>
> > Hi,
> > I too have a dependency on
> > org.apache.maven.plugin-testing:maven-plugin-testing-harness:3.3.0
> >
> > After upgrading the project's Maven dependencies to Maven 3.8.3 which
> > addressed this issue I got this error message when running the tests
> >
> > 1) Error injecting constructor, java.lang.NoSuchMethodError:
> > org.sonatype.plexus.components.sec.dispatcher.DefaultSecDispatcher: method
> > <init>()V not found
> > at
> > org.sonatype.plexus.components.sec.dispatcher.DefaultSecDispatcher$__sisu9.<init>(Unknown
> > Source)
> > while locating
> > org.sonatype.plexus.components.sec.dispatcher.DefaultSecDispatcher$__sisu9
> > at ClassRealm[plexus.core, parent: null] (via modules:
> > org.eclipse.sisu.wire.WireModule ->
> > org.eclipse.sisu.plexus.PlexusBindingModule)
> > while locating
> > org.sonatype.plexus.components.sec.dispatcher.SecDispatcher annotated with
> > @com.google.inject.name.Named(value=maven)
> > for the 1st parameter of
> > org.apache.maven.settings.crypto.DefaultSettingsDecrypter.<init>(Unknown
> > Source)
> > at ClassRealm[plexus.core, parent: null] (via modules:
> > org.eclipse.sisu.wire.WireModule ->
> > org.eclipse.sisu.plexus.PlexusBindingModule)
> > while locating org.apache.maven.settings.crypto.DefaultSettingsDecrypter
> > while locating java.lang.Object annotated with *
> > while locating org.apache.maven.repository.legacy.LegacyRepositorySystem
> > at ClassRealm[plexus.core, parent: null] (via modules:
> > org.eclipse.sisu.wire.WireModule ->
> > org.eclipse.sisu.plexus.PlexusBindingModule)
> > while locating org.apache.maven.repository.RepositorySystem
> >
> > You can find the error here
> > https://github.com/schrepfler/jira-maven-plugin/pull/176/checks?check_run_id=3835361698#step:4:2138
> >
> > and the PR that caused the exception after dependabot pushed the upgrade
> > to 3.8.3 is here: https://github.com/schrepfler/jira-maven-plugin/pull/176
> >
> > Kind regards,
> > Srdan
> >
> >
> >
> > On 2021/08/17 11:44:28, Nils Breunese <ni...@breun.nl> wrote:
> > > Hi,
> > >
> > > I have a project that uses
> > org.apache.maven.plugin-testing:maven-plugin-testing-harness:3.3.0 for
> > testing a Maven plugin.
> > >
> > > After upgrading the project’s Maven dependencies to Maven 3.8.2 I got
> > this error message when running tests:
> > >
> > > ----
> > > Error injecting:
> > org.sonatype.plexus.components.sec.dispatcher.DefaultSecDispatcher
> > > java.lang.NoClassDefFoundError:
> > org/sonatype/plexus/components/cipher/PlexusCipher ... 117 more
> > > ----
> > >
> > > PlexusCipher is a class in the plexus-cipher artifact, which is a
> > transitive dependency of maven-core 3.8.1:
> > >
> > > ----
> > > [INFO] org.example:plexus-cipher-mystery:jar:1.0-SNAPSHOT
> > > [INFO] \- org.apache.maven:maven-core:jar:3.8.1:compile
> > > [INFO] +- org.apache.maven:maven-model:jar:3.8.1:compile
> > > [INFO] +- org.apache.maven:maven-settings:jar:3.8.1:compile
> > > [INFO] +- org.apache.maven:maven-settings-builder:jar:3.8.1:compile
> > > [INFO] | +- org.codehaus.plexus:plexus-interpolation:jar:1.25:compile
> > > [INFO] | \- org.sonatype.plexus:plexus-sec-dispatcher:jar:1.4:compile
> > > [INFO] | \- org.sonatype.plexus:plexus-cipher:jar:1.4:compile
> > > [INFO] +- org.apache.maven:maven-builder-support:jar:3.8.1:compile
> > > (…snip…)
> > > ----
> > >
> > > But plexus-cipher is not a transitive dependency of maven-core 3.8.2:
> > >
> > > ----
> > > [INFO] org.example:plexus-cipher-mystery:jar:1.0-SNAPSHOT
> > > [INFO] \- org.apache.maven:maven-core:jar:3.8.2:compile
> > > [INFO] +- org.apache.maven:maven-model:jar:3.8.2:compile
> > > [INFO] +- org.apache.maven:maven-settings:jar:3.8.2:compile
> > > [INFO] +- org.apache.maven:maven-settings-builder:jar:3.8.2:compile
> > > [INFO] | +- org.codehaus.plexus:plexus-interpolation:jar:1.25:compile
> > > [INFO] | \- org.sonatype.plexus:plexus-sec-dispatcher:jar:1.4:compile
> > > [INFO] +- org.apache.maven:maven-builder-support:jar:3.8.2:compile
> > > (…snip…)
> > > ----
> > >
> > > Both maven-core 3.8.1 and 3.8.2 have a transitive dependency on
> > org.sonatype.plexus:plexus-sec-dispatcher:jar:1.4. The weird this is that
> > when using maven-core 3.8.1 plexus-sec-dispatcher has a dependency on
> > plexus-cipher, but when using maven-core 3.8.2 it doesn’t. How can this be?
