You are viewing a plain text version of this content. The canonical link for it is here.

Posted to issues@maven.apache.org by "Daniel Norberg (Jira)" <ji...@apache.org> on 2022/01/04 15:44:00 UTC

[jira] [Created] (MSHARED-1016) Transitive provided dependencies are not removed from collected dependency graph

Daniel Norberg created MSHARED-1016:
---------------------------------------

             Summary: Transitive provided dependencies are not removed from collected dependency graph
                 Key: MSHARED-1016
                 URL: https://issues.apache.org/jira/browse/MSHARED-1016
             Project: Maven Shared Components
          Issue Type: Bug
          Components: maven-dependency-tree
    Affects Versions: maven-dependency-tree-3.1.0
            Reporter: Daniel Norberg


DependencyCollectorBuilder#collectDependencyGraph returns a dependency graph containing transitive provided scope dependencies. This is inconsistent with Maven behavior, which removes transitive provided scope dependencies from the dependency graph:

[https://github.com/apache/maven/blob/706d9319f14b507f3c3deeba4eeda1a51a531c9b/maven-resolver-provider/src/main/java/org/apache/maven/repository/internal/MavenRepositorySystemUtils.java#L80|https://github.com/apache/maven/blob/706d9319f14b507f3c3deeba4eeda1a51a531c9b/maven-resolver-provider/src/main/java/org/apache/maven/repository/internal/MavenRepositorySystemUtils.java#L80.]

This might be the root cause of https://issues.apache.org/jira/browse/MENFORCER-402 and https://issues.apache.org/jira/browse/MENFORCER-394

Note that transitive test scope dependencies are correctly filtered out using a dependency selector.

It seems to me that we can add another dependency selector to also filter out transitive provided scope dependencies:

[https://github.com/apache/maven-dependency-tree/blob/7a1a12533ac6898fcb3dacbcf2466ef71d11c43a/src/main/java/org/apache/maven/shared/dependency/graph/internal/Maven31DependencyCollectorBuilder.java#L108|https://github.com/apache/maven-dependency-tree/blob/master/src/main/java/org/apache/maven/shared/dependency/graph/internal/Maven31DependencyCollectorBuilder.java#L108]

[https://github.com/apache/maven-dependency-tree/blob/7a1a12533ac6898fcb3dacbcf2466ef71d11c43a/src/main/java/org/apache/maven/shared/dependency/graph/internal/Maven3DependencyCollectorBuilder.java#L108]

I have submitted a PR to do this: [https://github.com/apache/maven-dependency-tree/pull/9]

 

 

 

 



--
This message was sent by Atlassian Jira
(v8.20.1#820001)