apache / apache/maven-dependency-tree
NPE in graph builders when a child DependencyNode has no Dependency
- Dominant language
- Java
- Stars
- 27
- Forks
- 31
- Avg merge
- 5h 53m
- Merged PRs (30d)
- 1
Description
## Summary
Both graph builders call `getDependencyArtifact(child.getDependency())` unconditionally for every child node. If a child node has a null `Dependency` (possible for nodes produced/omitted by certain resolver transformers), this throws a `NullPointerException` instead of being handled.
## Affected code
- `src/main/java/org/apache/maven/shared/dependency/graph/internal/DefaultDependencyCollectorBuilder.java:225-231` — `getDependencyArtifact(child.getDependency())`
- `src/main/java/org/apache/maven/shared/dependency/graph/internal/DefaultDependencyGraphBuilder.java:152-159` — `getDependencyArtifact(child.getDependency())`
## Note
The same code paths carefully null-guard `node.getDependency()` when reading `optional`/`exclusions` (e.g. `DefaultDependencyCollectorBuilder.java:187,192`), which is inconsistent with the unconditional child handling.
## Suggested fix
Null-guard `child.getDependency()` and skip or substitute the artifact accordingly, or document that children are guaranteed to carry a `Dependency` and fail with a clearer message.
Contributor guide
No contributing guide indexed for this repository
Research direction
Start with the affected child-node handling in src/main/java/org/apache/maven/shared/dependency/graph/internal/DefaultDependencyCollectorBuilder.java:225-231 and DefaultDependencyGraphBuilder.java:152-159, then compare the existing null guards around lines 187 and 192. Trace how resolver transformers produce children without a Dependency and confirm the intended skip, substitution, or clearer failure behavior. Done means both graph builders handle such children without an unexpected NullPointerException.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java
- Domain
- build-system
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 55/100