Fixes mojohaus#1140 for reports

Added an integration test + showVersionless for dependency-updates-report

versions-common/src/main/java/org/codehaus/mojo/versions/utils/DependencyComparator.java

@@ -21,9 +21,10 @@
 
 import java.util.Comparator;
 
-import org.apache.commons.lang3.StringUtils;
 import org.apache.maven.model.Dependency;
 
+import static java.util.Optional.ofNullable;
+
 /**
  * A comparator used to sort dependencies by group id, artifact id and finally version.
  *
@@ -41,17 +42,15 @@ public enum DependencyComparator implements Comparator<Dependency> {
      */
     @SuppressWarnings("checkstyle:InnerAssignment")
     public int compare(Dependency d1, Dependency d2) {
-        int r;
         return d1 == d2
                 ? 0
-                : d1 == null
-                        ? 1
-                        : d2 == null
-                                ? -1
-                                : (r = StringUtils.compare(d1.getGroupId(), d2.getGroupId())) != 0
-                                        ? r
-                                        : (r = StringUtils.compare(d1.getArtifactId(), d2.getArtifactId())) != 0
-                                                ? r
-                                                : StringUtils.compare(d1.getVersion(), d2.getVersion());
+                : Comparator.nullsLast(Comparator.comparing(Dependency::getGroupId)
+                                .thenComparing(
+                                        dep -> ofNullable(dep.getArtifactId()).orElse(""))
+                                .thenComparing(
+                                        dep -> ofNullable(dep.getClassifier()).orElse(""))
+                                .thenComparing(
+                                        dep -> ofNullable(dep.getVersion()).orElse("")))
+                        .compare(d1, d2);
     }
 }

versions-common/src/main/java/org/codehaus/mojo/versions/utils/MavenProjectUtils.java

@@ -33,6 +33,8 @@
 import static java.util.Collections.emptyList;
 import static java.util.Optional.ofNullable;
 import static org.apache.commons.lang3.StringUtils.startsWith;
+import static org.codehaus.mojo.versions.utils.DependencyBuilder.Location.ARTIFACT_ID;
+import static org.codehaus.mojo.versions.utils.DependencyBuilder.Location.VERSION;
 
 /**
  * Utility methods for extracting dependencies from a {@link org.apache.maven.project.MavenProject}
@@ -156,4 +158,12 @@ public static Dependency interpolateVersion(final Dependency dependency, final M
         }
         return dependency;
     }
+
+    /**
+     * @return {@code true} if the version of the dependency is definned locally in the same project
+     */
+    public static boolean dependencyVersionLocalToReactor(Dependency dependency) {
+        return dependency.getLocation(VERSION.toString()).getSource()
+                == dependency.getLocation(ARTIFACT_ID.toString()).getSource();
+    }
 }

versions-maven-plugin/src/it/it-dependency-updates-report-issue-1140/child/pom.xml

@@ -0,0 +1,40 @@
+<!--
+  ~ Licensed to the Apache Software Foundation (ASF) under one
+  ~ or more contributor license agreements.  See the NOTICE file
+  ~ distributed with this work for additional information
+  ~ regarding copyright ownership.  The ASF licenses this file
+  ~ to you under the Apache License, Version 2.0 (the
+  ~ "License"); you may not use this file except in compliance
+  ~ with the License.  You may obtain a copy of the License at
+  ~
+  ~     http://www.apache.org/licenses/LICENSE-2.0
+  ~
+  ~ Unless required by applicable law or agreed to in writing,
+  ~ software distributed under the License is distributed on an
+  ~ "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+  ~ KIND, either express or implied.  See the License for the
+  ~ specific language governing permissions and limitations
+  ~ under the License.
+  -->
+
+<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
+  <modelVersion>4.0.0</modelVersion>
+
+  <parent>
+    <groupId>localhost</groupId>
+    <artifactId>parent-artifact</artifactId>
+    <version>1.0.0-SNAPSHOT</version>
+  </parent>
+
+  <artifactId>child-artifact</artifactId>
+  <version>1.0.0-SNAPSHOT</version>
+
+  <dependencies>
+    <dependency>
+      <groupId>localhost</groupId>
+      <artifactId>dummy-api</artifactId>
+    </dependency>
+  </dependencies>
+
+</project>

versions-maven-plugin/src/it/it-dependency-updates-report-issue-1140/invoker.properties

