[MENFORCER-426] DependencyConvergence in 3.1.0 fails when using version ranges

• Type: Bug
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 3.0.0, 3.1.0
• Fix Version/s: 3.4.0
• Component/s: dependencyConvergence, Standard Rules
• Assignee: Slawomir Jaranowski
• Reporter: Joe Barnett
• Created: 11/Jul/22 23:11
• Updated: 22/May/23 17:19
• Resolved: 22/May/23 17:19

Description

In our project, using version 3.0.0-M3 of the maven-enforcer-plugin's DependencyConvergence rule passes.  Using version 3.1.0 starts to show convergence errors that I believe may be related to using version ranges to declare dependencies:

[WARNING] 
Dependency convergence error for com.trib3:graphql:jar:1.32.3279:compile paths to dependency are:
+-com.joe.quizzy:server:jar:1.0-SNAPSHOT
  +-com.joe.quizzy:graphql:jar:1.0-SNAPSHOT:compile
    +-com.trib3:graphql:jar:1.32.3279:compile
and
+-com.joe.quizzy:server:jar:1.0-SNAPSHOT
  +-com.trib3:graphql:jar:1.32.3324:compile

both com.joe.quizzy:server and com.joe.quizzy:graphql declare a dependency on com.trib3:graphql, with a version of [1.32.1,1.33-SNAPSHOT).  that version range should (currently) resolve to 1.32.3324 in both usages, but in enforcer 3.1.0's DependencyConvergence check does not.

Issue Links

• is caused by: MRESOLVER-345 Conflict resolution in verbose mode is sensitive to version ordering
• links to: GitHub Pull Request #259