This is an automated email from the ASF dual-hosted git repository. gnodet pushed a commit to branch it-gh12302 in repository https://gitbox.apache.org/repos/asf/maven.git
commit 0174254d8398f92b86098d3a47f713125a908de6 Author: Guillaume Nodet <[email protected]> AuthorDate: Thu Jun 18 17:41:05 2026 +0000 [#12302] Add RED IT for TransitiveDependencyManager version downgrade Adds integration test that verifies TransitiveDependencyManager does not silently downgrade dependency versions when an intermediate POM's <dependencyManagement> declares a lower version of a transitive dependency. Dependency chain: root → module-a:1.0 (parent=parent-a) → module-b:1.0 → lib-c:2.0 parent-a manages lib-c to 1.0 Expected: lib-c resolves to 2.0 (declared by module-b) Actual (bug): lib-c downgraded to 1.0 by parent-a's dependencyManagement because TransitiveDependencyManager has deriveUntil=MAX_VALUE. This test is expected to FAIL (RED) until the fix is applied. --- ...12302TransitiveDepMgmtVersionDowngradeTest.java | 84 +++++++++++++++++++++ .../pom.xml | 62 +++++++++++++++ .../repo/.gitattributes | 2 + .../maven/its/gh12302/lib-c/1.0/lib-c-1.0.jar | Bin 0 -> 322 bytes .../maven/its/gh12302/lib-c/1.0/lib-c-1.0.pom | 9 +++ .../maven/its/gh12302/lib-c/2.0/lib-c-2.0.jar | Bin 0 -> 322 bytes .../maven/its/gh12302/lib-c/2.0/lib-c-2.0.pom | 9 +++ .../its/gh12302/module-a/1.0/module-a-1.0.jar | Bin 0 -> 322 bytes .../its/gh12302/module-a/1.0/module-a-1.0.pom | 22 ++++++ .../its/gh12302/module-b/1.0/module-b-1.0.jar | Bin 0 -> 322 bytes .../its/gh12302/module-b/1.0/module-b-1.0.pom | 17 +++++ .../its/gh12302/parent-a/1.0/parent-a-1.0.pom | 19 +++++ .../settings-template.xml | 41 ++++++++++ 13 files changed, 265 insertions(+) diff --git a/its/core-it-suite/src/test/java/org/apache/maven/it/MavenITgh12302TransitiveDepMgmtVersionDowngradeTest.java b/its/core-it-suite/src/test/java/org/apache/maven/it/MavenITgh12302TransitiveDepMgmtVersionDowngradeTest.java new file mode 100644 index 0000000000..6ba89c4df6 --- /dev/null +++ b/its/core-it-suite/src/test/java/org/apache/maven/it/MavenITgh12302TransitiveDepMgmtVersionDowngradeTest.java @@ -0,0 +1,84 @@ +/* + * Licensed to the Apache Software Foundation (ASF) under one + * or more contributor license agreements. See the NOTICE file + * distributed with this work for additional information + * regarding copyright ownership. The ASF licenses this file + * to you under the Apache License, Version 2.0 (the + * "License"); you may not use this file except in compliance + * with the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, + * software distributed under the License is distributed on an + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + * KIND, either express or implied. See the License for the + * specific language governing permissions and limitations + * under the License. + */ +package org.apache.maven.it; + +import java.io.File; +import java.util.List; + +import org.junit.jupiter.api.Test; + +import static org.junit.jupiter.api.Assertions.assertFalse; +import static org.junit.jupiter.api.Assertions.assertTrue; + +/** + * Integration test for <a href="https://github.com/apache/maven/issues/12302";>gh-12302</a>. + * + * <p>Verifies that {@code TransitiveDependencyManager} does not silently downgrade + * dependency versions when an intermediate POM's {@code <dependencyManagement>} + * declares a lower version of a transitive dependency. + * + * <p>Dependency graph: + * <pre> + * root (test project) + * └── module-a:1.0 (parent = parent-a:1.0) + * └── module-b:1.0 + * └── lib-c:2.0 + * + * parent-a has <dependencyManagement> managing lib-c to 1.0 + * </pre> + * + * <p>Expected: lib-c resolves to 2.0 (declared by module-b). + * <br>Actual (bug): lib-c is downgraded to 1.0 by parent-a's dependencyManagement + * because {@code TransitiveDependencyManager} has {@code deriveUntil = Integer.MAX_VALUE}, + * collecting managed versions from every POM in the graph. + */ +public class MavenITgh12302TransitiveDepMgmtVersionDowngradeTest extends AbstractMavenIntegrationTestCase { + + MavenITgh12302TransitiveDepMgmtVersionDowngradeTest() { + super("[4.0.0-rc-3,)"); + } + + @Test + public void testTransitiveDependencyManagerDoesNotDowngradeVersions() throws Exception { + File testDir = extractResources("/gh-12302-transitive-dep-mgmt-version-downgrade"); + + Verifier verifier = newVerifier(testDir.getAbsolutePath()); + verifier.setAutoclean(false); + verifier.deleteDirectory("target"); + verifier.deleteArtifacts("org.apache.maven.its.gh12302"); + verifier.filterFile("settings-template.xml", "settings.xml"); + verifier.addCliArgument("--settings"); + verifier.addCliArgument("settings.xml"); + verifier.addCliArgument("validate"); + verifier.execute(); + verifier.verifyErrorFreeLog(); + + List<String> classpath = verifier.loadLines("target/classpath.txt"); + + // lib-c should resolve to 2.0 (as declared by module-b), not 1.0 + // (managed by parent-a's dependencyManagement). + // With the TransitiveDependencyManager bug, lib-c gets downgraded to 1.0. + assertTrue( + classpath.contains("lib-c-2.0.jar"), + "lib-c should be version 2.0 (declared by module-b), not downgraded: " + classpath); + assertFalse( + classpath.contains("lib-c-1.0.jar"), + "lib-c should NOT be downgraded to 1.0 by parent-a's dependencyManagement: " + classpath); + } +} diff --git a/its/core-it-suite/src/test/resources/gh-12302-transitive-dep-mgmt-version-downgrade/pom.xml b/its/core-it-suite/src/test/resources/gh-12302-transitive-dep-mgmt-version-downgrade/pom.xml new file mode 100644 index 0000000000..eb2f79c4a8 --- /dev/null +++ b/its/core-it-suite/src/test/resources/gh-12302-transitive-dep-mgmt-version-downgrade/pom.xml @@ -0,0 +1,62 @@ +<?xml version="1.0" encoding="UTF-8"?> +<!-- +Licensed to the Apache Software Foundation (ASF) under one +or more contributor license agreements. See the NOTICE file +distributed with this work for additional information +regarding copyright ownership. The ASF licenses this file +to you under the Apache License, Version 2.0 (the +"License"); you may not use this file except in compliance +with the License. You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +Unless required by applicable law or agreed to in writing, +software distributed under the License is distributed on an +"AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY +KIND, either express or implied. See the License for the +specific language governing permissions and limitations +under the License. +--> +<project> + <modelVersion>4.0.0</modelVersion> + + <groupId>org.apache.maven.its.gh12302</groupId> + <artifactId>test</artifactId> + <version>1.0</version> + <packaging>jar</packaging> + + <name>Maven Integration Test :: gh-12302</name> + <description>Verify that TransitiveDependencyManager does not downgrade dependency versions + when an intermediate POM's dependencyManagement declares a lower version.</description> + + <dependencies> + <dependency> + <groupId>org.apache.maven.its.gh12302</groupId> + <artifactId>module-a</artifactId> + <version>1.0</version> + </dependency> + </dependencies> + + <build> + <plugins> + <plugin> + <groupId>org.apache.maven.its.plugins</groupId> + <artifactId>maven-it-plugin-dependency-resolution</artifactId> + <version>2.1-SNAPSHOT</version> + <configuration> + <compileClassPath>target/classpath.txt</compileClassPath> + <significantPathLevels>1</significantPathLevels> + </configuration> + <executions> + <execution> + <id>resolve</id> + <goals> + <goal>compile</goal> + </goals> + <phase>validate</phase> + </execution> + </executions> + </plugin> + </plugins> + </build> +</project> diff --git a/its/core-it-suite/src/test/resources/gh-12302-transitive-dep-mgmt-version-downgrade/repo/.gitattributes b/its/core-it-suite/src/test/resources/gh-12302-transitive-dep-mgmt-version-downgrade/repo/.gitattributes new file mode 100644 index 0000000000..6d6420ce59 --- /dev/null +++ b/its/core-it-suite/src/test/resources/gh-12302-transitive-dep-mgmt-version-downgrade/repo/.gitattributes @@ -0,0 +1,2 @@ +*.pom text eol=lf +maven-metadata.xml text eol=lf diff --git a/its/core-it-suite/src/test/resources/gh-12302-transitive-dep-mgmt-version-downgrade/repo/org/apache/maven/its/gh12302/lib-c/1.0/lib-c-1.0.jar