apache / apache/maven-dependency-plugin

[MDEP-892] go-offline does not correctly resolve overridden properties

Open
#1,393 2 comments 0 reactions 0 assignees View on GitHub
bug priority:minor
Dominant language
Java
Stars
175
Forks
196
Avg merge
19h 30m
Merged PRs (30d)
5

Description

**[Arnout Engelen](https://issues.apache.org/jira/secure/ViewProfile.jspa?name=JIRAUSER291537)** opened **[MDEP-892](https://issues.apache.org/jira/browse/MDEP-892?redirect=false)** and commented

When a project shares a parent pom with a dependency, and overrides a property of that parent pom, this is not picked up by `{}dependency:go-offline{`}.

I have shared a reproducer at https://codeberg.org/raboof/maven-property-resolution . The scenario is `one` and `other-mod` both have parent pom `other-parent`. `other-parent` specifies version 7.4 of a dependency, but `one` overrides this to 7.3. Other plugins (including `mvn dependency:tree`) pick 7.3 in this scenario, but `mvn dependency:go-offline` downloads version 7.4.

It seems https://github.com/apache/maven-dependency-plugin/pull/2 (unmerged) fixed this, but its successor https://github.com/apache/maven-dependency-plugin/pull/135 (unmerged) does not.

An alternative is to use https://github.com/qaware/go-offline-maven-plugin instead.

---

**Affects:** 3.6.1

Contributor guide

No contributing guide indexed for this repository

Research direction

Start with the linked Codeberg reproducer, focusing on the `one`, `other-mod`, and `other-parent` scenario, and run `dependency:go-offline` alongside `dependency:tree`. Read the unmerged pull requests #2 and #135 for prior approaches. Done means the overridden 7.3 dependency is resolved instead of downloading 7.4.

Written by the indexing model from the issue text.

Assessment

Tech stack
java
Domain
build-system, tooling
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.