slachiewicz opened a new issue, #972: URL: https://github.com/apache/maven-wagon/issues/972
`wagon-http` 3.6.0-SNAPSHOT installs maven-shade-plugin's dependency-reduced POM as the main artifact's POM. The main jar is the *unshaded* one, so consumers resolving `org.apache.maven.wagon:wagon-http` no longer get `wagon-http-shared`, `httpclient`, `httpcore`, `commons-codec` or `commons-io` — exactly the shade `artifactSet` includes. `HttpWagon` extends `AbstractHttpClientWagon`, which lives in `wagon-http-shared`, so the shipped class cannot be loaded. This is a regression against 3.5.3, which publishes the shaded jar *and* keeps its dependencies: | | `-shaded` jar published | main POM keeps deps | |---|---|---| | 3.5.3 (Central) | yes | yes | | 3.6.0-SNAPSHOT | yes | **no** | **Impact.** Apache Maven 3.9.x, 3.10.x and 4.0.x all declare `wagon-http` without a classifier. Built against 3.6.0-SNAPSHOT, `wagon-http-shared` is the only jar missing from their `lib/` versus a 3.5.3 build, and forcing the wagon transport gives: ``` java.lang.NoClassDefFoundError: org/apache/maven/wagon/providers/http/HttpWagon Caused by: java.lang.NoClassDefFoundError: org/apache/maven/wagon/shared/http/AbstractHttpClientWagon ``` The resolver then falls back to its native HTTP transporter and the build reports `BUILD SUCCESS`, so this is silent. It is not silent for `maven-compat`'s legacy `DefaultWagonManager`, which looks `Wagon` up by protocol hint directly and bypasses transport priority. **Reproduce** against a distribution built with `wagonVersion` set to 3.6.0-SNAPSHOT: ``` mvn -X -Dmaven.repo.local=$(mktemp -d) -Dmaven.resolver.transport=wagon dependency:resolve ``` 3.5.3 selects `WagonTransporter` for both a `file://` repository and central. 3.6.0-SNAPSHOT selects it only for `file://`. **Cause.** The shade execution sets `shadedArtifactAttached=true` but never sets `createDependencyReducedPom=false`. Two changes since 3.5.3 combine here: the root POM dropped its explicit `maven-shade-plugin` 3.2.3 pin (the version now comes from maven-parent 49), and #750 added `<dependencyReducedPomLocation>` pointing into `target/`. Since the shaded jar is *attached* under a classifier and the main jar keeps its real dependencies, no dependency reduction should happen at all. Setting `createDependencyReducedPom=false` fixes this and keeps #750 fixed, since no reduced POM is written anywhere. `master` carries the same shade configuration and the same missing setting. *This issue was created with AI assistance.* -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
