slachiewicz opened a new issue, #301: URL: https://github.com/apache/maven-dependency-analyzer/issues/301
`DependencyGraphProject` (added for the 1.17.2 reachability refinement in `getTestArtifactsWithNonTestScope`) only overrides `getDependencyArtifacts()` to return the filtered, candidate-excluded dependency list — it does not override `getArtifacts()`. `MavenProject(MavenProject)`'s copy constructor carries over the original project's already-resolved artifact set, which still contains the excluded candidate. `ProjectDependenciesResolver` reads that pre-resolved set rather than re-deriving from the filtered model, so the excluded candidate is still "reachable" in its own synthetic graph and gets evicted from the non-test-scope warning — for any project where the candidate happens to resolve successfully at all, not only when it's genuinely reachable via another dependency. Reproduced downstream in apache/maven-dependency-plugin's `analyze-testDependencyWithNonTestScope` IT (apache/maven-dependency-plugin#1692): bumping this library from 1.17.1 to 1.17.2 makes the IT's expected warning table come back empty. Debug logging confirms `createDependencyGraphProject()` correctly excludes the candidate from the filtered dependency list handed to `DependencyGraphProject`, but `projectDependenciesResolver.resolve()` on that project still returns the candidate in the resolved graph anyway. Code: [`DependencyGraphProject`](https://github.com/apache/maven-dependency-analyzer/blob/master/src/main/java/org/apache/maven/shared/dependency/analyzer/DefaultProjectDependencyAnalyzer.java#L416-L429) overrides [`getDependencyArtifacts()`](https://github.com/apache/maven-dependency-analyzer/blob/master/src/main/java/org/apache/maven/shared/dependency/analyzer/DefaultProjectDependencyAnalyzer.java#L424) but not `getArtifacts()`, called from [`getTestArtifactsWithNonTestScope()`](https://github.com/apache/maven-dependency-analyzer/blob/master/src/main/java/org/apache/maven/shared/dependency/analyzer/DefaultProjectDependencyAnalyzer.java#L205). Suggested fix: also override `getArtifacts()` in `DependencyGraphProject` to return `null`, mirroring the existing `getDependencyArtifacts()` override, so `ProjectDependenciesResolver` can't fall back to the copied pre-resolved set. Note: #69 is an in-flight Maven 4/new-API rewrite that also touches this class but doesn't address this method — flagging so a maintainer can judge whether to base a fix on master or land it after #69. *This change was created with AI assistance.* -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
