slawekjaranowski opened a new pull request, #1078:
URL: https://github.com/apache/maven-enforcer/pull/1078
Since 3.7.0, `bannedDependencies` (and `requireReleaseDeps`) also check
direct optional dependencies
and their transitive dependencies. This restores the behavior lost in 3.3.0,
but builds that passed
with 3.3.x–3.6.x can now fail, e.g. with an exclude like
`*:*:*:jar:compile`. There was no way
to opt out, because include patterns cannot match optional dependencies.
This PR adds a new `ignoreOptionals` parameter to `BannedDependenciesBase`,
so it is available
for both `bannedDependencies` and `requireReleaseDeps`. Default is `false`,
so the 3.7.0 behavior is kept.
When `ignoreOptionals` is `true`:
- with `searchTransitive=true` (default): direct optional dependencies of
the project are not collected,
so they and their transitive dependencies are not checked
- with `searchTransitive=false`: direct optional dependencies are skipped
Closes #1077
---
To make clear that you license your contribution under
the [Apache License Version 2.0, January
2004](https://www.apache.org/licenses/LICENSE-2.0)
check one of the following:
- [ ] I hereby declare this contribution to be licensed under the [Apache
License Version 2.0, January 2004](https://www.apache.org/licenses/LICENSE-2.0)
- [x] I hereby declare that I have filed an [Apache Individual Contributor
License Agreement](https://www.apache.org/licenses/icla.pdf).
🤖 Generated with [Claude Code](https://claude.com/claude-code)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
