[CONFIGURATION-772] Exclude unused transitive dependencies

• Type: Improvement
• Status: Resolved
• Priority: Minor
• Resolution: Not A Problem
• Affects Version/s: 2.6
• Component/s: Build
• Labels: build pull-request-available security
• External issue URL: https://github.com/apache/commons-configuration/pull/40
• Assignee: Unassigned
• Reporter: César Soto Valero
• Created: 30/Nov/19 09:17
• Updated: 25/Mar/23 21:09
• Resolved: 25/Mar/23 21:09

Description

Hello. I noticed that poi-ooxml and postgresql, which are transitive dependencies induced via dbunit, are actually not used.

Looking at the Maven dependency tree of the project, we can see that these dependencies may create conflicts:

.  .  .
 |  +- org.apache.poi:poi-ooxml:jar:3.17:test
 |  |  +- org.apache.poi:poi:jar:3.17:test
 |  |  |  +- (commons-codec:commons-codec:jar:1.10:test - omitted for conflict with 1.13)
 |  |  |  \- org.apache.commons:commons-collections4:jar:4.1:test
 |  |  +- org.apache.poi:poi-ooxml-schemas:jar:3.17:test
 |  |  |  \- org.apache.xmlbeans:xmlbeans:jar:2.6.0:test
 |  |  |     \- stax:stax-api:jar:1.0.1:test
 |  |  \- com.github.virtuald:curvesapi:jar:1.04:test
 |  \- postgresql:postgresql:jar:8.4-701.jdbc3:test
.  .  .

Hence, It is a good practice to exclude these dependencies from the pom to avoid conflicts, to make the library smaller and the dependency tree clearer.

 

Issue Links

• links to: GitHub Pull Request #40