@@ -0,0 +1,2 @@
+invoker.goals = ${project.groupId}:${project.artifactId}:${project.version}:dependency-updates-report -f child/pom.xml
+invoker.mavenOpts = -DdependencyUpdatesReportFormats=xml -DprocessDependencyManagement=false -DprocessDependencyManagementTransitive=false -DonlyProjectDependencies=true -DonlyUpgradable=true -DshowVersionless=false

versions-maven-plugin/src/it/it-dependency-updates-report-issue-1140/pom.xml

@@ -0,0 +1,37 @@
+<!--
+  ~ Licensed to the Apache Software Foundation (ASF) under one
+  ~ or more contributor license agreements.  See the NOTICE file
+  ~ distributed with this work for additional information
+  ~ regarding copyright ownership.  The ASF licenses this file
+  ~ to you under the Apache License, Version 2.0 (the
+  ~ "License"); you may not use this file except in compliance
+  ~ with the License.  You may obtain a copy of the License at
+  ~
+  ~     http://www.apache.org/licenses/LICENSE-2.0
+  ~
+  ~ Unless required by applicable law or agreed to in writing,
+  ~ software distributed under the License is distributed on an
+  ~ "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+  ~ KIND, either express or implied.  See the License for the
+  ~ specific language governing permissions and limitations
+  ~ under the License.
+  -->
+
+<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
+  <modelVersion>4.0.0</modelVersion>
+  <groupId>localhost</groupId>
+  <artifactId>parent-artifact</artifactId>
+  <version>1.0.0-SNAPSHOT</version>
+  <packaging>pom</packaging>
+
+  <dependencyManagement>
+    <dependencies>
+      <dependency>
+        <groupId>localhost</groupId>
+        <artifactId>dummy-api</artifactId>
+        <version>1.0</version>
+      </dependency>
+    </dependencies>
+  </dependencyManagement>
+</project>

versions-maven-plugin/src/it/it-dependency-updates-report-issue-1140/verify.groovy

@@ -0,0 +1,2 @@
+def output = new File(basedir, "child/target/dependency-updates-report.xml").text
+assert !output.contains("<artifactId>dummy-api</artifactId>")

versions-maven-plugin/src/it/it-display-dependency-updates-009-processDependencyManagementTransitive-true/verify.groovy

@@ -0,0 +1,4 @@
+def buildLog = new File( basedir, "build.log").text
+assert buildLog =~ /\Qlocalhost:dummy-api\E\s*\.*\s*1\.1\s+->\s+3\.0/
+assert buildLog =~ /\Qlocalhost:dummy-impl\E\s*\.*\s*1\.2\s+->\s+2\.2/
+assert !(buildLog =~ /\Qlocalhost:dummy-api-impl-bom-pom\E\s*\.*\s*1\.0\s+->\s+2\.0/)

versions-maven-plugin/src/main/java/org/codehaus/mojo/versions/AbstractDependencyUpdatesReport.java

@@ -43,6 +43,7 @@
 import org.codehaus.mojo.versions.reporting.ReportRendererFactory;
 import org.codehaus.mojo.versions.reporting.model.DependencyUpdatesModel;
 import org.codehaus.mojo.versions.utils.DependencyComparator;
+import org.codehaus.mojo.versions.utils.MavenProjectUtils;
 import org.codehaus.mojo.versions.xml.DependencyUpdatesXmlReportRenderer;
 import org.codehaus.plexus.i18n.I18N;
 import org.eclipse.aether.RepositorySystem;
@@ -80,6 +81,17 @@ public abstract class AbstractDependencyUpdatesReport extends AbstractVersionsRe
     @Parameter(property = "processDependencyManagementTransitive", defaultValue = "true")
     protected boolean processDependencyManagementTransitive;
 
