apache / apache/maven-dependency-tree

NPE in graph builders when a child DependencyNode has no Dependency

Open
#135 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
Java
Stars
27
Forks
31
Avg merge
5h 53m
Merged PRs (30d)
1

Description

## Summary
Both graph builders call `getDependencyArtifact(child.getDependency())` unconditionally for every child node. If a child node has a null `Dependency` (possible for nodes produced/omitted by certain resolver transformers), this throws a `NullPointerException` instead of being handled.

## Affected code
- `src/main/java/org/apache/maven/shared/dependency/graph/internal/DefaultDependencyCollectorBuilder.java:225-231` — `getDependencyArtifact(child.getDependency())`
- `src/main/java/org/apache/maven/shared/dependency/graph/internal/DefaultDependencyGraphBuilder.java:152-159` — `getDependencyArtifact(child.getDependency())`

## Note
The same code paths carefully null-guard `node.getDependency()` when reading `optional`/`exclusions` (e.g. `DefaultDependencyCollectorBuilder.java:187,192`), which is inconsistent with the unconditional child handling.

## Suggested fix
Null-guard `child.getDependency()` and skip or substitute the artifact accordingly, or document that children are guaranteed to carry a `Dependency` and fail with a clearer message.

Contributor guide

No contributing guide indexed for this repository

Research direction

Start with the affected child-node handling in src/main/java/org/apache/maven/shared/dependency/graph/internal/DefaultDependencyCollectorBuilder.java:225-231 and DefaultDependencyGraphBuilder.java:152-159, then compare the existing null guards around lines 187 and 192. Trace how resolver transformers produce children without a Dependency and confirm the intended skip, substitution, or clearer failure behavior. Done means both graph builders handle such children without an unexpected NullPointerException.

Written by the indexing model from the issue text.

Assessment

Tech stack
java
Domain
build-system
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
55/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.