[
https://issues.apache.org/jira/browse/MNG-8187?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17872732#comment-17872732
]
Jeff Thomas commented on MNG-8187:
----------------------------------
Hi [~cstamas],
I don't mind being wrong :) and thank you for explaining!
I think something changed as I centrally updated dependency versions (we have a
parent POM where dependency-managenent and versions as properties are defined).
We have created a workaround by adding a top-level dependency with exclusion as
you suggested.
I was aware of the dependency tree order/depth and how the version is
determined, but I sort of was thinking that extra logic should be there to not
exclude if both don't exclude ... but ok I can live with it :)
Thanks again!
> Same transitive dependency 2x one with exclusion one without - exclusion wins
> -----------------------------------------------------------------------------
>
> Key: MNG-8187
> URL: https://issues.apache.org/jira/browse/MNG-8187
> Project: Maven
> Issue Type: Bug
> Components: Dependencies
> Affects Versions: 3.9.8
> Reporter: Jeff Thomas
> Priority: Major
>
> Hi Maven Team,
> I don't know if this is a strange behavior or works-as-designed but here is
> what I observed today.
> I have two libraries with transitive dependencies on
> 'com.opencsv:opencsv:5.9.0'.
> One of those two libraries is 'org.liquibase:liquibase-core:4.28.0' which
> excludes 'commons-beanutils'.
> {code:java}
> <dependency>
> <groupId>com.opencsv</groupId>
> <artifactId>opencsv</artifactId>
> <version>5.9</version>
> <scope>compile</scope>
> <exclusions>
> <exclusion>
> <groupId>commons-beanutils</groupId>
> <artifactId>commons-beanutils</artifactId>
> </exclusion>
> </exclusions>
> </dependency> {code}
> The other library is our own and has a dependency on opencsv *without* an
> exclusion on 'commons-beanutils'.
> Suddenly the maven dependency resolution started giving precedence to the
> liquibase-core dependency and the exclusion prevented commons-beanutils from
> being added to our WAR - which of course resulted in a ClassNotFoundException.
> (If I do a 'mvn dependency:tree' I see opencsv is being hung under
> liquibase-core without the commons-beanutils sub-dependency)
> I sort of expected, that if opencsv is in the dependency-tree in two
> locations and one excludes the dependency on commons-beanutils but the other
> does not, Maven would say "Hmmm... one of them still needs it so I had better
> include it!".
> Am I wrong? :)
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
