[MENFORCER-302] DependencyConvergence does not recognize exclusion wildcards

• Type: Bug
• Status: Closed
• Priority: Major
• Resolution: Duplicate
• Labels: convergence
• Assignee: Robert Scholte
• Reporter: Stanislav
• Created: 17/Apr/18 21:53
• Updated: 07/Feb/20 08:40
• Resolved: 07/Feb/20 08:40

Description

When I use wildcards to exclude all transitive dependencies from a dependency, convergence check still fails.

Steps to reproduce:

1. create pom: 

   <?xml version="1.0" encoding="UTF-8"?>
   
   <project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
            xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
     <modelVersion>4.0.0</modelVersion>
   
     <groupId>demo</groupId>
     <artifactId>bug</artifactId>
     <version>1.0-SNAPSHOT</version>
   
     <name>bug</name>
   
     <properties>
       <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
       <maven.compiler.source>1.8</maven.compiler.source>
       <maven.compiler.target>1.8</maven.compiler.target>
       <google-http-client.version>1.23.0</google-http-client.version>
     </properties>
   
     <dependencies>
       <dependency>
         <groupId>com.google.http-client</groupId>
         <artifactId>google-http-client</artifactId>
         <version>1.23.0</version>
         <exclusions>
           <exclusion>
             <groupId>*</groupId>
             <artifactId>*</artifactId>
           </exclusion>
         </exclusions>
       </dependency>
       <dependency>
         <groupId>com.google.api</groupId>
         <artifactId>api-common</artifactId>
         <version>1.2.0</version>
         <exclusions>
           <exclusion>
             <groupId>*</groupId>
             <artifactId>*</artifactId>
           </exclusion>
         </exclusions>
       </dependency>
     </dependencies>
     <build>
       <plugins>
         <plugin>
           <groupId>org.apache.maven.plugins</groupId>
           <artifactId>maven-enforcer-plugin</artifactId>
           <executions>
             <execution>
               <id>enforce</id>
               <configuration>
                 <rules>
                   <dependencyConvergence/>
                 </rules>
               </configuration>
               <goals>
                 <goal>enforce</goal>
               </goals>
             </execution>
           </executions>
         </plugin>
       </plugins>
     </build>
   </project>
   

   2. Run mvn dependency:tree

   ...
   [INFO] --- maven-dependency-plugin:2.8:tree (default-cli) @ bug ---
   [INFO] demo:bug:jar:1.0-SNAPSHOT
   [INFO] +- com.google.http-client:google-http-client:jar:1.23.0:compile
   [INFO] \- com.google.api:api-common:jar:1.2.0:compile
   

   3. Run mvn compile

   ...
   [INFO] --- maven-enforcer-plugin:3.0.0-M1:enforce (enforce) @ bug ---
   [WARNING] 
   Dependency convergence error for com.google.code.findbugs:jsr305:1.3.9 paths to dependency are:
   +-demo:bug:1.0-SNAPSHOT
     +-com.google.http-client:google-http-client:1.23.0
       +-com.google.code.findbugs:jsr305:1.3.9
   and
   +-demo:bug:1.0-SNAPSHOT
     +-com.google.api:api-common:1.2.0
       +-com.google.code.findbugs:jsr305:3.0.0
   
   [WARNING] Rule 0: org.apache.maven.plugins.enforcer.DependencyConvergence failed with message:
   Failed while enforcing releasability. See above detailed error message.

If I exclude jsr305 from both dependencies convergence succeds

<dependencies>
    <dependency>
      <groupId>com.google.http-client</groupId>
      <artifactId>google-http-client</artifactId>
      <version>1.23.0</version>
      <exclusions>
        <exclusion>
          <groupId>com.google.code.findbugs</groupId>
          <artifactId>jsr305</artifactId>
        </exclusion>
      </exclusions>
    </dependency>
    <dependency>
      <groupId>com.google.api</groupId>
      <artifactId>api-common</artifactId>
      <version>1.2.0</version>
      <exclusions>
        <exclusion>
          <groupId>com.google.code.findbugs</groupId>
          <artifactId>jsr305</artifactId>
        </exclusion>
      </exclusions>
    </dependency>
  </dependencies>

Issue Links

• duplicates: MENFORCER-195 Dependency convergence does not support wildcard exclusions
• duplicates: MENFORCER-232 DependencyConvergence doesn't acknowledge exclusion wildcards (MNG-2315)