gnodet-bot commented on code in PR #13715:
URL: https://github.com/apache/maven/pull/13715#discussion_r4389758630
##########
compat/maven-model-builder/src/main/java/org/apache/maven/model/composition/DefaultDependencyManagementImporter.java:
##########
@@ -62,11 +64,21 @@ public void importManagement(
target.setDependencyManagement(depMgmt);
}
+ Set<String> directDependencies = new
HashSet<>(dependencies.keySet());
+
for (DependencyManagement source : sources) {
for (Dependency dependency : source.getDependencies()) {
String key = dependency.getManagementKey();
- if (!dependencies.containsKey(key)) {
+ Dependency present = dependencies.get(key);
+ if (present == null) {
dependencies.put(key, dependency);
+ } else if (directDependencies.contains(key)
+ && present.getVersion() == null
+ && dependency.getVersion() != null) {
+ Dependency updated = present.clone();
+ updated.setVersion(dependency.getVersion());
+ updated.setLocation("version",
dependency.getLocation("version"));
+ dependencies.put(key, updated);
}
}
}
Review Comment:
**Convention violation: compat behavior change without Maven 3.x port**
This block adds version-inheritance-from-BOM to the compat layer, but the
same fix is not present in Maven 3.x. Specifically, `maven-3.10.x`'s
`maven-model-builder/src/main/java/org/apache/maven/model/composition/DefaultDependencyManagementImporter.java`
still has the old simple `if (!dependencies.containsKey(key))` logic — no
`directDependencies` tracking.
The compat module (`@Deprecated(since = "4.0.0")`) is meant to preserve
Maven 3.x behavior for embedders migrating to Maven 4. Introducing behavior
that Maven 3.x doesn't have creates an inconsistency: embedders testing with
Maven 3.10.x will see the bug; switching to Maven 4+compat will silently behave
differently.
**Required action**: First propose this fix for `maven-3.10.x` (the
`maven-model-builder` module, not `compat`), then this compat port follows
naturally. Alternatively, if the policy is that compat is allowed to be "more
correct" than Maven 3.x for bug fixes, please document that explicitly in the
PR description so maintainers can make an informed decision.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
