scordio opened a new issue, #1077: URL: https://github.com/apache/maven-enforcer/issues/1077
### Affected version 3.7.0 ### Bug description In 3.7.0, `bannedDependencies` started checking direct optional dependencies and their transitive dependencies. According to https://github.com/apache/maven-enforcer/pull/1025#issuecomment-5671222005, this change was intentional to restore behavior lost in 3.3.0, but it can break builds that passed with versions 3.3.x–3.6.x, like in https://github.com/scordio/junit-converters/pull/134. The release notes mention only `requireReleaseDeps`, so the impact on `bannedDependencies` isn't clear. For example, an exclusion of `*:*:*:jar:compile` now also bans optional compile dependencies and their trees. Could you please document this behavior change in the release notes or migration guidance? Also, it appears there's no way to restore the previous behavior through the rule’s configuration, since `<include>` patterns cannot match optional dependencies. Would you consider introducing a `bannedDependencies` opt-out for checking optional dependency trees? -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