> > >
> > > The pom.xml of plexus-sec-dispatcher:1.4 (
> > https://search.maven.org/artifact/org.sonatype.plexus/plexus-sec-dispatcher/1.4/jar)
> > indeed declares a dependency on plexus-cipher 1.4, but it’s not there when
> > depending on maven-core 3.8.2.
> > >
> > > How can this be? And is this intentional? Is there an exclusion
> > somewhere?
> > >
> > > Nils Breunese.
> >
> > ---------------------------------------------------------------------
> > To unsubscribe, e-mail: users-unsubscribe@maven.apache.org
> > For additional commands, e-mail: users-help@maven.apache.org
> >
> >
>
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@maven.apache.org
For additional commands, e-mail: users-help@maven.apache.org
Re: plexus-cipher missing from transitive dependencies of maven-core 3.8.2/3.8.3
Posted by Tamás Cservenák <ta...@cservenak.net>.
Zdravo Srdjane,
Here is a PR that does what you want:
https://github.com/schrepfler/jira-maven-plugin/pull/178
With PR, plugins works okay with 3.8.3 but also 3.8.2.
HTH
Yamas
On Fri, Oct 8, 2021 at 7:56 PM Srđan Šrepfler <sc...@gmail.com> wrote:
> Hi,
> I too have a dependency on
> org.apache.maven.plugin-testing:maven-plugin-testing-harness:3.3.0
>
> After upgrading the project's Maven dependencies to Maven 3.8.3 which
> addressed this issue I got this error message when running the tests
>
> 1) Error injecting constructor, java.lang.NoSuchMethodError:
> org.sonatype.plexus.components.sec.dispatcher.DefaultSecDispatcher: method
> <init>()V not found
> at
> org.sonatype.plexus.components.sec.dispatcher.DefaultSecDispatcher$__sisu9.<init>(Unknown
> Source)
> while locating
> org.sonatype.plexus.components.sec.dispatcher.DefaultSecDispatcher$__sisu9
> at ClassRealm[plexus.core, parent: null] (via modules:
> org.eclipse.sisu.wire.WireModule ->
> org.eclipse.sisu.plexus.PlexusBindingModule)
> while locating
> org.sonatype.plexus.components.sec.dispatcher.SecDispatcher annotated with
> @com.google.inject.name.Named(value=maven)
> for the 1st parameter of
> org.apache.maven.settings.crypto.DefaultSettingsDecrypter.<init>(Unknown
> Source)
> at ClassRealm[plexus.core, parent: null] (via modules:
> org.eclipse.sisu.wire.WireModule ->
> org.eclipse.sisu.plexus.PlexusBindingModule)
> while locating org.apache.maven.settings.crypto.DefaultSettingsDecrypter
> while locating java.lang.Object annotated with *
> while locating org.apache.maven.repository.legacy.LegacyRepositorySystem
> at ClassRealm[plexus.core, parent: null] (via modules:
> org.eclipse.sisu.wire.WireModule ->
> org.eclipse.sisu.plexus.PlexusBindingModule)
> while locating org.apache.maven.repository.RepositorySystem
>
> You can find the error here
> https://github.com/schrepfler/jira-maven-plugin/pull/176/checks?check_run_id=3835361698#step:4:2138
>
> and the PR that caused the exception after dependabot pushed the upgrade
> to 3.8.3 is here: https://github.com/schrepfler/jira-maven-plugin/pull/176
>
> Kind regards,
> Srdan
>
>
>
> On 2021/08/17 11:44:28, Nils Breunese <ni...@breun.nl> wrote:
> > Hi,
> >
> > I have a project that uses
> org.apache.maven.plugin-testing:maven-plugin-testing-harness:3.3.0 for
> testing a Maven plugin.
