[MNG-5769] Maven is ignoring dependencyManagement for transitive dependencies

• Type: Bug
• Status: Closed
• Priority: Major
• Resolution: Duplicate
• Affects Version/s: 3.2.5
• Component/s: Dependencies
• Assignee: Christian Schulte
• Reporter: Cintia DR
• Created: 19/Feb/15 22:27
• Updated: 24/Jun/16 01:11
• Resolved: 24/Jun/16 01:11

Description

Assume that an arbitrary dep-A has a dependencyManagement redefining the version of a transitive dependency (com.github.jnr:jffi).

Its dependency:tree looks fine:

test-deps/dep-A $ mvn3.2.5 org.apache.maven.plugins:maven-dependency-plugin:2.10:tree
...
[INFO] com.test.deps:depA:jar:1.0-SNAPSHOT
[INFO] \- com.github.jnr:jnr-ffi:jar:1.0.3:compile
[INFO]    +- com.github.jnr:jffi:jar:1.2.7:compile
[INFO]    +- com.github.jnr:jffi:jar:native:1.2.7:runtime    
[INFO]    +- org.ow2.asm:asm:jar:4.0:compile
[INFO]    +- org.ow2.asm:asm-commons:jar:4.0:compile
[INFO]    +- org.ow2.asm:asm-analysis:jar:4.0:compile
[INFO]    +- org.ow2.asm:asm-tree:jar:4.0:compile
[INFO]    +- org.ow2.asm:asm-util:jar:4.0:compile
[INFO]    \- com.github.jnr:jnr-x86asm:jar:1.0.2:compile (version selected from constraint [1.0.2,))

But when including dep-A as a compile dependency of proj-B, the dependencyManagement is ignored:

test-deps/proj-B $ mvn3.2.5 org.apache.maven.plugins:maven-dependency-plugin:2.10:tree
...
[INFO] com.test.deps:projb:jar:2.0-SNAPSHOT
[INFO] \- com.test.deps:depA:jar:1.0-SNAPSHOT:compile
[INFO]    \- com.github.jnr:jnr-ffi:jar:1.0.3:compile
[INFO]       +- com.github.jnr:jffi:jar:1.2.8-SNAPSHOT:compile (version selected from constraint [1.2.1,1.3.0))
[INFO]       +- com.github.jnr:jffi:jar:native:1.2.8-SNAPSHOT:runtime (version selected from constraint [1.2.1,1.3.0))
[INFO]       +- org.ow2.asm:asm:jar:4.0:compile
[INFO]       +- org.ow2.asm:asm-commons:jar:4.0:compile
[INFO]       +- org.ow2.asm:asm-analysis:jar:4.0:compile
[INFO]       +- org.ow2.asm:asm-tree:jar:4.0:compile
[INFO]       +- org.ow2.asm:asm-util:jar:4.0:compile
[INFO]       \- com.github.jnr:jnr-x86asm:jar:1.0.2:compile (version selected from constraint [1.0.2,))

I would expect both projects to have the same versions of the dependencies.

Issue Links

• duplicates: MNG-5761 Dependency management is not transitive.