[MDEP-750] 2.10:tree -Dverbose shows "for duplicate" where "for conflict" is expected

• Type: Bug
• Status: Closed
• Priority: Major
• Resolution: Won't Fix
• Affects Version/s: 2.10
• Component/s: tree

Environment

Apache Maven 3.8.1 (05c21c65bdfed0f71a2f2ada8b84da59348c4c5d)
Java version: 1.8.0_201, vendor: Oracle Corporation, runtime: C:\Program Files\Java\jdk1.8.0_201\jre
OS name: "windows 10", version: "10.0", arch: "amd64", family: "windows"

• Docs Text: https://maven.apache.org/plugins/maven-dependency-plugin/examples/resolving-conflicts-using-the-dependency-tree.html
• Assignee: Unassigned
• Reporter: Atsushi Nakagawa
• Created: 29/May/21 06:20
• Updated: 07/Jun/21 14:37
• Resolved: 07/Jun/21 14:37

Description

I'm not sure what the support status of 2.10 is but here goes.  At the least maybe this is a documentation issue and -Dverbose should just be taken with a grain of salt, or perhaps this is a test case for any future implementations.

In brief:
Running mvn -B org.apache.maven.plugins:maven-dependency-plugin:2.10:tree -Dverbose shows "omitted for duplicate" where "omitted for conflict" is expected.

I have attached a minimum pom.xml for reproducing the issue and the output from running the above command.  (Output shows a warning regarding inconsistencies between Maven 2 vs 3 but I'm presuming this is an issue regardless that pertains to version 2.)

Points of note:

• These two lines are contradictory because it shows 2.10.3 as the version used for "jackson-databind" but no conflict message is emitted when it tramples 2.12.3:
  • com.fasterxml.jackson.core:jackson-databind:jar:2.10.3:compile
  • (com.fasterxml.jackson.core:jackson-databind:jar:2.12.3:compile - omitted for duplicate)
• Hierarchy printout shows "com.fasterxml.jackson.core:jackson-databind:jar:2.10.3:compile" as a dependency of "software.amazon.awssdk:sdk-core:jar:2.16.62:compile" but the pom for the former actually depends on version 2.12.3.

Other noteworthy points:

• "jackson-databind:jar:2.12.3" is three plus levels deep and first (via sts) while 2.10.3 is two and second (via java-jwt) so 2.10.3 wins by nearest-wins.  (Assuming this is how it works.)  The issue is only with the conflict message printout.