+    /**
+     * <p>Include dependencies with version set in a parent or in a BOM.</p>
+     * <p>This is similar to {@code processDependencyManagementTransitive}, but will
+     * report updates on dependencies.</p>
+     * <p>Default is {@code false}.</p>
+     *
+     * @since 2.18.1
+     */
+    @Parameter(property = "showVersionless", defaultValue = "true")
+    protected boolean showVersionless = true;
+
     /**
      * Report formats (html and/or xml). HTML by default.
      */
@@ -142,17 +154,21 @@ protected void doGenerateReport(Locale locale, Sink sink) throws MavenReportExce
         Set<Dependency> dependencyManagement;
 
         if (processDependencyManagement) {
-            dependencyManagement = getDependencyManagement(dependencies);
+            dependencyManagement = getDependencyManagement();
             handleOnlyProjectDependencies(dependencyManagement, dependencies);
         } else {
             dependencyManagement = Collections.emptySet();
         }
 
         try {
-
             Map<Dependency, ArtifactVersions> dependencyUpdates = getHelper()
                     .lookupDependenciesUpdates(
-                            dependencies.stream().filter(d -> d.getVersion() != null), false, allowSnapshots);
+                            dependencies.stream()
+                                    .filter(d -> d.getVersion() != null)
+                                    .filter(d ->
+                                            showVersionless || MavenProjectUtils.dependencyVersionLocalToReactor(d)),
+                            false,
+                            allowSnapshots);
 
             Map<Dependency, ArtifactVersions> dependencyManagementUpdates = processDependencyManagement
                     ? getHelper()
@@ -245,7 +261,7 @@ private Set<Dependency> getDependencies() {
 
     /**
      * Implementations of {@link AbstractDependencyUpdatesReport} may use this to supply the main processing logic
-     * (see {@link #getDependencyManagement(Set)}) with desired dependency data, which will be used
+     * (see {@link #getDependencyManagement()}) with desired dependency data, which will be used
      * in the creation of the report.
      *
      * @param dependenciesCollector, a Set, initialized with a DependencyComparator
@@ -259,27 +275,26 @@ private Set<Dependency> getDependencies() {
      * in projects dependencyManagement section.
      *
      * @return a {@link Set<Dependency>} that can be additionally populated by
-     * {@link #populateDependencyManagement(Set, Set)}. If not, an empty set is returned
+     * {@link #populateDependencyManagement(Set)}. If not, an empty set is returned
      * */
-    private Set<Dependency> getDependencyManagement(Set<Dependency> dependencies) throws MavenReportException {
+    private Set<Dependency> getDependencyManagement() throws MavenReportException {
         final Set<Dependency> dependencyManagementCollector = new TreeSet<>(DEPENDENCY_COMPARATOR);
-        populateDependencyManagement(dependencyManagementCollector, dependencies);
+        populateDependencyManagement(dependencyManagementCollector);
         return dependencyManagementCollector;
     }
 
     /**
      * Implementations of {@link AbstractDependencyUpdatesReport} may use this to supply the main processing logic
-     * (see {@link #getDependencyManagement(Set)}) with desired managed dependencies data, which will be used
+     * (see {@link #getDependencyManagement()}) with desired managed dependencies data, which will be used
      * in the creation of the report.
      *
      * @param dependencyManagementCollector, a Set initialized with a DependencyComparator
-     * @param dependencies an already populated set of dependencies(non-managed)
      * comparator.
      *
      * @throws MavenReportException when things go wrong.
      * */
-    protected abstract void populateDependencyManagement(
-            Set<Dependency> dependencyManagementCollector, Set<Dependency> dependencies) throws MavenReportException;
+    protected abstract void populateDependencyManagement(Set<Dependency> dependencyManagementCollector)
+            throws MavenReportException;
 
     private void renderReport(Locale locale, Sink sink, DependencyUpdatesModel model) throws MavenReportException {
         for (String format : formats) {

versions-maven-plugin/src/main/java/org/codehaus/mojo/versions/DependencyUpdatesAggregateReport.java

