[
https://issues.apache.org/jira/browse/MSHARED-683?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=16368195#comment-16368195
]
Robert Scholte commented on MSHARED-683:
----------------------------------------
All Aether dependencies have the provided scope, so there should be no issue
with such transitive dependencies. If I run {{mvn dependency:list}} it confirms
for me those dependencies aren't used.
However, if you are saying that because you depend on both Aethers, you must
built those as well and THAT relies on blacklisted dependencies, then there's
the real issue. You must make a difference between compile time and runtime,
but also respect scopes.
If it would help you, we can add an enforcer-rule
[bannedDependencies|https://maven.apache.org/enforcer/enforcer-rules/bannedDependencies.html]
to ensure these dependencies aren't used.
> Use maven-resolver instead of (eclipse-)aether
> ----------------------------------------------
>
> Key: MSHARED-683
> URL: https://issues.apache.org/jira/browse/MSHARED-683
> Project: Maven Shared Components
> Issue Type: Dependency upgrade
> Components: maven-common-artifact-filters
> Reporter: Chris West (Faux)
> Priority: Major
>
> PR: https://github.com/apache/maven-common-artifact-filters/pull/1
> Stop using the old `aether` and `eclipse-aether` libraries, who's code is now
> part of `maven-resolver`, under the `org.eclipse` package. The old libraries
> are very abandoned, to the point that their websites have gone missing. They
> depend on some scarily broken libraries, which is a problem for distros like
> Debian.
> Tests green. Only non-find-and-replace changes is to add some properties:
> * `<javaVersion>7` as `maven-resolver` uses 7 and otherwise enforcer gets
> angry, and
> * `<maven.version>3.5.2`, as pre-3.5 maven used aether for other reasons, so
> it still ends up polluting the tree.
--
This message was sent by Atlassian JIRA
(v7.6.3#76005)