> >
> > After upgrading the project’s Maven dependencies to Maven 3.8.2 I got
> this error message when running tests:
> >
> > ----
> > Error injecting:
> org.sonatype.plexus.components.sec.dispatcher.DefaultSecDispatcher
> > java.lang.NoClassDefFoundError:
> org/sonatype/plexus/components/cipher/PlexusCipher ... 117 more
> > ----
> >
> > PlexusCipher is a class in the plexus-cipher artifact, which is a
> transitive dependency of maven-core 3.8.1:
> >
> > ----
> > [INFO] org.example:plexus-cipher-mystery:jar:1.0-SNAPSHOT
> > [INFO] \- org.apache.maven:maven-core:jar:3.8.1:compile
> > [INFO] +- org.apache.maven:maven-model:jar:3.8.1:compile
> > [INFO] +- org.apache.maven:maven-settings:jar:3.8.1:compile
> > [INFO] +- org.apache.maven:maven-settings-builder:jar:3.8.1:compile
> > [INFO] | +- org.codehaus.plexus:plexus-interpolation:jar:1.25:compile
> > [INFO] | \- org.sonatype.plexus:plexus-sec-dispatcher:jar:1.4:compile
> > [INFO] | \- org.sonatype.plexus:plexus-cipher:jar:1.4:compile
> > [INFO] +- org.apache.maven:maven-builder-support:jar:3.8.1:compile
> > (…snip…)
> > ----
> >
> > But plexus-cipher is not a transitive dependency of maven-core 3.8.2:
> >
> > ----
> > [INFO] org.example:plexus-cipher-mystery:jar:1.0-SNAPSHOT
> > [INFO] \- org.apache.maven:maven-core:jar:3.8.2:compile
> > [INFO] +- org.apache.maven:maven-model:jar:3.8.2:compile
> > [INFO] +- org.apache.maven:maven-settings:jar:3.8.2:compile
> > [INFO] +- org.apache.maven:maven-settings-builder:jar:3.8.2:compile
> > [INFO] | +- org.codehaus.plexus:plexus-interpolation:jar:1.25:compile
> > [INFO] | \- org.sonatype.plexus:plexus-sec-dispatcher:jar:1.4:compile
> > [INFO] +- org.apache.maven:maven-builder-support:jar:3.8.2:compile
> > (…snip…)
> > ----
> >
> > Both maven-core 3.8.1 and 3.8.2 have a transitive dependency on
> org.sonatype.plexus:plexus-sec-dispatcher:jar:1.4. The weird this is that
> when using maven-core 3.8.1 plexus-sec-dispatcher has a dependency on
> plexus-cipher, but when using maven-core 3.8.2 it doesn’t. How can this be?
> >
> > The pom.xml of plexus-sec-dispatcher:1.4 (
> https://search.maven.org/artifact/org.sonatype.plexus/plexus-sec-dispatcher/1.4/jar)
> indeed declares a dependency on plexus-cipher 1.4, but it’s not there when
> depending on maven-core 3.8.2.
> >
> > How can this be? And is this intentional? Is there an exclusion
> somewhere?
> >
> > Nils Breunese.
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: users-unsubscribe@maven.apache.org
> For additional commands, e-mail: users-help@maven.apache.org
>
>
Re: plexus-cipher missing from transitive dependencies of maven-core 3.8.2/3.8.3
Posted by Sr��an ��repfler <sc...@gmail.com>.
