[maven-4.0.x] Consumer POM should keep only transitive dependencies, fixes #11162 (#11163)

impl/maven-core/src/main/java/org/apache/maven/internal/transformation/impl/DefaultConsumerPomBuilder.java

@@ -29,6 +29,7 @@
 import java.util.stream.Collectors;
 
 import org.apache.maven.api.ArtifactCoordinates;
+import org.apache.maven.api.DependencyScope;
 import org.apache.maven.api.Node;
 import org.apache.maven.api.PathScope;
 import org.apache.maven.api.SessionData;
@@ -114,7 +115,7 @@ private Model buildEffectiveModel(RepositorySystemSession session, Path src) thr
             ArtifactCoordinates artifact = iSession.createArtifactCoordinates(
                     model.getGroupId(), model.getArtifactId(), model.getVersion(), null);
             Node node = iSession.collectDependencies(
-                    iSession.createDependencyCoordinates(artifact), PathScope.TEST_RUNTIME);
+                    iSession.createDependencyCoordinates(artifact), PathScope.MAIN_RUNTIME);
 
             Map<String, Node> nodes = node.stream()
                     .collect(Collectors.toMap(n -> getDependencyKey(n.getDependency()), Function.identity()));
@@ -159,20 +160,45 @@ private Model buildEffectiveModel(RepositorySystemSession session, Path src) thr
                 }
                 return dependency;
             });
+            // Only keep transitive scopes (null/empty => COMPILE)
+            directDependencies.values().removeIf(DefaultConsumerPomBuilder::hasDependencyScope);
             managedDependencies.keySet().removeAll(directDependencies.keySet());
 
             model = model.withDependencyManagement(
                             managedDependencies.isEmpty()
                                     ? null
                                     : model.getDependencyManagement().withDependencies(managedDependencies.values()))
                     .withDependencies(directDependencies.isEmpty() ? null : directDependencies.values());
+        } else {
+            // Even without dependencyManagement, filter direct dependencies to compile/runtime only
+            Map<String, Dependency> directDependencies = model.getDependencies().stream()
+                    .filter(dependency -> !"import".equals(dependency.getScope()))
+                    .collect(Collectors.toMap(
+                            DefaultConsumerPomBuilder::getDependencyKey,
+                            Function.identity(),
+                            this::merge,
+                            LinkedHashMap::new));
+            // Only keep transitive scopes
+            directDependencies.values().removeIf(DefaultConsumerPomBuilder::hasDependencyScope);
+            model = model.withDependencies(directDependencies.isEmpty() ? null : directDependencies.values());
         }
 
         return model;
     }
 
+    private static boolean hasDependencyScope(Dependency dependency) {
+        String scopeId = dependency.getScope();
+        DependencyScope scope;
+        if (scopeId == null || scopeId.isEmpty()) {
+            scope = DependencyScope.COMPILE;
+        } else {
+            scope = DependencyScope.forId(scopeId);
+        }
+        return scope == null || !scope.isTransitive();
+    }
+
     private Dependency merge(Dependency dep1, Dependency dep2) {
-        throw new IllegalArgumentException("Duplicate dependency: " + dep1);
+        throw new IllegalArgumentException("Duplicate dependency: " + getDependencyKey(dep1));
     }
 
     private static String getDependencyKey(org.apache.maven.api.Dependency dependency) {
@@ -182,7 +208,7 @@ private static String getDependencyKey(org.apache.maven.api.Dependency dependenc
 
     private static String getDependencyKey(Dependency dependency) {
         return dependency.getGroupId() + ":" + dependency.getArtifactId() + ":"
-                + (dependency.getType() != null ? dependency.getType() : "") + ":"
+                + (dependency.getType() != null ? dependency.getType() : "jar") + ":"
                 + (dependency.getClassifier() != null ? dependency.getClassifier() : "");
     }
 

its/.gitignore

@@ -1,6 +1,5 @@
 .svn
 target
-/repo
 .project
 .classpath
 .settings

its/core-it-suite/src/test/java/org/apache/maven/it/MavenITgh11162ConsumerPomScopesTest.java

