[MENFORCER-407] Enforcer 3.0.0 breaks with Maven 3.8.4

• Type: Bug
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 3.0.0
• Fix Version/s: 3.2.0, 3.2.1
• Component/s: Plugin
• Assignee: Slawomir Jaranowski
• Reporter: David Pilato
• Created: 16/Dec/21 12:40
• Updated: 02/Feb/23 10:51
• Resolved: 07/Jan/23 15:33

Description

Here is the situation. I'm trying to upgrade enforcer from 3.0.0-M3 to 3.0.0. 

 

Everything worked well on my laptop with Maven 3.5.3. So I looked at the version used by Github actions and saw that it's using Maven 3.8.4.

As soon as I upgraded my local version of Maven to 3.8.4, I started to hit the same exact issue. It seems to try to pull net.sf.ehcache:sizeof-agent:1.0.1. 

If I revert Enforcer to 3.0.0-M3 with Maven 3.8.4, I can run without any issue mvn enforcer:enforce.

So I suspect that the combination of both upgrades is triggering something. 

I noted also that 3.0.0 now tries to enforce as well dependencies marked as provided. Might be the reason of this.

I attached the full logs when running with 3.0.0 and 3.0.0-M3.

Issue Links

• is related to: MSHARED-1016 Transitive provided dependencies are not removed from collected dependency graph
• is related to: MENFORCER-435 Get rid of maven-dependency-tree dependency
• relates to: MENFORCER-437 DependencyConvergence treats provided dependencies are runtime dependencies
• links to: GitHub Pull Request #221