[JBoss JIRA] (SHRINKWRAP-345) MavenDependencyResolver resolves wrong version or scope for transitive dependencies when using <dependencyManagement>
11:09 p.m.
MavenDependencyResolver resolves wrong version or scope for transitive dependencies when
using <dependencyManagement>
---------------------------------------------------------------------------------------------------------------------
Key: SHRINKWRAP-345
URL: https://issues.jboss.org/browse/SHRINKWRAP-345
Project: ShrinkWrap
Issue Type: Bug
Components: ext-resolver
Affects Versions: resolver-1.1.0-alpha-1
Reporter: Mike Pettypiece
Using includesDependenciesFromPom() followed by resolveAsFiles() can produce a transitive
dependency with the wrong scope or version if it is defined in the
<dependencyManagment> section of the POM.
e.g.:
<dependencyManagement>
<dependencies>
<dependency>
<groupId>commons-logging</groupId>
<artifactId>commons-logging</artifactId>
<version>1.1</version>
</dependency>
</dependencies>
</dependencyManagement>
<dependencies>
<dependency>
<groupId>commons-beanutils</groupId>
<artifactId>commons-beanutils</artifactId>
<version>1.7.0</version>
<exclusions>
<exclusion>
<artifactId>servlet-api</artifactId>
<groupId>javax.servlet</groupId>
</exclusion>
</exclusions>
</dependency>
<dependencies>
common-beanutils depends on common-logging:1.0.3 but we've specified a higher version
in the <dependencyManagement> section. A 'mvn package' will put
common-logging:1.1 in the WEB-INF/lib directory but the following code will spit out a
version of 1.0.3:
File[] files =
DependencyResolvers.use( MavenDependencyResolver.class )
.useCentralRepo( false )
.configureFrom( System.getProperty( "user.home" ) +
"/.m2/settings.xml" )
.includeDependenciesFromPom( "pom.xml" )
.resolveAsFiles( new ScopeFilter( "compile", "runtime" ) );
for ( File f : files )
{
System.out.println( f.getName() );
}
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators:
https://issues.jboss.org/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira
11:11 p.m.
[
https://issues.jboss.org/browse/SHRINKWRAP-345?page=com.atlassian.jira.pl...
]
Mike Pettypiece edited comment on SHRINKWRAP-345 at 10/20/11 5:11 PM:
----------------------------------------------------------------------
Example project attached
was (Author: mtpettyp):
Example project
MavenDependencyResolver resolves wrong version or scope for
transitive dependencies when using <dependencyManagement>
---------------------------------------------------------------------------------------------------------------------
Key: SHRINKWRAP-345
URL: https://issues.jboss.org/browse/SHRINKWRAP-345
Project: ShrinkWrap
Issue Type: Bug
Components: ext-resolver
Affects Versions: resolver-1.1.0-alpha-1
Reporter: Mike Pettypiece
Attachments: maven-test.zip
Using includesDependenciesFromPom() followed by resolveAsFiles() can produce a transitive
dependency with the wrong scope or version if it is defined in the
<dependencyManagment> section of the POM.
e.g.:
<dependencyManagement>
<dependencies>
<dependency>
<groupId>commons-logging</groupId>
<artifactId>commons-logging</artifactId>
<version>1.1</version>
</dependency>
</dependencies>
</dependencyManagement>
<dependencies>
<dependency>
<groupId>commons-beanutils</groupId>
<artifactId>commons-beanutils</artifactId>
<version>1.7.0</version>
<exclusions>
<exclusion>
<artifactId>servlet-api</artifactId>
<groupId>javax.servlet</groupId>
</exclusion>
</exclusions>
</dependency>
<dependencies>
common-beanutils depends on common-logging:1.0.3 but we've specified a higher version
in the <dependencyManagement> section. A 'mvn package' will put
common-logging:1.1 in the WEB-INF/lib directory but the following code will spit out a
version of 1.0.3:
File[] files =
DependencyResolvers.use( MavenDependencyResolver.class )
.useCentralRepo( false )
.configureFrom( System.getProperty( "user.home" ) +
"/.m2/settings.xml" )
.includeDependenciesFromPom( "pom.xml" )
.resolveAsFiles( new ScopeFilter( "compile", "runtime" ) );
for ( File f : files )
{
System.out.println( f.getName() );
}
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators:
https://issues.jboss.org/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira
11:11 p.m.
