abhiramaab opened a new pull request, #1065:
URL: https://github.com/apache/maven-enforcer/pull/1065
Fixes #1063
### Motivation
When `requireUpperBoundDeps` runs with `excludedScopes` (which defaults to
`[test]`), `resolverUtil.resolveTransitiveDependenciesVerbose(excludedScopes)`
previously filtered out direct test dependencies before resolving the
dependency graph with Maven Resolver.
If a shallower test-scoped dependency path wins Maven's nearest-wins
mediation and introduces a lower version onto the runtime classpath, filtering
out direct test dependencies upfront prevents the rule from detecting the
downgrade. As a result, compile-scoped dependencies that require a higher
version may fail at runtime, while `requireUpperBoundDeps` incorrectly passes.
### Modifications
1. In `RequireUpperBoundDeps.execute()`, pass an empty list to
`resolveTransitiveDependenciesVerbose(...)` so the complete mediated dependency
graph is resolved and remains visible to the rule.
2. Pass `excludedScopes` to `RequireUpperBoundDepsVisitor`.
3. In `DependencyNodeHopCountPair`, resolve the scope of the root direct
dependency using `getDirectDependencyScope()`.
4. In `RequireUpperBoundDepsVisitor.containsConflicts()`, skip conflict
checking only for dependency pairs whose direct dependency scope is in
`excludedScopes`. This preserves MENFORCER-276 by continuing to ignore pure
test-scope conflicts while detecting runtime downgrades introduced by shallower
test paths.
5. Added unit tests in `RequireUpperBoundDepsTest`:
-
`testShallowerTestScopedPathDoesNotMaskLowerVersionRequiredByCompileScope`:
Verifies that a shallower test-scoped path that downgrades a compile dependency
triggers an `EnforcerRuleException`.
- `testPureTestScopedConflictsAreIgnoredWhenTestScopeExcluded`: Verifies
that pure test-scoped conflicts continue to be ignored when the test scope is
excluded.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
