[
https://issues.apache.org/jira/browse/MENFORCER-417?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Slawomir Jaranowski updated MENFORCER-417:
------------------------------------------
Fix Version/s: (was: waiting-for-feedback)
> requireUpperBoundDeps doesn't work when dependencies are managed
> ----------------------------------------------------------------
>
> Key: MENFORCER-417
> URL: https://issues.apache.org/jira/browse/MENFORCER-417
> Project: Maven Enforcer Plugin
> Issue Type: Bug
> Components: Standard Rules
> Affects Versions: 3.0.0, 3.1.0
> Reporter: James Howe
> Priority: Major
>
> {code:xml}
> <rules>
> <requireUpperBoundDeps/>
> </rules>{code}
> Example false-positive in a project using spring-boot-dependencies:
> {noformat}
> Failed while enforcing RequireUpperBoundDeps. The error(s) are [
> Require upper bound dependencies error for org.slf4j:slf4j-api:1.7.36 paths
> to dependency are:
> +-com.example:project:1.0-SNAPSHOT
>
> +-org.springframework.security.extensions:spring-security-saml2-core:1.0.10.RELEASE
> +-org.slf4j:slf4j-api:1.7.36 (managed) <-- org.slf4j:slf4j-api:1.7.29
> and
> +-com.example:project:1.0-SNAPSHOT
> +-com.github.zhanhb:thymeleaf-layout-dialect:3.0.0
> +-org.slf4j:slf4j-api:1.7.36 (managed) <-- org.slf4j:slf4j-api:1.7.32
> and
> +-com.example:project:1.0-SNAPSHOT
> +-org.springframework.boot:spring-boot-starter-logging:2.6.7 (managed) <--
> org.springframework.boot:spring-boot-starter-logging:2.6.7
> +-org.slf4j:jul-to-slf4j:1.7.36 (managed) <--
> org.slf4j:jul-to-slf4j:1.7.36
> +-org.slf4j:slf4j-api:1.7.36 (managed) <-- org.slf4j:slf4j-api:1.7.36
> ...
> {noformat}
> No version higher than 1.7.36 is listed anywhere, and at time of writing so
> such version has even been released (other than 2.0.0-alpha).
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