[
https://issues.jboss.org/browse/SHRINKWRAP-345?page=com.atlassian.jira.pl...
]
Mike Pettypiece updated SHRINKWRAP-345:
---------------------------------------
Attachment: maven-test.zip
Example project
MavenDependencyResolver resolves wrong version or scope for
transitive dependencies when using <dependencyManagement>
---------------------------------------------------------------------------------------------------------------------
Key: SHRINKWRAP-345
URL: https://issues.jboss.org/browse/SHRINKWRAP-345
Project: ShrinkWrap
Issue Type: Bug
Components: ext-resolver
Affects Versions: resolver-1.1.0-alpha-1
Reporter: Mike Pettypiece
Attachments: maven-test.zip
Using includesDependenciesFromPom() followed by resolveAsFiles() can produce a transitive
dependency with the wrong scope or version if it is defined in the
<dependencyManagment> section of the POM.
e.g.:
<dependencyManagement>
<dependencies>
<dependency>
<groupId>commons-logging</groupId>
<artifactId>commons-logging</artifactId>
<version>1.1</version>
</dependency>
</dependencies>
</dependencyManagement>
<dependencies>
<dependency>
<groupId>commons-beanutils</groupId>
<artifactId>commons-beanutils</artifactId>
<version>1.7.0</version>
<exclusions>
<exclusion>
<artifactId>servlet-api</artifactId>
<groupId>javax.servlet</groupId>
</exclusion>
</exclusions>
</dependency>
<dependencies>
common-beanutils depends on common-logging:1.0.3 but we've specified a higher version
in the <dependencyManagement> section. A 'mvn package' will put
common-logging:1.1 in the WEB-INF/lib directory but the following code will spit out a
version of 1.0.3:
File[] files =
DependencyResolvers.use( MavenDependencyResolver.class )
.useCentralRepo( false )
.configureFrom( System.getProperty( "user.home" ) +
"/.m2/settings.xml" )
.includeDependenciesFromPom( "pom.xml" )
.resolveAsFiles( new ScopeFilter( "compile", "runtime" ) );
for ( File f : files )
{
System.out.println( f.getName() );
}
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators:
https://issues.jboss.org/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira
11:15 p.m.
[
https://issues.jboss.org/browse/SHRINKWRAP-345?page=com.atlassian.jira.pl...
]
Mike Pettypiece commented on SHRINKWRAP-345:
--------------------------------------------
This appears to occur because the transitive dependencies are not loaded in
includedDependenciesFromPom(). By the time the transitive dependencies are loaded (in
resolveAsFiles()) none of the POM dependencyManagement information is available.
MavenDependencyResolver resolves wrong version or scope for
transitive dependencies when using <dependencyManagement>
---------------------------------------------------------------------------------------------------------------------
Key: SHRINKWRAP-345
URL: https://issues.jboss.org/browse/SHRINKWRAP-345
Project: ShrinkWrap
Issue Type: Bug
Components: ext-resolver
Affects Versions: resolver-1.1.0-alpha-1
Reporter: Mike Pettypiece
Attachments: maven-test.zip
Using includesDependenciesFromPom() followed by resolveAsFiles() can produce a transitive
dependency with the wrong scope or version if it is defined in the
<dependencyManagment> section of the POM.
