[
https://issues.apache.org/jira/browse/MNG-7906?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17787263#comment-17787263
]
Guillaume Nodet commented on MNG-7906:
--------------------------------------
While MPH-183 could be a way to investigate the problem, not reporting anything
is plainly and simply wrong.
Let's take a simple use case:
* in your project, you see a wrong version of a dependency being imported
* you add a {{<dependency>}} section in your {{dependencyManagement}} POM
section, usually at the end
* you rebuild, but the wrong version is still used
* you raise a JIRA after having spent hours to investigate the problem with
no solution
So I think the first step would be to add a WARNING when the POM _being built_
contains a managed dependency which is _lost_ because not first.
This will explain to the user what's wrong and that the dependency should be
moved up at the top of the managed dependency section in order to be useful.
That should be easily done and back ported to 3.9.x.
The behaviour could then be changed in 4.x with or without a toggle flag for
compatibility.
But definitely, the first step should be to WARN the user that there's a
problem.
> Dependency Management import does not work the "maven way"
> ----------------------------------------------------------
>
> Key: MNG-7906
> URL: https://issues.apache.org/jira/browse/MNG-7906
> Project: Maven
> Issue Type: Bug
> Components: Dependencies, Documentation: General
> Reporter: Tamas Cservenak
> Priority: Major
> Fix For: 4.0.x-candidate
>
>
> This affects all released Maven versions so far.
> Problem reproducer: https://github.com/cstamas/MNG-7852 (repo name is wrong,
> obviously).
> In short: unlike with dependencies, where you CAN override some "deep
> transitive" dependency by re-declaring it directly as 1st level dependency in
> POM, for depMgt import this does not work, actually, it works quite the
> opposite ("first comes, wins"). Moreover, Maven remains silent about this, as
> reproducer shows, and all of this goes unnoticed.
> Solution: at least depMgt import should make "the maven way", maybe not by
> default (to not break existing builds) but configurable. Problem is solved if
> in reproducer:
> - with fix enabled, junit 5.9.3 is used, AND
> - with fix disabled, Maven yells about ignored depMgt import
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
