[
https://issues.apache.org/jira/browse/MNG-6283?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Stefan Dellmuth updated MNG-6283:
---------------------------------
Description:
We have one occurrence of a "nested BOM", i.e. an import-scoped dependency
which is transitively resolved as part of another import-scoped dependency.
Moreover, as we are behind a company proxy, our only way of downloading
dependencies is via a repository in our Maven settings called {{central}} and
thus overwriting the default Maven Central repository.
Maven 3.2.2 introduced a regression which breaks the resolution of such nested
BOM dependencies. Maven tries to resolve them against the Maven Central
repository instead of our own.
So:
{code:xml}
<project xmlns="http://maven.apache.org/POM/4.0.0";
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance";
xsi:schemaLocation="http://maven.apache.org/POM/4.0.0
http://maven.apache.org/xsd/maven-4.0.0.xsd";>
<modelVersion>4.0.0</modelVersion>
<groupId>de.msg.maven</groupId>
<artifactId>nested-import-scope-example</artifactId>
<version>1.0</version>
<packaging>pom</packaging>
<dependencyManagement>
<dependencies>
<dependency>
<groupId>de.msg.maven</groupId>
<artifactId>nested-import-scope-bom</artifactId>
<version>1.0</version>
<type>pom</type>
<scope>import</scope>
</dependency>
</dependencies>
</dependencyManagement>
</project>
{code}
...which in turn leads to...
{code:xml}
<project xmlns="http://maven.apache.org/POM/4.0.0";
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance";
xsi:schemaLocation="http://maven.apache.org/POM/4.0.0
http://maven.apache.org/xsd/maven-4.0.0.xsd";>
<modelVersion>4.0.0</modelVersion>
<groupId>de.msg.maven</groupId>
<artifactId>nested-import-scope-bom</artifactId>
<version>1.0</version>
<packaging>pom</packaging>
<dependencyManagement>
<dependencies>
<dependency>
<groupId>org.jboss.bom.wfk</groupId>
<artifactId>jboss-javaee-6.0-with-tools</artifactId>
<version>2.4.0-redhat-2</version>
<type>pom</type>
<scope>import</scope>
</dependency>
</dependencies>
</dependencyManagement>
</project>
{code}
Maven settings contain:
{code:xml}
<profiles>
<profile>
<repositories>
<repository>
<id>central</id>
<url>http://maven.repository.redhat.com/techpreview/all/</url>
</repository>
</repositories>
<id>jboss</id>
</profile>
</profiles>
<activeProfiles>
<activeProfile>jboss</activeProfile>
</activeProfiles>
{code}
In this case, if I want to resolve the dependencies of
{{nested-import-scope-example}} (while having {{nested-import-scope-bom}}
available in my local or company's repository) fails because Maven tries to
download the JBoss BOM from Maven Central.
Workaround: Renaming our company repository's ID to something other than
{{central}} works as expected.
Disclaimer:
As I can't use our company repository's address here, I've reproduced the
problem with the example of MNG-5663 which I've found during my research.
was:
We have one occurrence a "nested BOM", i.e. an import-scoped dependency which
is transitively resolved as part of another import-scoped dependency. Moreover,
as we are behind a company proxy, our only way of downloading dependencies is
via a repository in our Maven settings called {{central}} and thus overwriting
the default Maven Central repository.
Maven 3.2.2 introduced a regression which breaks the resolution of such nested
BOM dependencies. Maven tries to resolve them against the Maven Central
repository instead of our own.
So:
{code:xml}
<project xmlns="http://maven.apache.org/POM/4.0.0";
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance";
xsi:schemaLocation="http://maven.apache.org/POM/4.0.0
http://maven.apache.org/xsd/maven-4.0.0.xsd";>
<modelVersion>4.0.0</modelVersion>
<groupId>de.msg.maven</groupId>
<artifactId>nested-import-scope-example</artifactId>
<version>1.0</version>
<packaging>pom</packaging>
<dependencyManagement>
<dependencies>
<dependency>
<groupId>de.msg.maven</groupId>
<artifactId>nested-import-scope-bom</artifactId>
<version>1.0</version>
<type>pom</type>
<scope>import</scope>
</dependency>
</dependencies>
</dependencyManagement>
</project>
{code}
...which in turn leads to...
