From 07811b50245ef65c3220a0b3af4a69c9b1e1f88f Mon Sep 17 00:00:00 2001
From: Basil Crow <me@basilcrow.com>
Date: Fri, 17 Dec 2021 12:34:44 -0800
Subject: [PATCH] Work around issues on 2.222.x, 2.235.x, and 2.289.x (#477)

---
 pom.xml | 64 +++++++++++++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 64 insertions(+)

diff --git a/pom.xml b/pom.xml
index f553d2050c..d3bf6a0e2f 100644
--- a/pom.xml
+++ b/pom.xml
@@ -563,6 +563,70 @@
                     <exclude>com.google.code.findbugs:jsr305</exclude> <!-- ditto -->
                     <exclude>net.java.dev.jna:jna</exclude> <!-- needed for Jenkins 1.585 and earlier -->
                     <exclude>org.kohsuke:access-modifier-annotation</exclude>
+                    <!--
+                      Work around the following require upper bound dependencies error on 2.222.x
+                      and 2.235.x:
+
+                        Require upper bound dependencies error for com.github.spotbugs:spotbugs-annotations:3.1.11 [provided] paths to dependency are:
+                        +-org.jenkins-ci.plugins:plugin:4.32-SNAPSHOT
+                          +-com.github.spotbugs:spotbugs-annotations:3.1.11 [provided]
+                        and
+                        +-org.jenkins-ci.plugins:plugin:4.32-SNAPSHOT
+                          +-org.jenkins-ci.main:jenkins-core:2.222 [provided]
+                            +-org.jenkins-ci.main:remoting:4.2 [provided] (managed) ← org.jenkins-ci.main:remoting:4.2 [provided]
+                              +-com.github.spotbugs:spotbugs-annotations:3.1.11 [provided] (managed) ← com.github.spotbugs:spotbugs-annotations:3.1.12 [provided]
+                        and
+                        +-org.jenkins-ci.plugins:plugin:4.32-SNAPSHOT
+                          +-org.jenkins-ci.main:jenkins-core:2.222 [provided]
+                            +-org.jenkins-ci.main:cli:2.222 [provided]
+                              +-com.github.spotbugs:spotbugs-annotations:3.1.11 [provided] (managed) ← com.github.spotbugs:spotbugs-annotations:3.1.12 [provided]
+
+                      In the long term, this ought to be mitigated by jenkinsci/remoting#495 (which
+                      makes Remoting's dependency on spotbugs-annotations optional) and by
+                      jenkinsci/jenkins#6066 (which makes cli's dependency on spotbugs-annotations
+                      optional).
+                    -->
+                    <exclude>com.github.spotbugs:spotbugs-annotations</exclude>
+                    <!--
+                      Work around the following require upper bound dependencies error on 2.289.x:
+
+                        Require upper bound dependencies error for org.ow2.asm:asm:9.0 [provided] paths to dependency are:
+                        +-org.jenkins-ci.plugins:plugin:4.32-SNAPSHOT
+                          +-org.kohsuke:access-modifier-annotation:1.21 [provided]
+                            +-org.ow2.asm:asm:9.0 [provided]
+                        and
+                        +-org.jenkins-ci.plugins:plugin:4.32-SNAPSHOT
+                          +-org.jenkins-ci.main:jenkins-core:2.289 [provided]
+                            +-com.github.jnr:jnr-posix:3.1.5 [provided] (managed) ← com.github.jnr:jnr-posix:3.1.5 [provided]
+                              +-com.github.jnr:jnr-ffi:2.2.2 [provided]
+                                +-org.ow2.asm:asm:9.1 [provided]
+                        and
+                        +-org.jenkins-ci.plugins:plugin:4.32-SNAPSHOT
+                          +-org.jenkins-ci.main:jenkins-core:2.289 [provided]
+                            +-com.github.jnr:jnr-posix:3.1.5 [provided] (managed) ← com.github.jnr:jnr-posix:3.1.5 [provided]
+                              +-com.github.jnr:jnr-ffi:2.2.2 [provided]
+                                +-org.ow2.asm:asm-commons:9.1 [provided]
+                                  +-org.ow2.asm:asm:9.1 [provided]
+                        and
+                        +-org.jenkins-ci.plugins:plugin:4.32-SNAPSHOT
+                          +-org.jenkins-ci.main:jenkins-core:2.289 [provided]
+                            +-com.github.jnr:jnr-posix:3.1.5 [provided] (managed) ← com.github.jnr:jnr-posix:3.1.5 [provided]
+                              +-com.github.jnr:jnr-ffi:2.2.2 [provided]
+                                +-org.ow2.asm:asm-tree:9.1 [provided]
+                                  +-org.ow2.asm:asm:9.1 [provided]
+                        and
+                        +-org.jenkins-ci.plugins:plugin:4.32-SNAPSHOT
+                          +-org.jenkins-ci.main:jenkins-core:2.289 [provided]
+                            +-com.github.jnr:jnr-posix:3.1.5 [provided] (managed) ← com.github.jnr:jnr-posix:3.1.5 [provided]
+                              +-com.github.jnr:jnr-ffi:2.2.2 [provided]
+                                +-org.ow2.asm:asm-util:9.1 [provided]
+                                  +-org.ow2.asm:asm:9.1 [provided]
+
+                      In the long term, this ought to be mitigated by jenkinsci/jenkins#6014 (which
+                      explicitly aligns ASM dependencies) and by jenkinsci/jenkins#5979 (which
+                      removes JNR).
+                    -->
+                    <exclude>org.ow2.asm:asm</exclude>
                   </excludes>
                 </requireUpperBoundDeps>
               </rules>