Interesting, but we should probably understand why Gradle does X and Maven does Y... Does one of them have a bug, or do they have different philosophies or does one or the other need to get with the times? Does Claude's suggestion revert advances by gradle, or workaround a problem in gradle?
On Mon, Mar 9, 2026 at 2:23 PM Jan Høydahl <[email protected]> wrote: > Asked our friend Claude to analyze, and he claims to know what is > happening, and to have a solution in > https://github.com/apache/solr/pull/4199 > > Jan > > > 9. mars 2026 kl. 16:07 skrev Bram Luyten <[email protected]>: > > > > *Apache Maven 3.9.9 (8e8579a9e76f7d015ee5ec7bfcdc97d260186937)* > > > > Maven home: /opt/homebrew/Cellar/maven/3.9.9/libexec > > > > Java version: 21.0.9, vendor: Homebrew, runtime: > > /opt/homebrew/Cellar/openjdk@21/21.0.9/libexec/openjdk.jdk/Contents/Home > > > > Default locale: en_US, platform encoding: UTF-8 > > > > OS name: "mac os x", version: "15.7.4", arch: "aarch64", family: "mac" > > > > On Mon, Mar 9, 2026 at 1:27 PM Gus Heck <[email protected]> wrote: > > > >> What version of maven are you using? > >> > >> On Mon, Mar 9, 2026 at 8:09 AM Gus Heck <[email protected]> wrote: > >> > >>> Hmm, maven limitation? I made a gradle project and it gives this > without > >>> error: > >>> > >>> compileClasspath - Compile classpath for source set 'main'. > >>> \--- org.apache.solr:solr-solrj:10.0.0 > >>> \--- org.apache.solr:solr-api:10.0.0 > >>> +--- com.fasterxml.jackson.core:jackson-annotations:2.20 > >>> \--- io.swagger.core.v3:swagger-annotations-jakarta:2.2.22 > >>> > >>> compileOnly - Compile-only dependencies for the 'main' feature. (n) > >>> No dependencies > >>> > >>> default - Configuration for default artifacts. (n) > >>> No dependencies > >>> > >>> implementation - Implementation dependencies for the 'main' feature. > (n) > >>> \--- org.apache.solr:solr-solrj:10.0.0 (n) > >>> > >>> mainSourceElements - List of source directories contained in the Main > >>> SourceSet. (n) > >>> No dependencies > >>> > >>> runtimeClasspath - Runtime classpath of source set 'main'. > >>> \--- org.apache.solr:solr-solrj:10.0.0 > >>> +--- org.apache.solr:solr-api:10.0.0 > >>> | +--- com.fasterxml.jackson.core:jackson-annotations:2.20 > >>> | +--- io.swagger.core.v3:swagger-annotations-jakarta:2.2.22 > >>> | +--- jakarta.ws.rs:jakarta.ws.rs-api:3.1.0 > >>> | +--- org.semver4j:semver4j:6.0.0 > >>> | | \--- org.jspecify:jspecify:1.0.0 > >>> | \--- org.slf4j:slf4j-api:2.0.17 > >>> +--- com.fasterxml.jackson.core:jackson-databind:2.20.0 > >>> | +--- com.fasterxml.jackson.core:jackson-annotations:2.20 > >>> | +--- com.fasterxml.jackson.core:jackson-core:2.20.0 > >>> | | \--- com.fasterxml.jackson:jackson-bom:2.20.0 > >>> | | +--- > >>> com.fasterxml.jackson.core:jackson-annotations:2.20 (c) > >>> | | +--- com.fasterxml.jackson.core:jackson-core:2.20.0 > >> (c) > >>> | | \--- > >>> com.fasterxml.jackson.core:jackson-databind:2.20.0 (c) > >>> | \--- com.fasterxml.jackson:jackson-bom:2.20.0 (*) > >>> +--- com.fasterxml.jackson.core:jackson-annotations:2.20 > >>> +--- com.fasterxml.jackson.core:jackson-core:2.20.0 (*) > >>> +--- org.slf4j:slf4j-api:2.0.17 > >>> \--- org.slf4j:jcl-over-slf4j:2.0.17 > >>> \--- org.slf4j:slf4j-api:2.0.17 > >>> > >>> On Sat, Mar 7, 2026 at 11:03 AM Bram Luyten <[email protected]> > >>> wrote: > >>> > >>>> Hi Jan, > >>>> > >>>> Thank you for the swift feedback. To