e.g.:
<dependencyManagement>
<dependencies>
<dependency>
<groupId>commons-logging</groupId>
<artifactId>commons-logging</artifactId>
<version>1.1</version>
</dependency>
</dependencies>
</dependencyManagement>
<dependencies>
<dependency>
<groupId>commons-beanutils</groupId>
<artifactId>commons-beanutils</artifactId>
<version>1.7.0</version>
<exclusions>
<exclusion>
<artifactId>servlet-api</artifactId>
<groupId>javax.servlet</groupId>
</exclusion>
</exclusions>
</dependency>
<dependencies>
common-beanutils depends on common-logging:1.0.3 but we've specified a higher version
in the <dependencyManagement> section. A 'mvn package' will put
common-logging:1.1 in the WEB-INF/lib directory but the following code will spit out a
version of 1.0.3:
File[] files =
DependencyResolvers.use( MavenDependencyResolver.class )
.useCentralRepo( false )
.configureFrom( System.getProperty( "user.home" ) +
"/.m2/settings.xml" )
.includeDependenciesFromPom( "pom.xml" )
.resolveAsFiles( new ScopeFilter( "compile", "runtime" ) );
for ( File f : files )
{
System.out.println( f.getName() );
}
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators:
https://issues.jboss.org/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira
11:17 p.m.
[
https://issues.jboss.org/browse/SHRINKWRAP-345?page=com.atlassian.jira.pl...
]
Mike Pettypiece updated SHRINKWRAP-345:
---------------------------------------
Workaround Description: Include each transitive dependency in the <dependencies>
section
MavenDependencyResolver resolves wrong version or scope for
transitive dependencies when using <dependencyManagement>
---------------------------------------------------------------------------------------------------------------------
Key: SHRINKWRAP-345
URL: https://issues.jboss.org/browse/SHRINKWRAP-345
Project: ShrinkWrap
Issue Type: Bug
Components: ext-resolver
Affects Versions: resolver-1.1.0-alpha-1
Reporter: Mike Pettypiece
Attachments: maven-test.zip
Using includesDependenciesFromPom() followed by resolveAsFiles() can produce a transitive
dependency with the wrong scope or version if it is defined in the
<dependencyManagment> section of the POM.
e.g.:
<dependencyManagement>
<dependencies>
<dependency>
<groupId>commons-logging</groupId>
<artifactId>commons-logging</artifactId>
<version>1.1</version>
</dependency>
</dependencies>
</dependencyManagement>
<dependencies>
<dependency>
<groupId>commons-beanutils</groupId>
<artifactId>commons-beanutils</artifactId>
<version>1.7.0</version>
<exclusions>
<exclusion>
<artifactId>servlet-api</artifactId>
<groupId>javax.servlet</groupId>
</exclusion>
</exclusions>
</dependency>
<dependencies>
common-beanutils depends on common-logging:1.0.3 but we've specified a higher version
in the <dependencyManagement> section. A 'mvn package' will put
common-logging:1.1 in the WEB-INF/lib directory but the following code will spit out a
version of 1.0.3:
File[] files =
DependencyResolvers.use( MavenDependencyResolver.class )
.useCentralRepo( false )
.configureFrom( System.getProperty( "user.home" ) +
"/.m2/settings.xml" )
.includeDependenciesFromPom( "pom.xml" )
.resolveAsFiles( new ScopeFilter( "compile", "runtime" ) );
for ( File f : files )
{
System.out.println( f.getName() );
}
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators:
https://issues.jboss.org/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira
4:47 p.m.
[
https://issues.jboss.org/browse/SHRINKWRAP-345?page=com.atlassian.jira.pl...
]
Karel Piwko updated SHRINKWRAP-345:
-----------------------------------
Assignee: Karel Piwko
Fix Version/s: resolver-2.0.0-alpha-1
Affects Version/s: 1.0.0-beta-5
(was: resolver-1.1.0-alpha-1)
Thanks for the test. I'll try it to on newest development branch, where we reworked
the internals and dependencyManagement was added to Aether resolution, which should fix
your issue.