b/its/core-it-suite/src/test/resources/gh-12302-transitive-dep-mgmt-version-downgrade/repo/org/apache/maven/its/gh12302/lib-c/1.0/lib-c-1.0.jar new file mode 100644 index 0000000000..ee3ce6555d Binary files /dev/null and b/its/core-it-suite/src/test/resources/gh-12302-transitive-dep-mgmt-version-downgrade/repo/org/apache/maven/its/gh12302/lib-c/1.0/lib-c-1.0.jar differ diff --git a/its/core-it-suite/src/test/resources/gh-12302-transitive-dep-mgmt-version-downgrade/repo/org/apache/maven/its/gh12302/lib-c/1.0/lib-c-1.0.pom b/its/core-it-suite/src/test/resources/gh-12302-transitive-dep-mgmt-version-downgrade/repo/org/apache/maven/its/gh12302/lib-c/1.0/lib-c-1.0.pom new file mode 100644 index 0000000000..c969e383a7 --- /dev/null +++ b/its/core-it-suite/src/test/resources/gh-12302-transitive-dep-mgmt-version-downgrade/repo/org/apache/maven/its/gh12302/lib-c/1.0/lib-c-1.0.pom @@ -0,0 +1,9 @@ +<?xml version="1.0" encoding="UTF-8"?> +<project> + <modelVersion>4.0.0</modelVersion> + + <groupId>org.apache.maven.its.gh12302</groupId> + <artifactId>lib-c</artifactId> + <version>1.0</version> + <packaging>jar</packaging> +</project> diff --git a/its/core-it-suite/src/test/resources/gh-12302-transitive-dep-mgmt-version-downgrade/repo/org/apache/maven/its/gh12302/lib-c/2.0/lib-c-2.0.jar b/its/core-it-suite/src/test/resources/gh-12302-transitive-dep-mgmt-version-downgrade/repo/org/apache/maven/its/gh12302/lib-c/2.0/lib-c-2.0.jar new file mode 100644 index 0000000000..ee3ce6555d Binary files /dev/null and b/its/core-it-suite/src/test/resources/gh-12302-transitive-dep-mgmt-version-downgrade/repo/org/apache/maven/its/gh12302/lib-c/2.0/lib-c-2.0.jar differ diff --git a/its/core-it-suite/src/test/resources/gh-12302-transitive-dep-mgmt-version-downgrade/repo/org/apache/maven/its/gh12302/lib-c/2.0/lib-c-2.0.pom b/its/core-it-suite/src/test/resources/gh-12302-transitive-dep-mgmt-version-downgrade/repo/org/apache/maven/its/gh12302/lib-c/2.0/lib-c-2.0.pom new file mode 100644 index 0000000000..5aa08a8cbc --- /dev/null +++ b/its/core-it-suite/src/test/resources/gh-12302-transitive-dep-mgmt-version-downgrade/repo/org/apache/maven/its/gh12302/lib-c/2.0/lib-c-2.0.pom @@ -0,0 +1,9 @@ +<?xml version="1.0" encoding="UTF-8"?> +<project> + <modelVersion>4.0.0</modelVersion> + + <groupId>org.apache.maven.its.gh12302</groupId> + <artifactId>lib-c</artifactId> + <version>2.0</version> + <packaging>jar</packaging> +</project> diff --git a/its/core-it-suite/src/test/resources/gh-12302-transitive-dep-mgmt-version-downgrade/repo/org/apache/maven/its/gh12302/module-a/1.0/module-a-1.0.jar b/its/core-it-suite/src/test/resources/gh-12302-transitive-dep-mgmt-version-downgrade/repo/org/apache/maven/its/gh12302/module-a/1.0/module-a-1.0.jar new file mode 100644 index 0000000000..ee3ce6555d Binary files /dev/null and b/its/core-it-suite/src/test/resources/gh-12302-transitive-dep-mgmt-version-downgrade/repo/org/apache/maven/its/gh12302/module-a/1.0/module-a-1.0.jar differ diff --git a/its/core-it-suite/src/test/resources/gh-12302-transitive-dep-mgmt-version-downgrade/repo/org/apache/maven/its/gh12302/module-a/1.0/module-a-1.0.pom b/its/core-it-suite/src/test/resources/gh-12302-transitive-dep-mgmt-version-downgrade/repo/org/apache/maven/its/gh12302/module-a/1.0/module-a-1.0.pom new file mode 100644 index 0000000000..5c8d0bf728 --- /dev/null +++ b/its/core-it-suite/src/test/resources/gh-12302-transitive-dep-mgmt-version-downgrade/repo/org/apache/maven/its/gh12302/module-a/1.0/module-a-1.0.pom @@ -0,0 +1,22 @@ +<?xml version="1.0" encoding="UTF-8"?