clarify: our app (DSpace, an > >>>> open-source repository platform) depends on both: > >>>> > >>>> 1. solr-solrj (runtime) — as a Solr client > >>>> 2. solr-core (test scope) — for EmbeddedSolrServer in our integration > >>>> tests > >>>> > >>>> The issue we're seeing is that the published Maven POMs for solr-core > >> (and > >>>> solr-solrj, solr-api) on Maven Central reference > >>>> com.fasterxml.jackson.core:jackson-databind, jackson-core, > >>>> jackson-annotations, jackson-dataformat-smile, and > >> jackson-dataformat-cbor > >>>> without specifying a version. Since Solr's Gradle build manages these > >>>> versions via a BOM/platform that isn't published as a Maven BOM, Maven > >>>> considers the POM invalid and drops all transitive dependencies from > >> that > >>>> artifact. > >>>> > >>>> The Maven warning we see is: > >>>> > >>>> [WARNING] The POM for org.apache.solr:solr-core:jar:10.0.0 is invalid, > >>>> transitive dependencies (if any) will not be available: > >>>> 5 problems were encountered while building the effective model for > >>>> org.apache.solr:solr-core:10.0.0 > >>>> [ERROR] 'dependencies.dependency.version' for > >>>> com.fasterxml.jackson.core:jackson-annotations:jar is missing. > >>>> [ERROR] 'dependencies.dependency.version' for > >>>> com.fasterxml.jackson.core:jackson-core:jar is missing. > >>>> [ERROR] 'dependencies.dependency.version' for > >>>> com.fasterxml.jackson.core:jackson-databind:jar is missing. > >>>> [ERROR] 'dependencies.dependency.version' for > >>>> com.fasterxml.jackson.dataformat:jackson-dataformat-smile:jar is > >> missing. > >>>> [ERROR] 'dependencies.dependency.version' for > >>>> com.fasterxml.jackson.dataformat:jackson-dataformat-cbor:jar is > missing. > >>>> > >>>> The practical impact for Maven consumers: all transitive dependencies > of > >>>> the affected artifact are lost (not just the Jackson ones). We had to > >>>> manually declare ~20+ transitive dependencies of solr-core in our own > >> POM > >>>> (Jersey, OpenTelemetry, Curator, Lucene modules, etc.) to work around > >>>> this. > >>>> > >>>> For solr-solrj the impact is smaller since it has fewer transitive > deps, > >>>> but the same invalid-POM warning appears. > >>>> > >>>> Bram > >>>> > >>>> On Sat, Mar 7, 2026 at 3:32 PM Jan Høydahl <[email protected]> > >> wrote: > >>>> > >>>>> I have not looked into it, but it sounds like something that deserves > >> a > >>>>> JIRA to look into. > >>>>> To clarify, your app imports solr-solrj to act as a client, and you > >> are > >>>>> forced to manually specify jackson version. You do not depend on > >>>> solr-core > >>>>> directly? > >>>>> > >>>>> Jan > >>>>> > >>>>>> 7. mars 2026 kl. 08:28 skrev Bram Luyten <[email protected]>: > >>>>>> > >>>>>> Hi, > >>>>>> > >>>>>> I've been lurking on the sidelines on your mailinglist since > >> December > >>>>>> watching the final steps of the SOLR 10 release, thank you very much > >>>> for > >>>>>> all the work and congratulations on the release!!! > >>>>>> > >>>>>> While integrating Solr 10.0.0 as a Maven dependency in our project > >>>>>> (DSpace), we discovered that the published POMs for solr-core, > >>>>> solr-solrj, > >>>>>> and solr-api on Maven Central are missing <version> elements for > >> their > >>>>>> Jackson 2 (com.fasterxml.jackson) dependencies. > >>>>>> > >>>>>> Affected artifacts: > >>>>>> > >>>>>> solr-core:10.0.0 