@@ -27,7 +27,6 @@
 import org.apache.maven.plugins.annotations.Mojo;
 import org.apache.maven.plugins.annotations.ResolutionScope;
 import org.apache.maven.project.MavenProject;
-import org.apache.maven.reporting.MavenReportException;
 import org.apache.maven.wagon.Wagon;
 import org.codehaus.mojo.versions.reporting.ReportRendererFactory;
 import org.codehaus.mojo.versions.reporting.util.AggregateReportUtils;
@@ -71,8 +70,7 @@ protected void populateDependencies(Set<Dependency> dependenciesCollector) {
      * {@inheritDoc}
      * */
     @Override
-    protected void populateDependencyManagement(
-            Set<Dependency> dependencyManagementCollector, Set<Dependency> dependencies) throws MavenReportException {
+    protected void populateDependencyManagement(Set<Dependency> dependencyManagementCollector) {
         for (MavenProject project : AggregateReportUtils.getProjectsToProcess(getProject())) {
             getLog().debug(String.format("Collecting managed dependencies for project %s", project.getName()));
             handleDependencyManagementTransitive(project, dependencyManagementCollector);

versions-maven-plugin/src/main/java/org/codehaus/mojo/versions/DependencyUpdatesReport.java

@@ -28,7 +28,6 @@
 import org.apache.maven.model.Dependency;
 import org.apache.maven.plugins.annotations.Mojo;
 import org.apache.maven.plugins.annotations.ResolutionScope;
-import org.apache.maven.reporting.MavenReportException;
 import org.apache.maven.wagon.Wagon;
 import org.codehaus.mojo.versions.reporting.ReportRendererFactory;
 import org.codehaus.plexus.i18n.I18N;
@@ -67,8 +66,7 @@ protected void populateDependencies(Set<Dependency> dependenciesCollector) {
      * {@inheritDoc}
      * */
     @Override
-    protected void populateDependencyManagement(
-            Set<Dependency> dependencyManagementCollector, Set<Dependency> dependencies) throws MavenReportException {
+    protected void populateDependencyManagement(Set<Dependency> dependencyManagementCollector) {
         if (hasDependencyManagement(getProject())) {
             getLog().debug(String.format(
                     "Collecting managed dependencies for project %s",

versions-maven-plugin/src/main/java/org/codehaus/mojo/versions/DisplayDependencyUpdatesMojo.java

@@ -45,13 +45,12 @@
 import org.codehaus.mojo.versions.internal.DependencyUpdatesLoggingHelper.DependencyUpdatesResult;
 import org.codehaus.mojo.versions.rewriting.MutableXMLStreamReader;
 import org.codehaus.mojo.versions.utils.DependencyComparator;
+import org.codehaus.mojo.versions.utils.MavenProjectUtils;
 import org.codehaus.mojo.versions.utils.SegmentUtils;
 import org.eclipse.aether.RepositorySystem;
 
 import static java.util.Collections.emptySet;
 import static org.codehaus.mojo.versions.filtering.DependencyFilter.filterDependencies;
-import static org.codehaus.mojo.versions.utils.DependencyBuilder.Location.ARTIFACT_ID;
-import static org.codehaus.mojo.versions.utils.DependencyBuilder.Location.VERSION;
 import static org.codehaus.mojo.versions.utils.MavenProjectUtils.extractDependenciesFromDependencyManagement;
 import static org.codehaus.mojo.versions.utils.MavenProjectUtils.extractDependenciesFromPlugins;
 import static org.codehaus.mojo.versions.utils.MavenProjectUtils.extractPluginDependenciesFromPluginsInPluginManagement;
@@ -371,14 +370,6 @@ public boolean isVerbose() {
 
     // --------------------- Interface Mojo ---------------------
 
-    /**
-     * @return {@code true} if the version of the dependency is definned locally in the same project
-     */
-    private static boolean dependencyVersionLocalToReactor(Dependency dependency) {
-        return dependency.getLocation(VERSION.toString()).getSource()
-                == dependency.getLocation(ARTIFACT_ID.toString()).getSource();
-    }
-
     /**
      * @throws org.apache.maven.plugin.MojoExecutionException when things go wrong
      * @throws org.apache.maven.plugin.MojoFailureException   when things go wrong in a very bad way
@@ -421,7 +412,8 @@ public void execute() throws MojoExecutionException, MojoFailureException {
                                                                         .noneMatch(depMan ->
                                                                                 dependenciesMatch(dep, depMan)))
                                                                 .filter(dep -> showVersionless
-                                                                        || dependencyVersionLocalToReactor(dep))
+                                                                        || MavenProjectUtils
+                                                                                .dependencyVersionLocalToReactor(dep))
                                                                 .collect(
                                                                         () -> new TreeSet<>(
                                                                                 DependencyComparator.INSTANCE),