@@ -0,0 +1,84 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.apache.maven.it;
+
+import java.io.Reader;
+import java.nio.file.Files;
+import java.nio.file.Path;
+import java.nio.file.Paths;
+
+import org.apache.maven.api.model.Model;
+import org.apache.maven.model.v4.MavenStaxReader;
+import org.junit.jupiter.api.Test;
+
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+
+/**
+ * Verify that consumer POM keeps only "compile" and "runtime" scoped dependencies
+ * and drops other scopes including the new scopes introduced by Maven 4.
+ */
+class MavenITgh11162ConsumerPomScopesTest extends AbstractMavenIntegrationTestCase {
+
+    MavenITgh11162ConsumerPomScopesTest() {
+        super("(4.0.0-rc-3,)");
+    }
+
+    @Test
+    void testConsumerPomFiltersScopes() throws Exception {
+        Path basedir = extractResources("/gh-11162-consumer-pom-scopes").toPath();
+
+        Verifier verifier = newVerifier(basedir.toString());
+        verifier.addCliArgument("install");
+        verifier.execute();
+        verifier.verifyErrorFreeLog();
+
+        Path consumerPom = basedir.resolve(Paths.get(
+                "target",
+                "project-local-repo",
+                "org.apache.maven.its.gh11162",
+                "consumer-pom-scopes-app",
+                "1.0",
+                "consumer-pom-scopes-app-1.0-consumer.pom"));
+        assertTrue(Files.exists(consumerPom), "consumer pom not found at " + consumerPom);
+
+        Model consumerPomModel;
+        try (Reader r = Files.newBufferedReader(consumerPom)) {
+            consumerPomModel = new MavenStaxReader().read(r);
+        }
+
+        long numDeps = consumerPomModel.getDependencies() != null
+                ? consumerPomModel.getDependencies().size()
+                : 0;
+        assertEquals(2, numDeps, "Consumer POM should keep only compile and runtime dependencies");
+
+        boolean hasCompile = consumerPomModel.getDependencies().stream()
+                .anyMatch(d -> "compile".equals(d.getScope()) && "compile-dep".equals(d.getArtifactId()));
+        boolean hasRuntime = consumerPomModel.getDependencies().stream()
+                .anyMatch(d -> "runtime".equals(d.getScope()) && "runtime-dep".equals(d.getArtifactId()));
+        assertTrue(hasCompile, "compile dependency should be present");
+        assertTrue(hasRuntime, "runtime dependency should be present");
+
+        long dropped = consumerPomModel.getDependencies().stream()
+                .map(d -> d.getScope())
+                .filter(s -> !"compile".equals(s) && !"runtime".equals(s))
+                .count();
+        assertEquals(0, dropped, "All non compile/runtime scopes should be dropped in consumer POM");
+    }
+}

its/core-it-suite/src/test/java/org/apache/maven/it/MavenITmng8527ConsumerPomTest.java

@@ -70,11 +70,11 @@ void testIt() throws Exception {
                 consumerPomLines.stream().anyMatch(s -> s.contains("<organization>")),
                 "Consumer pom should have an <organization> element");
         assertEquals(
-                2,
+                1,
                 consumerPomLines.stream()
                         .filter(s -> s.contains("<dependency>"))
                         .count(),
-                "Consumer pom should have two dependencies");
+                "Consumer pom should have one dependency");
 
         List<String> buildPomLines;
         try (Stream<String> lines = Files.lines(buildPomPath)) {

its/core-it-suite/src/test/java/org/apache/maven/it/TestSuiteOrdering.java

@@ -103,6 +103,7 @@ public TestSuiteOrdering() {
          * the tests are to finishing. Newer tests are also more likely to fail, so this is
          * a fail fast technique as well.
          */
+        suite.addTestSuite(MavenITgh11162ConsumerPomScopesTest.class);
         suite.addTestSuite(MavenITgh11181CoreExtensionsMetaVersionsTest.class);
         suite.addTestSuite(MavenITgh11055DIServiceInjectionTest.class);
         suite.addTestSuite(MavenITgh11084ReactorReaderPreferConsumerPomTest.class);

