[MENFORCER-466] RequireUpperBoundDeps fails on provided dependencies since 3.2.1 #828

Activity

1. jira-importer commented on Feb 4, 2023

   

   jira-importer

   on Feb 4, 2023

   Author

   More actions

   Andrzej J. commented

   I guess I must've misunderstood Sławek's comment.
2. jira-importer commented on Feb 4, 2023

   

   jira-importer

   on Feb 4, 2023

   Author

   More actions

   Piotr Zygielo commented

   MENFORCER-402
3. jira-importer commented on Feb 4, 2023

   

   jira-importer

   on Feb 4, 2023

   Author

   More actions

   Andrzej J. commented

   Yup, I'm preparing a PR.

   In particular, ResolveUtils.resolveTransitiveDependencies() will by default (that is, if no other set of exclusions is provided) use the same set of DependencyExclusions as present in MavenRepositorySystemUtils.newSession():

   new AndDependencySelector( new ScopeDependencySelector( "test", "provided" ),
            new OptionalDependencySelector(), new ExclusionDependencySelector() );
4. jira-importer commented on Feb 4, 2023

   

   jira-importer

   on Feb 4, 2023

   Author

   More actions

   Andrzej J. commented

   #248
5. jira-importer commented on Mar 11, 2023

   

   jira-importer

   on Mar 11, 2023

   Author

   More actions

   Slawomir Jaranowski commented

   We have the same configuration from Maven ... do last change must be verified again
6. jira-importer commented on Mar 11, 2023

   

   jira-importer

   on Mar 11, 2023

   Author

   More actions

   Andrzej J. commented

   I don't follow. Should we introduce some more changes?
7. jira-importer commented on Mar 11, 2023

   

   jira-importer

   on Mar 11, 2023

   Author

   More actions

   Slawomir Jaranowski commented

   There is the same as in DependencyConvergence - standard ScopeDependencySelector filter dependencies at level >= 2, we need also filter direct dependencies
8. jira-importer commented on Mar 12, 2023

   

   jira-importer

   on Mar 12, 2023

   Author

   More actions

   Andrzej J. commented

   What about RequireReleaseDeps?

   And BannedDependencies (there might be a problem with an integration test there if we should also ignore {}test-{}scoped dependencies there - an integration test called MENFORCER-434 actually expects the plugin to ban a test dependency).

   If we have those two answered -- and especially this: should we ignore test and provided dependencies on all levels for BannedDependencies - then we can have the same selectors everywhere.
9. jira-importer commented on Mar 15, 2023

   

   jira-importer

   on Mar 15, 2023

   Author

   More actions

   Slawomir Jaranowski commented

   We have more options with rules which use dependencies collections (tree) and we should think if is used correctly

   Rule	verbose mode	filter root scope
   bannedDependencies	true ??	false
   banDynamicVersions	false	false
   banTransitiveDependencies	false (changed in 469)	false
   dependencyConvergence	true	true
   requireReleaseDeps	true ???	false
   requireUpperBoundDeps	true	false
10. jira-importer commented on Mar 16, 2023

    

    jira-importer

    on Mar 16, 2023

    Author

    More actions

    Andrzej J. commented

    Ok, for the time being I have created a new PR for RequireUpperBoundDeps only -- #254

    It's not clear to me whether direct dependencies need to be considered for other rules. It's also not mentioned in the docs -- so, leaving them as they are.

    In any case, I think those other rules can be tackled in separate tickets.
11. jira-importer commented on Mar 17, 2023

    

    jira-importer

    on Mar 17, 2023

    Author

    More actions

    Slawomir Jaranowski commented

    Yes exactly other rules  should be discussed on separate issue.
    I only sumarize her.
12. jira-importer commented on Mar 17, 2023

    

    jira-importer

    on Mar 17, 2023

    Author

    More actions

    Slawomir Jaranowski commented

    With implementation IT was added - should be ok now.
13. jira-importer

    closed this as completedon Mar 19, 2023
14. jira-importer

    assigned

    slawekjaranowski

    on Jun 14, 2025
15. jira-importer

    added

    bugSomething isn't workingSomething isn't working

    priority:majorMajor loss of functionMajor loss of function

    on Jun 14, 2025