[MNG-5761] Dependency management is not transitive.

• Type: Bug
• Status: Reopened
• Priority: Critical
• Resolution: Unresolved
• Affects Version/s: 3.2.5
• Fix Version/s: 4.0.x-candidate
• Component/s: Dependencies
• Assignee: Unassigned
• Reporter: Jeff Schnitzer
• Created: 04/Feb/15 13:24
• Updated: 08/Feb/24 08:35

Description

A detailed description of the issue is here:

http://stackoverflow.com/questions/28312975/maven-dependencymanagement-version-ignored-in-transitive-dependencies

The short of it is that maven appears to be using the wrong <dependencyManagement> version in a transitive dependency. There are two relevant <dependencyManagement> sections in the build, one pulled in by guice and one pulled in by gwizard-parent. These are the dependency paths from the top:

gwizard-example -> gwizard-config -> gwizard-parent
gwizard-example -> gwizard-config -> guice -> guice-parent

gwizard-parent's dependencyManagement specifies guava 18
guice-parent's dependencyManagement specifies guava 16

Guava 16 is winning. This seems highly undesirable, and in fact it breaks our build. I would expect that in a version # fight, "closest to the top" should win.

Issue Links

• causes: FLINK-9091 Failure while enforcing releasability in building flink-json module
• duplicates: MNG-3890 Transitive dependencies override explicitly set scope.
• is blocked by: MRESOLVER-10 New 'TransitiveDependencyManager' supporting transitive dependency management
• is blocked by: MNG-6056 Implement Feature Toggle Module to handle Feature Toggles
• is duplicated by: MNG-5769 Maven is ignoring dependencyManagement for transitive dependencies
• is related to: MNG-7982 Switch to enable transitivity in depMgr used by Maven
• is required by: MNG-6139 Addition of command line option 'legacy-dependency-management'.
• relates to: MNG-7003 Inconsistent dependency tree
• mentioned in: Page Loading...