[MNG-5739] Adding a test dependency can move dependencies from the compile scope to the test scope

• Type: Bug
• Status: Open
• Priority: Major
• Resolution: Unresolved
• Fix Version/s: needing-scrub-3.4.0-fallout
• Component/s: Dependencies
• Assignee: Unassigned
• Reporter: Andy Wilkinson
• Created: 17/Dec/14 07:47
• Updated: 27/Jul/23 07:02

Description

I'm seeing some strange behaviour where the transitive dependencies of a test-scope dependency are causing transitive dependencies of a compile-scope dependency to become test-scoped.

A pom with a single dependency on org.eclipse.jetty:jetty-webapp produces the following dependencies:

$ mvn dependency:tree | grep org.eclipse.jetty:
[INFO] \- org.eclipse.jetty:jetty-webapp:jar:8.1.10.v20130312:compile
[INFO]    +- org.eclipse.jetty:jetty-xml:jar:8.1.10.v20130312:compile
[INFO]    |  \- org.eclipse.jetty:jetty-util:jar:8.1.10.v20130312:compile
[INFO]    \- org.eclipse.jetty:jetty-servlet:jar:8.1.10.v20130312:compile
[INFO]       \- org.eclipse.jetty:jetty-security:jar:8.1.10.v20130312:compile
[INFO]          \- org.eclipse.jetty:jetty-server:jar:8.1.10.v20130312:compile
[INFO]             +- org.eclipse.jetty:jetty-continuation:jar:8.1.10.v20130312:compile
[INFO]             \- org.eclipse.jetty:jetty-http:jar:8.1.10.v20130312:compile
[INFO]                \- org.eclipse.jetty:jetty-io:jar:8.1.10.v20130312:compile

If I now add a test dependency on org.apache.solr:sole-core, a number of dependencies that were previously in the compile scope are now in the test scope:

$ mvn dependency:tree | grep org.eclipse.jetty:
[INFO] +- org.eclipse.jetty:jetty-webapp:jar:8.1.10.v20130312:compile
[INFO] |  +- org.eclipse.jetty:jetty-xml:jar:8.1.10.v20130312:compile
[INFO] |  \- org.eclipse.jetty:jetty-servlet:jar:8.1.10.v20130312:compile
[INFO]    +- org.eclipse.jetty:jetty-continuation:jar:8.1.10.v20130312:test
[INFO]    +- org.eclipse.jetty:jetty-deploy:jar:8.1.10.v20130312:test
[INFO]    +- org.eclipse.jetty:jetty-http:jar:8.1.10.v20130312:test
[INFO]    +- org.eclipse.jetty:jetty-io:jar:8.1.10.v20130312:test
[INFO]    +- org.eclipse.jetty:jetty-jmx:jar:8.1.10.v20130312:test
[INFO]    +- org.eclipse.jetty:jetty-security:jar:8.1.10.v20130312:compile
[INFO]    +- org.eclipse.jetty:jetty-server:jar:8.1.10.v20130312:test
[INFO]    +- org.eclipse.jetty:jetty-util:jar:8.1.10.v20130312:compile

My understanding is that this is because the shortest route to the root of the hierarchy wins and, for a number of the Jetty dependencies, the shortest route is via the test-scoped org.apache.solr:sole-core. I can understand a test-scoped dependency being upgraded to the compile scope when a dependency is added, but downgrading a dependency from the compile scope to the test scope feels broken to me.

I can work around the problem by using dependency management to force the dependencies into the compile scope, or by declaring direct dependencies on the transitive dependencies of org.eclipse.jetty:jetty-webapp, but both approaches require me to know what all those dependencies are and "duplicate" them in my pom, undermining the value of the dependencies being pulled in transitively in the first place.

Issue Links

• is related to: MNG-6135 Maven plugins and core extensions are not dependencies, they should be resolved the same way as projects.
• relates to: MNG-1378 Make dependencies of test-jars transitive
• relates to: MNG-7852 Use all the versions for dependency resolution rather than "nearest first" or "declared first"