Dependency Conflict in upgrading to Maven 3.6.1

[suztomo]

Upgrading maven-core to 3.6.1 failed with following runtime erorors (#802 802):

[INFO] -------------------------------------------------------
[INFO]  T E S T S
[INFO] -------------------------------------------------------
[INFO] Running com.google.cloud.tools.dependencies.enforcer.LinkageCheckerRuleTest
SLF4J: Failed to load class "org.slf4j.impl.StaticLoggerBinder".
SLF4J: Defaulting to no-operation (NOP) logger implementation
SLF4J: See http://www.slf4j.org/codes.html#StaticLoggerBinder for further details.
[ERROR] Tests run: 12, Failures: 0, Errors: 8, Skipped: 0, Time elapsed: 2.023 s <<< FAILURE! - in com.google.cloud.tools.dependencies.enforcer.LinkageCheckerRuleTest
[ERROR] testExecute_shouldPassGoodBom(com.google.cloud.tools.dependencies.enforcer.LinkageCheckerRuleTest)  Time elapsed: 1.699 s  <<< ERROR!
java.lang.NoClassDefFoundError: org/codehaus/plexus/util/xml/Xpp3DomBuilder$InputLocationBuilder
	at com.google.cloud.tools.dependencies.enforcer.LinkageCheckerRuleTest.testExecute_shouldPassGoodBom(LinkageCheckerRuleTest.java:293)
Caused by: java.lang.ClassNotFoundException: org.codehaus.plexus.util.xml.Xpp3DomBuilder$InputLocationBuilder
	at com.google.cloud.tools.dependencies.enforcer.LinkageCheckerRuleTest.testExecute_shouldPassGoodBom(LinkageCheckerRuleTest.java:293)

org.codehaus.plexus:plexus-utils:3.1.0 has org.codehaus.plexus.util.xml.Xpp3DomBuilder without InputLocationBuilder.

org.codehaus.plexus:plexus-utils:3.2.0 has Xpp3DomBuilder.InputLocationBuilder. It's used by maven-compat

[INFO] --- maven-dependency-plugin:2.8:tree (default-cli) @ linkage-checker-enforcer-rules ---
[INFO] com.google.cloud.tools:linkage-checker-enforcer-rules:jar:0.2.4-SNAPSHOT
[INFO] +- com.google.cloud.tools:dependencies:jar:0.2.4-SNAPSHOT:compile
[INFO] |  +- org.apache.bcel:bcel:jar:6.3.1:compile
[INFO] |  +- (org.apache.maven:maven-core:jar:3.6.0:compile - version managed from 3.0; omitted for duplicate)
[INFO] |  +- org.apache.maven:maven-compat:jar:3.6.1:compile
[INFO] |  |  +- (org.apache.maven:maven-model:jar:3.6.1:compile - omitted for conflict with 3.6.0)
[INFO] |  |  +- (org.apache.maven:maven-model-builder:jar:3.6.1:compile - omitted for conflict with 3.6.0)
[INFO] |  |  +- (org.apache.maven:maven-settings:jar:3.6.1:compile - omitted for conflict with 3.6.0)
[INFO] |  |  +- (org.apache.maven:maven-settings-builder:jar:3.6.1:compile - omitted for conflict with 3.6.0)
[INFO] |  |  +- (org.apache.maven:maven-artifact:jar:3.6.1:compile - omitted for conflict with 3.0)
[INFO] |  |  +- (org.apache.maven:maven-core:jar:3.6.0:compile - version managed from 3.6.1; omitted for duplicate)
[INFO] |  |  +- (org.apache.maven:maven-resolver-provider:jar:3.6.0:compile - version managed from 3.6.1; omitted for duplicate)
[INFO] |  |  +- (org.apache.maven:maven-repository-metadata:jar:3.6.1:compile - omitted for conflict with 3.6.0)
[INFO] |  |  +- (org.apache.maven.resolver:maven-resolver-api:jar:1.4.0:compile - version managed from 1.3.3; omitted for duplicate)
[INFO] |  |  +- (org.apache.maven.resolver:maven-resolver-util:jar:1.3.3:compile - omitted for conflict with 1.3.1)
[INFO] |  |  +- (org.apache.maven.resolver:maven-resolver-impl:jar:1.3.3:compile - omitted for conflict with 1.3.1)
[INFO] |  |  +- (org.codehaus.plexus:plexus-utils:jar:3.2.0:compile - omitted for conflict with 3.1.0)
[INFO] |  |  +- org.codehaus.plexus:plexus-interpolation:jar:1.25:compile
[INFO] |  |  +- (org.eclipse.sisu:org.eclipse.sisu.plexus:jar:0.3.3:compile - omitted for duplicate)
[INFO] |  |  +- (org.codehaus.plexus:plexus-component-annotations:jar:1.7.1:compile - omitted for duplicate)
[INFO] |  |  \- org.apache.maven.wagon:wagon-provider-api:jar:3.3.2:compile
[INFO] |  |     \- (org.codehaus.plexus:plexus-utils:jar:3.1.0:compile - omitted for duplicate)
...

[elharo]

It's hard to see this as a bug when it only exists if we make a modification to the code we haven't made yet.

[elharo]

This is the part that looks off. If I read this right com.google.cloud.tools:dependencies:jar:0.2.4-SNAPSHOT has direct dependencies on org.apache.maven:maven-core:jar:3.6.0 and org.apache.maven:maven-compat:jar:3.6.1. I expect the versions of these to match.

[INFO] +- com.google.cloud.tools:dependencies:jar:0.2.4-SNAPSHOT:compile
[INFO] |  +- org.apache.bcel:bcel:jar:6.3.1:compile
[INFO] |  +- (org.apache.maven:maven-core:jar:3.6.0:compile - version managed from 3.0; omitted for duplicate)
[INFO] |  +- org.apache.maven:maven-compat:jar:3.6.1:compile

[suztomo]

The maven-core's version under com.google.cloud.tools:dependencies:jar:0.2.4-SNAPSHOT is 6.3.1 in 6bf73a6 when I ran mvn dependency:tree -Dverbose=true at project root:

[INFO] --- maven-dependency-plugin:2.8:tree (default-cli) @ linkage-checker-enforcer-rules ---
[INFO] com.google.cloud.tools:linkage-checker-enforcer-rules:jar:0.2.4-SNAPSHOT
[INFO] +- com.google.cloud.tools:dependencies:jar:0.2.4-SNAPSHOT:compile
[INFO] |  +- org.apache.bcel:bcel:jar:6.3.1:compile
[INFO] |  +- (org.apache.maven:maven-core:jar:3.6.1:compile - version managed from 3.0; omitted for duplicate)
[INFO] |  +- org.apache.maven:maven-compat:jar:3.6.1:compile

from gist

How did you get the output containing "3.6.0" in the dependency tree?

[suztomo]

The problem would be fixed by #802 but the root cause seems deeper than I thought.

• Missing class org.codehaus.plexus.util.xml.Xpp3DomBuilder$InputLocationBuilder
• mvn dependency:tree shows plexus-util 3.2.0, which contains the class (gist)
• When checked with the enforcer rule, it also tells the class is missing, because it picks up plexus-util 3.1.0

  Class org.codehaus.plexus.util.xml.Xpp3DomBuilder$InputLocationBuilder is not found;
  referenced by 1 class file
    org.apache.maven.model.io.xpp3.MavenXpp3ReaderEx (maven-model-3.6.1.jar)
  

  

Why didn't maven or surefire plugin was not able to build a class path containing Xpp3DomBuilder$InputLocationBuilder?

Enforcer-rule contains plexus-util 3.1.0 dependency: