[
https://issues.apache.org/jira/browse/MNG-8187?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17872313#comment-17872313
]
Tamas Cservenak commented on MNG-8187:
--------------------------------------
In short, yes you are wrong :)
Let me explain, but first let's lay down some nomenclature:
artifact - is essentially an "adressable" (GACEV} file
dependency - is an artifact in "role" of dependency with extra configuration,
like scope, type, exclusion, etc
dependencyNode - is a dependency in the dependency graph (tree, once conflicts
resolved) w "links" to collected child nodes
When a graph is collected, conflict resolution eliminates by artifacts (as you
cannot have two same JARs in "flat" classpath). And rules here are simple:
* dependencyNode has "depth" (distance from graph root) - node with lower
distance ("closer to root") wins over higher distance
* dependencyNode has "order" (on same distance, nodes are also ordered) - node
with lower order wins of higher order (simply put: the order in POM
dependencies matters)
Unsure what happened that made "suddenly" things change for you, to me sounds
like either liquibase-core was added in process (and got "lower" in POM than
existing own in-house dependency).
But solution could be to reorder dependencies: make your own in-house
dependency "higher" (closer to 1st place) while liquibase-core "lower" (closer
to last place) in dependencies.
> Same transitive dependency 2x one with exclusion one without - exclusion wins
> -----------------------------------------------------------------------------
>
> Key: MNG-8187
> URL: https://issues.apache.org/jira/browse/MNG-8187
> Project: Maven
> Issue Type: Bug
> Components: Dependencies
> Affects Versions: 3.9.8
> Reporter: Jeff Thomas
> Priority: Major
>
> Hi Maven Team,
> I don't know if this is a strange behavior or works-as-designed but here is
> what I observed today.
> I have two libraries with transitive dependencies on
> 'com.opencsv:opencsv:5.9.0'.
> One of those two libraries is 'org.liquibase:liquibase-core:4.28.0' which
> excludes 'commons-beanutils'.
> {code:java}
> <dependency>
> <groupId>com.opencsv</groupId>
> <artifactId>opencsv</artifactId>
> <version>5.9</version>
> <scope>compile</scope>
> <exclusions>
> <exclusion>
> <groupId>commons-beanutils</groupId>
> <artifactId>commons-beanutils</artifactId>
> </exclusion>
> </exclusions>
> </dependency> {code}
> The other library is our own and has a dependency on opencsv *without* an
> exclusion on 'commons-beanutils'.
> Suddenly the maven dependency resolution started giving precedence to the
> liquibase-core dependency and the exclusion prevented commons-beanutils from
> being added to our WAR - which of course resulted in a ClassNotFoundException.
> (If I do a 'mvn dependency:tree' I see opencsv is being hung under
> liquibase-core without the commons-beanutils sub-dependency)
> I sort of expected, that if opencsv is in the dependency-tree in two
> locations and one excludes the dependency on commons-beanutils but the other
> does not, Maven would say "Hmmm... one of them still needs it so I had better
> include it!".
> Am I wrong? :)
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
