[MPMD-384] maven-pmd-plugin is dowloading transitive dependencies of unmanaged version - ASF JIRA

Attach files

Attach Screenshot

Voters

Watch issue

Watchers

Create sub-task

Link

Clone

Update Comment Author

Replace String in Comment

Update Comment Visibility

Delete Comments

XML

Word

Printable

JSON

Details

Type: Bug
Status: Closed
Priority: Major
Resolution: Fixed
Affects Version/s: 3.15.0, 3.16.0, 3.17.0, 3.18.0, 3.19.0, 3.20.0, 3.21.0
Fix Version/s: 3.21.1, 3.21.2
Component/s: PMD
Labels:
None

Description

The app pom introduces A:1.0-RELEASE, and this artifact A has transitive dependency B:0.12.0-SNAPSHOT. In app pom, we manage B as version 0.13.0-RELEASE.

When the pmd:3.15.0 and above is being executed, it will resolve dependencies, and somehow the B:0.12.0-SNAPSHOT is resolved as a dependency instead of B:0.13.0-RELEASE.

This is not only downloading wrong version, but also means lots of transitive dependencies with unmanaged version will be always downloaded (if not in cache) causing build slowness. Especially when we are using BF option: -Daether.dependencyCollector.impl=bf, this algorithm will skip downloading poms of for conflict losers, but maven-pmd-plugin (having this bug) again downloads those skipped ones.

More details about BF:
https://issues.apache.org/jira/browse/MRESOLVER-324