wilx commented on issue #1271:
URL:
https://github.com/apache/maven-dependency-plugin/issues/1271#issuecomment-5158664296
I reproduced this using the linked `sify21/mvntest` project, isolating the
affected `abc-flink` module. This is not caused by `dependency:tree`; it is a
side effect of the old Maven Shade Plugin modifying the in-memory Maven project
while creating the dependency-reduced POM.
With Maven 3.9.16 and the current `maven-dependency-plugin`
(`3.11.1-SNAPSHOT`):
* Shade 3.0.0 and 3.2.0 reproduce the report: the compile tree selects
`snappy-java:1.1.4`, while the tree after `package` selects `1.1.7.2`.
* Shade 3.2.2, 3.4.0, and 3.6.2 produce identical compile/package trees,
selecting `1.1.4`.
The old Shade implementation adds an exclusion for `flink-runtime_2.11` to
the direct, provided `flink-streaming-java_2.11` dependency and modifies the
corresponding Maven-owned dependency object. The later `dependency:tree`
invocation therefore no longer sees this path:
```
flink-streaming-java_2.11 (provided)
\- flink-runtime_2.11 (provided)
\- snappy-java:1.1.4
```
Once that path is removed, the remaining Kafka path selects
`snappy-java:1.1.7.2`. Scope mediation explains the version change, but
`dependency:tree` is accurately reporting the already-modified project graph.
This specific problem was fixed by
[MSHADE-311](https://github.com/apache/maven-shade-plugin/issues/312) in Maven
Shade Plugin **3.2.2**, which stopped adding exclusions for provided transitive
dependencies. Upgrading the Shade Plugin resolves the reproducer; disabling
`createDependencyReducedPom` is a workaround for older versions.
I think this issue can be closed as fixed in Maven Shade Plugin 3.2.2; no
Maven Dependency Plugin change is needed.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
