apache / apache/maven-dependency-plugin

dependency:tree -Dscope filter is silently non-functional due to MSHARED-4

Open
#1,649 1 comment 0 reactions 0 assignees View on GitHub
bug
Dominant language
Java
Stars
175
Forks
196
Avg merge
19h 30m
Merged PRs (30d)
5

Description

`TreeMojo` has a `scope` parameter (line 122) that is supposed to filter the dependency tree, but it has been non-functional for years due to `MSHARED-4` in the `maven-dependency-tree` library. The TODO at line 232 documents this:

```java
// TODO: note that filter does not get applied due to MSHARED-4
ArtifactFilter artifactFilter = createResolvingArtifactFilter();
```

The `artifactFilter` is passed to `dependencyCollectorBuilder.collectDependencyGraph()` and `dependencyGraphBuilder.buildDependencyGraph()` at lines 241 and 246, but these methods ignore the filter. This means:

```bash
mvn dependency:tree -Dscope=compile
```

still shows all scopes (test, provided, etc.) with no warning that the filter was not applied.

The fix would be to apply the filter client-side after obtaining the tree, or to fix MSHARED-4 in maven-dependency-tree, or at minimum to log a warning when a scope is specified that it may not be honored.

Contributor guide

No contributing guide indexed for this repository

Research direction

Start in TreeMojo around the scope parameter and the TODO near line 232, then trace createResolvingArtifactFilter through dependencyCollectorBuilder.collectDependencyGraph() and dependencyGraphBuilder.buildDependencyGraph() at lines 241 and 246. Reproduce with mvn dependency:tree -Dscope=compile and verify that the chosen resolution either honors the scope filter or clearly warns when it cannot be applied.

Written by the indexing model from the issue text.

Assessment

Tech stack
java
Domain
build-system
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
48/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.