jenkinsci / jenkinsci/plugin-pom

published incremental poms have dependencyManagement stripped causing incorrect dependency resolution

Open
#705 23 comments 0 reactions 1 assignee Claimed by @jtnord View on GitHub
Dominant language
Java
Stars
75
Forks
81
Avg merge
9m
Merged PRs (30d)
18

Description

### Jenkins and plugins versions report

Environment
ci.jenkins.io - N/A

A plugin that is using incrementals/CD publishing has its pom mangled by the `maven-flatten-plugin`

this flattening removes the `dependencyManagement` entries as can be seen between this [repository file](https://repo.jenkins-ci.org/releases/io/jenkins/plugins/okhttp-api/4.10.0-125.v3593b_a_f8c97b_/okhttp-api-4.10.0-125.v3593b_a_f8c97b_.pom) and this [published artifact](https://github.com/jenkinsci/okhttp-api-plugin/blob/4.10.0-125.v3593b_a_f8c97b_/pom.xml)

As the dependencies on kotlin are transitive they are not included in the flattened pom, but are included in the [hpi](https://repo.jenkins-ci.org/artifactory/releases/io/jenkins/plugins/okhttp-api/4.10.0-125.v3593b_a_f8c97b_/okhttp-api-4.10.0-125.v3593b_a_f8c97b_.hpi).

when the plugin is depended on by another plugin the result is the dependency manamgemtn is gone so you get the transitive version of the dependencies, not the version that the plugin was built with and bundled.

This not only causes errors for consumers - it also makes the behaviour of a build different in your IDE than when deployed - as in the IDE with workspace resolution the dependencies would be correct, but once released or in CI they would be different.


```text
Failed while enforcing RequireUpperBoundDeps. The error(s) are [
Require upper bound dependencies error for org.jetbrains.kotlin:kotlin-stdlib-jdk8:1.6.10 paths to dependency are:
+-org.jenkins-ci.plugins:github-api:1.303-999999-SNAPSHOT
ohttp-api-plugin ---> +-io.jenkins.plugins:okhttp-api:4.10.0-125.v3593b_a_f8c97b_
+-com.squareup.okhttp3:logging-interceptor:4.10.0
+-org.jetbrains.kotlin:kotlin-stdlib-jdk8:1.6.10
and
+-org.jenkins-ci.plugins:github-api:1.303-999999-SNAPSHOT
ohttp-api-plugin ---> +-io.jenkins.plugins:okhttp-api:4.10.0-125.v3593b_a_f8c97b_
+-com.squareup.okio:okio:3.3.0
+-com.squareup.okio:okio-jvm:3.3.0
+-org.jetbrains.kotlin:kotlin-stdlib-jdk8:1.8.0
]
```

https://github.com/jenkinsci/github-api-plugin/pull/200#pullrequestreview-1332512714

### What Operating System are you using (both controller, and any agents involved in the problem)?

N/A

### Reproduction steps

https://github.com/jenkinsci/github-api-plugin/pull/200#pullrequestreview-1332512714

### Expected Results

no enforcer error - `dependency:tree` would show the same versions of kotlin both in the okhttp-api plugin and in any other consumer of it that does not itself depend on kotlin

### Actual Results

`dependencyManagement` is stripped, downstream consumers get incorrect library versions.

### Anything else?

_No response_

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.