apache / apache/maven-enforcer

RequireUpperBoundDeps error message is difficult to decipher

Open
#937 2 comments 1 reaction 0 assignees View on GitHub
bug
Dominant language
Java
Stars
161
Forks
180
Avg merge
1d 20m
Merged PRs (30d)
8

Description

### Affected version

3.6.1

### Bug description

In certain situations the error reported by `RequireUpperBoundDeps` is hard to decipher.

For example, this error:
```
[ERROR] Rule 0: org.apache.maven.enforcer.rules.dependency.RequireUpperBoundDeps failed with message:
[ERROR] Failed while enforcing RequireUpperBoundDeps. The error(s) are [
[ERROR] Require upper bound dependencies error for org.springframework.data:spring-data-commons:3.4.5. Paths to dependency are:
[ERROR] +-com.example:enforcer-bug:0
[ERROR] +-com.vaadin:vaadin-core:24.9.1
[ERROR] +-com.vaadin:vaadin-core-internal:24.9.1
[ERROR] +-com.vaadin:vaadin-core-components:24.9.1 (managed) <-- com.vaadin:vaadin-core-components:24.9.1
[ERROR] +-com.vaadin:vaadin-combo-box-flow:24.9.1 (managed) <-- com.vaadin:vaadin-combo-box-flow:24.9.1
[ERROR] +-org.springframework.data:spring-data-commons:3.4.5 (managed) <-- org.springframework.data:spring-data-commons:3.5.4
[ERROR] and
[ERROR] +-com.example:enforcer-bug:0
[ERROR] +-com.vaadin:vaadin-core:24.9.1
[ERROR] +-com.vaadin:vaadin-core-internal:24.9.1
[ERROR] +-com.vaadin:vaadin-core-components:24.9.1 (managed) <-- com.vaadin:vaadin-core-components:24.9.1
[ERROR] +-com.vaadin:vaadin-grid-flow:24.9.1 (managed) <-- com.vaadin:vaadin-grid-flow:24.9.1
[ERROR] +-org.springframework.data:spring-data-commons:3.4.5 (managed) <-- org.springframework.data:spring-data-commons:3.5.4
[ERROR] ]
```

(Note, you have to look carefully - the version mismatch is between `3.4.5` and `3.5.4`).

If you inspect `com.vaadin:vaadin-combo-box-flow:24.9.1` and `com.vaadin:vaadin-grid-flow:24.9.1` you will see that they both declare this dependency:
```xml

org.springframework.data
spring-data-commons
3.5.4
compile

```

Yet the error message seems to be complaining that they are actually depending on `3.4.5` instead of `3.5.4` when you look at the `+-` child relationships.

The dependency on `3.4.5` is coming from the parent and you can see it in the `help:effective-pom`. But this is not at all obvious from the error message. In the error message, the `3.4.5` dependency is seemingly coming from "nowhere".

A contributor to this problem is that [the website for RequireUpperBoundDeps](https://maven.apache.org/enforcer/enforcer-rules/requireUpperBoundDeps.html) does not explain how to interpret the error messages.

Would it be possible to explain this kind of conflict more clearly? Thanks.

Below is a POM that reproduces this situation when you run `mvn validate`.

```xml

4.0.0

org.springframework.boot
spring-boot-dependencies
3.4.5

com.example
enforcer-bug
Enforcer bug
0
war


3.6.1
24.9.1



com.vaadin
vaadin-core





com.vaadin
vaadin-bom
${vaadin.version}
pom
import





org.apache.maven.plugins
maven-enforcer-plugin
${maven-enforcer-plugin.version}


maven_enforcer
validate

enforce





com.fasterxml.jackson.core:jackson-core
com.fasterxml.jackson.core:jackson-databind
com.fasterxml.jackson.datatype:jackson-datatype-jsr310
com.google.guava:guava
commons-codec:commons-codec
io.netty:netty-all
io.projectreactor.netty:reactor-netty
org.apache.commons:commons-lang3
org.apache.commons:commons-text
org.jspecify:jspecify
org.slf4j:slf4j-api








```

Contributor guide

No contributing guide indexed for this repository

Research direction

Start with the supplied POM and run `mvn validate` to reproduce the RequireUpperBoundDeps output. Review the RequireUpperBoundDeps rule and its website documentation to determine how the conflicting managed and declared versions should be explained. Done means the conflict is understandable from the error message and the website explains how to interpret it.

Written by the indexing model from the issue text.

Assessment

Tech stack
java
Domain
build-system, documentation
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Active
Clarity
Mostly clear
Newbie friendliness
52/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.