The maven dependencies are 'provided' dependencies and are related to the optional use of a Maven Plugin to run xmlbeans code generation.
POI users don't need these dependencies and any build tool worth its salt will understand what a 'provided' dependency is. I generally don't worry about convergence issues because if you have a few transitive dependencies, it is almost inevitable that those dependencies will have their own dependencies on common libraries and that the versions are almost guaranteed not to match. This is rarely an issue unless the version diff is large. To reiterate, POI users should be unaffected and XMLBeans maven plugin users may need to add explicit dependencies on the divergent transitive dependencies if their build tools flag this. On Tuesday 7 January 2025 at 20:39:45 GMT+1, Tim Allison <talli...@apache.org> wrote: Sorry. I'm looking at these more closely, and the problem is with the maven dependencies brought in my xmlbeans...not something that we should fix on POI or xmlbeans. WDYT? P.S. I did notice some convergence issues. I don't think these are a > showstopper...not clear if we should fix these in XMLBeans or let > downstream users fix them in the next release. > > [ERROR] Dependency convergence error for > org.codehaus.plexus:plexus-utils:jar:3.5.1 paths to dependency are: > [ERROR] +-org.apache.tika:tika-parser-microsoft-module:jar:4.0.0-SNAPSHOT > [ERROR] +-org.apache.poi:poi-ooxml:jar:5.4.0:compile > [ERROR] +-org.apache.xmlbeans:xmlbeans:jar:5.3.0:compile > [ERROR] +-org.apache.maven:maven-core:jar:3.9.9:runtime > [ERROR] +-org.apache.maven:maven-settings:jar:3.9.9:runtime > [ERROR] +-org.codehaus.plexus:plexus-utils:jar:3.5.1:runtime > [ERROR] and > [ERROR] +-org.apache.tika:tika-parser-microsoft-module:jar:4.0.0-SNAPSHOT > [ERROR] +-org.apache.poi:poi-ooxml:jar:5.4.0:compile > [ERROR] +-org.apache.xmlbeans:xmlbeans:jar:5.3.0:compile > [ERROR] +-org.apache.maven:maven-core:jar:3.9.9:runtime > [ERROR] +-org.apache.maven:maven-settings-builder:jar:3.9.9:runtime > [ERROR] +-org.codehaus.plexus:plexus-utils:jar:3.5.1:runtime > [ERROR] and > [ERROR] +-org.apache.tika:tika-parser-microsoft-module:jar:4.0.0-SNAPSHOT > [ERROR] +-org.apache.poi:poi-ooxml:jar:5.4.0:compile > [ERROR] +-org.apache.xmlbeans:xmlbeans:jar:5.3.0:compile > [ERROR] +-org.apache.maven:maven-core:jar:3.9.9:runtime > [ERROR] +-org.apache.maven:maven-settings-builder:jar:3.9.9:runtime > [ERROR] > +-org.codehaus.plexus:plexus-sec-dispatcher:jar:2.0:runtime > [ERROR] +-org.codehaus.plexus:plexus-utils:jar:3.4.1:runtime > [ERROR] and > [ERROR] +-org.apache.tika:tika-parser-microsoft-module:jar:4.0.0-SNAPSHOT > [ERROR] +-org.apache.poi:poi-ooxml:jar:5.4.0:compile > [ERROR] +-org.apache.xmlbeans:xmlbeans:jar:5.3.0:compile > [ERROR] +-org.apache.maven:maven-core:jar:3.9.9:runtime > [ERROR] > +-org.apache.maven:maven-repository-metadata:jar:3.9.9:runtime > [ERROR] +-org.codehaus.plexus:plexus-utils:jar:3.5.1:runtime > [ERROR] and > [ERROR] +-org.apache.tika:tika-parser-microsoft-module:jar:4.0.0-SNAPSHOT > [ERROR] +-org.apache.poi:poi-ooxml:jar:5.4.0:compile > [ERROR] +-org.apache.xmlbeans:xmlbeans:jar:5.3.0:compile > [ERROR] +-org.apache.maven:maven-core:jar:3.9.9:runtime > [ERROR] +-org.apache.maven:maven-artifact:jar:3.9.9:runtime > [ERROR] +-org.codehaus.plexus:plexus-utils:jar:3.5.1:runtime > [ERROR] and > [ERROR] +-org.apache.tika:tika-parser-microsoft-module:jar:4.0.0-SNAPSHOT > [ERROR] +-org.apache.poi:poi-ooxml:jar:5.4.0:compile > [ERROR] +-org.apache.xmlbeans:xmlbeans:jar:5.3.0:compile > [ERROR] +-org.apache.maven:maven-core:jar:3.9.9:runtime > [ERROR] > +-org.apache.maven:maven-resolver-provider:jar:3.9.9:runtime > [ERROR] +-org.codehaus.plexus:plexus-utils:jar:3.5.1:runtime > [ERROR] and > [ERROR] +-org.apache.tika:tika-parser-microsoft-module:jar:4.0.0-SNAPSHOT > [ERROR] +-org.apache.poi:poi-ooxml:jar:5.4.0:compile > [ERROR] +-org.apache.xmlbeans:xmlbeans:jar:5.3.0:compile > [ERROR] +-org.apache.maven:maven-core:jar:3.9.9:runtime > [ERROR] > +-org.eclipse.sisu:org.eclipse.sisu.plexus:jar:0.9.0.M3:runtime > [ERROR] +-org.codehaus.plexus:plexus-utils:jar:3.5.1:runtime > [ERROR] and > [ERROR] +-org.apache.tika:tika-parser-microsoft-module:jar:4.0.0-SNAPSHOT > [ERROR] +-org.apache.poi:poi-ooxml:jar:5.4.0:compile > [ERROR] +-org.apache.xmlbeans:xmlbeans:jar:5.3.0:compile > [ERROR] +-org.apache.maven:maven-core:jar:3.9.9:runtime > [ERROR] +-org.codehaus.plexus:plexus-utils:jar:3.5.1:runtime > [ERROR] and > [ERROR] +-org.apache.tika:tika-parser-microsoft-module:jar:4.0.0-SNAPSHOT > [ERROR] +-org.apache.poi:poi-ooxml:jar:5.4.0:compile > [ERROR] +-org.apache.xmlbeans:xmlbeans:jar:5.3.0:compile > [ERROR] +-org.apache.maven:maven-model:jar:3.9.9:runtime > [ERROR] +-org.codehaus.plexus:plexus-utils:jar:3.5.1:runtime > [ERROR] and > [ERROR] +-org.apache.tika:tika-parser-microsoft-module:jar:4.0.0-SNAPSHOT > [ERROR] +-org.apache.poi:poi-ooxml:jar:5.4.0:compile > [ERROR] +-org.apache.xmlbeans:xmlbeans:jar:5.3.0:compile > [ERROR] +-org.apache.maven:maven-plugin-api:jar:3.9.9:runtime > [ERROR] +-org.codehaus.plexus:plexus-utils:jar:3.5.1:runtime > [ERROR] > [ERROR] > [ERROR] Dependency convergence error for > org.codehaus.plexus:plexus-classworlds:jar:2.6.0 paths to dependency are: > [ERROR] +-org.apache.tika:tika-parser-microsoft-module:jar:4.0.0-SNAPSHOT > [ERROR] +-org.apache.poi:poi-ooxml:jar:5.4.0:compile > [ERROR] +-org.apache.xmlbeans:xmlbeans:jar:5.3.0:compile > [ERROR] +-org.apache.maven:maven-core:jar:3.9.9:runtime > [ERROR] > +-org.eclipse.sisu:org.eclipse.sisu.plexus:jar:0.9.0.M3:runtime > [ERROR] > +-org.codehaus.plexus:plexus-classworlds:jar:2.6.0:runtime > [ERROR] and > [ERROR] +-org.apache.tika:tika-parser-microsoft-module:jar:4.0.0-SNAPSHOT > [ERROR] +-org.apache.poi:poi-ooxml:jar:5.4.0:compile > [ERROR] +-org.apache.xmlbeans:xmlbeans:jar:5.3.0:compile > [ERROR] +-org.apache.maven:maven-core:jar:3.9.9:runtime > [ERROR] +-org.codehaus.plexus:plexus-classworlds:jar:2.8.0:runtime > [ERROR] and > [ERROR] +-org.apache.tika:tika-parser-microsoft-module:jar:4.0.0-SNAPSHOT > [ERROR] +-org.apache.poi:poi-ooxml:jar:5.4.0:compile > [ERROR] +-org.apache.xmlbeans:xmlbeans:jar:5.3.0:compile > [ERROR] +-org.apache.maven:maven-plugin-api:jar:3.9.9:runtime > [ERROR] +-org.codehaus.plexus:plexus-classworlds:jar:2.8.0:runtime > > > On Mon, Jan 6, 2025 at 4:56 PM PJ Fanning <fannin...