Transitive dependency issue

[Jeff Schnitzer]

I pushed gwizard 0.5 to maven central and updated the example. This has the com.voodoodyne.gwizard -> org.gwizard package rename.

There's a problem with the code right now though. Maven seems to be doing something retarded with transitive dependencies - pulling in the wrong version of guava. This causes the example to fail with NoSuchMethodErrors.

gwizard-parent specifies version 18 of guava in dependencyManagement. From everything I have read, this means 18 should override any transitive inclusion of guava.

However, the example app is pulling in version 16 through this chain:

[INFO] org.gwizard:gwizard-example:jar:1.0-SNAPSHOT

[INFO] +- org.gwizard:gwizard-config:jar:0.5:compile

[INFO] |  +- com.google.inject:guice:jar:4.0-beta5:compile

[INFO] |  |  \- com.google.guava:guava:jar:16.0.1:compile

This makes no sense to me. Anyone have any ideas?

Jeff

[Jon Stevens]

The problem is that you haven't explicitly included the gwizard-services dependency in the gwizard-example pom. If you don't do that, then gwizard-example has no idea which version of guava you want to include because it is only defined in the dependencyManagement section of the gwizard parent pom.

Yes, I know that gwizard-services is included as a transitive dependency, but that doesn't happen until after guava 16 is already included as a transitive dependency of something else and therefore it is an already satisfied dependency, so maven doesn't seem to go looking for the latest version of guava. Dumb.

You can kind of see this in the output of the shade plugin. Without the explicit gwizard-services dependency, guava is included near the top of the output. With it, it is included after the gwizard-services jar is added.

....

[INFO] Including javax.inject:javax.inject:jar:1 in the shaded jar.

[INFO] Including aopalliance:aopalliance:jar:1.0 in the shaded jar.

[INFO] Including com.google.guava:guava:jar:16.0.1 in the shaded jar.

[INFO] Including org.slf4j:slf4j-api:jar:1.7.7 in the shaded jar.

....

vs.

[INFO] Including org.gwizard:gwizard-services:jar:0.5 in the shaded jar.

[INFO] Including com.google.guava:guava:jar:18.0 in the shaded jar.

Seems kind of like a bug in the dependency resolution of maven or the shade plugin... I don't know which one is broken here.

jon

--
You received this message because you are subscribed to the Google Groups "GWizard Discussion" group.
To unsubscribe from this group and stop receiving emails from it, send an email to gwizard+u...@googlegroups.com.
To post to this group, send email to gwi...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/gwizard/CADK-0ugKsWQuKFS63Vp-ikN4g26MwQJ_aOVMi%3Di85hB790afqA%40mail.gmail.com.
For more options, visit https://groups.google.com/d/optout.

[Jeff Schnitzer]

This definitely seems like something broken in Maven. I posted to SO and created a JIRA issue:

http://stackoverflow.com/questions/28312975/maven-dependencymanagement-version-ignored-in-transitive-dependencies

https://jira.codehaus.org/browse/MNG-5761

Jeff

To view this discussion on the web visit https://groups.google.com/d/msgid/gwizard/CAKsoiPh-0FKXoE3FiE-fygvo1O5UBEiB-%3DhDmJmTw0pkb2U0Bg%40mail.gmail.com.