apache / apache/maven-shade-plugin

[MSHADE-202] When promoteTransitiveDependencies=true, some <exclusions> are stripped from the dependency-reduced-pom

Open
#573 3 comments 0 reactions 0 assignees View on GitHub
bug priority:major
Dominant language
Java
Stars
188
Forks
103
Avg merge
16h 39m
Merged PRs (30d)
4

Description

**[Andrey Stepaonv](https://issues.apache.org/jira/secure/ViewProfile.jspa?name=drutech)** opened **[MSHADE-202](https://issues.apache.org/jira/browse/MSHADE-202?redirect=false)** and commented

I have 2 modules. First module uses this dependencies:

```xml

ch.imvs
sdes4j
1.1.3


commons-codec
commons-codec

commons-codec
commons-codec
1.10

```

and second module uses first module and maven-shade plugin with execution:

```xml

shade-for-obfuscate
package

shade



${project.groupId}:firstModule


true
${basedir}/target/dependency-reduced-pom.xml

```

As a result i have reduced pom with dependencies:

```xml

ch.imvs
sdes4j
1.1.3
compile

commons-codec
commons-codec
1.10
compile

```

But i had to get dependency with \

---

**Affects:** 2.4.1

**Issue Links:**
- [MSHARED-852](https://issues.apache.org/jira/browse/MSHARED-852) Add Exclusions to DependencyNode
(_**"depends upon"**_)

1 votes, 3 watchers

Contributor guide

No contributing guide indexed for this repository

Research direction

Start with the maven-shade plugin's promoteTransitiveDependencies handling and reproduce the issue using the two-module configuration and dependency-reduced-pom.xml described in the report. Trace how dependency exclusions are represented while transitive dependencies are promoted; done means the reduced POM retains the commons-codec exclusion from sdes4j.

Written by the indexing model from the issue text.

Assessment

Tech stack
java
Domain
build-system
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.