zacthompson opened a new issue, #998: URL: https://github.com/apache/maven-enforcer/issues/998
### Affected version 3.6.3 ### Bug description The docs for requireUpperBoundDeps state (emphasis mine): > excludes - specify the dependencies that will be ignored. **The format is `groupId[:artifactId]`** includes - specify the dependencies that will be checked. If not empty only these will be checked. **The format is `groupId[:artifactId]`** ... but in fact, the `artifactId` is *not* optional. We tried to narrow a plugin execution to only report on our team's first-party dependencies, by just including our own `groupId` in the execution, but when we tested it, it did not detect any of the known upper bound problems. We were only able to get it to work by specifying our `artifactId` values as well, which means we would have to specify every artifactId that we own. (This means, e.g., we can't reliably apply this enforcement in a central place without perpetually adjusting its includes every time we create a new shared component.) I took a quick glance at RequireUpperBoundDeps.java and it appears to only check whether the include values *directly match* the visited dependencies, which is contrary to the docs (and prevents my use case). The fix would be to make the artifactId truly optional when filtering dependencies for consideration, just like many of the other rules do: e.g., bannedDependencies works fine in this regard. Probably RequireUpperBoundDeps.java should be doing something like those rules: `Predicate<Artifact> shouldInclude = ArtifactUtils.prepareDependencyArtifactMatcher(includes)` instead of just a direct match comparison. (My guess is that `excludes` probably has the same problem here, but I did not test it.) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