jackson-annotations, jackson-core, > >> jackson-databind, > >>>>>> jackson-dataformat-smile, jackson-dataformat-cbor > >>>>>> solr-solrj:10.0.0 jackson-databind, jackson-annotations, > >> jackson-core > >>>>>> solr-api:10.0.0 jackson-annotations > >>>>>> > >>>>>> Impact: Maven marks these POMs as invalid and refuses to resolve any > >>>>>> transitive dependencies from the affected modules. For solr-core, > >> this > >>>>>> means ~50+ transitive dependencies are silently lost (Jersey, > >>>>>> OpenTelemetry, Curator, Lucene modules, HPPC, etc.). Projects that > >> use > >>>>>> solr-core as a test dependency for EmbeddedSolrServer must manually > >>>>> declare > >>>>>> all of these. > >>>>>> > >>>>>> Maven warning: > >>>>>> [WARNING] The POM for org.apache.solr:solr-core:jar:10.0.0 is > >>>> invalid, > >>>>>> transitive dependencies > >>>>>> (if any) will not be available: 5 problems were encountered while > >>>>>> building the effective model > >>>>>> for org.apache.solr:solr-core:10.0.0 > >>>>>> [ERROR] 'dependencies.dependency.version' for > >>>>>> com.fasterxml.jackson.core:jackson-annotations:jar is missing. > >>>>>> [ERROR] 'dependencies.dependency.version' for > >>>>>> com.fasterxml.jackson.core:jackson-core:jar is missing. > >>>>>> [ERROR] 'dependencies.dependency.version' for > >>>>>> com.fasterxml.jackson.core:jackson-databind:jar is missing. > >>>>>> [ERROR] 'dependencies.dependency.version' for > >>>>>> com.fasterxml.jackson.dataformat:jackson-dataformat-smile:jar is > >>>> missing. > >>>>>> [ERROR] 'dependencies.dependency.version' for > >>>>>> com.fasterxml.jackson.dataformat:jackson-dataformat-cbor:jar is > >>>> missing. > >>>>>> > >>>>>> Root cause (likely): Solr 10 uses Gradle for building and uses a > >>>> Jackson > >>>>> 2 > >>>>>> BOM (jackson-bom) for version management. The Gradle maven-publish > >>>> plugin > >>>>>> generates the POM from the Gradle model, but BOM-managed versions > >> are > >>>> not > >>>>>> resolved/flattened into the published POM. Since the published POM > >>>> has no > >>>>>> <parent> element, there is no BOM to fall back on at consumption > >> time. > >>>>>> > >>>>>> Workaround: Projects that depend on solr-core (e.g. for testing with > >>>>>> EmbeddedSolrServer) must explicitly declare all dependencies that > >>>> would > >>>>>> normally come transitively through solr-core. In our case this meant > >>>>> adding > >>>>>> ~20 explicit test dependencies to match what solr-core would have > >>>>> provided. > >>>>>> > >>>>>> Would it be worth creating a JIRA for this? The fix would likely > >>>> involve > >>>>>> either adding explicit versions to the Gradle dependency > >> declarations > >>>> for > >>>>>> Jackson, or configuring the maven-publish plugin to resolve > >>>> BOM-managed > >>>>>> versions when generating POMs. > >>>>>> > >>>>>> Thanks, > >>>>>> > >>>>>> Bram Luyten, Atmire > >>>>> > >>>>> > >>>>> --------------------------------------------------------------------- > >>>>> To unsubscribe, e-mail: [email protected] > >>>>> For additional commands, e-mail: [email protected] > >>>>> > >>>>> > >>>> > >>> > >>> > >>> -- > >>> http://www.needhamsoftware.com (work) > >>> https://a.co/d/b2sZLD9 (my fantasy fiction book) > >>> > >> > >> > >> -- > >> http://www.needhamsoftware.com (work) > >> https://a.co/d/b2sZLD9 (my fantasy fiction book) > >> > > -- http://www.needhamsoftware.com (work) https://a.co/d/b2sZLD9 (my fantasy fiction book)
