[MENFORCER-119] new rule to check for invalid dependency excludes

• Type: Improvement
• Status: Closed
• Priority: Major
• Resolution: Auto Closed
• Affects Version/s: 1.0.1
• Component/s: Standard Rules
• Assignee: Unassigned
• Reporter: Travis Schneeberger
• Created: 06/Jul/11 18:30
• Updated: 14/Sep/21 13:53
• Resolved: 06/Sep/15 20:45

Description

Say you depend on the foo jar and would like to exclude the servlet-api. For example:

<dependency>
<groupId>com.foo</groupId>
<artifactId>foo</artifactId>
<version>1</version>
<exclusions>
<exclusion>
<groupId>javax.servlet</groupId>
<artifactId>servlet-api</artifactId>
</exclusion>
</exclusions>
</dependency>

Later the foo jar switches to using the geronimo version of the servlet spec. You upgrade to use the new foo jar and your exclusion of the javax.servlet:servlet-api is no longer valid. It would be nice if there was a enforcer rule to check for these invalid excludes.

This type of thing happens for various reasons like:

dependency switched to the "same" dependency but with a different groupId - technically these are different deps according to maven
dependency changed minimum java language version where some apis are now included in the java runtime
dependency switched to a new implementation of the same library
dependency no longer uses a dependency

Without this kind of rule it is very easy for an unwanted dependency slip in unnoticed.

Btw. I also created a similar jira for the dependency plugin. I'm not sure which plugin should should support this functionality.

Issue Links

• is related to: MDEP-317 Add goal dependency:analyze-exclusions - check for invalid excludes