[
https://issues.apache.org/jira/browse/MNG-7906?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17787175#comment-17787175
]
Elliotte Rusty Harold commented on MNG-7906:
--------------------------------------------
I went down this rabbit hole for 2+ years, and yes, it's confusing. However,
that ship has sailed. I don't see any realistic possibility to change the rules
now without breaking a large part of the existing Maven and Java ecosystem.
I've done a lot of work on improving the documentation of the admittedly weird
Maven dependency resolution rules, e.g. using the word "closer" without
defining that word in sufficient detail, but if there are places in the
official docs that are still confusing, feel free to file docs bugs and assign
them to me. Beyond that, I'm tempted to close this as Won't Fix.
> Dependency Management import does not work the "maven way"
> ----------------------------------------------------------
>
> Key: MNG-7906
> URL: https://issues.apache.org/jira/browse/MNG-7906
> Project: Maven
> Issue Type: Bug
> Components: Dependencies
> Reporter: Tamas Cservenak
> Priority: Blocker
> Fix For: 4.0.x-candidate
>
>
> This affects all released Maven versions so far.
> Problem reproducer: https://github.com/cstamas/MNG-7852 (repo name is wrong,
> obviously).
> In short: unlike with dependencies, where you CAN override some "deep
> transitive" dependency by re-declaring it directly as 1st level dependency in
> POM, for depMgt import this does not work, actually, it works quite the
> opposite ("first comes, wins"). Moreover, Maven remains silent about this, as
> reproducer shows, and all of this goes unnoticed.
> Solution: at least depMgt import should make "the maven way", maybe not by
> default (to not break existing builds) but configurable. Problem is solved if
> in reproducer:
> - with fix enabled, junit 5.9.3 is used, AND
> - with fix disabled, Maven yells about ignored depMgt import
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
