question-mark
Stuck on an issue?

Lightrun Answers was designed to reduce the constant googling that comes with debugging 3rd party libraries. It collects links to all the places you might be looking at while hunting down a tough bug.

And, if you’re still stuck at the end, we’re happy to hop on a call to see how we can help out.

Bug in the mediation of transitive dependencies

See original GitHub issue

Running version v4.2.183.4139.1 (as reported by IntelliJ Idea) of this plugin

THERE SEEMS TO BE A PROBLEM (AS I UNDERSTAND IT) WITH THE TRANSITIVE DEPENDENCIES LIST/TREE WHEN COMPARED TO THE SPECIFICATION

Dependency mediation - this determines what version of an artifact will be chosen when multiple versions are encountered as dependencies. Maven picks the “nearest definition”. That is, it uses the version of the closest dependency to your project in the tree of dependencies. You can always guarantee a version by declaring it explicitly in your project’s POM. Note that if two dependency versions are at the same depth in the dependency tree, the first declaration wins. “nearest definition” means that the version used will be the closest one to your project in the tree of dependencies. For example, if dependencies for A, B, and C are defined as A -> B -> C -> D 2.0 and A -> E -> D 1.0, then D 1.0 will be used when building A because the path from A to D through E is shorter. You could explicitly add a dependency to D 2.0 in A to force the use of D 2.0.

EXAMPLE

I have the following maven projects (actual names obfuscated):

A 12.0.1
A 13.0.0
A 13.2.0
B 12.0.1
  -> A 12.0.1
B 12.0.2
  -> A 13.0.0
C 8.2.0
  -> A 13.2.0
  -> B 12.0.2
D 0.7.1
  -> A 13.0.0
  -> C 12.0.1

When E is defined as

E 0.9.3
  -> A 13.2.0
  -> C 8.2.0
  -> D 0.7.1

transitive dependencies in the dependency tree/list is wrong

E 0.9.3
  -> A 13.2.0
  -> C 8.2.0
     -> A 13.2.0
     -> B 12.0.2
          -> A 13.0.0 (omitted for conflict with 13.2.0) -- CORRECT
  -> D 0.7.1
    -> A 13.2.0 -- WRONG!!! SHOULD BE 13.0.0 and omitted for conflict with 13.2.0
    -> B 12.0.1 (omitted for conflict with 12.0.2)  -- CORRECT

When E is defined as

E 0.9.3
  -> A 13.2.0
  -> D 0.7.1
  -> C 8.2.0

transitive dependencies in the dependency tree/list is correct

E 0.9.3
  -> A 13.2.0
  -> D 0.7.1
    -> A 13.0.0 (omitted for conflict with 13.2.0) -- CORRECT
    -> B 12.0.1 -- CORRECT 
          -> A 12.0.1 (omitted for conflict with 13.2.0) -- CORRECT
  -> C 8.2.0
     -> A 13.2.0
     -> B 12.0.2 (omitted for conflict with 12.0.1) -- CORRECT

Why this bothers me is that it failed to report a dependency conflict when it was supposed to!

Issue Analytics

  • State:open
  • Created 4 years ago
  • Comments:7 (5 by maintainers)

github_iconTop GitHub Comments

12reactions
krasacommented, Jun 6, 2019

I released a new version with a fix.

0reactions
krasacommented, Aug 6, 2020

@ruwanka probably a bug, I might have done it too strict. A reproducible project would help, or you could debug it yourself

Read more comments on GitHub >

github_iconTop Results From Across the Web

[#MNG-5988] Dependency mediation should prioritize ...
Dependency mediation should prioritize transitive dependencies based on scope. Status: Assignee: Priority: Resolution: Reopened. Unassigned.
Read more >
Transitive dependencies brought by provided scope and ...
We face an issue when a same artifact-X is transitively brought by a dependency-1 with provided scope, and another dependency-2 with default ...
Read more >
Transitive Dependencies Account for 95% of Bugs
Nearly all (95%) open source vulnerabilities are found in transitive or indirect dependencies, according to a new report from Endor Labs ...
Read more >
[jira] [Commented] (MNG-5988) Dependency mediation should ...
{quote}is the bug that Maven is not doing what it claims to do {quote} Probably ... If both compile- and test scoped dependencies...
Read more >
[m2] Dependency mediation - users@maven.apache.org - narkive
my project has transitive dependencies on both asm 1.5.3 (from cglib 2.1_2, which I fixed locally, see [1]) and 1.4.3 (from hibernate 3.0.5)....
Read more >

github_iconTop Related Medium Post

No results found

github_iconTop Related StackOverflow Question

No results found

github_iconTroubleshoot Live Code

Lightrun enables developers to add logs, metrics and snapshots to live code - no restarts or redeploys required.
Start Free

github_iconTop Related Reddit Thread

No results found

github_iconTop Related Hackernoon Post

No results found

github_iconTop Related Tweet

No results found

github_iconTop Related Dev.to Post

No results found

github_iconTop Related Hashnode Post

No results found