Document `bannedDependencies` behavior change in 3.7.0 and provide an opt-out for optional dependencies
Maintainers usually reply within 1 day
Assessment
This issue has not been assessed yet.
Description
Affected version
3.7.0
Bug description
In 3.7.0, bannedDependencies started checking direct optional dependencies and their transitive dependencies. According to https://github.com/apache/maven-enforcer/pull/1025#issuecomment-5671222005, this change was intentional to restore behavior lost in 3.3.0, but it can break builds that passed with versions 3.3.x–3.6.x, like in https://github.com/scordio/junit-converters/pull/134.
The release notes mention only requireReleaseDeps, so the impact on bannedDependencies isn't clear. For example, an exclusion of *:*:*:jar:compile now also bans optional compile dependencies and their trees.
Could you please document this behavior change in the release notes or migration guidance?
Also, it appears there's no way to restore the previous behavior through the rule’s configuration, since <include> patterns cannot match optional dependencies. Would you consider introducing a bannedDependencies opt-out for checking optional dependency trees?
- Dominant language
- Java
- Stars
- 162
- Forks
- 190
- Avg merge
- 1d 17h
- Merged PRs (30d)
- 20
Getting set up
- No Dockerfile or Docker Compose file
- Has a pull request template
- No contributing guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from apache/maven-enforcer
-
RequireUpperBoundDeps does not support includes with only groupIdPossibly taken @waterWang claimed this 105 days ago. Openbug
Difficulty 2/5 1-3 hours Newbie friendliness 76/100
apache/maven-enforcer#998 ·
Maintainers usually reply within 1 day
-
bug
Difficulty 4/5 3-5 days Newbie friendliness 48/100
apache/maven-enforcer#1038 · 1 comment ·
Maintainers usually reply within 1 day
-
New rule: banSplitPackages — detect packages split across modules and artifactsMay be free again @ascheman claimed this 110 days ago, and no pull request is open. Openenhancement
apache/maven-enforcer#997 · 2 comments · 1 assignee ·
Maintainers usually reply within 1 day
-
New rules: enforce Java Module System descriptor policyMay be free again @ascheman claimed this 116 days ago, and no pull request is open. Openenhancement
apache/maven-enforcer#995 · 1 reaction · 1 assignee ·
Maintainers usually reply within 1 day
-
bug
Difficulty 3/5 1-2 days Newbie friendliness 25/100
apache/maven-enforcer#950 ·
Maintainers usually reply within 1 day
All issues in apache/maven-enforcer
Similar issues
-
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
rusefi/rusefi#10602 · 1 comment ·
Maintainers usually reply within 1 day
-
pdfium-drift
Difficulty 1/5 Under an hour Newbie friendliness 84/100
Stirling-Tools/JPDFium#240 ·
Maintainers usually reply within 1 day
-
Bug
Difficulty 2/5 1-3 hours Newbie friendliness 60/100
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 86/100
Maintainers usually reply within 1 day
-
Difficulty 1/5 Under an hour Newbie friendliness 68/100
Vakore/ZappierGames#285 ·