Dependency conflicts on org.springframework:spring-core, leading to inconsistent program behaviors

Hi, in **distributed-redis-tool-1.0.5**, there are mulptiple versions of library **org.springframework:spring-core**. However, according to Maven's dependency management strategy: **_"first declaration wins"_**, only **org.springframework:spring-core:4.2.1.RELEASE** can be loaded, and **org.springframework:spring-core:4.3.10.RELEASE** will be shadowed.

**In total, there are 21 conflicting API pairs between these two library version.**

As shown in the following figure, your project expects to invoke method **__** in library _**org.springframework:spring-core:4.3.10.RELEASE**_ (along the _original dependency path_). As it has been shadowed, this method defined in **_org.springframework:spring-core:4.2.1.RELEASE_** is actually forced to be referenced via the following invocation path (along the _actual dependency path_):

```
/home/wwww/sensor/unzip/distributed-redis-tool-1.0.5/target/classes
/home/wwww/sensor/unzip/distributed-redis-tool-1.0.5/target/classes
/home/wwww/.m2/repository/org/springframework/data/spring-data-redis/1.8.6.RELEASE/spring-data-redis-1.8.6.RELEASE.jar
()V> /home/wwww/.m2/repository/org/springframework/data/spring-data-redis/1.8.6.RELEASE/spring-data-redis-1.8.6.RELEASE.jar
()V> /home/wwww/.m2/repository/org/springframework/data/spring-data-redis/1.8.6.RELEASE/spring-data-redis-1.8.6.RELEASE.jar
/home/wwww/.m2/repository/org/springframework/data/spring-data-redis/1.8.6.RELEASE/spring-data-redis-1.8.6.RELEASE.jar
/home/wwww/.m2/repository/org/springframework/data/spring-data-redis/1.8.6.RELEASE/spring-data-redis-1.8.6.RELEASE.jar
/home/wwww/.m2/repository/org/springframework/data/spring-data-redis/1.8.6.RELEASE/spring-data-redis-1.8.6.RELEASE.jar
/home/wwww/.m2/repository/org/springframework/data/spring-data-redis/1.8.6.RELEASE/spring-data-redis-1.8.6.RELEASE.jar
/home/wwww/.m2/repository/org/springframework/data/spring-data-redis/1.8.6.RELEASE/spring-data-redis-1.8.6.RELEASE.jar
/home/wwww/.m2/repository/org/springframework/data/spring-data-redis/1.8.6.RELEASE/spring-data-redis-1.8.6.RELEASE.jar
/home/wwww/.m2/repository/org/springframework/data/spring-data-redis/1.8.6.RELEASE/spring-data-redis-1.8.6.RELEASE.jar
/home/wwww/.m2/repository/org/springframework/data/spring-data-redis/1.8.6.RELEASE/spring-data-redis-1.8.6.RELEASE.jar

```


Although both of these conflicting libraries contain the referenced methods (**_with the same signature_**), they have **_different implementations_**. This issue will not cause runtime crashes, but it can introduce inconsistent semantic program hehaviors----

Code snippet of **__** in _**org.springframework:spring-core:4.3.10.RELEASE**_ (shadowed but expected to invoke method):

detailed method body

```java
public String toString() {
return owner + '.' + name + desc + " (" + tag + (itf? " itf": "") + ')';
}
```

Code snippet of **__** in _**org.springframework:spring-core:4.2.1.RELEASE**_ (loaded version):

detailed method body

```java
public String toString() {
return owner + '.' + name + desc + " (" + tag + ')';
}
```

**The detailed informantion of the remaining 20 conflicting API pairs can be found in the following attachment.**
[21 conflicting API pairs in project distributed-redis-tool.txt](https://github.com/crossoverJie/distributed-redis-tool/files/5428410/21.conflicting.API.pairs.in.project.distributed-redis-tool.txt)

