Stefan Dellmuth created MNG-6283: ------------------------------------ Summary: [regression] resolution of nested import-scoped transitive dependencies ignores repositories overwriting 'central' Key: MNG-6283 URL: https://issues.apache.org/jira/browse/MNG-6283 Project: Maven Issue Type: Bug Components: Artifacts and Repositories, Dependencies Affects Versions: 3.5.0, 3.2.2 Reporter: Stefan Dellmuth
We have one occurrence a "nested BOM", i.e. an import-scoped dependency which is transitively resolved as part of another import-scoped dependency. Moreover, as we are behind a company proxy, our only way of downloading dependencies is via a repository in our Maven settings called {{central}} and thus overwriting the default Maven Central repository. Maven 3.2.2 introduced a regression which breaks the resolution of such nested BOM dependencies. Maven tries to resolve them against the Maven Central repository instead of our own. So: {code:xml} <project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd"> <modelVersion>4.0.0</modelVersion> <groupId>de.msg.maven</groupId> <artifactId>nested-import-scope-example</artifactId> <version>1.0</version> <packaging>pom</packaging> <dependencyManagement> <dependencies> <dependency> <groupId>de.msg.maven</groupId> <artifactId>nested-import-scope-bom</artifactId> <version>1.0</version> <type>pom</type> <scope>import</scope> </dependency> </dependencies> </dependencyManagement> </project> {code} ...which in turn leads to... {code:xml} <project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd"> <modelVersion>4.0.0</modelVersion> <groupId>de.msg.maven</groupId> <artifactId>nested-import-scope-bom</artifactId> <version>1.0</version> <packaging>pom</packaging> <dependencyManagement> <dependencies> <dependency> <groupId>org.jboss.bom.wfk</groupId> <artifactId>jboss-javaee-6.0-with-tools</artifactId> <version>2.4.0-redhat-2</version> <type>pom</type> <scope>import</scope> </dependency> </dependencies> </dependencyManagement> </project> {code} Maven settings contain: {code:xml} <profiles> <profile> <repositories> <repository> <id>central</id> <url>http://maven.repository.redhat.com/techpreview/all/</url> </repository> </repositories> <id>jboss</id> </profile> </profiles> <activeProfiles> <activeProfile>jboss</activeProfile> </activeProfiles> {code} In this case, if I want to resolve the dependencies of {{nested-import-scope-example}} (while having {{nested-import-scope-bom}} available in my local or company's repository) fails because Maven tries to download the JBoss BOM from Maven Central. Workaround: Renaming our company repository's ID to something other than {{central}} works as expected. Disclaimer: As I can't use our company repository's address here, I've reproduced the problem with the example of MNG-5663 which I've found during my research. -- This message was sent by Atlassian JIRA (v6.4.14#64029)