Logo Questions Linux Laravel Mysql Ubuntu Git Menu
 

Confusing transitive dependency behavior with xml-apis

In my project I depend on several external libraries that depend on various versions of xml-apis. If I use maven-enforcer-plugin to fail if there are version conflicts my build fails.

Before I started, printing the classpath of my running app gives xml-apis:xml-apis:1.4.01

When I enable maven-enforcer-plugin I get this, which is expected

Dependency convergence error for xml-apis:xml-apis:1.3.04 paths to dependency are:

+-org.bbraile:bbraile:1.0-SNAPSHOT
  +-org.bbraile:utd:1.0-SNAPSHOT
    +-xalan:xalan:2.7.2
      +-xalan:serializer:2.7.2
        +-xml-apis:xml-apis:1.3.04
and
+-org.bbraile:bbraile:1.0-SNAPSHOT
  +-org.bbraile:utd:1.0-SNAPSHOT
    +-xml-apis:xml-apis:1.4.01
and
+-org.bbraile:bbraile:1.0-SNAPSHOT
  +-org.bbraile:utd:1.0-SNAPSHOT
    +-xerces:xercesImpl:2.11.0
      +-xml-apis:xml-apis:1.4.01
and
+-org.bbraile:bbraile:1.0-SNAPSHOT
  +-com.io7m.xom:xom:1.2.10
    +-xml-apis:xml-apis:1.3.03
and
+-org.bbraile:bbraile:1.0-SNAPSHOT
  +-org.apache.xmlgraphics:batik-transcoder:1.7
    +-org.apache.xmlgraphics:batik-bridge:1.7
      +-org.apache.xmlgraphics:batik-anim:1.7
        +-xml-apis:xml-apis:1.3.04
and
+-org.bbraile:bbraile:1.0-SNAPSHOT
  +-org.apache.xmlgraphics:batik-transcoder:1.7
    +-org.apache.xmlgraphics:batik-bridge:1.7
      +-org.apache.xmlgraphics:batik-css:1.7
        +-xml-apis:xml-apis:1.3.04
and
+-org.bbraile:bbraile:1.0-SNAPSHOT
  +-org.apache.xmlgraphics:batik-transcoder:1.7
    +-org.apache.xmlgraphics:batik-bridge:1.7
      +-org.apache.xmlgraphics:batik-ext:1.7
        +-xml-apis:xml-apis:1.3.04
and
+-org.bbraile:bbraile:1.0-SNAPSHOT
  +-org.apache.xmlgraphics:batik-transcoder:1.7
    +-org.apache.xmlgraphics:batik-bridge:1.7
      +-xml-apis:xml-apis:1.3.04
and
+-org.bbraile:bbraile:1.0-SNAPSHOT
  +-org.apache.xmlgraphics:batik-transcoder:1.7
    +-org.apache.xmlgraphics:batik-dom:1.7
      +-xml-apis:xml-apis:1.3.04
and
+-org.bbraile:bbraile:1.0-SNAPSHOT
  +-org.apache.xmlgraphics:batik-transcoder:1.7
    +-org.apache.xmlgraphics:batik-gvt:1.7
      +-xml-apis:xml-apis:1.3.04
and
+-org.bbraile:bbraile:1.0-SNAPSHOT
  +-org.apache.xmlgraphics:batik-transcoder:1.7
    +-org.apache.xmlgraphics:batik-svg-dom:1.7
      +-xml-apis:xml-apis:1.3.04
and
+-org.bbraile:bbraile:1.0-SNAPSHOT
  +-org.apache.xmlgraphics:batik-transcoder:1.7
    +-org.apache.xmlgraphics:batik-svggen:1.7
      +-xml-apis:xml-apis:1.3.04
and
+-org.bbraile:bbraile:1.0-SNAPSHOT
  +-org.apache.xmlgraphics:batik-transcoder:1.7
    +-xml-apis:xml-apis:1.3.04

To fix this based on what I've read I should add this to my POM

<dependencyManagement>
    <dependencies>
        <dependency>
            <groupId>xml-apis</groupId>
            <artifactId>xml-apis</artifactId>
            <version>2.0.2</version>
        </dependency>
    </dependencies>
</dependencyManagement>

And re-run my program again. It passes maven-enforcer-plugin checks but my classpath says now I'm running xml-apis:xml-apis:1.0.b2. How did the version number get older? Why is my version getting ignored?