MavenDependencyResolver resolves wrong version or scope for
transitive dependencies when using <dependencyManagement>
---------------------------------------------------------------------------------------------------------------------
Key: SHRINKWRAP-345
URL: https://issues.jboss.org/browse/SHRINKWRAP-345
Project: ShrinkWrap
Issue Type: Bug
Components: ext-resolver
Affects Versions: 1.0.0-beta-5
Reporter: Mike Pettypiece
Assignee: Karel Piwko
Fix For: resolver-2.0.0-alpha-1
Attachments: maven-test.zip
Using includesDependenciesFromPom() followed by resolveAsFiles() can produce a transitive
dependency with the wrong scope or version if it is defined in the
<dependencyManagment> section of the POM.
e.g.:
<dependencyManagement>
<dependencies>
<dependency>
<groupId>commons-logging</groupId>
<artifactId>commons-logging</artifactId>
<version>1.1</version>
</dependency>
</dependencies>
</dependencyManagement>
<dependencies>
<dependency>
<groupId>commons-beanutils</groupId>
<artifactId>commons-beanutils</artifactId>
<version>1.7.0</version>
<exclusions>
<exclusion>
<artifactId>servlet-api</artifactId>
<groupId>javax.servlet</groupId>
</exclusion>
</exclusions>
</dependency>
<dependencies>
common-beanutils depends on common-logging:1.0.3 but we've specified a higher version
in the <dependencyManagement> section. A 'mvn package' will put
common-logging:1.1 in the WEB-INF/lib directory but the following code will spit out a
version of 1.0.3:
File[] files =
DependencyResolvers.use( MavenDependencyResolver.class )
.useCentralRepo( false )
.configureFrom( System.getProperty( "user.home" ) +
"/.m2/settings.xml" )
.includeDependenciesFromPom( "pom.xml" )
.resolveAsFiles( new ScopeFilter( "compile", "runtime" ) );
for ( File f : files )
{
System.out.println( f.getName() );
}
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators:
https://issues.jboss.org/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira
10:14 a.m.
[
https://issues.jboss.org/browse/SHRINKWRAP-345?page=com.atlassian.jira.pl...
]
Karel Piwko commented on SHRINKWRAP-345:
----------------------------------------
Fixed in
https://github.com/kpiwko/resolver/commit/a00fa3ca5c1fad9455c55600650b8e2...
Usage:
{code}
@Test
public void testIncludeFromPomWithDependencyManagement() {
File[] jars =
DependencyResolvers.use(MavenDependencyResolver.class).useCentralRepo(false)
.loadEffectiveFromPom("target/poms/test-depmngmt-transitive.xml").importAllDependencies().resolveAsFiles();
Assert.assertEquals("Exactly 2 files were resolved", 2, jars.length);
new FileValidationUtil("test-deps-b-2.0.0",
"test-deps-c-1.0.0").validate(jars);
}
{code}
Note: API is suspect to change.
MavenDependencyResolver resolves wrong version or scope for
transitive dependencies when using <dependencyManagement>
---------------------------------------------------------------------------------------------------------------------
Key: SHRINKWRAP-345
URL: https://issues.jboss.org/browse/SHRINKWRAP-345
Project: ShrinkWrap
Issue Type: Bug
Components: ext-resolver
Affects Versions: 1.0.0-beta-5
Reporter: Mike Pettypiece
Assignee: Karel Piwko
Fix For: resolver-2.0.0-alpha-1
Attachments: maven-test.zip
Using includesDependenciesFromPom() followed by resolveAsFiles() can produce a transitive
dependency with the wrong scope or version if it is defined in the
<dependencyManagment> section of the POM.