its/core-it-suite/src/test/resources/gh-11162-consumer-pom-scopes/app/pom.xml

@@ -0,0 +1,65 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<project xmlns="http://maven.apache.org/POM/4.1.0">
+  <modelVersion>4.1.0</modelVersion>
+
+  <parent>
+    <groupId>org.apache.maven.its.gh11162</groupId>
+    <artifactId>consumer-pom-scopes-parent</artifactId>
+    <version>1.0</version>
+  </parent>
+
+  <artifactId>consumer-pom-scopes-app</artifactId>
+  <packaging>jar</packaging>
+
+  <name>Maven Integration Test :: mng-8750 :: Consumer POM Scopes App</name>
+
+  <dependencies>
+    <!-- should be kept as compile -->
+    <dependency>
+      <groupId>org.apache.maven.its.gh11162</groupId>
+      <artifactId>compile-dep</artifactId>
+      <version>1.0</version>
+      <scope>compile</scope>
+    </dependency>
+
+    <!-- should be dropped (non-transitive) -->
+    <dependency>
+      <groupId>org.apache.maven.its.gh11162</groupId>
+      <artifactId>compile-only-dep</artifactId>
+      <version>1.0</version>
+      <scope>compile-only</scope>
+    </dependency>
+
+    <!-- should be dropped (non-transitive) -->
+    <dependency>
+      <groupId>org.apache.maven.its.gh11162</groupId>
+      <artifactId>test-only-dep</artifactId>
+      <version>1.0</version>
+      <scope>test-only</scope>
+    </dependency>
+
+    <!-- should be dropped (non-transitive) -->
+    <dependency>
+      <groupId>org.apache.maven.its.gh11162</groupId>
+      <artifactId>test-dep</artifactId>
+      <version>1.0</version>
+      <scope>test</scope>
+    </dependency>
+
+    <!-- should be dropped (non-compile/runtime) -->
+    <dependency>
+      <groupId>org.apache.maven.its.gh11162</groupId>
+      <artifactId>test-runtime-dep</artifactId>
+      <version>1.0</version>
+      <scope>test-runtime</scope>
+    </dependency>
+
+    <!-- should be kept as runtime -->
+    <dependency>
+      <groupId>org.apache.maven.its.gh11162</groupId>
+      <artifactId>runtime-dep</artifactId>
+      <version>1.0</version>
+      <scope>runtime</scope>
+    </dependency>
+  </dependencies>
+</project>

its/core-it-suite/src/test/resources/gh-11162-consumer-pom-scopes/pom.xml

@@ -0,0 +1,45 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!--
+Licensed to the Apache Software Foundation (ASF) under one
+or more contributor license agreements.  See the NOTICE file
+distributed with this work for additional information
+regarding copyright ownership.  The ASF licenses this file
+to you under the Apache License, Version 2.0 (the
+"License"); you may not use this file except in compliance
+with the License.  You may obtain a copy of the License at
+
+  http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing,
+software distributed under the License is distributed on an
+"AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+KIND, either express or implied.  See the License for the
+specific language governing permissions and limitations
+under the License.
+-->
+<project xmlns="http://maven.apache.org/POM/4.1.0" root="true">
+  <modelVersion>4.1.0</modelVersion>
+
+  <groupId>org.apache.maven.its.gh11162</groupId>
+  <artifactId>consumer-pom-scopes-parent</artifactId>
+  <version>1.0</version>
+  <packaging>pom</packaging>
+
+  <modules>
+    <module>app</module>
+  </modules>
+
+  <repositories>
+    <repository>
+      <releases>
+        <enabled>true</enabled>
+        <checksumPolicy>ignore</checksumPolicy>
+      </releases>
+      <snapshots>
+        <enabled>false</enabled>
+      </snapshots>
+      <id>local-test-repo</id>
+      <url>file://${project.rootDirectory}/repo</url>
+    </repository>
+  </repositories>
+</project>

its/core-it-suite/src/test/resources/gh-11162-consumer-pom-scopes/repo/org/apache/maven/its/gh11162/compile-dep/1.0/compile-dep-1.0.pom

