[MNG-5129] Maven struggles while resolving locked snapshots by two or more simultaneously used projects.

• Type: Bug
• Status: Closed
• Priority: Blocker
• Resolution: Incomplete
• Affects Version/s: 3.0.3
• Component/s: Dependencies
• Assignee: Unassigned
• Reporter: Christopher Klewes
• Created: 07/Jul/11 09:02
• Updated: 05/Mar/18 20:36
• Resolved: 22/Jan/14 20:31

Description

This has to be explained with an easy example. Given that we have three projects (A, B and C). Both projects B and C has a dependency to a locked snapshot of project A.

Project B requires build number #2

<dependency>
  <groupId>org.codehaus</groupId>
  <artifactId>A</artifactId>
  <version>1.0.0-20110705.132520-2</version>
</dependency>

Project C requires build number #1

<dependency>
  <groupId>org.codehaus</groupId>
  <artifactId>A</artifactId>
  <version>1.0.0-20110705.132120-1</version>
</dependency>

We now call dependency:resolve on each projects to resolve their dependencies from the repositories. As we can see in our local repository both versions are fetched and downloaded from their respective repository server. Unfortunately a last one wins conflict occurs. The project on which dependency:resolve is called last wins the race. Maven typically copies the latest fetched snapshot version (even if it's locked!) to the default version. Let's have a look at the folder structure:

Folder listing of the artifact dependency A (repository/org/codehaus/A/)

    maven-metadata-local.xml
    maven-metadata-opensaga.xml
    maven-metadata-opensaga.xml.sha1

    A-1.0.0-20110705.132120-1.jar
    A-1.0.0-20110705.132120-1.pom

    A-1.0.0-20110705.132520-2.jar
    A-1.0.0-20110705.132520-2.pom
 
    A-1.0.0-SNAPSHOT.jar (the last fetched snapshot version)
    A-1.0.0-SNAPSHOT.pom

The last version will be copied to the file A-1.0.0-SNAPSHOT.jar. Maven references their dependencies to the file without the exactt timestamp/buildnumber. This fact make it impossible to develop the project B and C or even run them simultaneously, because only the last one wins.

It would be mandatory to exactly reference the file with the timestamp of each project!

What do you think on this issue? I submitted the project structure so you can easily reproduce this issue.

Issue Links

• relates to: MNG-4189 Maven not picking up specific timestamped version dependency when a later timestamped version was downloaded and already present in the local repository
• relates to: MNG-5037 Download only snapshot artefacts in local repo and not timestamped jars