junit-vintage-engine:5.8.0 requires junit:junit:{strictly 4.13.2}

[wilkinsona]

Building a project with JUnit 5.8.0 and Jackson 2.12.5 can result in a build failure due to junit-vintage-engine-5.8.0 strictly requiring junit:junit:4.13.2. Jackson 2.12.5's bom manages the version as 4.13.1. I suspect this dependency management should not be present in Jackson's bom and have opened FasterXML/jackson-bom#43, but it's been there for quite some time and this problem only appeared when upgrading to JUnit 5.8.0 from 5.7.

Here's a build scan from building Spring Boot where I originally discovered the problem: https://ge.spring.io/s/xwscy4qijm2w6/failure#1.

Steps to reproduce

Here's a much simpler build that should reproduce the problem using Gradle 6.9.1:

plugins {
	id 'java'
}

repositories {
	mavenCentral()
}

dependencies {
	implementation(enforcedPlatform('com.fasterxml.jackson:jackson-bom:2.12.5'))
	implementation('com.fasterxml.jackson.core:jackson-databind')
	testImplementation('org.junit.vintage:junit-vintage-engine:5.8.0')
}

 ./gradlew dependencyInsight --dependency junit:junit --configuration testCompileClasspath

> Task :dependencyInsight
junit:junit:4.13.1 FAILED
   Selection reasons:
      - By constraint
      - Forced
   Failures:
      - Could not resolve junit:junit:4.13.1.
          - Cannot find a version of 'junit:junit' that satisfies the version constraints:
               Dependency path ':jackson-bom-junit-5.8-problem:unspecified' --> 'org.junit.vintage:junit-vintage-engine:5.8.0' --> 'junit:junit:{strictly 4.13.2}'
               Constraint path ':jackson-bom-junit-5.8-problem:unspecified' --> 'com.fasterxml.jackson:jackson-bom:2.12.5' --> 'junit:junit:4.13.1'
               Constraint path ':jackson-bom-junit-5.8-problem:unspecified' --> 'com.fasterxml.jackson.core:jackson-databind:2.12.5' --> 'com.fasterxml.jackson:jackson-bom:2.12.5' --> 'junit:junit:4.13.1'

junit:junit:4.13.1 FAILED
\--- com.fasterxml.jackson:jackson-bom:2.12.5
     +--- testCompileClasspath
     +--- com.fasterxml.jackson.core:jackson-databind:2.12.5
     |    +--- testCompileClasspath (requested com.fasterxml.jackson.core:jackson-databind)
     |    \--- com.fasterxml.jackson:jackson-bom:2.12.5 (*)
     +--- com.fasterxml.jackson.core:jackson-annotations:2.12.5
     |    +--- com.fasterxml.jackson.core:jackson-databind:2.12.5 (*)
     |    \--- com.fasterxml.jackson:jackson-bom:2.12.5 (*)
     \--- com.fasterxml.jackson.core:jackson-core:2.12.5
          +--- com.fasterxml.jackson.core:jackson-databind:2.12.5 (*)
          \--- com.fasterxml.jackson:jackson-bom:2.12.5 (*)

junit:junit:4.13.2 FAILED
   Failures:
      - Could not resolve junit:junit:{strictly 4.13.2}. (already reported)

junit:junit:{strictly 4.13.2} -> 4.13.2 FAILED
\--- org.junit.vintage:junit-vintage-engine:5.8.0
     +--- testCompileClasspath
     \--- org.junit:junit-bom:5.8.0
          +--- org.junit.platform:junit-platform-engine:1.8.0
          |    +--- org.junit:junit-bom:5.8.0 (*)
          |    \--- org.junit.vintage:junit-vintage-engine:5.8.0 (*)
          +--- org.junit.platform:junit-platform-commons:1.8.0
          |    +--- org.junit.platform:junit-platform-engine:1.8.0 (*)
          |    \--- org.junit:junit-bom:5.8.0 (*)
          \--- org.junit.vintage:junit-vintage-engine:5.8.0 (*)

org.junit:junit-bom:5.8.0
   variant "apiElements" [
      org.gradle.category            = platform
      org.gradle.usage               = java-api
      org.gradle.status              = release (not requested)

      Requested attributes not found in the selected variant:
         org.gradle.dependency.bundling = external
         org.gradle.libraryelements     = classes
         org.gradle.jvm.version         = 11
   ]

org.junit:junit-bom:5.8.0
+--- org.junit.platform:junit-platform-commons:1.8.0
|    +--- org.junit.platform:junit-platform-engine:1.8.0
|    |    +--- org.junit:junit-bom:5.8.0 (*)
|    |    \--- org.junit.vintage:junit-vintage-engine:5.8.0
|    |         +--- testCompileClasspath
|    |         \--- org.junit:junit-bom:5.8.0 (*)
|    \--- org.junit:junit-bom:5.8.0 (*)
+--- org.junit.platform:junit-platform-engine:1.8.0 (*)
\--- org.junit.vintage:junit-vintage-engine:5.8.0 (*)

(*) - dependencies omitted (listed previously)

A web-based, searchable dependency report is available by adding the --scan option.