e.g.:
<dependencyManagement>
<dependencies>
<dependency>
<groupId>commons-logging</groupId>
<artifactId>commons-logging</artifactId>
<version>1.1</version>
</dependency>
</dependencies>
</dependencyManagement>
<dependencies>
<dependency>
<groupId>commons-beanutils</groupId>
<artifactId>commons-beanutils</artifactId>
<version>1.7.0</version>
<exclusions>
<exclusion>
<artifactId>servlet-api</artifactId>
<groupId>javax.servlet</groupId>
</exclusion>
</exclusions>
</dependency>
<dependencies>
common-beanutils depends on common-logging:1.0.3 but we've specified a higher version
in the <dependencyManagement> section. A 'mvn package' will put
common-logging:1.1 in the WEB-INF/lib directory but the following code will spit out a
version of 1.0.3:
File[] files =
DependencyResolvers.use( MavenDependencyResolver.class )
.useCentralRepo( false )
.configureFrom( System.getProperty( "user.home" ) +
"/.m2/settings.xml" )
.includeDependenciesFromPom( "pom.xml" )
.resolveAsFiles( new ScopeFilter( "compile", "runtime" ) );
for ( File f : files )
{
System.out.println( f.getName() );
}
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators:
https://issues.jboss.org/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira
3:48 p.m.
[
https://issues.jboss.org/browse/SHRINKWRAP-345?page=com.atlassian.jira.pl...
]
Karel Piwko resolved SHRINKWRAP-345.
------------------------------------
Resolution: Done
Pushed upstream.
MavenDependencyResolver resolves wrong version or scope for
transitive dependencies when using <dependencyManagement>
---------------------------------------------------------------------------------------------------------------------
Key: SHRINKWRAP-345
URL: https://issues.jboss.org/browse/SHRINKWRAP-345
Project: ShrinkWrap
Issue Type: Bug
Components: ext-resolver
Affects Versions: 1.0.0-beta-5
Reporter: Mike Pettypiece
Assignee: Karel Piwko
Fix For: resolver-2.0.0-alpha-1
Attachments: maven-test.zip
Using includesDependenciesFromPom() followed by resolveAsFiles() can produce a transitive
dependency with the wrong scope or version if it is defined in the
<dependencyManagment> section of the POM.
e.g.:
<dependencyManagement>
<dependencies>
<dependency>
<groupId>commons-logging</groupId>
<artifactId>commons-logging</artifactId>
<version>1.1</version>
</dependency>
</dependencies>
</dependencyManagement>
<dependencies>
<dependency>
<groupId>commons-beanutils</groupId>
<artifactId>commons-beanutils</artifactId>
<version>1.7.0</version>
<exclusions>
<exclusion>
<artifactId>servlet-api</artifactId>
<groupId>javax.servlet</groupId>
</exclusion>
</exclusions>
</dependency>
<dependencies>
common-beanutils depends on common-logging:1.0.3 but we've specified a higher version
in the <dependencyManagement> section. A 'mvn package' will put
common-logging:1.1 in the WEB-INF/lib directory but the following code will spit out a
version of 1.0.3:
File[] files =
DependencyResolvers.use( MavenDependencyResolver.class )
.useCentralRepo( false )
.configureFrom( System.getProperty( "user.home" ) +
"/.m2/settings.xml" )
.includeDependenciesFromPom( "pom.xml" )
.resolveAsFiles( new ScopeFilter( "compile", "runtime" ) );
for ( File f : files )
{
System.out.println( f.getName() );
}
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators:
https://issues.jboss.org/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira
4575
days inactive
4593
days old
shrinkwrap-issues@lists.jboss.org
7 comments
7 participants
participants (7)
-
Karel Piwko (Commented) (JIRA) -
Karel Piwko (Resolved) (JIRA)
-
Karel Piwko (Updated) (JIRA)
-
Mike Pettypiece (Commented) (JIRA)
-
Mike Pettypiece (Created) (JIRA)
-
Mike Pettypiece (Issue Comment Edited) (JIRA)
-
Mike Pettypiece (Updated) (JIRA)