apache / apache/maven

[MNG-8187] Same transitive dependency 2x one with exclusion one without - exclusion wins

Open
#10,452 2 comments 0 reactions 0 assignees View on GitHub
bug priority:major
Dominant language
Java
Stars
5.3k
Forks
3.1k
Avg merge
20h 42m
Merged PRs (30d)
297

Description

**[Jeff Thomas](https://issues.apache.org/jira/secure/ViewProfile.jspa?name=jwt007)** opened **[MNG-8187](https://issues.apache.org/jira/browse/MNG-8187?redirect=false)** and commented

Hi Maven Team,

I don't know if this is a strange behavior or works-as-designed but here is what I observed today.

I have two libraries with transitive dependencies on 'com.opencsv:opencsv:5.9.0'.

One of those two libraries is 'org.liquibase:liquibase-core:4.28.0' which excludes 'commons-beanutils'.

```java

    com.opencsv
    opencsv
    5.9
    compile
   
       
            commons-beanutils
            commons-beanutils
       
   

```

The other library is our own and has a dependency on opencsv **without** an exclusion on 'commons-beanutils'.

Suddenly the maven dependency resolution started giving precedence to the liquibase-core dependency and the exclusion prevented commons-beanutils from being added to our WAR - which of course resulted in a ClassNotFoundException.

(If I do a 'mvn dependency:tree' I see opencsv is being hung under liquibase-core without the commons-beanutils sub-dependency)

I sort of expected, that if opencsv is in the dependency-tree in two locations and one excludes the dependency on commons-beanutils but the other does not, Maven would say "Hmmm... one of them still needs it so I had better include it!".

Am I wrong? :) 

---

**Affects:** 3.9.8

Contributor guide

Open the contributing guide

Research direction

The issue names Maven 3.9.8 and the mvn dependency:tree command, but no source file or test. Start by reproducing the two opencsv dependency paths and compare how the exclusion is resolved; done means the intended behavior is established and covered by an appropriate regression test or design decision.

Written by the indexing model from the issue text.

Assessment

Tech stack
java
Domain
build-system
Issue type
Bug
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.