Manage commons-io via dependencyManagement#562
Open
ascheman wants to merge 1 commit into
Open
Conversation
The direct commons-io dependency was a Maven 4.0.0-rc-3-era workaround; it is unused in code and makes dependency:analyze warn about an unused declared dependency. The pin itself is still required: without it, file-management's transitive commons-io 2.19.0 wins conflict resolution against the 2.22.0 that plexus-archiver 4.12.0 expects. Moving the pin to dependencyManagement keeps the effective classpath identical (2.22.0 on Maven 3.10.0-rc-1 and 4.0.0-rc-5, verified via dependency:tree) and silences the warning. Full -P run-its passes on both Maven lines (38/38 ITs).
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The 3.x line declares
commons-io:commons-io:2.22.0as a direct compile dependency although nothing in the code uses it, so every build emits:The POM comment marks it as a Maven 4.0.0-rc-3-era workaround ("looks like dependencyManagement is not taken into account"). That behaviour is gone:
dependencyManagementis honored by current Maven 3 and 4.Note the pin itself is still required — simply removing the dependency silently downgrades commons-io:
org.apache.maven.shared:file-management:3.2.0 → commons-io:2.19.0wins first-declaration conflict resolution againstplexus-archiver:4.12.0 → commons-io:2.22.0(both depth 2), while plexus-archiver 4.12.0 expects 2.22.0. This PR therefore moves the pin into<dependencyManagement>instead of dropping it.Verified (found while verifying the 3.5.1 release candidate):
dependency:tree -Dincludes=commons-ioresolves 2.22.0 with both Maven 3.10.0-rc-1 and Maven 4.0.0-rc-5 — effective classpath unchanged.mvn clean verify -P run-itsgreen on both Maven lines: 38/38 ITs (incl. the toolchain-gated ones),dependency:analyzewarning gone.Dependabot keeps bumping the version in
dependencyManagementas before.