ascheman commented on issue #13084:
URL: https://github.com/apache/maven/issues/13084#issuecomment-5619932755
Some empirical scope/severity data across the release lines (reproduced with
@cstamas's gist), since it affects where the fix must land and how to test it:
| line | result |
|---|---|
| 4.0.0-rc-6 (released) | ✅ not affected — resolves resteasy's transitives
normally |
| maven-4.0.x (→ rc-7) | ❌ affected, **silently** |
| master (4.1.0-SNAPSHOT) | ❌ affected, **silently** |
| 3.10.x | ❌ affected — hard failure (as reported) |
rc-6 predates the change (tag 2026-07-30; `03c947d8` is 2026-09-01), so
current Maven 4 users are fine. But it has reached **4.0.x and master**, where
— unlike 3.10.x's hard failure — it manifests as a **silent drop of transitive
dependencies**:
```
[WARNING] The POM for org.jboss.resteasy:resteasy-client:jar:7.0.0.Final is
invalid, transitive dependencies (if any) will not be available: 9 problems …
[ERROR] version missing for jboss-logging, httpclient, jakarta.ws.rs-api,
…
```
`dependency:tree` on 4.0.x / master lists only the direct `resteasy-client`
jar; on rc-6 it lists `jboss-logging`, `httpclient`, `jakarta.ws.rs-api`, … An
empty project still reports BUILD SUCCESS, but a real consumer of those
transitives fails to compile / hits `NoClassDefFoundError` at runtime.
Two implications:
1. The fix needs to land on **4.0.x (before rc-7) and master (4.1.0)**, not
just 3.10.x. Since a GitHub issue carries a single milestone (this one is
`3.10.0`), how would you like to track the other lines — split per line, or
track them here?
2. Because 4.0.x / master fail **silently** (build green, transitives gone),
a regression test should assert the transitives are actually **resolved** (e.g.
`dependency:tree` / classpath contains `jboss-logging`), not merely that the
build succeeds.
@gnodet's `isSafePropertyActivation` approach (pass through negated-property
/ default-on activations like `resteasy-default`, keep blocking positive ones,
still strip repositories) looks right to me and should restore this case.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
