apache / apache/maven-dependency-plugin

Unclear warning message from analyze-dep-mgt - only ":jar was excluded", no artifact or group ID present

Open
#1,493 1 comment 0 reactions 0 assignees View on GitHub
bug
Dominant language
Java
Stars
175
Forks
196
Avg merge
19h 30m
Merged PRs (30d)
5

Description

### Affected version

3.8.1

### Bug description

I am running maven-dependency-plugin 3.8.1 on a company project. Here is the warning that I get:

```
[INFO] --- dependency:3.8.1:analyze-dep-mgt (additional-analysis) @ myproject ---
[INFO] Found Resolved Dependency/DependencyManagement mismatches:
[INFO] Ignoring Direct Dependencies.
[INFO] :jar was excluded in DepMgt, but version 2.0.17 has been found in the dependency tree.
[INFO] :jar was excluded in DepMgt, but version 2.1.5 has been found in the dependency tree.
[INFO] :jar was excluded in DepMgt, but version 1.3.5 has been found in the dependency tree.
[INFO] :jar was excluded in DepMgt, but version 3.0.1 has been found in the dependency tree.
[INFO] :jar was excluded in DepMgt, but version 3.0.1 has been found in the dependency tree.
[INFO] :jar was excluded in DepMgt, but version 2.2 has been found in the dependency tree.
[INFO] :jar was excluded in DepMgt, but version 2.0.1 has been found in the dependency tree.
[INFO] :jar was excluded in DepMgt, but version 2.2 has been found in the dependency tree.
[WARNING] Potential problems found in Dependency Management
```

It's difficult to determine which jars these represent, without the artifact or group ID's present.

I'm pretty new to Java and not sure the best way to troubleshoot, if the problem isn't immediately obvious from this description let me know how I can help. The configuration has multiple parents - one parent specifies some stuff in pluginManagement and then this plugin has two different execution blocks, this is the second one.

Contributor guide

No contributing guide indexed for this repository

Research direction

Start with the maven-dependency-plugin's analyze-dep-mgt execution and trace where the reported dependency-management mismatch warning is assembled. Reproduce the warning with the configuration described in the issue, then verify that each message identifies the relevant group and artifact instead of only ":jar".

Written by the indexing model from the issue text.

Assessment

Tech stack
java
Domain
build-system
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
42/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.