elharo commented on issue #124: URL: https://github.com/apache/maven-war-plugin/issues/124#issuecomment-5084892682
### Issue Overview & Context This issue (originally filed as **MWAR-294** in Jira) describes a scenario in multi-module Maven builds where transitive dependencies from a `provided`-scope dependency are unexpectedly packaged into the resulting WAR file under `WEB-INF/lib`. Specifically, the user reported: 1. Module `war-module` depends on `jar-module` with `<scope>provided</scope>`. 2. A `<dependencyManagement>` section in the POM specifies explicit `compile` or `runtime` scopes for dependencies that happen to match transitive dependencies of `jar-module`. 3. Under Maven 2.2.1, the transitive dependencies were omitted from `WEB-INF/lib` as expected for a `provided` dependency. Under Maven 3.x, those dependencies get pulled into `WEB-INF/lib`. --- ### Is it still accurate? **Yes, the behavior described is accurate according to how Maven 3+ handles dependency resolution, but it is not a bug in `maven-war-plugin`.** This behavior stems from a fundamental design change in dependency resolution between Maven 2 and Maven 3 (specifically, the transition from `maven-artifact` resolution to Aether/Maven Resolver): * In Maven 3+, the dependency graph construction and scope inheritance rules dictate that `<dependencyManagement>` overrides dependency traits across the resolution tree. * When a dependency management block explicitly assigns `compile` or `runtime` scope to a GAV coordinate, it elevates/overrides the managed scope during graph resolution. * The `maven-war-plugin` does not calculate dependency resolution trees itself; it consumes the `Artifact` collection provided directly by the core Maven reactor (`project.getArtifacts()`). Because Maven core resolves those managed artifacts to `compile`/`runtime`, the WAR plugin packages them into `WEB-INF/lib`. --- ### Should it be fixed or closed? **It should be closed.** #### Reasons to Close: 1. **Wrong Component / Target:** The WAR plugin is simply acting on the artifact set resolved by Maven Core. If this were considered invalid behavior, it would require a resolution change in Maven Core (`maven-resolver`), not `maven-war-plugin`. 2. **Defined Maven 3 Semantics:** `<dependencyManagement>` intentionally acts as a global override mechanism for dependency attributes across sub-modules. Specifying explicit `compile` or `runtime` scope in dependency management intentionally forces those artifacts to participate in runtime packaging. 3. **Correct User Workaround:** If a transitive dependency of a `provided` module should not be packaged in the WAR, it should either: * Be declared with `<scope>provided</scope>` in `<dependencyManagement>`, or * Be explicitly excluded via `<exclusions>` in the `jar-module` dependency declaration. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
