[MSHARED-1255] Do something about Hamcrest

• Type: Bug
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Component/s: maven-dependency-analyzer, maven-shared-utils
• Assignee: Unassigned
• Reporter: Elliotte Rusty Harold
• Created: 16/May/23 20:02
• Updated: 17/Jun/23 18:42
• Resolved: 17/Jun/23 18:42

Description

Currently there's a weird situation with Hamcrest deps that the dependency analyzer doesn't truly grok and which leads to false positive warnings like:

[WARNING] Unused declared dependencies found:
[WARNING] org.hamcrest:hamcrest-core:jar:2.2:test

This happens in maven-shared-utils for intance.

This is a result of moving classes between artifacts from version 1 to 2, and appears when JUnit 4 is used and thus an older version of hamcrest-core gets pulled in unless the empty org.hamcrest:hamcrest-core:jar:2.2 is added:

https://hamcrest.org/JavaHamcrest/distributables

Options:
1. special case this one
2. Notice when a dependency appears unused but does upgrade a version lower in the tree
3. use dependency management instead to upgrade hamcrest-core?