Dependency convergence error on log4j-core-test

[Edhilion]

Description

When I try to build my project using log4j-core-test via maven, the following error is displayed :

[ERROR] Rule 0: org.apache.maven.enforcer.rules.dependency.DependencyConvergence failed with message:
[ERROR] Failed while enforcing releasability.
[ERROR] 
[ERROR] Dependency convergence error for org.hamcrest:hamcrest:jar:2.1 paths to dependency are:
[ERROR] +-com.me.mypackage:myapp:jar:2.0.1-SNAPSHOT
[ERROR]   +-org.apache.logging.log4j:log4j-core-test:jar:2.21.1:compile
[ERROR]     +-org.awaitility:awaitility:jar:4.2.0:compile
[ERROR]       +-org.hamcrest:hamcrest:jar:2.1:compile
[ERROR] and
[ERROR] +-com.me.mypackage:myapp:jar:2.0.1-SNAPSHOT
[ERROR]   +-org.apache.logging.log4j:log4j-core-test:jar:2.21.1:compile
[ERROR]     +-org.hamcrest:hamcrest:jar:2.2:compile

And I must keep a strict dependency rule.
I know I can simply force hamcrest to 2.2 in my pom.xml, or exclude it from the file, but I don't want to do it to solve a dependency problem that is not on my side.

Please can you fix it on your side, or better, get rid of awaitility, which hasn't been updated since 2022 ?

Configuration

Version: 2.21.1

Operating system: Ubuntu 20.04.6 LTS

JDK: openjdk 11.0.20.1 2023-08-24

Logs

After a simple mvn clean install command.

[ERROR] Rule 0: org.apache.maven.enforcer.rules.dependency.DependencyConvergence failed with message:
[ERROR] Failed while enforcing releasability.
[ERROR] 
[ERROR] Dependency convergence error for org.hamcrest:hamcrest:jar:2.1 paths to dependency are:
[ERROR] +-com.me.mypackage:myapp:jar:2.0.1-SNAPSHOT
[ERROR]   +-org.apache.logging.log4j:log4j-core-test:jar:2.21.1:compile
[ERROR]     +-org.awaitility:awaitility:jar:4.2.0:compile
[ERROR]       +-org.hamcrest:hamcrest:jar:2.1:compile
[ERROR] and
[ERROR] +-com.me.mypackage:myapp:jar:2.0.1-SNAPSHOT
[ERROR]   +-org.apache.logging.log4j:log4j-core-test:jar:2.21.1:compile
[ERROR]     +-org.hamcrest:hamcrest:jar:2.2:compile

Reproduction

mvn clean install on any project with strict dependency Maven Enforcer Plugin (https://maven.apache.org/enforcer/enforcer-rules/dependencyConvergence.html).

Let me know if you need a full live project to reproduce.

Cheers.

[ppkarwasz]

Hi @Edhilion,

As already explained in #1494, I believe that dependency convergence is a myth. The only way to achieve it would be for a tool like Dependabot to consider dependency convergence when suggesting upgrades.

The version of org.hamcrest:hamcrest in our artifacts is not divergent: the parent POM of all Log4j artifacts (org.apache.logging.log4j:log4j) manages 300+ artifact versions and org.hamcrest:hamcrest is amongst them. From our perspective the <dependencyConvergence> rule passes.

However, when you consume log4j-core-test in your own application, you don't consume its dependency management section. That is why the versions of org.hamcrest:hamcrest do not converge in your project. In order to achieve convergence you would need to import org.apache.logging.log4j:log4j into your dependency management (I would advise against that) or simply add org.hamcrest:hamcrest to the dependency management.

TL;DR: there is nothing we can do on our part to prevent org.hamcrest:hamcrest versions to diverge in your project.

Please can you fix it on your side, or better, get rid of awaitility, which hasn't been updated since 2022 ?

If a project does not make a release each year, it doesn't mean it is dead. Hamcrest for example had its latest release in 2019.

[ppkarwasz]

I am closing this issue as duplicate. Feel free to reopen it or to submit a PR if you think otherwise.