NullPointerException when Maven-style exclusions are enabled and a dependency has a pom which Maven's Model Builder considers to be invalid #365

bratkartoffel · 2023-07-17T11:39:10Z

Hi,

after upgrading the plugin to the latest released version, 1.1.0 to 1.1.1, the build fails due to a NPE:
Buildscan available at: https://scans.gradle.com/s/6ygpyymluwloq

Caused by: java.lang.NullPointerException: Cannot invoke "io.spring.gradle.dependencymanagement.org.apache.maven.model.Model.getGroupId()" because "effectiveModel" is null
at io.spring.gradle.dependencymanagement.internal.maven.MavenPomResolver.createPoms(MavenPomResolver.java:136)	
at io.spring.gradle.dependencymanagement.internal.maven.MavenPomResolver.createPoms(MavenPomResolver.java:129)	
at io.spring.gradle.dependencymanagement.internal.maven.MavenPomResolver.resolvePomsLeniently(MavenPomResolver.java:79)	
at io.spring.gradle.dependencymanagement.internal.ExclusionResolver.resolveExclusions(ExclusionResolver.java:75)	
at io.spring.gradle.dependencymanagement.internal.ExclusionConfiguringAction.findExcludedDependencies(ExclusionConfiguringAction.java:121)	
at io.spring.gradle.dependencymanagement.internal.ExclusionConfiguringAction.applyMavenExclusions(ExclusionConfiguringAction.java:92)	
at io.spring.gradle.dependencymanagement.internal.ExclusionConfiguringAction.execute(ExclusionConfiguringAction.java:87)	
at io.spring.gradle.dependencymanagement.internal.ExclusionConfiguringAction.execute(ExclusionConfiguringAction.java:56)	
at org.gradle.configuration.internal.DefaultUserCodeApplicationContext$CurrentApplication$1.execute(DefaultUserCodeApplicationContext.java:123)	
at org.gradle.internal.event.BroadcastDispatch$ActionvocationHandler.dispatch(BroadcastDispatch.java:97)	
at org.gradle.internal.event.BroadcastDispatch$ActionvocationHandler.dispatch(BroadcastDispatch.java:85)	
at org.gradle.internal.event.AbstractBroadcastDispatch.dispatch(AbstractBroadcastDispatch.java:43)	
at org.gradle.internal.event.BroadcastDispatch$SingletonDispatch.dispatch(BroadcastDispatch.java:257)	
at org.gradle.internal.event.BroadcastDispatch$SingletonDispatch.dispatch(BroadcastDispatch.java:164)	
at org.gradle.internal.event.AbstractBroadcastDispatch.dispatch(AbstractBroadcastDispatch.java:83)	
at org.gradle.internal.event.AbstractBroadcastDispatch.dispatch(AbstractBroadcastDispatch.java:69)	
at org.gradle.internal.event.BroadcastDispatch$CompositeDispatch.dispatch(BroadcastDispatch.java:363)	
at org.gradle.internal.event.BroadcastDispatch$CompositeDispatch.dispatch(BroadcastDispatch.java:261)	
at org.gradle.internal.event.ListenerBroadcast.dispatch(ListenerBroadcast.java:148)	
at org.gradle.internal.event.ListenerBroadcast.dispatch(ListenerBroadcast.java:37)	
at org.gradle.internal.dispatch.ProxyDispatchAdapter$DispatchingevocationHandler.invoke(ProxyDispatchAdapter.java:94)	
[...]

The repository with the sources is private, but I can give a maintainer access to it for analyzing.

Thanks,
bk

The text was updated successfully, but these errors were encountered:

wilkinsona · 2023-07-17T12:28:37Z

Thanks for the report. Looking at the build scan, I can see that the plugin's support for Maven-style exclusions encounters a problem when processing the pom for eu.fraho.spring:security-jwt-base-spring-boot-starter:5.0.5. It can be reproduced with the following build script:

plugins {
	id "java"
	id "io.spring.dependency-management" version "1.1.2"
}

repositories {
	mavenCentral()
}

dependencies {
	implementation("eu.fraho.spring:security-jwt-base-spring-boot-starter:5.0.5")
}

Running with --debug shows the problem:

[FATAL] 'dependencies.dependency[eu.fraho.spring:security-jwt-base-spring-boot-starter:5.0.5]' for eu.fraho.spring:security-jwt-base-spring-boot-starter:5.0.5 is referencing itself. @ 

        at io.spring.gradle.dependencymanagement.org.apache.maven.model.building.DefaultModelProblemCollector.newModelBuildingException(DefaultModelProblemCollector.java:197)
        at io.spring.gradle.dependencymanagement.org.apache.maven.model.building.DefaultModelBuilder.readModel(DefaultModelBuilder.java:697)
        at io.spring.gradle.dependencymanagement.org.apache.maven.model.building.DefaultModelBuilder.build(DefaultModelBuilder.java:303)
        at io.spring.gradle.dependencymanagement.org.apache.maven.model.building.DefaultModelBuilder.build(DefaultModelBuilder.java:267)
        at io.spring.gradle.dependencymanagement.internal.maven.EffectiveModelBuilder.buildModel(EffectiveModelBuilder.java:72)
        at io.spring.gradle.dependencymanagement.internal.maven.EffectiveModelBuilder.buildModels(EffectiveModelBuilder.java:60)
        at io.spring.gradle.dependencymanagement.internal.maven.MavenPomResolver.createPoms(MavenPomResolver.java:133)
        at io.spring.gradle.dependencymanagement.internal.maven.MavenPomResolver.createPoms(MavenPomResolver.java:129)
        at io.spring.gradle.dependencymanagement.internal.maven.MavenPomResolver.resolvePomsLeniently(MavenPomResolver.java:79)
        at io.spring.gradle.dependencymanagement.internal.ExclusionResolver.resolveExclusions(ExclusionResolver.java:75)
        at io.spring.gradle.dependencymanagement.internal.ExclusionConfiguringAction.findExcludedDependencies(ExclusionConfiguringAction.java:123)
        at io.spring.gradle.dependencymanagement.internal.ExclusionConfiguringAction.applyMavenExclusions(ExclusionConfiguringAction.java:92)
        at io.spring.gradle.dependencymanagement.internal.ExclusionConfiguringAction.execute(ExclusionConfiguringAction.java:87)
        at io.spring.gradle.dependencymanagement.internal.ExclusionConfiguringAction.execute(ExclusionConfiguringAction.java:56)
        …

There's a similar problem with eu.fraho.spring:security-jwt-base:5.0.5 as its pom also references itself.

I suspect that this is now causing a failure due to an upgrade of the version of Maven's model builder that the dependency management plugin embeds. This upgrade was done to fix #350 and picked up the changes for MNG-6123.

Please report the invalid poms to the maintainers of eu.fraho.spring:security-jwt-base and eu.fraho.spring:security-jwt-base-spring-boot-starter.

You can work around the failure that the invalid pom is now causing in the dependency management plugin by disabling Maven-style exclusions:

dependencyManagement {
	applyMavenExclusions = false
}

I'll take a look at tolerating self-referential poms that Maven's model builder considers to be invalid.

bratkartoffel · 2023-07-17T12:41:55Z

Thank you very much for analyizing this. I'm the maintainer of the mentioned artifact and I have no idea how / when the pom became invalid and why I didn't notice it earlier.

// edit: ok, it broke with 4.3.0 (bratkartoffel/security-jwt@4.2.0...4.3.0). After digging in and analyzing the pom it seems, that the 'java-test-fixtures' plugin is causing the problem. As soon as I enable that plugin, the pom-file contains a self-reference.

// edit-2: seems like I'm not the only one with that issue: https://stackoverflow.com/q/69877418

// edit-3: I've found a workaround to remove the self referential dependencies when using the testFixtures: bratkartoffel/security-jwt@48a7e84

jamesdh · 2023-07-17T14:46:53Z

We're also experiencing issues w/ the update from 1.1.1/1.1.2 (1.1.0 works fine). Initially it gives the same error @bratkartoffel got above, e.g.

Cannot invoke "io.spring.gradle.dependencymanagement.org.apache.maven.model.Model.getGroupId()" because "effectiveModel" is null

But with --debug, we get the following:

io.spring.gradle.dependencymanagement.org.apache.maven.model.building.ModelBuildingException: 1 problem was encountered while building the effective model for org.eclipse.platform:org.eclipse.core.contenttype:3.8.200
[FATAL] 'modelVersion' of '4.0' is newer than the versions supported by this version of Maven: [4.0.0]. Building this project requires a newer version of Maven. @

        at io.spring.gradle.dependencymanagement.org.apache.maven.model.building.DefaultModelProblemCollector.newModelBuildingException(DefaultModelProblemCollector.java:197)

EDIT: Related to eclipse-platform/eclipse.platform#180

Starting with Spring Dependency Management Plugin version 1.1.0, invalid POMs cause the plugin to fail. Unfortunately, Sonar has dependencies that have invalid POMs, and it doesn't appear that Sonar is going to change to use dependencies with valid POMs any time soon. Therefore, in order to continuing using the name.remal.sonarlint plugin, there are only two options: 1. Downgrade Sonar to a version that has dependencies all with valid POMs. That could be done by adding a dependency on: `sonarlintCorePlugins("org.sonarsource.java:sonar-java-plugin:7.18.0.31443")` However, it's not ideal to be stuck on an old version for an indeterminate amount of time. 2. Disable Spring Dependency Management Plugin's new maven exclusion semantics. There doesn't appear to be a downside for this project in doing so. See: spring-gradle-plugins/dependency-management-plugin#365 See: https://community.sonarsource.com/t/sonar-java-plugin-has-dependencies-with-invalid-poms/96334/6

Remove workaround as the name.remal.sonarlint plugin now works around the issue See: spring-gradle-plugins/dependency-management-plugin#365

io.spring.dependency-management:1.1.3 fixes this issue. See: spring-gradle-plugins/dependency-management-plugin#365

