[jira] [Created] (MNG-7773) Exclusion inside a transitive dependency overrides global visibility of excluded dependency

["Max Schaefer (Jira)" <ji...@apache.org>]

Max Schaefer created MNG-7773:
---------------------------------

             Summary: Exclusion inside a transitive dependency overrides global visibility of excluded dependency
                 Key: MNG-7773
                 URL: https://issues.apache.org/jira/browse/MNG-7773
             Project: Maven
          Issue Type: Bug
          Components: Dependencies
    Affects Versions: 3.8.8
         Environment: Apache Maven 3.8.8 (4c87b05d9aedce574290d1acc98575ed5eb6cd39)
Maven home: C:\DEV\apache-maven
Java version: 11.0.17, vendor: Amazon.com Inc., runtime: C:\DEV\amazon-corretto-windows-x64-jdk-javafx-11.0.17.8.1
Default locale: en_US, platform encoding: Cp1252
OS name: "windows 10", version: "10.0", arch: "amd64", family: "windows"
            Reporter: Max Schaefer
         Attachments: dependencyTestWithFailure.zip

The attached example project has basically these maven dependencies:
{code:java}
sample.ProjectX:Project-X:jar
\- sample.ProjectY:Project-Y:jar
   \- sample.ProjectB:Project-B:jar
      \- sample.ProjectC:Project-C:jar
         \- sample.ProjectD:Project-D:jar
\- sample.ProjectA:Project-A:jar
   \- sample.ProjectC:Project-C:jar {code}
In Project-X there is class X which uses class D from Project-D

However, in Project-A's pom there is an exclusion of Project-D on dependency of Project-C 

That is causing Project-D to disappear from the build path of Project-X causing the build to fail.

When removing dependency of Project-A from Project-X then the build works fine.

The attached project is just to demo the problem that when adding some third-party dependency to my pom some other transitive dependency can inexpertly disappear from my dependencies.

Especially on huge projects with lots of dependencies this can be very tricky to spot.

The disappeared dependency might contain stuff just needed at runtime by the depending third-party (so not my own project).

 

 

 



--
This message was sent by Atlassian Jira
(v8.20.10#820010)