Mysterious maven dependency question for protobuf-java

[Michael Fong]

Hello, 

This may be a long shot, but we need some pointer on this maven mystery. I wonder if someone has encountered this before? Please also let me know if this is not the proper group for this question. Thanks in advance!

We are trying to upgrade protobuf-java lib from 3.21.11 to 3.25.5. for our project, which uses maven shade plugin to pack every dependencies classes into an uber jar. That protobuf-java is specifically declared as a direct dependency in that project pom.xml

The build log shows it's packing 3.25.5 in uber jar:

Processing JAR <my maven directory>.m2/repository/com/google/protobuf/protobuf-java/3.25.5/protobuf-java-3.25.5.jar

However, when the shade happens, it places the maven information under /META-INF/maven/ inside the uber jar but somehow places a version 3.21.12 

$> cat META-INF/maven/com.google.protobuf/protobuf-java/pom.properties
#Generated by org.apache.felix.bundleplugin
#Wed Dec 14 15:36:41 EST 2022
groupId=com.google.protobuf
artifactId=protobuf-java
version=3.21.12

This is both reproducible locally even after I clean up maven cache as well as in our Jenkins CI build.

that version 3.21.12 does not show anywhere in the dependency tree.
 

[INFO] -------------------------< com.my.application >-------------------------

[INFO] Building my-application 2.0.3-SNAPSHOT                                 [4/4]

[INFO] --------------------------------[ jar ]---------------------------------

[INFO] 

[INFO] --- maven-dependency-plugin:2.10:tree (default-cli) @ my-application ---

[INFO] com.my-application:jar:2.0.3-SNAPSHOT

[INFO] \- com.google.protobuf:protobuf-java:jar:3.25.5:compile


Even we tried other 3.25.x versions or latest 4.29.x versions. The same problem persists and always show 3.21.12 in uber jar. 

[Tomo Suzuki]

That’s an interesting problem. Try “mvn -X” for debug-print and find occurrences of “3.21”.

If that doesn’t solve it. Would you create a minimal pom.xml that reproduces the behavior?

Regards,

Tomo

--
You received this message because you are subscribed to the Google Groups "Protocol Buffers" group.
To unsubscribe from this group and stop receiving emails from it, send an email to protobuf+u...@googlegroups.com.
To view this discussion visit https://groups.google.com/d/msgid/protobuf/dfabe675-9ef9-47fd-8888-34d639ec9023n%40googlegroups.com.

[Michael Fong]

Thanks for replying and sorry for the late response. 


We didn't see any occurrences of “3.21” in “mvn -X” debug log. 

I will try to see if it's possible to create a minimal pom.xml to reproduce the issue.