@@ -0,0 +1,7 @@
+<project xmlns="http://maven.apache.org/POM/4.0.0">
+    <modelVersion>4.0.0</modelVersion>
+    <groupId>org.apache.maven.its.gh11162</groupId>
+    <artifactId>compile-only-dep</artifactId>
+    <version>1.0</version>
+    <packaging>jar</packaging>
+</project>

its/core-it-suite/src/test/resources/gh-11162-consumer-pom-scopes/repo/org/apache/maven/its/gh11162/compile-only-dep/1.0/compile-only-dep-1.0.pom

@@ -0,0 +1,7 @@
+<project xmlns="http://maven.apache.org/POM/4.0.0">
+    <modelVersion>4.0.0</modelVersion>
+    <groupId>org.apache.maven.its.gh11162</groupId>
+    <artifactId>compile-only-dep</artifactId>
+    <version>1.0</version>
+    <packaging>jar</packaging>
+</project>

its/core-it-suite/src/test/resources/gh-11162-consumer-pom-scopes/repo/org/apache/maven/its/gh11162/runtime-dep/1.0/runtime-dep-1.0.pom

@@ -0,0 +1,7 @@
+<project xmlns="http://maven.apache.org/POM/4.0.0">
+    <modelVersion>4.0.0</modelVersion>
+    <groupId>org.apache.maven.its.gh11162</groupId>
+    <artifactId>runtime-dep</artifactId>
+    <version>1.0</version>
+    <packaging>jar</packaging>
+</project>

its/core-it-suite/src/test/resources/gh-11162-consumer-pom-scopes/repo/org/apache/maven/its/gh11162/test-dep/1.0/test-dep-1.0.pom

@@ -0,0 +1,7 @@
+<project xmlns="http://maven.apache.org/POM/4.0.0">
+    <modelVersion>4.0.0</modelVersion>
+    <groupId>org.apache.maven.its.gh11162</groupId>
+    <artifactId>test-dep</artifactId>
+    <version>1.0</version>
+    <packaging>jar</packaging>
+</project>

its/core-it-suite/src/test/resources/gh-11162-consumer-pom-scopes/repo/org/apache/maven/its/gh11162/test-only-dep/1.0/test-only-dep-1.0.pom

@@ -0,0 +1,7 @@
+<project xmlns="http://maven.apache.org/POM/4.0.0">
+    <modelVersion>4.0.0</modelVersion>
+    <groupId>org.apache.maven.its.gh11162</groupId>
+    <artifactId>test-only-dep</artifactId>
+    <version>1.0</version>
+    <packaging>jar</packaging>
+</project>

its/core-it-suite/src/test/resources/gh-11162-consumer-pom-scopes/repo/org/apache/maven/its/gh11162/test-runtime-dep/1.0/test-runtime-dep-1.0.pom

@@ -0,0 +1,7 @@
+<project xmlns="http://maven.apache.org/POM/4.0.0">
+    <modelVersion>4.0.0</modelVersion>
+    <groupId>org.apache.maven.its.gh11162</groupId>
+    <artifactId>test-runtime-dep</artifactId>
+    <version>1.0</version>
+    <packaging>jar</packaging>
+</project>

its/core-it-suite/src/test/resources/mng-6957-buildconsumer/expected/simple-weather.pom

@@ -5,12 +5,4 @@
   <artifactId>simple-weather</artifactId>
   <version>0.9-MNG6957-SNAPSHOT</version>
   <name>Multi Chapter Simple Weather API</name>
-  <dependencies>
-    <dependency>
-      <groupId>org.sonatype.mavenbook.multi</groupId>
-      <artifactId>simple-testutils</artifactId>
-      <version>0.9-MNG6957-SNAPSHOT</version>
-      <scope>test</scope>
-    </dependency>
-  </dependencies>
 </project>