Skip to content

Fix dependency-reduced-pom exclusion loss for classifier-distinct duplicate deps (Maven 4)#820

Open
ascheman wants to merge 1 commit into
apache:masterfrom
aschemaven:mshade-819-drp-classifier-exclusions
Open

Fix dependency-reduced-pom exclusion loss for classifier-distinct duplicate deps (Maven 4)#820
ascheman wants to merge 1 commit into
apache:masterfrom
aschemaven:mshade-819-drp-classifier-exclusions

Conversation

@ascheman

Copy link
Copy Markdown
Contributor

What

Fixes the generated dependency-reduced-pom.xml dropping an <exclusion> on one of two classifier-distinct duplicate variants of a dependency under Maven 4 (e.g. b:0.2 keeps the exclusion, b:0.2:alt loses it).

Why

ShadeMojo.updateExcludesInDeps() walks a single conflict-resolved collect graph. Under Maven 4 the resolver prunes the duplicate transitive node (omitted for duplicate) under one variant, so the exclusion is re-attached to only that variant. This is stable, intended resolver behaviour (not a resolver bug); shade's own dependency keying is already classifier-aware.

Fix

Collect that graph with verbose conflict resolution (ConflictResolver.CONFIG_PROP_VERBOSE = STANDARD) on a copied session, so the omitted-duplicate node is retained as a marker; the existing walk then re-attaches the exclusion to both variants. Localized to the single collectDependencies call; no behaviour change on Maven 3.

Test

Covered by the existing ITs dep-reduced-pom-exclusions and MSHADE-467_parallel-dependency-reduced-pom (red on Maven 4 / green on Maven 3 before; green on both after). Full -P run-its verified locally: 83/0 on both Maven 4.0.0-SNAPSHOT and Maven 3.9.16.

Closes #819

Under Maven 4, ShadeMojo.updateExcludesInDeps() walks a single
conflict-resolved collect graph. The resolver prunes the duplicate
transitive node ("omitted for duplicate") under one of two
classifier-distinct variants of the same artifact, so the generated
dependency-reduced-pom keeps the <exclusion> on only one variant.

Collect that graph with verbose conflict resolution
(ConflictResolver.CONFIG_PROP_VERBOSE = STANDARD) so the omitted-duplicate
node is retained as a marker; the existing walk then re-attaches the
exclusion to both variants. No behaviour change on Maven 3.9.16.

Covered by the existing dep-reduced-pom-exclusions and
MSHADE-467_parallel-dependency-reduced-pom ITs.

Closes apache#819

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
@ascheman

Copy link
Copy Markdown
Contributor Author

Note on Maven 4 coverage: this repo's PR matrix runs Maven 3.9.16 only, so the green checks here confirm there is no Maven 3 regression but do not exercise the Maven 4 path this fixes.

For the Maven 4 evidence I ran the full -P run-its suite against the latest Apache Maven 4.0.0-SNAPSHOT distribution on a fork branch (informational job that downloads the snapshot dist and runs the ITs):

Locally the suite is also 83/0 on both Maven 4.0.0-SNAPSHOT and Maven 3.9.16.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Dependency-reduced POM drops <exclusion> on classifier-distinct duplicate dependencies (Maven 4)

1 participant