Starting with Spring Dependency Management Plugin version 1.1.0, invalid POMs cause the plugin to fail. Unfortunately, Sonar has dependencies that have invalid POMs, and it doesn't appear that Sonar is going to change to use dependencies with valid POMs any time soon. Therefore, in order to continuing using the name.remal.sonarlint plugin, there are only two options: 1. Downgrade Sonar to a version that has dependencies all with valid POMs. That could be done by adding a dependency on: `sonarlintCorePlugins("org.sonarsource.java:sonar-java-plugin:7.18.0.31443")` However, it's not ideal to be stuck on an old version for an indeterminate amount of time. 2. Disable Spring Dependency Management Plugin's new maven exclusion semantics. There doesn't appear to be a downside for this project in doing so. See: spring-gradle-plugins/dependency-management-plugin#365 See: https://community.sonarsource.com/t/sonar-java-plugin-has-dependencies-with-invalid-poms/96334/6

io.spring.dependency-management:1.1.3 fixes this issue. See: spring-gradle-plugins/dependency-management-plugin#365

spring-projects-issues added the status: waiting-for-triage label Jul 17, 2023

wilkinsona added type: bug and removed status: waiting-for-triage labels Jul 17, 2023

jamesdh mentioned this issue Jul 17, 2023

flakiness in the Eclipse WTP formatter diffplug/spotless#1610

Open

Lucas3oo mentioned this issue Jul 19, 2023

sonarlintMain fails with io.spring.dependency-management 1.1.2 Lucas3oo/sonarlint-gradle-plugin#4

Closed

candrews mentioned this issue Jul 27, 2023

Disable maven exclusion semantics in Spring Dependency Management Plugin candrews/jumpstart#940

Merged

jochenberger mentioned this issue Jul 31, 2023

Could not create task ':spotlessGroovy' w/ plugin io.spring.dependency-management > 1.1.0 diffplug/spotless#1772

Open

wilkinsona closed this as completed in 1fe2c33 Aug 8, 2023

candrews added a commit to candrews/jumpstart that referenced this issue Aug 8, 2023

Remove spring dependency management workaround

1f78142

Remove workaround as the name.remal.sonarlint plugin now works around the issue See: spring-gradle-plugins/dependency-management-plugin#365

candrews mentioned this issue Aug 8, 2023

Remove spring dependency management workaround candrews/jumpstart#986

Merged

wilkinsona added this to the 1.1.3 milestone Aug 10, 2023

candrews added a commit to candrews/jumpstart that referenced this issue Aug 21, 2023

Remove spring dependency management workaround

7e389a1

io.spring.dependency-management:1.1.3 fixes this issue. See: spring-gradle-plugins/dependency-management-plugin#365

candrews added a commit to candrews/jumpstart that referenced this issue Aug 21, 2023

Remove spring dependency management workaround

3336548

io.spring.dependency-management:1.1.3 fixes this issue. See: spring-gradle-plugins/dependency-management-plugin#365

candrews added a commit to candrews/jumpstart that referenced this issue Aug 21, 2023

Remove spring dependency management workaround

d744021

io.spring.dependency-management:1.1.3 fixes this issue. See: spring-gradle-plugins/dependency-management-plugin#365

candrews added a commit to candrews/jumpstart that referenced this issue Aug 21, 2023

Remove spring dependency management workaround

e1d2f77

io.spring.dependency-management:1.1.3 fixes this issue. See: spring-gradle-plugins/dependency-management-plugin#365

Nashatyrev mentioned this issue Aug 23, 2023

Teku Maven artifacts issues when including as dependency Consensys/teku#7444

Closed

Devhunter416 pushed a commit to Devhunter416/jumpstart that referenced this issue Mar 6, 2024

Remove spring dependency management workaround

1a2796c

io.spring.dependency-management:1.1.3 fixes this issue. See: spring-gradle-plugins/dependency-management-plugin#365

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

NullPointerException when Maven-style exclusions are enabled and a dependency has a pom which Maven's Model Builder considers to be invalid #365

NullPointerException when Maven-style exclusions are enabled and a dependency has a pom which Maven's Model Builder considers to be invalid #365

bratkartoffel commented Jul 17, 2023

wilkinsona commented Jul 17, 2023 •

edited

Loading

bratkartoffel commented Jul 17, 2023 •

edited

Loading

jamesdh commented Jul 17, 2023 •

edited

Loading

NullPointerException when Maven-style exclusions are enabled and a dependency has a pom which Maven's Model Builder considers to be invalid #365

NullPointerException when Maven-style exclusions are enabled and a dependency has a pom which Maven's Model Builder considers to be invalid #365

Comments

bratkartoffel commented Jul 17, 2023

wilkinsona commented Jul 17, 2023 • edited Loading

bratkartoffel commented Jul 17, 2023 • edited Loading

jamesdh commented Jul 17, 2023 • edited Loading

wilkinsona commented Jul 17, 2023 •

edited

Loading

bratkartoffel commented Jul 17, 2023 •

edited

Loading

jamesdh commented Jul 17, 2023 •

edited

Loading