## **Dependency tree--**

[INFO] top.crossoverjie.opensource:distributed-redis-tool:jar:1.0.5
[INFO] +- redis.clients:jedis:jar:2.9.0:compile
[INFO] | \- org.apache.commons:commons-pool2:jar:2.4.2:compile
[INFO] +- org.springframework.data:spring-data-redis:jar:1.8.6.RELEASE:compile
[INFO] | +- org.springframework.data:spring-data-keyvalue:jar:1.2.6.RELEASE:compile
[INFO] | | +- org.springframework.data:spring-data-commons:jar:1.13.6.RELEASE:compile
[INFO] | | | +- **(org.springframework:spring-core:jar:4.3.10.RELEASE:compile - omitted for duplicate)**
[INFO] | | | +- (org.springframework:spring-beans:jar:4.3.10.RELEASE:compile - omitted for duplicate)
[INFO] | | | +- (org.slf4j:slf4j-api:jar:1.7.25:compile - omitted for duplicate)
[INFO] | | | \- (org.slf4j:jcl-over-slf4j:jar:1.7.25:runtime - omitted for duplicate)
[INFO] | | +- (org.springframework:spring-context:jar:4.3.10.RELEASE:compile - omitted for conflict with 4.2.1.RELEASE)
[INFO] | | +- (org.springframework:spring-tx:jar:4.3.10.RELEASE:compile - omitted for duplicate)
[INFO] | | +- (org.slf4j:slf4j-api:jar:1.7.25:compile - omitted for duplicate)
[INFO] | | \- (org.slf4j:jcl-over-slf4j:jar:1.7.25:runtime - omitted for duplicate)
[INFO] | +- org.springframework:spring-tx:jar:4.3.10.RELEASE:compile
[INFO] | | +- (org.springframework:spring-beans:jar:4.3.10.RELEASE:compile - omitted for conflict with 4.2.1.RELEASE)
[INFO] | | \- **(org.springframework:spring-core:jar:4.3.10.RELEASE:compile - omitted for conflict with 4.2.1.RELEASE)**
[INFO] | +- org.springframework:spring-oxm:jar:4.3.10.RELEASE:compile
[INFO] | | +- (org.springframework:spring-beans:jar:4.3.10.RELEASE:compile - omitted for duplicate)
[INFO] | | \- **(org.springframework:spring-core:jar:4.3.10.RELEASE:compile - omitted for duplicate)**
[INFO] | +- (org.springframework:spring-aop:jar:4.3.10.RELEASE:compile - omitted for conflict with 4.2.1.RELEASE)
[INFO] | +- (org.springframework:spring-context-support:jar:4.3.10.RELEASE:compile - omitted for conflict with 4.2.1.RELEASE)
[INFO] | +- (org.slf4j:slf4j-api:jar:1.7.25:compile - omitted for conflict with 1.7.7)
[INFO] | \- org.slf4j:jcl-over-slf4j:jar:1.7.25:runtime
[INFO] | \- (org.slf4j:slf4j-api:jar:1.7.25:runtime - omitted for duplicate)
[INFO] +- junit:junit:jar:4.8.2:test
[INFO] +- org.mockito:mockito-all:jar:1.9.5:test
[INFO] +- org.easymock:easymock:jar:3.2:test
[INFO] | \- org.objenesis:objenesis:jar:1.3:test
[INFO] +- com.google.guava:guava:jar:19.0:compile
[INFO] +- org.slf4j:slf4j-api:jar:1.7.7:compile
[INFO] +- ch.qos.logback:logback-core:jar:1.0.13:compile
[INFO] +- ch.qos.logback:logback-classic:jar:1.0.13:compile
[INFO] | +- (ch.qos.logback:logback-core:jar:1.0.13:compile - omitted for duplicate)
[INFO] | \- (org.slf4j:slf4j-api:jar:1.7.5:compile - omitted for conflict with 1.7.7)
[INFO] +- org.springframework:spring-aop:jar:4.2.1.RELEASE:compile
[INFO] | +- aopalliance:aopalliance:jar:1.0:compile
[INFO] | +- (org.springframework:spring-beans:jar:4.2.1.RELEASE:compile - omitted for duplicate)
