[MNG-6607] Transitive dependencies brought by provided scope and compile scope are computed as compile scope

**[Donatello](https://issues.apache.org/jira/secure/ViewProfile.jspa?name=donatello)** opened **[MNG-6607](https://issues.apache.org/jira/browse/MNG-6607?redirect=false)** and commented

We face an issue when a same +artifact-X+ is transitively brought by a +dependency-1+
with **provided** scope, and another +dependency-2+ with **default (compile)** scope.
This +artifact-X+ will be computed as **compile** scope, while we expect it to be explicitly provided by +dependency-1+.

For example, +dependency-1+ pom contains:

```xml

org.apache.commons
commons-lang3
3.7


org.apache.commons
commons-collections4
4.1

```

+dependency-2+ pom contains:

```xml

org.apache.commons
commons-lang3
3.8

```

Assembly project pom contains:

```xml



com.company
module-1
1.0
provided

com.company
module-2
1.0


```

But a _mvn dependency:tree_ on assembly project will output:

```
[INFO] --- maven-dependency-plugin:3.1.0:tree (show-app-dependencies) @ module-3 ---
[INFO] com.company:module-3:pom:1.0
[INFO] +- com.company:module-1:jar:1.0:provided
[INFO] | +- org.apache.commons:commons-lang3:jar:3.7:compile
[INFO] | \- org.apache.commons:commons-collections4:jar:4.1:provided
[INFO] \- com.company:module-2:jar:1.0:compile
```

And we can see the artifact +commons-lang3:jar:3.7+ which come from +dependency-1+ is now at **compile** scope. Note that we don't use any dependency management here (see simple reproducer project in attachment).

This is confusing, and leads to duplicate libraries in runtime classpath when +dependency-1+ is effectively provided in classpath of +dependency-2+ runtime (for example by an application server).

Moreover, based on Maven documentation about dependency mediation/scope, the transitive dependencies that are provided should be always **ommited**.

http://maven.apache.org/guides/introduction/introduction-to-dependency-mechanism.html#Dependency_Scope

Then, how to package ONLY the libraries defined as compile/runtime (and ignore all the provided ones, and their transitives) ??

---

**Affects:** 3.3.9, 3.5.0, 3.6.0

**Attachments:**
- [test-dependencies-project.zip](https://issues.apache.org/jira/secure/attachment/12962367/test-dependencies-project.zip) (_4.12 kB_)

1 votes, 4 watchers

Start with the attached test-dependencies-project.zip and run the shown dependency:tree command to reproduce the scope calculation. Read Maven's dependency mediation and dependency-scope documentation, then trace the dependency-resolution path responsible for the transitive commons-lang3 scope. Done means the provided dependency's transitives are omitted or retain the expected provided treatment without introducing duplicate runtime libraries.

Written by the indexing model from the issue text.