BUILD SUCCESSFUL in 513ms
1 actionable task: 1 executed

If you downgrade junit-vintage-engine to 5.7.2 the problem does not occur:

./gradlew dependencyInsight --dependency junit:junit --configuration testCompileClasspath

> Task :dependencyInsight
junit:junit:4.13.1
   variant "compile" [
      org.gradle.status              = release (not requested)
      org.gradle.usage               = java-api
      org.gradle.libraryelements     = jar (compatible with: classes)
      org.gradle.category            = library

      Requested attributes not found in the selected variant:
         org.gradle.dependency.bundling = external
         org.gradle.jvm.version         = 11
   ]
   Selection reasons:
      - By constraint
      - Forced

junit:junit:4.13.1
\--- com.fasterxml.jackson:jackson-bom:2.12.5
     +--- testCompileClasspath
     +--- com.fasterxml.jackson.core:jackson-databind:2.12.5
     |    +--- testCompileClasspath (requested com.fasterxml.jackson.core:jackson-databind)
     |    \--- com.fasterxml.jackson:jackson-bom:2.12.5 (*)
     +--- com.fasterxml.jackson.core:jackson-annotations:2.12.5
     |    +--- com.fasterxml.jackson.core:jackson-databind:2.12.5 (*)
     |    \--- com.fasterxml.jackson:jackson-bom:2.12.5 (*)
     \--- com.fasterxml.jackson.core:jackson-core:2.12.5
          +--- com.fasterxml.jackson.core:jackson-databind:2.12.5 (*)
          \--- com.fasterxml.jackson:jackson-bom:2.12.5 (*)

junit:junit:4.13 -> 4.13.1
\--- org.junit.vintage:junit-vintage-engine:5.7.2
     +--- testCompileClasspath
     \--- org.junit:junit-bom:5.7.2
          +--- org.junit.platform:junit-platform-engine:1.7.2
          |    +--- org.junit:junit-bom:5.7.2 (*)
          |    \--- org.junit.vintage:junit-vintage-engine:5.7.2 (*)
          +--- org.junit.platform:junit-platform-commons:1.7.2
          |    +--- org.junit.platform:junit-platform-engine:1.7.2 (*)
          |    \--- org.junit:junit-bom:5.7.2 (*)
          \--- org.junit.vintage:junit-vintage-engine:5.7.2 (*)

org.junit:junit-bom:5.7.2
   variant "apiElements" [
      org.gradle.category            = platform
      org.gradle.usage               = java-api
      org.gradle.status              = release (not requested)

      Requested attributes not found in the selected variant:
         org.gradle.dependency.bundling = external
         org.gradle.libraryelements     = classes
         org.gradle.jvm.version         = 11
   ]

org.junit:junit-bom:5.7.2
+--- org.junit.platform:junit-platform-commons:1.7.2
|    +--- org.junit.platform:junit-platform-engine:1.7.2
|    |    +--- org.junit:junit-bom:5.7.2 (*)
|    |    \--- org.junit.vintage:junit-vintage-engine:5.7.2
|    |         +--- testCompileClasspath
|    |         \--- org.junit:junit-bom:5.7.2 (*)
|    \--- org.junit:junit-bom:5.7.2 (*)
+--- org.junit.platform:junit-platform-engine:1.7.2 (*)
\--- org.junit.vintage:junit-vintage-engine:5.7.2 (*)

(*) - dependencies omitted (listed previously)

A web-based, searchable dependency report is available by adding the --scan option.

BUILD SUCCESSFUL in 610ms
1 actionable task: 1 executed

Context

• Used versions (Jupiter/Vintage/Platform): 5.8.0
• Build Tool/IDE: Gradle 6.9.1

Deliverables

• TBD

[sormuras]

Does the same happen with Maven 3.x? IIRC, the "first BOM that defines a version wins", thus if the JUnit BOM is loaded before Jackson's BOM, 4.13.2 should be used for all junit:junit occurances.

[marcphilipp]

We switched to using a version range for our internal dependency management with 5.8:
https://github.com/junit-team/junit5/blob/a295157c098d0b4419983ef1c6731ff5eb27b6a0/gradle/libs.versions.toml#L31

However, we have the following config in place:

https://github.com/junit-team/junit5/blob/931ecaa04c4181612284b70b267e320e1cb1b787/buildSrc/src/main/kotlin/java-library-conventions.gradle.kts#L95-L103

This causes 4.13.2 to be published in the POM and the following dependency in Gradle Module Metadata:

{
  "group": "junit",
  "module": "junit",
  "version": {
    "strictly": "4.13.2",
    "requires": "4.13.2"
  }
}

In 5.7.2 that used to be:

{
  "group": "junit",
  "module": "junit",
  "version": {
    "requires": "4.13"
  }
}

---

I think the right thing to do would be to remove fromResolutionResult() from the build script mentioned above. Then, the Gradle module dependency would look as it should (since the engine still supports all versions since 4.12):

{
  "group": "junit",
  "module": "junit",
  "version": {
    "strictly": "[4.12,)",
    "requires": "[4.12,)",
    "prefers": "4.13.2"
  }
}

However, that would also cause the version range to be published in the POM which I initially wanted to avoid since I'm not sure if using it would break any consumers:

<dependency>
  <groupId>junit</groupId>
  <artifactId>junit</artifactId>
  <version>[4.12,)</version>
  <scope>compile</scope>
</dependency>

@junit-team/junit-lambda @wilkinsona Thoughts?

[marcphilipp]

Actually, I think the better fix as it's less risky would be to change our version declaration from strictly to requires. That would cause the GMM to contain

{
  "group": "junit",
  "module": "junit",
  "version": {
    "requires": "4.13.2"
  }
}

and the POM:

<dependency>
  <groupId>junit</groupId>
  <artifactId>junit</artifactId>
  <version>4.13.2</version>
  <scope>compile</scope>
</dependency>