[INFO] | \- (org.springframework:spring-core:jar:4.2.1.RELEASE:compile - omitted for duplicate)
[INFO] +- org.springframework:spring-aspects:jar:4.2.1.RELEASE:compile
[INFO] | \- org.aspectj:aspectjweaver:jar:1.8.6:compile
[INFO] +- org.springframework:spring-beans:jar:4.2.1.RELEASE:compile
[INFO] | \- (org.springframework:spring-core:jar:4.2.1.RELEASE:compile - omitted for duplicate)
[INFO] +- org.springframework:spring-context:jar:4.2.1.RELEASE:compile
[INFO] | +- (org.springframework:spring-aop:jar:4.2.1.RELEASE:compile - omitted for duplicate)
[INFO] | +- (org.springframework:spring-beans:jar:4.2.1.RELEASE:compile - omitted for duplicate)
[INFO] | +- (org.springframework:spring-core:jar:4.2.1.RELEASE:compile - omitted for duplicate)
[INFO] | \- org.springframework:spring-expression:jar:4.2.1.RELEASE:compile
[INFO] | \- (org.springframework:spring-core:jar:4.2.1.RELEASE:compile - omitted for duplicate)
[INFO] +- org.springframework:spring-context-support:jar:4.2.1.RELEASE:compile
[INFO] | +- (org.springframework:spring-beans:jar:4.2.1.RELEASE:compile - omitted for duplicate)
[INFO] | +- (org.springframework:spring-context:jar:4.2.1.RELEASE:compile - omitted for duplicate)
[INFO] | \- (org.springframework:spring-core:jar:4.2.1.RELEASE:compile - omitted for duplicate)
[INFO] +- **org.springframework:spring-core:jar:4.2.1.RELEASE:compile**
[INFO] | \- commons-logging:commons-logging:jar:1.2:compile
[INFO] +- org.springframework:spring-web:jar:4.2.1.RELEASE:compile
[INFO] | +- (org.springframework:spring-aop:jar:4.2.1.RELEASE:compile - omitted for duplicate)
[INFO] | +- (org.springframework:spring-beans:jar:4.2.1.RELEASE:compile - omitted for duplicate)
[INFO] | +- (org.springframework:spring-context:jar:4.2.1.RELEASE:compile - omitted for duplicate)
[INFO] | \- (org.springframework:spring-core:jar:4.2.1.RELEASE:compile - omitted for duplicate)
[INFO] +- org.springframework:spring-webmvc:jar:4.2.1.RELEASE:compile
[INFO] | +- (org.springframework:spring-beans:jar:4.2.1.RELEASE:compile - omitted for duplicate)
[INFO] | +- (org.springframework:spring-context:jar:4.2.1.RELEASE:compile - omitted for duplicate)
[INFO] | +- (org.springframework:spring-core:jar:4.2.1.RELEASE:compile - omitted for duplicate)
[INFO] | +- (org.springframework:spring-expression:jar:4.2.1.RELEASE:compile - omitted for duplicate)
[INFO] | \- (org.springframework:spring-web:jar:4.2.1.RELEASE:compile - omitted for duplicate)
[INFO] \- javax.servlet:servlet-api:jar:2.5:provided

## Suggested solutions:

**Solution:** Update direct dependency org.springframework:spring-core from 4.2.1.RELEASE to 4.3.10.RELEASE.

Thanks.
Best regards,
Coco

Start by inspecting the Maven dependency declarations for org.springframework:spring-core and compare them with the dependency tree shown in the issue. Done means the direct dependency no longer causes the 4.2.1.RELEASE version to shadow 4.3.10.RELEASE; verify the resolved dependency tree and the affected Redis code path.

Written by the indexing model from the issue text.