Hi,
I too have a dependency on org.apache.maven.plugin-testing:maven-plugin-testing-harness:3.3.0
After upgrading the project's Maven dependencies to Maven 3.8.3 which addressed this issue I got this error message when running the tests
1) Error injecting constructor, java.lang.NoSuchMethodError: org.sonatype.plexus.components.sec.dispatcher.DefaultSecDispatcher: method <init>()V not found
at org.sonatype.plexus.components.sec.dispatcher.DefaultSecDispatcher$__sisu9.<init>(Unknown Source)
while locating org.sonatype.plexus.components.sec.dispatcher.DefaultSecDispatcher$__sisu9
at ClassRealm[plexus.core, parent: null] (via modules: org.eclipse.sisu.wire.WireModule -> org.eclipse.sisu.plexus.PlexusBindingModule)
while locating org.sonatype.plexus.components.sec.dispatcher.SecDispatcher annotated with @com.google.inject.name.Named(value=maven)
for the 1st parameter of org.apache.maven.settings.crypto.DefaultSettingsDecrypter.<init>(Unknown Source)
at ClassRealm[plexus.core, parent: null] (via modules: org.eclipse.sisu.wire.WireModule -> org.eclipse.sisu.plexus.PlexusBindingModule)
while locating org.apache.maven.settings.crypto.DefaultSettingsDecrypter
while locating java.lang.Object annotated with *
while locating org.apache.maven.repository.legacy.LegacyRepositorySystem
at ClassRealm[plexus.core, parent: null] (via modules: org.eclipse.sisu.wire.WireModule -> org.eclipse.sisu.plexus.PlexusBindingModule)
while locating org.apache.maven.repository.RepositorySystem
You can find the error here https://github.com/schrepfler/jira-maven-plugin/pull/176/checks?check_run_id=3835361698#step:4:2138
and the PR that caused the exception after dependabot pushed the upgrade to 3.8.3 is here: https://github.com/schrepfler/jira-maven-plugin/pull/176
Kind regards,
Srdan
On 2021/08/17 11:44:28, Nils Breunese <ni...@breun.nl> wrote:
> Hi,
>
> I have a project that uses org.apache.maven.plugin-testing:maven-plugin-testing-harness:3.3.0 for testing a Maven plugin.
>
> After upgrading the project’s Maven dependencies to Maven 3.8.2 I got this error message when running tests:
>
> ----
> Error injecting: org.sonatype.plexus.components.sec.dispatcher.DefaultSecDispatcher
> java.lang.NoClassDefFoundError: org/sonatype/plexus/components/cipher/PlexusCipher ... 117 more
> ----
>
> PlexusCipher is a class in the plexus-cipher artifact, which is a transitive dependency of maven-core 3.8.1:
>
> ----
> [INFO] org.example:plexus-cipher-mystery:jar:1.0-SNAPSHOT
> [INFO] \- org.apache.maven:maven-core:jar:3.8.1:compile
> [INFO] +- org.apache.maven:maven-model:jar:3.8.1:compile
> [INFO] +- org.apache.maven:maven-settings:jar:3.8.1:compile
> [INFO] +- org.apache.maven:maven-settings-builder:jar:3.8.1:compile
> [INFO] | +- org.codehaus.plexus:plexus-interpolation:jar:1.25:compile
> [INFO] | \- org.sonatype.plexus:plexus-sec-dispatcher:jar:1.4:compile
> [INFO] | \- org.sonatype.plexus:plexus-cipher:jar:1.4:compile
> [INFO] +- org.apache.maven:maven-builder-support:jar:3.8.1:compile
> (…snip…)
> ----
>
> But plexus-cipher is not a transitive dependency of maven-core 3.8.2:
>
> ----
> [INFO] org.example:plexus-cipher-mystery:jar:1.0-SNAPSHOT
> [INFO] \- org.apache.maven:maven-core:jar:3.8.2:compile
> [INFO] +- org.apache.maven:maven-model:jar:3.8.2:compile
> [INFO] +- org.apache.maven:maven-settings:jar:3.8.2:compile
> [INFO] +- org.apache.maven:maven-settings-builder:jar:3.8.2:compile
> [INFO] | +- org.codehaus.plexus:plexus-interpolation:jar:1.25:compile
> [INFO] | \- org.sonatype.plexus:plexus-sec-dispatcher:jar:1.4:compile
> [INFO] +- org.apache.maven:maven-builder-support:jar:3.8.2:compile
> (…snip…)
> ----
>
> Both maven-core 3.8.1 and 3.8.2 have a transitive dependency on org.sonatype.plexus:plexus-sec-dispatcher:jar:1.4. The weird this is that when using maven-core 3.8.1 plexus-sec-dispatcher has a dependency on plexus-cipher, but when using maven-core 3.8.2 it doesn’t. How can this be?
>
> The pom.xml of plexus-sec-dispatcher:1.4 (https://search.maven.org/artifact/org.sonatype.plexus/plexus-sec-dispatcher/1.4/jar) indeed declares a dependency on plexus-cipher 1.4, but it’s not there when depending on maven-core 3.8.2.
>
> How can this be? And is this intentional? Is there an exclusion somewhere?
>
> Nils Breunese.
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@maven.apache.org
For additional commands, e-mail: users-help@maven.apache.org