[MDEP-507] dependency:resolve-plugins and dependency:go-offline doesn't respect plugin dependencies from pom.xml

[jira-importer]

Marek Hudik opened MDEP-507 and commented

When I override plugin dependecies in pom.xml then dependency:resolve-plugins and dependency:go-offline displays wrong dependencies.

This example shows selenium version 2.21.0 instead of 2.47.1. The only way to check what is used is to delete local maven repo, execute the target and see what dependencies were downloaded.

pom.xml

<plugin>
    <groupId>org.codehaus.mojo</groupId>
    <artifactId>selenium-maven-plugin</artifactId>
    <version>2.3</version>
    <dependencies>
        <dependency>
            <groupId>org.seleniumhq.selenium</groupId>
            <artifactId>selenium-server</artifactId>
            <version>2.47.1</version>
        </dependency>
        <dependency>
            <groupId>org.seleniumhq.selenium</groupId>
            <artifactId>selenium-remote-driver</artifactId>
            <version>2.47.1</version>
        </dependency>
        <dependency>
            <groupId>org.seleniumhq.selenium</groupId>
            <artifactId>selenium-api</artifactId>
            <version>2.47.1</version>
        </dependency>
    </dependencies>

mvn dependency:resolve-plugins

[INFO] Plugin Resolved: selenium-maven-plugin-2.3.jar
[INFO]     Plugin Dependency Resolved: gmaven-mojo-1.3.jar
[INFO]     Plugin Dependency Resolved: gmaven-mojo-support-1.3.jar
[INFO]     Plugin Dependency Resolved: groovy-all-1.7.5.jar
[INFO]     Plugin Dependency Resolved: selenium-server-2.21.0.jar
[INFO]     Plugin Dependency Resolved: selenium-remote-driver-2.21.0.jar
[INFO]     Plugin Dependency Resolved: selenium-api-2.21.0.jar
[INFO]     Plugin Dependency Resolved: selenium-remote-control-2.0rc2.jar
[INFO]     Plugin Dependency Resolved: bcprov-jdk15-140.jar
[INFO]     Plugin Dependency Resolved: guava-10.0.1.jar
[INFO]     Plugin Dependency Resolved: commons-exec-1.1.jar
[INFO]     Plugin Dependency Resolved: commons-logging-1.1.1.jar
[INFO]     Plugin Dependency Resolved: selenium-java-client-driver-1.0.2.jar
[INFO]     Plugin Dependency Resolved: servlet-api-2.4.jar
[INFO]     Plugin Dependency Resolved: commons-lang-2.4.jar
[INFO]     Plugin Dependency Resolved: commons-codec-1.5.jar
[INFO]     Plugin Dependency Resolved: log4j-1.2.14.jar

mvn dependency:go-offline

[INFO] Plugin Resolved: selenium-maven-plugin-2.3.jar
[INFO]     Plugin Dependency Resolved: gmaven-mojo-1.3.jar
[INFO]     Plugin Dependency Resolved: gmaven-mojo-support-1.3.jar
[INFO]     Plugin Dependency Resolved: groovy-all-1.7.5.jar
[INFO]     Plugin Dependency Resolved: selenium-server-2.21.0.jar
[INFO]     Plugin Dependency Resolved: selenium-remote-driver-2.21.0.jar
[INFO]     Plugin Dependency Resolved: selenium-api-2.21.0.jar
[INFO]     Plugin Dependency Resolved: selenium-remote-control-2.0rc2.jar
[INFO]     Plugin Dependency Resolved: bcprov-jdk15-140.jar
[INFO]     Plugin Dependency Resolved: guava-10.0.1.jar
[INFO]     Plugin Dependency Resolved: commons-exec-1.1.jar
[INFO]     Plugin Dependency Resolved: commons-logging-1.1.1.jar
[INFO]     Plugin Dependency Resolved: selenium-java-client-driver-1.0.2.jar
[INFO]     Plugin Dependency Resolved: servlet-api-2.4.jar
[INFO]     Plugin Dependency Resolved: commons-lang-2.4.jar
[INFO]     Plugin Dependency Resolved: commons-codec-1.5.jar
[INFO]     Plugin Dependency Resolved: log4j-1.2.14.jar

---

Affects: 2.8, 3.1.2, 3.3.0

Issue Links:

• MDEP-474 Overriding the tomcat-maven-plugin dependencies to 7.0.53 does not get picked up by dependency:resolve-plugins
  ("is duplicated by")
• MDEP-863 go-offline / resolve-plugins don't take into account dependency overwrite
  ("is duplicated by")
• MDEP-934 dependency:resolve-plugins doesn't consider plugin dependency overrides
  ("is duplicated by")
• MDEP-820 dependency:go-offline does not download plugin dependencies
  ("is duplicated by")
• MDEP-830 Dependencies of explicit dependencies of plugins are not resolved

5 votes, 5 watchers

[jira-importer]

Andreas Janning commented

This problem still exists in the maven-dependency-plugin 3.1.2 with the exact same reproducer

[jira-importer]

Benjamin Asbach commented

Still a problem in 3.3.0.

[wilx]

Fixed in maven-dependency-plugin 3.9.0 by #1521.

I verified the original Selenium reproducer: both dependency:resolve-plugins and dependency:go-offline resolve the declared 2.47.1 plugin-dependency overrides with 3.9.0 (and current master), whereas 3.3.0 resolves the original 2.21.0 dependencies from the plugin POM.

This issue can be closed.