[MENFORCER-432] requireUpperBoundDeps support for checking dependencyManagement

Open
  • Is something wrong?
#774 2 comments 0 reactions 0 assignees View on GitHub

Maintainers usually reply within 1 day

Nobody has claimed this yet.

Assessment

Difficulty
4/5
Estimated time
3-5 days
Newbie friendliness
35/100
Issue type
Feature
Clarity
Mostly clear
Activity status
Stale
Tech stack
java
Domain
build-system

Research direction

Start with the requireUpperBoundDeps rule and inspect how maven-dependency-tree determines managed dependencies in DefaultDependencyCollectorBuilder and the older Maven31DependencyCollectorBuilder. Use the provided BOM example as a reproduction and verify that dependencyManagement conflicts are detected, with a way to enable or disable the check if that design is retained.

Written by the indexing model from the issue text.

Description

enhancement priority:minor

Marcono1234 opened MENFORCER-432 and commented

For projects which are either used as parent by other projects, or which are used as Bill of Materials (BOM) and which declare dependencies in the dependencyManagement it would be useful if requireUpperBoundDeps was able to check the dependencies in the dependencyManagement. This would allow verifying that the versions of these managed dependencies are correct and do not cause any issues for consuming projects.

Currently requireUpperBoundDeps seems to only check regular dependencies; this prevents it from being used directly on the parent / BOM project, but requires applying it on all consuming projects.
It would be quite useful to already detect conflicting dependency versions directly in the parent / BOM project.

Maybe a separate option for this (e.g. checkDependencyManagement) would be useful to allow enabling / disabling this check.

It appears maven-dependency-tree already determines those managed dependencies in DefaultDependencyCollectorBuilder respectively Maven31DependencyCollectorBuilder (in older versions), but does not expose this information.

Example
<project>
    <modelVersion>4.0.0</modelVersion>

    <groupId>com.example</groupId>
    <artifactId>my-bom</artifactId>
    <version>1</version>
    <packaging>pom</packaging>

    <dependencyManagement>
        <!-- Example from https://maven.apache.org/enforcer/enforcer-rules/requireUpperBoundDeps.html -->
        <dependencies>
            <dependency>
                <groupId>org.slf4j</groupId>
                <artifactId>slf4j-api</artifactId>
                <version>1.4.0</version>
            </dependency>
            <dependency>
                <groupId>ch.qos.logback</groupId>
                <artifactId>logback-classic</artifactId>
                <version>0.9.9</version>
                <!-- Depends on org.slf4j:slf4j-api:1.5.0 -->
            </dependency>
        </dependencies>
    </dependencyManagement>

    <build>
        <plugins>
            <plugin>
                <groupId>org.apache.maven.plugins</groupId>
                <artifactId>maven-enforcer-plugin</artifactId>
                <version>3.2.1</version>
                <executions>
                    <execution>
                        <id>enforce</id>
                        <configuration>
                            <rules>
                                <requireUpperBoundDeps>
                                </requireUpperBoundDeps>
                            </rules>
                        </configuration>
                        <goals>
                            <goal>enforce</goal>
                        </goals>
                    </execution>
                </executions>
            </plugin>
        </plugins>
    </build>
</project>

Running mvn validate passes. Only when changing the dependencyManagement to regular dependencies Maven Enforcer detects the rule violation.

Affects: 3.1.0, 3.2.1

Dominant language
Java
Stars
162
Forks
188
Avg merge
1d 9h
Merged PRs (30d)
17

Getting set up

  • No Dockerfile or Docker Compose file
  • Has a pull request template
  • No contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from apache/maven-enforcer

All issues in apache/maven-enforcer

Similar issues

More Java issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.