jenkinsci / jenkinsci/plugin-pom
published incremental poms have dependencyManagement stripped causing incorrect dependency resolution
- Dominant language
- Java
- Stars
- 75
- Forks
- 81
- Avg merge
- 9m
- Merged PRs (30d)
- 18
Description
### Jenkins and plugins versions report
Environment
ci.jenkins.io - N/A
A plugin that is using incrementals/CD publishing has its pom mangled by the `maven-flatten-plugin`
this flattening removes the `dependencyManagement` entries as can be seen between this [repository file](https://repo.jenkins-ci.org/releases/io/jenkins/plugins/okhttp-api/4.10.0-125.v3593b_a_f8c97b_/okhttp-api-4.10.0-125.v3593b_a_f8c97b_.pom) and this [published artifact](https://github.com/jenkinsci/okhttp-api-plugin/blob/4.10.0-125.v3593b_a_f8c97b_/pom.xml)
As the dependencies on kotlin are transitive they are not included in the flattened pom, but are included in the [hpi](https://repo.jenkins-ci.org/artifactory/releases/io/jenkins/plugins/okhttp-api/4.10.0-125.v3593b_a_f8c97b_/okhttp-api-4.10.0-125.v3593b_a_f8c97b_.hpi).
when the plugin is depended on by another plugin the result is the dependency manamgemtn is gone so you get the transitive version of the dependencies, not the version that the plugin was built with and bundled.
This not only causes errors for consumers - it also makes the behaviour of a build different in your IDE than when deployed - as in the IDE with workspace resolution the dependencies would be correct, but once released or in CI they would be different.
```text
Failed while enforcing RequireUpperBoundDeps. The error(s) are [
Require upper bound dependencies error for org.jetbrains.kotlin:kotlin-stdlib-jdk8:1.6.10 paths to dependency are:
+-org.jenkins-ci.plugins:github-api:1.303-999999-SNAPSHOT
ohttp-api-plugin ---> +-io.jenkins.plugins:okhttp-api:4.10.0-125.v3593b_a_f8c97b_
+-com.squareup.okhttp3:logging-interceptor:4.10.0
+-org.jetbrains.kotlin:kotlin-stdlib-jdk8:1.6.10
and
+-org.jenkins-ci.plugins:github-api:1.303-999999-SNAPSHOT
ohttp-api-plugin ---> +-io.jenkins.plugins:okhttp-api:4.10.0-125.v3593b_a_f8c97b_
+-com.squareup.okio:okio:3.3.0
+-com.squareup.okio:okio-jvm:3.3.0
+-org.jetbrains.kotlin:kotlin-stdlib-jdk8:1.8.0
]
```
https://github.com/jenkinsci/github-api-plugin/pull/200#pullrequestreview-1332512714
### What Operating System are you using (both controller, and any agents involved in the problem)?
N/A
### Reproduction steps
https://github.com/jenkinsci/github-api-plugin/pull/200#pullrequestreview-1332512714
### Expected Results
no enforcer error - `dependency:tree` would show the same versions of kotlin both in the okhttp-api plugin and in any other consumer of it that does not itself depend on kotlin
### Actual Results
`dependencyManagement` is stripped, downstream consumers get incorrect library versions.
### Anything else?
_No response_
Contributor guide
Assessment
This issue has not been assessed yet.