[
https://issues.apache.org/jira/browse/MENFORCER-195?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=16924258#comment-16924258
]
Thomas Mortagne commented on MENFORCER-195:
-------------------------------------------
There seems to be a regression in 3.6.2 (I guess related to MNG-6713) that
makes the enforcer plugin not take into account anymore exclusions located in
the dependencyManagement of a parent pom.
My example is the following:
https://github.com/xwiki/xwiki-platform/blob/xwiki-platform-11.7/xwiki-platform-core/xwiki-platform-search/xwiki-platform-search-solr/xwiki-platform-search-solr-server/xwiki-platform-search-solr-server-plugin/pom.xml#L43
and
https://github.com/xwiki/xwiki-platform/blob/xwiki-platform-11.7/xwiki-platform-core/xwiki-platform-search/xwiki-platform-search-solr/pom.xml#L70
and I enabled requireUpperBoundDeps. If you want to build
xwiki-platform-search-solr-server-plugin to reproduce the issue you will need
to add XWiki repository in your settings.xml (see
https://dev.xwiki.org/xwiki/bin/view/Community/Building/#HInstallingMaven).
When I build with Maven 3.6.2 I get:
{noformat}
[INFO] --- maven-enforcer-plugin:1.4.1:enforce (enforce-upper-bounds) @
xwiki-platform-search-solr-server-plugin ---
[WARNING] Rule 0: org.apache.maven.plugins.enforcer.RequireUpperBoundDeps
failed with message:
Failed while enforcing RequireUpperBoundDeps. The error(s) are [
Require upper bound dependencies error for
javax.servlet:javax.servlet-api:3.0.1 paths to dependency are:
+-org.xwiki.platform:xwiki-platform-search-solr-server-plugin:11.8-SNAPSHOT
+-org.apache.solr:solr-core:8.1.1
+-javax.servlet:javax.servlet-api:3.0.1 (managed) <--
javax.servlet:javax.servlet-api:3.1.0
]
{noformat}
Which does not make sense because servlet-api is supposed to be excluded in
solr-core.
Works fine with Maven 3.6.1 but more importantly works fine with "mvn
dependency:tree" in Maven 3.6.2, all the excludes coming from the
dependencyManagement are properly taken into account. Either Maven 3.6.2 broke
some API which are not used by the dependency plugin or the inforcer plugin use
some more or less internal stuff.
> Dependency convergence does not support wildcard exclusions
> -----------------------------------------------------------
>
> Key: MENFORCER-195
> URL: https://issues.apache.org/jira/browse/MENFORCER-195
> Project: Maven Enforcer Plugin
> Issue Type: Bug
> Components: Plugin
> Affects Versions: 1.3.1
> Environment: Maven 3.2.1
> Reporter: Tomaz Cerar
> Priority: Major
> Time Spent: 1h 10m
> Remaining Estimate: 0h
>
> Maven 3.2 introduced wildcard exclusions for dependencies.
> But if you use them dependencyConvergence wrongly complains about conflicting
> transitive dependencies.
--
This message was sent by Atlassian Jira
(v8.3.2#803003)
