apache / apache/maven-enforcer
RequireUpperBoundDeps error message is difficult to decipher
- Dominant language
- Java
- Stars
- 161
- Forks
- 180
- Avg merge
- 1d 20m
- Merged PRs (30d)
- 8
Description
### Affected version
3.6.1
### Bug description
In certain situations the error reported by `RequireUpperBoundDeps` is hard to decipher.
For example, this error:
```
[ERROR] Rule 0: org.apache.maven.enforcer.rules.dependency.RequireUpperBoundDeps failed with message:
[ERROR] Failed while enforcing RequireUpperBoundDeps. The error(s) are [
[ERROR] Require upper bound dependencies error for org.springframework.data:spring-data-commons:3.4.5. Paths to dependency are:
[ERROR] +-com.example:enforcer-bug:0
[ERROR] +-com.vaadin:vaadin-core:24.9.1
[ERROR] +-com.vaadin:vaadin-core-internal:24.9.1
[ERROR] +-com.vaadin:vaadin-core-components:24.9.1 (managed) <-- com.vaadin:vaadin-core-components:24.9.1
[ERROR] +-com.vaadin:vaadin-combo-box-flow:24.9.1 (managed) <-- com.vaadin:vaadin-combo-box-flow:24.9.1
[ERROR] +-org.springframework.data:spring-data-commons:3.4.5 (managed) <-- org.springframework.data:spring-data-commons:3.5.4
[ERROR] and
[ERROR] +-com.example:enforcer-bug:0
[ERROR] +-com.vaadin:vaadin-core:24.9.1
[ERROR] +-com.vaadin:vaadin-core-internal:24.9.1
[ERROR] +-com.vaadin:vaadin-core-components:24.9.1 (managed) <-- com.vaadin:vaadin-core-components:24.9.1
[ERROR] +-com.vaadin:vaadin-grid-flow:24.9.1 (managed) <-- com.vaadin:vaadin-grid-flow:24.9.1
[ERROR] +-org.springframework.data:spring-data-commons:3.4.5 (managed) <-- org.springframework.data:spring-data-commons:3.5.4
[ERROR] ]
```
(Note, you have to look carefully - the version mismatch is between `3.4.5` and `3.5.4`).
If you inspect `com.vaadin:vaadin-combo-box-flow:24.9.1` and `com.vaadin:vaadin-grid-flow:24.9.1` you will see that they both declare this dependency:
```xml
org.springframework.data
spring-data-commons
3.5.4
compile
```
Yet the error message seems to be complaining that they are actually depending on `3.4.5` instead of `3.5.4` when you look at the `+-` child relationships.
The dependency on `3.4.5` is coming from the parent and you can see it in the `help:effective-pom`. But this is not at all obvious from the error message. In the error message, the `3.4.5` dependency is seemingly coming from "nowhere".
A contributor to this problem is that [the website for RequireUpperBoundDeps](https://maven.apache.org/enforcer/enforcer-rules/requireUpperBoundDeps.html) does not explain how to interpret the error messages.
Would it be possible to explain this kind of conflict more clearly? Thanks.
Below is a POM that reproduces this situation when you run `mvn validate`.
```xml
4.0.0
org.springframework.boot
spring-boot-dependencies
3.4.5
com.example
enforcer-bug
Enforcer bug
0
war
3.6.1
24.9.1
com.vaadin
vaadin-core
com.vaadin
vaadin-bom
${vaadin.version}
pom
import
org.apache.maven.plugins
maven-enforcer-plugin
${maven-enforcer-plugin.version}
maven_enforcer
validate
enforce
com.fasterxml.jackson.core:jackson-core
com.fasterxml.jackson.core:jackson-databind
com.fasterxml.jackson.datatype:jackson-datatype-jsr310
com.google.guava:guava
commons-codec:commons-codec
io.netty:netty-all
io.projectreactor.netty:reactor-netty
org.apache.commons:commons-lang3
org.apache.commons:commons-text
org.jspecify:jspecify
org.slf4j:slf4j-api
```
Contributor guide
No contributing guide indexed for this repository
Research direction
Start with the supplied POM and run `mvn validate` to reproduce the RequireUpperBoundDeps output. Review the RequireUpperBoundDeps rule and its website documentation to determine how the conflicting managed and declared versions should be explained. Done means the conflict is understandable from the error message and the website explains how to interpret it.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java
- Domain
- build-system, documentation
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Active
- Clarity
- Mostly clear
- Newbie friendliness
- 52/100