[MDEP-644] Reintroduce the verbose option for dependency:tree

[jira-importer]

John Lin opened MDEP-644 and commented

The verbose option for dependency:tree is removed in maven-dependency-plugin 3.0. This issue is to reintroduce the option.

In verbose mode the dependency tree shows dependencies that were omitted for: being a duplicate of another; conflicting with another's version and/or scope; and introducing a cycle into the dependency tree.

---

Issue Links:

• MDEP-709 Adding maven-resolver-api to dependency plugin breaks tests
  ("is blocked by")

• MDEP-639 Not showing omitted dependencies when running dependency:tree verbose
  ("is duplicated by")

• MDEP-662 Re-Add Dependency Tree Verbose
  ("is duplicated by")

• MDEP-721 Document verbose option

• MSHARED-339 DependencyGraphBuilder does not provide verbose tree

• MDEP-761 Tree plugin does not terminate with 3.2.0

Remote Links:

• GitHub Pull Request #54
  
• GitHub Pull Request #92
  
• GitHub Pull Request #94
  
• GitHub Pull Request #95
  
• GitHub Pull Request #96
  
• GitHub Pull Request #97
  

7 votes, 20 watchers

[jira-importer]

Robert Scholte commented

Does this mean you're going to implement it? The verbose option had to be removed to make the code Maven3 compatible, the cause is quite deep in the codebase.

[jira-importer]

John Lin commented

Hi Robert,

Yes, I would like to implement it. Is there any relevant material you suggest to read? Thank you.

[jira-importer]

Olof Larsson commented

Thank you for linking my ticket (https://issues.apache.org/jira/browse/MDEP-662) as a duplicate Robert Scholte.

I'll move the bounty over to this ticket instead.

Ticket Bounty: 300USD (will send via PayPal to address of authors choice upon feature re-addition with proper Maven 3 support)

[jira-importer]

Olof Larsson commented

I see it's been half a year since I last posted. The 300USD ticket bounty is still available. Any interested developers out there that would be willing to pick this ticket up :)?

[jira-importer]

Ian Lavallee commented

Olof Larsson I'm working on it. It's my first significant ticket so it may take me a while but hopefully I can get it done.

[jira-importer]

Ian Lavallee commented

This repo contains a maven project that introduces a limited functionality verboseTree plugin with the updated APIs. I'm having a lot of difficulty with integrating the changes in the current dependency-plugin as adding the maven-resolver-api breaks tests. I am still working on the issue but if I am not able to get it into the actual plugin hopefully when the dependency-plugin is on 3.1 someone can use this. 

[jira-importer]

Olof Larsson commented

I'm looking forward to test this (with the bounty in mind). It does not seem available quite yet https://maven.apache.org/plugins/maven-dependency-plugin/? Looking at the plugin website says the latest version is 3.1.2, and the feature is reintroduced in 3.2.0, right?

 

[jira-importer]

Elliotte Rusty Harold commented

Correct. It's checked in at HEAD, but a release hasn't been cut.

[jira-importer]

Ian Lavallee commented

I'm interested to hear your feedback Olof but don't worry about the money. I did this work as part of a paid internship so you can keep the bounty.

[jira-importer]

Olof Larsson commented

Ian Lavallee, okay great! Then I'll happily keep my money. Thanks :).

So how can I help out testing this? How do I go about running it locally? Is there an easy way to do so, or must I build it locally myself?

[jira-importer]

Ken Warkentyne commented

Any idea when the release with the new verbose mode will be published? Just wondering...

[jira-importer]

Andy Feldman commented

There seems to be an issue with the version of this feature in HEAD, at least for some people. If you intend to use it, I recommend checking out HEAD to try it now. It's not hard to try it: just git clone https://gitbox.apache.org/repos/asf/maven-dependency-plugin.git, run mvn install from that directory, and then set your repo's maven-dependency-plugin version to the snapshot version that you just installed.

There was some discussion of the issue on the Maven users list earlier this month: https://lists.apache.org/thread.html/rc9464fe4f817897384777fd6bd79f6d8fb1805e7c02b062a0d525de3%40%3Cusers.maven.apache.org%3E

[jira-importer]

Ken Warkentyne commented

Thanks for the info. I built the 3.1.3 release tag and HEAD. Both versions seemed to get stuck and never printed the dependency tree. 

[jira-importer]

Steve Springett commented

Is it my understanding this issue was resolved over a year ago and we're still waiting for a release that includes the fix?

FYI, this has been identified as an issue with the OWASP CycloneDX Maven plugin, which produces Software Bill of Materials (SBOM). With the recent Executive Order from the Whitehouse requiring SBOMs, many people are looking to CycloneDX to fulfill that requirement. Not being able to produce an accurate dependency-graph in the SBOM is an issue for Maven users at the moment. Is there anything the OWASP community can do to move this forward?

CycloneDX/cyclonedx-maven-plugin#116

[jira-importer]

Elliotte Rusty Harold commented

Absolutely. You can hire/contract with a PMC member (I'm not one) to
release the new version. You can scan the archives to see who's
released other plugins lately. Absent money on the table, you're
waiting until someone with the right privileges feels like this is an
itch they need to scratch.

--
Elliotte Rusty Harold
elharo@ibiblio.org