@apache.org> wrote: > >> We need at least 1 more review from a POI PMC member before we can >> proceed. If anyone has time, it would be much appreciated. >> >> >> On 2025/01/02 13:29:43 Dominik Stadler wrote: >> > Hi, >> > >> > I tested the staged binaries with various projects and reviewed >> contents of >> > the source-distribution. Also compilation from source did work. So >> > everything fine as far as I see. >> > >> > I vote +1 for release! >> > >> > Thanks PJ for preparing the release! Dominik. >> > >> > On Sun, Dec 29, 2024 at 8:19 PM PJ Fanning <fannin...@yahoo.com.invalid >> > >> > wrote: >> > >> > > Hello POI Community, >> > > >> > > This is a call for a vote to release Apache POI version 5.4.0 (RC2). >> > > >> > > The discussion thread: >> > > https://lists.apache.org/thread/4sd7p5z2cxp0l9wb2orw4n0gc9w348gw >> > > >> > > The release candidate: >> > > https://dist.apache.org/repos/dist/dev/poi/5.4.0-RC2/ >> > > >> > > >> > > This release has been signed with a PGP key available here: >> > > https://downloads.apache.org/poi/KEYS >> > > >> > > Release Notes: >> > > https://dist.apache.org/repos/dist/dev/poi/RELEASE-NOTES-5.4.0.txt >> > > >> > > I will add the svn tag REL_5_4_0 if the vote passes. >> > > >> > > Svn commit ID: https://svn.apache.org/repos/asf/poi/trunk@1922754 >> > > >> > > Please download, verify, and test. >> > > >> > > >> > > We have also staged jars in the Apache Nexus Repository. >> > > These were built with the same code as appears in this Source Release >> > > Candidate. >> > > We would appreciate if users could test with these too. >> > > >> > > If anyone finds any serious problems with these jars, please also >> notify >> > > us on this thread. >> > > >> > > https://repository.apache.org/content/groups/staging/org/apache/poi/ >> > > >> > > In gradle, you can add this repository. >> > > >> > > maven { >> > > url "https://repository.apache.org/content/groups/staging/"; >> > > } >> > > >> > > >> > > The VOTE will pass if we have more positive votes than negative votes >> > > and there must be a minimum of 3 approvals from POI PMC members. >> > > >> > > I will leave the vote open for at least a week. >> > > >> > > [ ] +1 approve >> > > [ ] +0 no opinion >> > > [ ] -1 disapprove with the reason >> > > >> > > To learn more about Apache POI, please see https://poi.apache.org/ >> > > >> > > >> > > Checklist for reference: >> > > [ ] Download links are valid. >> > > [ ] Checksums and signatures. >> > > [ ] LICENSE/NOTICE files exist >> > > [ ] No unexpected binary files >> > > [ ] Source files have ASF headers >> > > [ ] Can compile from source >> > > >> > > To compile from the source, please refer to: >> > > https://poi.apache.org/devel/index.html >> > > >> > > Some notes about verifying downloads can be found at: >> > > https://poi.apache.org/download.html >> > > >> > > Here is my +1 (binding). >> > > >> > > Thanks, >> > > PJ Fanning (Apache POI PMC member) >> > > >> > > --------------------------------------------------------------------- >> > > To unsubscribe, e-mail: dev-unsubscr...@poi.apache.org >> > > For additional commands, e-mail: dev-h...@poi.apache.org >> > > >> > > >> > >> >> --------------------------------------------------------------------- >> To unsubscribe, e-mail: dev-unsubscr...@poi.apache.org >> For additional commands, e-mail: dev-h...@poi.apache.org >> >> --------------------------------------------------------------------- To unsubscribe, e-mail: dev-unsubscr...@poi.apache.org For additional commands, e-mail: dev-h...@poi.apache.org