{code:xml}
<project xmlns="http://maven.apache.org/POM/4.0.0";
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance";
xsi:schemaLocation="http://maven.apache.org/POM/4.0.0
http://maven.apache.org/xsd/maven-4.0.0.xsd";>
<modelVersion>4.0.0</modelVersion>
<groupId>de.msg.maven</groupId>
<artifactId>nested-import-scope-bom</artifactId>
<version>1.0</version>
<packaging>pom</packaging>
<dependencyManagement>
<dependencies>
<dependency>
<groupId>org.jboss.bom.wfk</groupId>
<artifactId>jboss-javaee-6.0-with-tools</artifactId>
<version>2.4.0-redhat-2</version>
<type>pom</type>
<scope>import</scope>
</dependency>
</dependencies>
</dependencyManagement>
</project>
{code}
Maven settings contain:
{code:xml}
<profiles>
<profile>
<repositories>
<repository>
<id>central</id>
<url>http://maven.repository.redhat.com/techpreview/all/</url>
</repository>
</repositories>
<id>jboss</id>
</profile>
</profiles>
<activeProfiles>
<activeProfile>jboss</activeProfile>
</activeProfiles>
{code}
In this case, if I want to resolve the dependencies of
{{nested-import-scope-example}} (while having {{nested-import-scope-bom}}
available in my local or company's repository) fails because Maven tries to
download the JBoss BOM from Maven Central.
Workaround: Renaming our company repository's ID to something other than
{{central}} works as expected.
Disclaimer:
As I can't use our company repository's address here, I've reproduced the
problem with the example of MNG-5663 which I've found during my research.
> [regression] resolution of nested import-scoped transitive dependencies
> ignores repositories overwriting 'central'
> ------------------------------------------------------------------------------------------------------------------
>
> Key: MNG-6283
> URL: https://issues.apache.org/jira/browse/MNG-6283
> Project: Maven
> Issue Type: Bug
> Components: Artifacts and Repositories, Dependencies
> Affects Versions: 3.2.2, 3.5.0
> Reporter: Stefan Dellmuth
>
> We have one occurrence of a "nested BOM", i.e. an import-scoped dependency
> which is transitively resolved as part of another import-scoped dependency.
> Moreover, as we are behind a company proxy, our only way of downloading
> dependencies is via a repository in our Maven settings called {{central}} and
> thus overwriting the default Maven Central repository.
> Maven 3.2.2 introduced a regression which breaks the resolution of such
> nested BOM dependencies. Maven tries to resolve them against the Maven
> Central repository instead of our own.
> So:
> {code:xml}
> <project xmlns="http://maven.apache.org/POM/4.0.0";
> xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance";
> xsi:schemaLocation="http://maven.apache.org/POM/4.0.0
> http://maven.apache.org/xsd/maven-4.0.0.xsd";>
> <modelVersion>4.0.0</modelVersion>
> <groupId>de.msg.maven</groupId>
> <artifactId>nested-import-scope-example</artifactId>
> <version>1.0</version>
> <packaging>pom</packaging>
> <dependencyManagement>
> <dependencies>
> <dependency>
> <groupId>de.msg.maven</groupId>
> <artifactId>nested-import-scope-bom</artifactId>
> <version>1.0</version>
> <type>pom</type>
> <scope>import</scope>
> </dependency>
> </dependencies>
> </dependencyManagement>
> </project>
> {code}
> ...which in turn leads to...
> {code:xml}
> <project xmlns="http://maven.apache.org/POM/4.0.0";
> xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance";
> xsi:schemaLocation="http://maven.apache.org/POM/4.0.0
> http://maven.apache.org/xsd/maven-4.0.0.xsd";>
> <modelVersion>4.0.0</modelVersion>
> <groupId>de.msg.maven</groupId>
> <artifactId>nested-import-scope-bom</artifactId>
> <version>1.0</version>
> <packaging>pom</packaging>
> <dependencyManagement>
> <dependencies>
> <dependency>
> <groupId>org.jboss.bom.wfk</groupId>
> <artifactId>jboss-javaee-6.0-with-tools</artifactId>
> <version>2.4.0-redhat-2</version>
> <type>pom</type>
> <scope>import</scope>
> </dependency>
> </dependencies>
> </dependencyManagement>
> </project>
> {code}
> Maven settings contain:
> {code:xml}
> <profiles>
> <profile>
> <repositories>
> <repository>
> <id>central</id>
> <url>http://maven.repository.redhat.com/techpreview/all/</url>
> </repository>
> </repositories>
> <id>jboss</id>
> </profile>
> </profiles>
> <activeProfiles>
> <activeProfile>jboss</activeProfile>
> </activeProfiles>
> {code}
> In this case, if I want to resolve the dependencies of
> {{nested-import-scope-example}} (while having {{nested-import-scope-bom}}
> available in my local or company's repository) fails because Maven tries to
> download the JBoss BOM from Maven Central.
> Workaround: Renaming our company repository's ID to something other than
> {{central}} works as expected.
> Disclaimer:
> As I can't use our company repository's address here, I've reproduced the
> problem with the example of MNG-5663 which I've found during my research.
--
This message was sent by Atlassian JIRA
(v6.4.14#64029)
