elharo commented on issue #12648:
URL: https://github.com/apache/maven/issues/12648#issuecomment-5143895010

   This is a deliberate behavioral change in Maven 4, not a bug. The behavior 
in Maven 3 was a known limitation in its dependency resolution mechanism, which 
Maven 4 corrects.
   
   ### Maven 3 Behavior (The Flaw)
   
   In Maven 3, `dependencyManagement` is only applied if it is declared in the 
root project or imported via a BOM directly into the root project. Maven 3 
completely ignores `dependencyManagement` sections found in transitive 
dependencies or their parents.
   
   Because the root POM's BOM (`spring-boot-dependencies`) does not dictate a 
version for `snappy-java`, Maven 3 ignores the `dependencyManagement` in 
`io.confluent:common-parent`. It falls back to standard nearest-definition 
resolution, pulling `snappy-java:1.1.10.7` directly from the `kafka-clients` 
POM.
   
   ### Maven 4 Behavior (The Correction)
   
   Maven 4 introduces Transitive Dependency Management. The Maven Resolver now 
accumulates `dependencyManagement` constraints as it traverses the dependency 
graph and applies them to sub-trees.
   
   When Maven 4 resolves the dependencies for `kafka-schema-registry-client`, 
it incorporates the `dependencyManagement` constraints inherited from 
`io.confluent:common-parent` (`snappy-java:1.1.10.5`). This constraint is 
passed down to `kafka-schema-registry-client`'s subgraph. When evaluating 
`kafka-clients`, the accumulated transitive management constraint overrides the 
`1.1.10.7` version declared in the `kafka-clients` POM.
   
   To restore the Maven 3 resolution output in Maven 4, you must explicitly 
declare `snappy-java:1.1.10.7` in the root POM's `dependencyManagement` block. 
Root-level constraints will override transitive constraints in both versions.


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: [email protected]

For queries about this service, please contact Infrastructure at:
[email protected]

Reply via email to