apache / apache/maven-dependency-analyzer

getTestArtifactsWithNonTestScope wrongly clears warnings once the excluded candidate resolves at all (DependencyGraphProject leaks the original resolved artifact set)

Open
#301 0 comments 0 reactions 0 assignees View on GitHub
bug
Dominant language
Java
Stars
43
Forks
54
Avg merge
10h 49m
Merged PRs (30d)
1

Description

`DependencyGraphProject` (added for the 1.17.2 reachability refinement in
`getTestArtifactsWithNonTestScope`) only overrides `getDependencyArtifacts()` to
return the filtered, candidate-excluded dependency list — it does not override
`getArtifacts()`. `MavenProject(MavenProject)`'s copy constructor carries over the
original project's already-resolved artifact set, which still contains the excluded
candidate. `ProjectDependenciesResolver` reads that pre-resolved set rather than
re-deriving from the filtered model, so the excluded candidate is still "reachable"
in its own synthetic graph and gets evicted from the non-test-scope warning — for
any project where the candidate happens to resolve successfully at all, not only
when it's genuinely reachable via another dependency.

Reproduced downstream in apache/maven-dependency-plugin's
`analyze-testDependencyWithNonTestScope` IT
(apache/maven-dependency-plugin#1692): bumping this library from 1.17.1 to 1.17.2
makes the IT's expected warning table come back empty. Debug logging confirms
`createDependencyGraphProject()` correctly excludes the candidate from the filtered
dependency list handed to `DependencyGraphProject`, but
`projectDependenciesResolver.resolve()` on that project still returns the
candidate in the resolved graph anyway.

Code: [`DependencyGraphProject`](https://github.com/apache/maven-dependency-analyzer/blob/master/src/main/java/org/apache/maven/shared/dependency/analyzer/DefaultProjectDependencyAnalyzer.java#L416-L429)
overrides [`getDependencyArtifacts()`](https://github.com/apache/maven-dependency-analyzer/blob/master/src/main/java/org/apache/maven/shared/dependency/analyzer/DefaultProjectDependencyAnalyzer.java#L424)
but not `getArtifacts()`, called from
[`getTestArtifactsWithNonTestScope()`](https://github.com/apache/maven-dependency-analyzer/blob/master/src/main/java/org/apache/maven/shared/dependency/analyzer/DefaultProjectDependencyAnalyzer.java#L205).

Suggested fix: also override `getArtifacts()` in `DependencyGraphProject` to
return `null`, mirroring the existing `getDependencyArtifacts()` override, so
`ProjectDependenciesResolver` can't fall back to the copied pre-resolved set.

Note: #69 is an in-flight Maven 4/new-API rewrite that also touches this class but
doesn't address this method — flagging so a maintainer can judge whether to base a
fix on master or land it after #69.

*This change was created with AI assistance.*

Contributor guide

No contributing guide indexed for this repository

Research direction

Start in src/main/java/org/apache/maven/shared/dependency/analyzer/DefaultProjectDependencyAnalyzer.java, reading getTestArtifactsWithNonTestScope() and DependencyGraphProject’s getDependencyArtifacts() override. Then inspect the downstream analyze-testDependencyWithNonTestScope integration test and the resolver call described in the issue. Done means the excluded candidate no longer appears in the resolved synthetic graph and the warning table is restored.

Written by the indexing model from the issue text.

Assessment

Tech stack
java
Domain
build-system
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Active
Clarity
Clearly specified
Newbie friendliness
74/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.