apache / apache/maven-dependency-plugin

[MDEP-976] artifactId is not guaranteed to be globally unique

Open
#1,476 1 comment 0 reactions 0 assignees View on GitHub
bug priority:major
Dominant language
Java
Stars
175
Forks
196
Avg merge
19h 30m
Merged PRs (30d)
5

Description

**[Gili](https://issues.apache.org/jira/secure/ViewProfile.jspa?name=cowwoc)** opened **[MDEP-976](https://issues.apache.org/jira/browse/MDEP-976?redirect=false)** and commented

The copy-dependencies Mojo incorrectly assumes that a dependency's artifactId is globally unique. If a project depends on two different groupIds that happen to have the same artifactId then one dependency will overwrite the other.

Consider adding ${groupId} to the default output filename and/or add an option for doing so in case users wish to retain backwards compatibility.

---

**Affects:** 3.8.1

**Remote Links:**
- [GitHub Pull Request #523
](https://github.com/apache/maven-dependency-plugin/pull/523)

Contributor guide

No contributing guide indexed for this repository

Research direction

Start by reviewing the copy-dependencies Mojo and the linked pull request #523. Reproduce the case with two dependencies sharing an artifactId but using different groupIds, then confirm that both outputs are retained while the requested backwards-compatibility behavior is preserved.

Written by the indexing model from the issue text.

Assessment

Tech stack
java
Domain
build-system
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.