Manage commons-io via dependencyManagement#562
Conversation
The direct commons-io dependency was a Maven 4.0.0-rc-3-era workaround; it is unused in code and makes dependency:analyze warn about an unused declared dependency. The pin itself is still required: without it, file-management's transitive commons-io 2.19.0 wins conflict resolution against the 2.22.0 that plexus-archiver 4.12.0 expects. Moving the pin to dependencyManagement keeps the effective classpath identical (2.22.0 on Maven 3.10.0-rc-1 and 4.0.0-rc-5, verified via dependency:tree) and silences the warning. Full -P run-its passes on both Maven lines (38/38 ITs).
|
how about fix file-managemen ? |
@slachiewicz Good point — the root cause is |
|
Correction after checking: file-management master already has commons-io 2.22.0 (dependabot #105, merged 2026-04-24) — v3.2.0 just predates it. So no code PR is needed; what is missing is a file-management release. Until a release with that bump is consumable here, the |
|
@ascheman Please assign appropriate label to PR according to the type of change. |
2 participants
The 3.x line declares
commons-io:commons-io:2.22.0as a direct compile dependency although nothing in the code uses it, so every build emits:The POM comment marks it as a Maven 4.0.0-rc-3-era workaround ("looks like dependencyManagement is not taken into account"). That behaviour is gone:
dependencyManagementis honored by current Maven 3 and 4.Note the pin itself is still required — simply removing the dependency silently downgrades commons-io:
org.apache.maven.shared:file-management:3.2.0 → commons-io:2.19.0wins first-declaration conflict resolution againstplexus-archiver:4.12.0 → commons-io:2.22.0(both depth 2), while plexus-archiver 4.12.0 expects 2.22.0. This PR therefore moves the pin into<dependencyManagement>instead of dropping it.Verified (found while verifying the 3.5.1 release candidate):
dependency:tree -Dincludes=commons-ioresolves 2.22.0 with both Maven 3.10.0-rc-1 and Maven 4.0.0-rc-5 — effective classpath unchanged.mvn clean verify -P run-itsgreen on both Maven lines: 38/38 ITs (incl. the toolchain-gated ones),dependency:analyzewarning gone.Dependabot keeps bumping the version in
dependencyManagementas before.