[MNG-8645] Plugins resolving doesn't use dependency management for plugin project

[jira-importer]

Slawomir Jaranowski opened MNG-8645 and commented

example in maven-jar-plugin (3.x) we have dependencyManagement for commons-io

https://github.com/apache/maven-jar-plugin/blob/08cea8ed3caf1c7f6575b8392d4fc1396f24a09c/pom.xml#L82

Maven 3.9.x and rc-2 resolve as:

[DEBUG] org.apache.maven.plugins:maven-jar-plugin:jar:3.4.3-SNAPSHOT
[DEBUG] +- org.apache.maven.shared:file-management:jar:3.1.0 [compile]
[DEBUG] |  +- org.codehaus.plexus:plexus-utils:jar:4.0.1 [compile]
[DEBUG] |  \- commons-io:commons-io:jar:2.16.1 [compile]
[DEBUG] +- org.apache.maven:maven-archiver:jar:3.6.2 [compile]
[DEBUG] |  \- org.codehaus.plexus:plexus-interpolation:jar:1.27 [compile]
[DEBUG] +- org.codehaus.plexus:plexus-archiver:jar:4.9.2 [compile]
[DEBUG] |  +- org.codehaus.plexus:plexus-io:jar:3.4.2 [compile]
[DEBUG] |  +- org.apache.commons:commons-compress:jar:1.26.1 [compile]
[DEBUG] |  |  \- org.apache.commons:commons-lang3:jar:3.14.0 [compile]
[DEBUG] |  +- commons-codec:commons-codec:jar:1.16.1 [compile]
[DEBUG] |  +- org.iq80.snappy:snappy:jar:0.4 [compile]
[DEBUG] |  +- org.tukaani:xz:jar:1.9 [runtime]
[DEBUG] |  \- com.github.luben:zstd-jni:jar:1.5.5-11 [runtime]
[DEBUG] +- javax.inject:javax.inject:jar:1 [compile]
[DEBUG] \- org.slf4j:slf4j-api:jar:1.7.36 [compile]

but for rc-3 we have:

[DEBUG] org.apache.maven.plugins:maven-jar-plugin:jar:3.4.3-SNAPSHOT
[DEBUG] +- org.apache.maven.shared:file-management:jar:3.1.0 [compile]
[DEBUG] |  +- org.codehaus.plexus:plexus-utils:jar:3.4.2 [compile]
[DEBUG] |  \- commons-io:commons-io:jar:2.11.0 [compile]
[DEBUG] +- org.apache.maven:maven-archiver:jar:3.6.2 [compile]
[DEBUG] |  \- org.codehaus.plexus:plexus-interpolation:jar:1.27 [compile]
[DEBUG] +- org.codehaus.plexus:plexus-archiver:jar:4.9.2 [compile]
[DEBUG] |  +- org.codehaus.plexus:plexus-io:jar:3.4.2 [compile]
[DEBUG] |  +- org.apache.commons:commons-compress:jar:1.26.1 [compile]
[DEBUG] |  |  \- org.apache.commons:commons-lang3:jar:3.14.0 [compile]
[DEBUG] |  +- commons-codec:commons-codec:jar:1.16.1 [compile]
[DEBUG] |  +- org.iq80.snappy:snappy:jar:0.4 [compile]
[DEBUG] |  +- org.tukaani:xz:jar:1.9 [runtime]
[DEBUG] |  \- com.github.luben:zstd-jni:jar:1.5.5-11 [runtime]
[DEBUG] +- javax.inject:javax.inject:jar:1 [compile]
[DEBUG] \- org.slf4j:slf4j-api:jar:1.7.36 [compile]

commons-io and plexus-utils have defined versions in dependency management but it is not taken into account.

---

Affects: 4.0.0-rc-3

Remote Links:

• GitHub Pull Request #2183
  

[jira-importer]

Guillaume Nodet commented

Could you double check, I haven't been able to reproduce the problem on that branch of m-jar-p:

➜  maven-jar-plugin git:(08cea8e) ~/.sdkman/candidates/maven/3.9.9/bin/mvn dependency:tree -V | grep -E "Maven|commons-io"
Apache Maven 3.9.9 (8e8579a9e76f7d015ee5ec7bfcdc97d260186937)
Maven home: /Users/gnodet/.sdkman/candidates/maven/3.9.9
[INFO] Building Apache Maven JAR Plugin 3.4.3-SNAPSHOT
[INFO] |  \- commons-io:commons-io:jar:2.16.1:compile
➜  maven-jar-plugin git:(08cea8e) ~/.sdkman/candidates/maven/4.0.0-rc-2/bin/mvn dependency:tree -V | grep -E "Maven|commons-io"
Apache Maven 4.0.0-rc-2 (273314404f85ec3c089e295d8b4e0cb18c287cf5)
Maven home: /Users/gnodet/.sdkman/candidates/maven/4.0.0-rc-2
[INFO] Building Apache Maven JAR Plugin 3.4.3-SNAPSHOT
[INFO] |  \- commons-io:commons-io:jar:2.16.1:compile
➜  maven-jar-plugin git:(08cea8e) ~/.sdkman/candidates/maven/4.0.0-rc-3/bin/mvn dependency:tree -V | grep -E "Maven|commons-io"
Apache Maven 4.0.0-rc-3 (3952d00ce65df6753b63a51e86b1f626c55a8df2)
Maven home: /Users/gnodet/.sdkman/candidates/maven/4.0.0-rc-3
[INFO] Building Apache Maven JAR Plugin 3.4.3-SNAPSHOT
[INFO] |  \- commons-io:commons-io:jar:2.16.1:compile

[jira-importer]

Slawomir Jaranowski commented

to reproduce please execute:

mvn verify -P run-its -Dinvoker.test=MJAR-307

in maven-jar-plugin, dependency:tree is ok, internal plugin resolving in Maven has issue.

[jira-importer]

Guillaume Nodet commented

Ah, I see now. The problem is in the consumer POM. I'll have a look.