apache / apache/maven-dependency-plugin

filterDependencies destructively mutates the caller's set via Iterator.remove()

Open
#1,646 2 comments 0 reactions 0 assignees View on GitHub
bug
Dominant language
Java
Stars
175
Forks
196
Avg merge
19h 30m
Merged PRs (30d)
5

Description

`AbstractAnalyzeMojo.filterDependencies()` at line 568-573:

```java
for (Iterator it = artifacts.iterator(); it.hasNext(); ) {
Artifact artifact = it.next();
if (!filter.include(artifact)) {
it.remove(); // mutates the ORIGINAL set passed in
result.add(artifact);
}
}
```

This method is called multiple times on the same set with different filter arrays (lines 363-375):

```java
ignoredUsedUndeclared.addAll(filterDependencies(usedUndeclaredWithClasses.keySet(), ignoredDependencies));
ignoredUsedUndeclared.addAll(filterDependencies(usedUndeclaredWithClasses.keySet(), ignoredUsedUndeclaredDependencies));
```

After the first non-empty filter removes matching entries from `usedUndeclaredWithClasses`, the second call operates on an already-reduced set. The "Used undeclared dependencies found:" warning listing (line 392, 394) iterates `usedUndeclaredWithClasses` which has been destructively modified — entries matching `ignoredDependencies` are silently missing from the warning output.

The same pattern applies to `unusedDeclared` and `nonTestScope` (lines 367-375).

The method should either:
1. Copy the set before iterating, or
2. Build the result without removing from the input, leaving the caller responsible for subtraction

Contributor guide

No contributing guide indexed for this repository

Research direction

Start in AbstractAnalyzeMojo.filterDependencies() at lines 568-573, then inspect its call sites at lines 363-375 and the warning listing at lines 392-394. Verify that repeated filtering leaves the caller's sets intact and that the warning still includes dependencies matched by earlier filters.

Written by the indexing model from the issue text.

Assessment

Tech stack
java
Domain
build-system, tooling
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Quiet
Clarity
Clearly specified
Newbie friendliness
72/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.