Asked our friend Claude to analyze, and he claims to know what is happening, and to have a solution in https://github.com/apache/solr/pull/4199
Jan > 9. mars 2026 kl. 16:07 skrev Bram Luyten <[email protected]>: > > *Apache Maven 3.9.9 (8e8579a9e76f7d015ee5ec7bfcdc97d260186937)* > > Maven home: /opt/homebrew/Cellar/maven/3.9.9/libexec > > Java version: 21.0.9, vendor: Homebrew, runtime: > /opt/homebrew/Cellar/openjdk@21/21.0.9/libexec/openjdk.jdk/Contents/Home > > Default locale: en_US, platform encoding: UTF-8 > > OS name: "mac os x", version: "15.7.4", arch: "aarch64", family: "mac" > > On Mon, Mar 9, 2026 at 1:27 PM Gus Heck <[email protected]> wrote: > >> What version of maven are you using? >> >> On Mon, Mar 9, 2026 at 8:09 AM Gus Heck <[email protected]> wrote: >> >>> Hmm, maven limitation? I made a gradle project and it gives this without >>> error: >>> >>> compileClasspath - Compile classpath for source set 'main'. >>> \--- org.apache.solr:solr-solrj:10.0.0 >>> \--- org.apache.solr:solr-api:10.0.0 >>> +--- com.fasterxml.jackson.core:jackson-annotations:2.20 >>> \--- io.swagger.core.v3:swagger-annotations-jakarta:2.2.22 >>> >>> compileOnly - Compile-only dependencies for the 'main' feature. (n) >>> No dependencies >>> >>> default - Configuration for default artifacts. (n) >>> No dependencies >>> >>> implementation - Implementation dependencies for the 'main' feature. (n) >>> \--- org.apache.solr:solr-solrj:10.0.0 (n) >>> >>> mainSourceElements - List of source directories contained in the Main >>> SourceSet. (n) >>> No dependencies >>> >>> runtimeClasspath - Runtime classpath of source set 'main'. >>> \--- org.apache.solr:solr-solrj:10.0.0 >>> +--- org.apache.solr:solr-api:10.0.0 >>> | +--- com.fasterxml.jackson.core:jackson-annotations:2.20 >>> | +--- io.swagger.core.v3:swagger-annotations-jakarta:2.2.22 >>> | +--- jakarta.ws.rs:jakarta.ws.rs-api:3.1.0 >>> | +--- org.semver4j:semver4j:6.0.0 >>> | | \--- org.jspecify:jspecify:1.0.0 >>> | \--- org.slf4j:slf4j-api:2.0.17 >>> +--- com.fasterxml.jackson.core:jackson-databind:2.20.0 >>> | +--- com.fasterxml.jackson.core:jackson-annotations:2.20 >>> | +--- com.fasterxml.jackson.core:jackson-core:2.20.0 >>> | | \--- com.fasterxml.jackson:jackson-bom:2.20.0 >>> | | +--- >>> com.fasterxml.jackson.core:jackson-annotations:2.20 (c) >>> | | +--- com.fasterxml.jackson.core:jackson-core:2.20.0 >> (c) >>> | | \--- >>> com.fasterxml.jackson.core:jackson-databind:2.20.0 (c) >>> | \--- com.fasterxml.jackson:jackson-bom:2.20.0 (*) >>> +--- com.fasterxml.jackson.core:jackson-annotations:2.20 >>> +--- com.fasterxml.jackson.core:jackson-core:2.20.0 (*) >>> +--- org.slf4j:slf4j-api:2.0.17 >>> \--- org.slf4j:jcl-over-slf4j:2.0.17 >>> \--- org.slf4j:slf4j-api:2.0.17 >>> >>> On Sat, Mar 7, 2026 at 11:03 AM Bram Luyten <[email protected]> >>> wrote: >>> >>>> Hi Jan, >>>> >>>> Thank you for the swift feedback. To clarify: our app (DSpace, an >>>> open-source repository platform) depends on both: >>>> >>>> 1. solr-solrj (runtime) — as a Solr client >>>> 2. solr-core (test scope) — for EmbeddedSolrServer in our integration >>>> tests >>>> >>>> The issue we're seeing is that the published Maven POMs for solr-core >> (and >>>> solr-solrj, solr-api) on Maven Central reference >>>> com.fasterxml.jackson.core:jackson-databind, jackson-core, >>>> jackson-annotations, jackson-dataformat-smile, and >> jackson-dataformat-cbor >>>> without specifying a version. Since Solr's Gradle build manages these >>>> versions via a BOM/platform that isn't published as a Maven BOM, Maven >>>> considers the POM invalid and drops all transitive dependencies from >> that >>>> artifact. >>>> >>>> The Maven warning we see is: >>>> >>>> [WARNING] The POM for org.apache.solr:solr-core:jar:10.0.0 is invalid, >>>> transitive dependencies (if any) will not be available: >>>> 5 problems were encountered while building the effective model for >>>> org.apache.solr:solr-core:10.0.0 >>>> [ERROR] 'dependencies.dependency.version' for >>>> com.fasterxml.jackson.core:jackson-annotations:jar is missing. >>>> [ERROR] 'dependencies.dependency.version' for >>>> com.fasterxml.jackson.core:jackson-core:jar is missing. >>>> [ERROR] 'dependencies.dependency.version' for >>>> com.fasterxml.jackson.core:jackson-databind:jar is missing. >>>> [ERROR] 'dependencies.dependency.version' for >>>> com.fasterxml.jackson.dataformat:jackson-dataformat-smile:jar is >> missing. >>>> [ERROR] 'dependencies.dependency.version' for >>>> com.fasterxml.jackson.dataformat:jackson-dataformat-cbor:jar is missing. >>>> >>>> The practical impact for Maven consumers: all transitive dependencies of >>>> the affected artifact are lost (not just the Jackson ones). We had to >>>> manually declare ~20+ transitive dependencies of solr-core in our own >> POM >>>> (Jersey, OpenTelemetry, Curator, Lucene modules, etc.) to work around >>>> this. >>>> >>>> For solr-solrj the impact is smaller since it has fewer transitive deps, >>>> but the same invalid-POM warning appears. >>>> >>>> Bram >>>> >>>> On Sat, Mar 7, 2026 at 3:32 PM Jan Høydahl <[email protected]> >> wrote: >>>> >>>>> I have not looked into it, but it sounds like something that deserves >> a >>>>> JIRA to look into. >>>>> To clarify, your app imports solr-solrj to act as a client, and you >> are >>>>> forced to manually specify jackson version. You do not depend on >>>> solr-core >>>>> directly? >>>>> >>>>> Jan >>>>> >>>>>> 7. mars 2026 kl. 08:28 skrev Bram Luyten <[email protected]>: >>>>>> >>>>>> Hi, >>>>>> >>>>>> I've been lurking on the sidelines on your mailinglist since >> December >>>>>> watching the final steps of the SOLR 10 release, thank you very much >>>> for >>>>>> all the work and congratulations on the release!!! >>>>>> >>>>>> While integrating Solr 10.0.0 as a Maven dependency in our project >>>>>> (DSpace), we discovered that the published POMs for solr-core, >>>>> solr-solrj, >>>>>> and solr-api on Maven Central are missing <version> elements for >> their >>>>>> Jackson 2 (com.fasterxml.jackson) dependencies. >>>>>> >>>>>> Affected artifacts: >>>>>> >>>>>> solr-core:10.0.0 jackson-annotations, jackson-core, >> jackson-databind, >>>>>> jackson-dataformat-smile, jackson-dataformat-cbor >>>>>> solr-solrj:10.0.0 jackson-databind, jackson-annotations, >> jackson-core >>>>>> solr-api:10.0.0 jackson-annotations >>>>>> >>>>>> Impact: Maven marks these POMs as invalid and refuses to resolve any >>>>>> transitive dependencies from the affected modules. For solr-core, >> this >>>>>> means ~50+ transitive dependencies are silently lost (Jersey, >>>>>> OpenTelemetry, Curator, Lucene modules, HPPC, etc.). Projects that >> use >>>>>> solr-core as a test dependency for EmbeddedSolrServer must manually >>>>> declare >>>>>> all of these. >>>>>> >>>>>> Maven warning: >>>>>> [WARNING] The POM for org.apache.solr:solr-core:jar:10.0.0 is >>>> invalid, >>>>>> transitive dependencies >>>>>> (if any) will not be available: 5 problems were encountered while >>>>>> building the effective model >>>>>> for org.apache.solr:solr-core:10.0.0 >>>>>> [ERROR] 'dependencies.dependency.version' for >>>>>> com.fasterxml.jackson.core:jackson-annotations:jar is missing. >>>>>> [ERROR] 'dependencies.dependency.version' for >>>>>> com.fasterxml.jackson.core:jackson-core:jar is missing. >>>>>> [ERROR] 'dependencies.dependency.version' for >>>>>> com.fasterxml.jackson.core:jackson-databind:jar is missing. >>>>>> [ERROR] 'dependencies.dependency.version' for >>>>>> com.fasterxml.jackson.dataformat:jackson-dataformat-smile:jar is >>>> missing. >>>>>> [ERROR] 'dependencies.dependency.version' for >>>>>> com.fasterxml.jackson.dataformat:jackson-dataformat-cbor:jar is >>>> missing. >>>>>> >>>>>> Root cause (likely): Solr 10 uses Gradle for building and uses a >>>> Jackson >>>>> 2 >>>>>> BOM (jackson-bom) for version management. The Gradle maven-publish >>>> plugin >>>>>> generates the POM from the Gradle model, but BOM-managed versions >> are >>>> not >>>>>> resolved/flattened into the published POM. Since the published POM >>>> has no >>>>>> <parent> element, there is no BOM to fall back on at consumption >> time. >>>>>> >>>>>> Workaround: Projects that depend on solr-core (e.g. for testing with >>>>>> EmbeddedSolrServer) must explicitly declare all dependencies that >>>> would >>>>>> normally come transitively through solr-core. In our case this meant >>>>> adding >>>>>> ~20 explicit test dependencies to match what solr-core would have >>>>> provided. >>>>>> >>>>>> Would it be worth creating a JIRA for this? The fix would likely >>>> involve >>>>>> either adding explicit versions to the Gradle dependency >> declarations >>>> for >>>>>> Jackson, or configuring the maven-publish plugin to resolve >>>> BOM-managed >>>>>> versions when generating POMs. >>>>>> >>>>>> Thanks, >>>>>> >>>>>> Bram Luyten, Atmire >>>>> >>>>> >>>>> --------------------------------------------------------------------- >>>>> To unsubscribe, e-mail: [email protected] >>>>> For additional commands, e-mail: [email protected] >>>>> >>>>> >>>> >>> >>> >>> -- >>> http://www.needhamsoftware.com (work) >>> https://a.co/d/b2sZLD9 (my fantasy fiction book) >>> >> >> >> -- >> http://www.needhamsoftware.com (work) >> https://a.co/d/b2sZLD9 (my fantasy fiction book) >>
