You are viewing a plain text version of this content. The canonical link for it is here.
Posted to issues@maven.apache.org by "James Nord (Jira)" <ji...@apache.org> on 2025/01/10 10:34:00 UTC
[jira] [Created] (MENFORCER-517) requireReleaseDeps ignores optioanal dependencies
James Nord created MENFORCER-517:
------------------------------------
Summary: requireReleaseDeps ignores optioanal dependencies
Key: MENFORCER-517
URL: https://issues.apache.org/jira/browse/MENFORCER-517
Project: Maven Enforcer Plugin
Issue Type: Bug
Components: requireReleaseDeps
Affects Versions: 3.5.0
Environment: Apache Maven 3.9.9 (8e8579a9e76f7d015ee5ec7bfcdc97d260186937)
Maven home: c:\Java\maven-3.9.9
Java version: 17.0.9, vendor: Eclipse Adoptium, runtime: c:\java\jdk-17.0.9.9-hotspot
Default locale: en_GB, platform encoding: Cp1252
OS name: "windows 11", version: "10.0", arch: "amd64", family: "windows"
Reporter: James Nord
A project configured with an optional dependency with a snapshot version and enforcer with {{requireReleaseDeps}} set to fail should fail the build, however the rule does not look at optional dependencies.
Whilst this makes not difference to consumers, it means that {{requireReleaseDeps}} can not be used to help enforce the reproducibility of release builds.
h3. Steps to Reproduce
create a maven pom with the following:
{code:java}
<?xml version="1.0" encoding="utf-8"?>
<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd">
<modelVersion>4.0.0</modelVersion> <groupId>maven.test</groupId>
<artifactId>enforcer-bug</artifactId>
<packaging>jar</packaging>
<version>1-SNAPSHOT</version> <build>
<pluginManagement>
<plugins>
<plugin>
<artifactId>maven-enforcer-plugin</artifactId>
<version>3.5.0</version>
</plugin>
</plugins>
</pluginManagement> <plugins>
<plugin>
<artifactId>maven-enforcer-plugin</artifactId>
<executions>
<execution>
<id>enforce-no-snapshots</id>
<goals>
<goal>enforce</goal>
</goals>
<configuration>
<rules>
<requireReleaseDeps>
<message>No Snapshots Allowed For Release Versions</message>
<onlyWhenRelease>false</onlyWhenRelease>
</requireReleaseDeps>
</rules>
<fail>true</fail>
<skip>false</skip>
</configuration>
</execution>
</executions>
</plugin>
</plugins>
</build> <dependencies>
<dependency>
<groupId>junit</groupId>
<artifactId>junit</artifactId>
<version>4.1-SNAPSHOT</version>
<type>jar</type>
<scope>test</scope>
<optional>true</optional>
</dependency>
</dependencies></project>
{code}
run {{mvn validate}}
h3. Expected results
The build fails with
{code:java}
[ERROR] Failed to execute goal org.apache.maven.plugins:maven-enforcer-plugin:3.5.0:enforce (enforce-no-snapshots) on project enforcer-bug:
[ERROR] Rule 0: org.apache.maven.enforcer.rules.dependency.RequireReleaseDeps failed with message:
[ERROR] No Snapshots Allowed For Release Versions
[ERROR] maven.test:enforcer-bug:jar:1-SNAPSHOT
[ERROR] junit:junit:jar:4.1-SNAPSHOT <--- is not a release dependency {code}
h3. Actual results
the build passes
{code:java}
[INFO] Rule 0: org.apache.maven.enforcer.rules.dependency.RequireReleaseDeps passed {code}
Note if you remove the {{<optional>true</optional>}} from the dependency you will see that the enforcer rule passes
--
This message was sent by Atlassian Jira
(v8.20.10#820010)