[
https://issues.apache.org/jira/browse/MDEP-791?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17494940#comment-17494940
]
Tamás Cservenák edited comment on MDEP-791 at 2/19/22, 11:03 AM:
-----------------------------------------------------------------
Maven always makes "closer dep declaration win" (closer to project being
built), and "explicit dep declaration overrides implicit" (so if you explicitly
declare something in POM it affects transitive deps).
In short, you have a project P that depends on D1 compile time (as P
extends/uses classes from D1), where in turn D1 depends on D2 (as D1
extends/uses classes from D2). Hence, right thing to do is:
In P declare direct compile dependency on D1.
What wrong is, that m-dep-p reports this as a problem (it clearly ignores the
fact that by P extending classes from D1 it implicitly "uses" classes from D2
as well, otherwise compilation of P would fail, would be impossible.
All the other changes are wrong:
If P declare direct test dependency on D2 , this breaks compilation of P, as
Java compiler must have access to classes in D2 that classes in D1 extends.
Also, as P -> D2 is closer to P than indirect dependency P -> D1 -> D2, former
wins.
IF P declare direct compile dependency on D2, while formally not incorrect, is
superfluous IMHO.
In short, IMHO direct dependency on D2 should NOT be directly declared (in any
scope), and m-dep-p bug should be fixed in regarding of this false report. It
clearly considers only "first level" deps, but is unaware the fact that to
compile P you must have not only D1 on compile classpath but also D2. The fact
D2 classes are referenced directly in tests only (this one detects m-dep-p)
should be overridden by the fact that D2 is needed as compile dependency for D1
in main code.
was (Author: cstamas):
Maven always makes "closer dep declaration win" (closer to project being built).
In short, you have a project P that depends on D1 compile time (as P
extends/uses classes from D1), where in turn D1 depends on D2 (as D1
extends/uses classes from D2). Hence, right thing to do is:
In P declare direct compile dependency on D1.
What wrong is, that m-dep-p reports this as a problem (it clearly ignores the
fact that by P extending classes from D1 it implicitly "uses" classes from D2
as well, otherwise compilation of P would fail, would be impossible.
All the other changes are wrong:
If P declare direct test dependency on D2 , this breaks compilation of P, as
Java compiler must have access to classes in D2 that classes in D1 extends.
Also, as P -> D2 is closer to P than indirect dependency P -> D1 -> D2, former
wins.
IF P declare direct compile dependency on D2, while formally not incorrect, is
superfluous IMHO.
In short, IMHO direct dependency on D2 should NOT be directly declared (in any
scope), and m-dep-p bug should be fixed in regarding of this false report. It
clearly considers only "first level" deps, but is unaware the fact that to
compile P you must have not only D1 on compile classpath but also D2.
> Non-test scoped and transitive dependencies in compile scope
> ------------------------------------------------------------
>
> Key: MDEP-791
> URL: https://issues.apache.org/jira/browse/MDEP-791
> Project: Maven Dependency Plugin
> Issue Type: Bug
> Affects Versions: 3.2.0, 3.3.0
> Reporter: Slawomir Jaranowski
> Priority: Critical
> Attachments: MDEP-791.zip
>
>
> When we use some dependency in test classes which is not used in production
> code but is required as transitive dependency for other used in production
> code - such dependency should not be included in {*}{{Non-test scoped}}{*}.
> Example:
> * test code use {{ObjectCodec}} from {{jackson-core}}
> * production code use only {{ObjectMapper}} from {{jackson-databind}}
> * production code don't use any classes from {{jackson-core}}
> {{jackson-core}} is needed by {{jackson-databind}} and must by in compile
> scope so should not be reported as {{Non-test scoped}}
>
--
This message was sent by Atlassian Jira
(v8.20.1#820001)
