apache / apache/maven-dependency-analyzer
getTestArtifactsWithNonTestScope wrongly clears warnings once the excluded candidate resolves at all (DependencyGraphProject leaks the original resolved artifact set)
- Dominant language
- Java
- Stars
- 43
- Forks
- 54
- Avg merge
- 10h 49m
- Merged PRs (30d)
- 1
Description
`DependencyGraphProject` (added for the 1.17.2 reachability refinement in
`getTestArtifactsWithNonTestScope`) only overrides `getDependencyArtifacts()` to
return the filtered, candidate-excluded dependency list — it does not override
`getArtifacts()`. `MavenProject(MavenProject)`'s copy constructor carries over the
original project's already-resolved artifact set, which still contains the excluded
candidate. `ProjectDependenciesResolver` reads that pre-resolved set rather than
re-deriving from the filtered model, so the excluded candidate is still "reachable"
in its own synthetic graph and gets evicted from the non-test-scope warning — for
any project where the candidate happens to resolve successfully at all, not only
when it's genuinely reachable via another dependency.
Reproduced downstream in apache/maven-dependency-plugin's
`analyze-testDependencyWithNonTestScope` IT
(apache/maven-dependency-plugin#1692): bumping this library from 1.17.1 to 1.17.2
makes the IT's expected warning table come back empty. Debug logging confirms
`createDependencyGraphProject()` correctly excludes the candidate from the filtered
dependency list handed to `DependencyGraphProject`, but
`projectDependenciesResolver.resolve()` on that project still returns the
candidate in the resolved graph anyway.
Code: [`DependencyGraphProject`](https://github.com/apache/maven-dependency-analyzer/blob/master/src/main/java/org/apache/maven/shared/dependency/analyzer/DefaultProjectDependencyAnalyzer.java#L416-L429)
overrides [`getDependencyArtifacts()`](https://github.com/apache/maven-dependency-analyzer/blob/master/src/main/java/org/apache/maven/shared/dependency/analyzer/DefaultProjectDependencyAnalyzer.java#L424)
but not `getArtifacts()`, called from
[`getTestArtifactsWithNonTestScope()`](https://github.com/apache/maven-dependency-analyzer/blob/master/src/main/java/org/apache/maven/shared/dependency/analyzer/DefaultProjectDependencyAnalyzer.java#L205).
Suggested fix: also override `getArtifacts()` in `DependencyGraphProject` to
return `null`, mirroring the existing `getDependencyArtifacts()` override, so
`ProjectDependenciesResolver` can't fall back to the copied pre-resolved set.
Note: #69 is an in-flight Maven 4/new-API rewrite that also touches this class but
doesn't address this method — flagging so a maintainer can judge whether to base a
fix on master or land it after #69.
*This change was created with AI assistance.*
Contributor guide
No contributing guide indexed for this repository
Research direction
Start in src/main/java/org/apache/maven/shared/dependency/analyzer/DefaultProjectDependencyAnalyzer.java, reading getTestArtifactsWithNonTestScope() and DependencyGraphProject’s getDependencyArtifacts() override. Then inspect the downstream analyze-testDependencyWithNonTestScope integration test and the resolver call described in the issue. Done means the excluded candidate no longer appears in the resolved synthetic graph and the warning table is restored.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java
- Domain
- build-system
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Active
- Clarity
- Clearly specified
- Newbie friendliness
- 74/100