[jira] [Comment Edited] (MENFORCER-385) Enforce that transitive provided dependencies of direct dependencies are directly declared

["Konrad Windszus (Jira)" <ji...@apache.org>]

    [ https://issues.apache.org/jira/browse/MENFORCER-385?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17349318#comment-17349318 ] 

Konrad Windszus edited comment on MENFORCER-385 at 5/21/21, 3:25 PM:
---------------------------------------------------------------------

{{dependency:analyze}} is not able to detect such situations ([http://maven.apache.org/plugins/maven-dependency-plugin/analyze-mojo.html)] either as it disregards class files not contained in the dependency tree (https://github.com/apache/maven-dependency-analyzer/blob/372fe2a0cad9678dcf38617dab9a7b45597bc8b1/src/main/java/org/apache/maven/shared/dependency/analyzer/DefaultProjectDependencyAnalyzer.java#L80)


was (Author: kwin):
{{dependency:analyze}} is not able to detect such situations ([http://maven.apache.org/plugins/maven-dependency-plugin/analyze-mojo.html)] either as it only checks local class files, but not those of dependencies....

> Enforce that transitive provided dependencies of direct dependencies are directly declared
> ------------------------------------------------------------------------------------------
>
>                 Key: MENFORCER-385
>                 URL: https://issues.apache.org/jira/browse/MENFORCER-385
>             Project: Maven Enforcer Plugin
>          Issue Type: Improvement
>          Components: Standard Rules
>            Reporter: Konrad Windszus
>            Priority: Major
>
> All dependencies with {{provided}} scope are not transitively inherited. While this isn't a problem usually during compile time it is a problem for Maven plugins at run time, as they use the Maven dependency classpath also at run time. At run time they fail if the transitive provided dependency has not been declared explicitly.
> As manually specifying all transitive (but hidden) {{provided}} dependencies is a very error-prone process a enforcer rule for that would be highly beneficial. Especially as the transitive dependencies have to be rechecked once you upgrade to a newer version.
> Example:
> {code:java}
> My Maven Plugin "A" -> 3rd Party Library "B" -> Provided Dependency "C"{code}
> As "B" uses "C" at run time it needs to be declared as dependency of "A" as well otherwise you might see  {{java.lang.ClassNotFoundException}} when executing Maven plugin "A".



--
This message was sent by Atlassian Jira
(v8.3.4#803005)