Adding this to my POM, with or without the <version> tag has no effect

<dependencies>
    <dependency>
        <groupId>xml-apis</groupId>
        <artifactId>xml-apis</artifactId>
        <version>2.0.2</version>
    </dependency>
</dependencies>

Consulting dependency:tree -Dverbose=true -Dincludes=xml-apis gives below, which implies 2.0.2

org.bbraile:bbraile:jar:1.0-SNAPSHOT
+- org.bbraile:utd:jar:1.0-SNAPSHOT:compile
|  +- xalan:xalan:jar:2.7.2:compile
|  |  \- xalan:serializer:jar:2.7.2:compile
|  |     \- (xml-apis:xml-apis:jar:2.0.2:compile - version managed from 1.0.b2; omitted for duplicate)
|  +- (xml-apis:xml-apis:jar:2.0.2:compile - version managed from 1.0.b2; omitted for conflict with 1.0.b2)
|  \- xerces:xercesImpl:jar:2.11.0:compile
|     \- (xml-apis:xml-apis:jar:2.0.2:compile - version managed from 1.0.b2; omitted for duplicate)
+- com.io7m.xom:xom:jar:1.2.10:compile
|  \- (xml-apis:xml-apis:jar:2.0.2:compile - version managed from 1.0.b2; omitted for duplicate)
+- org.apache.xmlgraphics:batik-transcoder:jar:1.7:compile
|  +- org.apache.xmlgraphics:batik-bridge:jar:1.7:compile
|  |  +- org.apache.xmlgraphics:batik-anim:jar:1.7:compile
|  |  |  +- (xml-apis:xml-apis:jar:2.0.2:compile - version managed from 1.0.b2; omitted for duplicate)
|  |  |  \- (xml-apis:xml-apis-ext:jar:1.3.04:compile - omitted for duplicate)
|  |  +- org.apache.xmlgraphics:batik-css:jar:1.7:compile
|  |  |  +- (xml-apis:xml-apis:jar:2.0.2:compile - version managed from 1.0.b2; omitted for duplicate)
|  |  |  \- (xml-apis:xml-apis-ext:jar:1.3.04:compile - omitted for duplicate)
|  |  +- org.apache.xmlgraphics:batik-ext:jar:1.7:compile
|  |  |  \- (xml-apis:xml-apis:jar:2.0.2:compile - version managed from 1.0.b2; omitted for duplicate)
|  |  +- (xml-apis:xml-apis:jar:2.0.2:compile - version managed from 1.0.b2; omitted for duplicate)
|  |  \- (xml-apis:xml-apis-ext:jar:1.3.04:compile - omitted for duplicate)
|  +- org.apache.xmlgraphics:batik-dom:jar:1.7:compile
|  |  +- (xml-apis:xml-apis:jar:2.0.2:compile - version managed from 1.0.b2; omitted for duplicate)
|  |  \- (xml-apis:xml-apis-ext:jar:1.3.04:compile - omitted for duplicate)
|  +- org.apache.xmlgraphics:batik-gvt:jar:1.7:compile
|  |  \- (xml-apis:xml-apis:jar:2.0.2:compile - version managed from 1.0.b2; omitted for duplicate)
|  +- org.apache.xmlgraphics:batik-svg-dom:jar:1.7:compile
|  |  +- (xml-apis:xml-apis:jar:2.0.2:compile - version managed from 1.0.b2; omitted for duplicate)
|  |  \- (xml-apis:xml-apis-ext:jar:1.3.04:compile - omitted for duplicate)
|  +- org.apache.xmlgraphics:batik-svggen:jar:1.7:compile
|  |  \- (xml-apis:xml-apis:jar:2.0.2:compile - version managed from 1.0.b2; omitted for duplicate)
|  +- (xml-apis:xml-apis:jar:2.0.2:compile - version managed from 1.0.b2; omitted for duplicate)
|  \- xml-apis:xml-apis-ext:jar:1.3.04:compile
\- xml-apis:xml-apis:jar:2.0.2:compile

Why is my explicit version in dependencyManagment being ignored? Why did setting that reduce the version on my classpath? How can I pass maven-enforcer-plugin with the most recent xml-apis version?

like image 944
TheLQ Avatar asked Mar 30 '15 19:03

TheLQ


People also ask

What are transitive dependencies in NET Core?

In our last article on Transitive dependencies in .NET Core, we understood on basics of transitive dependencies. We understood Transitive dependency occurs when your project reference a package that in turn uses or references another package. You add a package B to your project A that in turn relies on another package C.

What is the difference between direct and transitive dependency?

We understood Transitive dependency occurs when your project reference a package that in turn uses or references another package. You add a package B to your project A that in turn relies on another package C. So here A-B shows a direct dependency whereas the A-C relationship is transitive in nature.

How to list all direct and transitive dependencies using DotNet command?

NET Core Tooling dotnet command provides an easy and convenient option to list all package references including direct and transitive dependencies for a specific project. Below is a flag “–include-transitive” which can be used for getting the list of Transitive dependencies.

How to list all package references including direct and transitive dependencies?

dotnet command provides an easy and convenient option to list all package references including direct and transitive dependencies for a specific project. Below is a flag “–include-transitive” which can be used for getting the list of Transitive dependencies. The above figure shows limited transitive dependencies due to the size of the figure. 3.


Video Answer


1 Answers

Turns out this isn't a maven problem, this is a xml-api's problem. As of today this is how xml-apis:xml-apis looks in Maven Central

Very confusing xml-apis versions

If you look carefully 2.0.2 isn't the latest release, 1.4.01 is! While everybody else and their IDEs considers 2 to be greater than 1, xml-apis goes backwards.

This is extremely confusing and non-obvious, so hopefully someone finds this useful.

like image 148
TheLQ Avatar answered Oct 29 '22 21:10

TheLQ