> +<project> + <modelVersion>4.0.0</modelVersion> + + <parent> + <groupId>org.apache.maven.its.gh12302</groupId> + <artifactId>parent-a</artifactId> + <version>1.0</version> + </parent> + + <artifactId>module-a</artifactId> + <version>1.0</version> + <packaging>jar</packaging> + + <dependencies> + <dependency> + <groupId>org.apache.maven.its.gh12302</groupId> + <artifactId>module-b</artifactId> + <version>1.0</version> + </dependency> + </dependencies> +</project> diff --git a/its/core-it-suite/src/test/resources/gh-12302-transitive-dep-mgmt-version-downgrade/repo/org/apache/maven/its/gh12302/module-b/1.0/module-b-1.0.jar b/its/core-it-suite/src/test/resources/gh-12302-transitive-dep-mgmt-version-downgrade/repo/org/apache/maven/its/gh12302/module-b/1.0/module-b-1.0.jar new file mode 100644 index 0000000000..ee3ce6555d Binary files /dev/null and b/its/core-it-suite/src/test/resources/gh-12302-transitive-dep-mgmt-version-downgrade/repo/org/apache/maven/its/gh12302/module-b/1.0/module-b-1.0.jar differ diff --git a/its/core-it-suite/src/test/resources/gh-12302-transitive-dep-mgmt-version-downgrade/repo/org/apache/maven/its/gh12302/module-b/1.0/module-b-1.0.pom b/its/core-it-suite/src/test/resources/gh-12302-transitive-dep-mgmt-version-downgrade/repo/org/apache/maven/its/gh12302/module-b/1.0/module-b-1.0.pom new file mode 100644 index 0000000000..40e8134d7e --- /dev/null +++ b/its/core-it-suite/src/test/resources/gh-12302-transitive-dep-mgmt-version-downgrade/repo/org/apache/maven/its/gh12302/module-b/1.0/module-b-1.0.pom @@ -0,0 +1,17 @@ +<?xml version="1.0" encoding="UTF-8"?> +<project> + <modelVersion>4.0.0</modelVersion> + + <groupId>org.apache.maven.its.gh12302</groupId> + <artifactId>module-b</artifactId> + <version>1.0</version> + <packaging>jar</packaging> + + <dependencies> + <dependency> + <groupId>org.apache.maven.its.gh12302</groupId> + <artifactId>lib-c</artifactId> + <version>2.0</version> + </dependency> + </dependencies> +</project> diff --git a/its/core-it-suite/src/test/resources/gh-12302-transitive-dep-mgmt-version-downgrade/repo/org/apache/maven/its/gh12302/parent-a/1.0/parent-a-1.0.pom b/its/core-it-suite/src/test/resources/gh-12302-transitive-dep-mgmt-version-downgrade/repo/org/apache/maven/its/gh12302/parent-a/1.0/parent-a-1.0.pom new file mode 100644 index 0000000000..9d0c192914 --- /dev/null +++ b/its/core-it-suite/src/test/resources/gh-12302-transitive-dep-mgmt-version-downgrade/repo/org/apache/maven/its/gh12302/parent-a/1.0/parent-a-1.0.pom @@ -0,0 +1,19 @@ +<?xml version="1.0" encoding="UTF-8"?> +<project> + <modelVersion>4.0.0</modelVersion> + + <groupId>org.apache.maven.its.gh12302</groupId> + <artifactId>parent-a</artifactId> + <version>1.0</version> + <packaging>pom</packaging> + + <dependencyManagement> + <dependencies> + <dependency> + <groupId>org.apache.maven.its.gh12302</groupId> + <artifactId>lib-c</artifactId> + <version>1.0</version> + </dependency> + </dependencies> + </dependencyManagement> +</project> diff --git a/its/core-it-suite/src/test/resources/gh-12302-transitive-dep-mgmt-version-downgrade/settings-template.xml b/its/core-it-suite/src/test/resources/gh-12302-transitive-dep-mgmt-version-downgrade/settings-template.xml new file mode 100644 index 0000000000..c25336565b --- /dev/null +++ b/its/core-it-suite/src/test/resources/gh-12302-transitive-dep-mgmt-version-downgrade/settings-template.xml @@ -0,0 +1,41 @@ +<?xml version="1.0" encoding="UTF-8"?> +<!-- +Licensed to the Apache Software Foundation (ASF) under one +or more contributor license agreements. See the NOTICE file +distributed with this work for additional information +regarding copyright ownership. The ASF licenses this file +to you under the Apache License, Version 2.0 (the +"License"); you may not use this file except in compliance +with the License. You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +Unless required by applicable law or agreed to in writing, +software distributed under the License is distributed on an +"AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY +KIND, either express or implied. See the License for the +specific language governing permissions and limitations +under the License. +--> +<settings> + <profiles> + <profile> + <id>maven-core-it-repo</id> + <repositories> + <repository> + <id>maven-core-it</id> + <url>@baseurl@/repo</url> + <releases> + <checksumPolicy>ignore</checksumPolicy> + </releases> + <snapshots> + <enabled>false</enabled> + </snapshots> + </repository> + </repositories> + </profile> + </profiles> + <activeProfiles> + <activeProfile>maven-core-it-repo</activeProfile> + </activeProfiles> +</settings>
