[
https://issues.apache.org/jira/browse/MDEP-679?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17064053#comment-17064053
]
Elliotte Rusty Harold commented on MDEP-679:
--------------------------------------------
This is not the only edge case I've seen where mvn dependency:analyze isn't
spot on. I was looking at another one today where a dependency was listed as
declared but not used. I took it out, and it immediately listed as used but not
declared. WTF?
The issue seems to be that we're recognizing all string literals as class
names. I'm not sure how to do better than that short of full flow analysis to
see where and how the string is used.
> mvn dependency:analyze detected wrong transitive dependency
> -----------------------------------------------------------
>
> Key: MDEP-679
> URL: https://issues.apache.org/jira/browse/MDEP-679
> Project: Maven Dependency Plugin
> Issue Type: Bug
> Components: analyze
> Affects Versions: 3.1.1
> Reporter: John Lin
> Priority: Minor
> Time Spent: 10m
> Remaining Estimate: 0h
>
> To illustrate this issue, I created a sample project here:
> [https://github.com/johnlinp/misc-demo/tree/master/maven-dependency-analyze-dnsjava]
> The dependency tree is like this:
> {code:java}
> My app ---> ApacheJMeter_http ---> dnsjava
> {code}
> I didn't use any code directly from the artifact {{dnsjava}} in my app. I
> only used {{ApacheJMeter_http}}. However, the command {{mvn
> dependency:analyze}} will report a used undeclared dependency: {{dnsjava}}.
> {code:java}
> [INFO] --- maven-dependency-plugin:3.1.1:analyze (default-cli) @
> maven-dependency-analyze-dnsjava ---
> [WARNING] Used undeclared dependencies found:
> [WARNING] dnsjava:dnsjava:jar:2.1.9:runtime {code}
> It seems that the problem came from the line:
> {code:java}
> map.put("update", null);
> {code}
> If I change it into {{map.put("create", null);}} or even {{map.put("UPDATE",
> null);}}, the problem will disappear. Therefore, I think there might be
> something to do with the string "update".
> Note that this issue is not reproducible in maven-dependency-plugin:2.8.
--
This message was sent by Atlassian Jira
(v8.3.4#803005)
