Whitelist dependency for dependencyConvergence rule in Maven Enforcer plugin

301 views Asked by At

I have the following Maven dependency in the tree:

...
[INFO] |  |  |  \- io.netty:netty-tcnative-boringssl-static:jar:2.0.50.Final:compile
[INFO] |  |  |     +- io.netty:netty-tcnative-classes:jar:2.0.48.Final:compile
[INFO] |  |  |     +- io.netty:netty-tcnative-boringssl-static:jar:linux-x86_64:2.0.48.Final:compile
[INFO] |  |  |     +- io.netty:netty-tcnative-boringssl-static:jar:linux-aarch_64:2.0.48.Final:compile
[INFO] |  |  |     +- io.netty:netty-tcnative-boringssl-static:jar:osx-x86_64:2.0.48.Final:compile
[INFO] |  |  |     +- io.netty:netty-tcnative-boringssl-static:jar:osx-aarch_64:2.0.48.Final:compile
[INFO] |  |  |     \- io.netty:netty-tcnative-boringssl-static:jar:windows-x86_64:2.0.48.Final:compile
...

This is flagged by the dependencyConvergence rule of Maven Enforcer plugin like below:

[WARNING] 
Dependency convergence error for io.netty:netty-tcnative-boringssl-static:2.0.50.Final paths to dependency are:
+-com.twitter:finagle-http_2.12:22.2.0
  +-io.netty:netty-tcnative-boringssl-static:2.0.50.Final
and
+-com.twitter:finagle-http_2.12:22.2.0
  +-io.netty:netty-tcnative-boringssl-static:2.0.50.Final
    +-io.netty:netty-tcnative-boringssl-static:2.0.48.Final

And here is the plugin configuration:

<plugin>
    <groupId>org.apache.maven.plugins</groupId>
    <artifactId>maven-enforcer-plugin</artifactId>
    <version>${enforce-plugin.version}</version>
    <executions>
        <execution>
            <id>enforce-banned-dependencies</id>
            <goals>
                <goal>enforce</goal>
            </goals>
        </execution>
    </executions>
    <configuration>
        <rules>
            <dependencyConvergence>
                <uniqueVersions>true</uniqueVersions>
            </dependencyConvergence>
        </rules>
        <fail>true</fail>
    </configuration>
</plugin>

This cannot be fixed by excluding the conflicting dependency, so is there a way to configure the plugin to just ignore this dependency?

EDIT:

After updating the maven-enforcer-plugin to latest version, the issue is still there, but the error message changed a bit:

Dependency convergence error for io.netty:netty-tcnative-boringssl-static:jar:2.0.50.Final:compile paths to dependency are:

+-com.ing.wbs.toolkit:wbs-toolkit-tpa-httpclient:jar:5.5.0
  +-com.ing.apisdk:toolkit-connectivity-transport-http_2.12:jar:20.1.0:compile
    +-com.twitter:finagle-http_2.12:jar:22.2.0:compile
      +-io.netty:netty-tcnative-boringssl-static:jar:2.0.50.Final:compile
and
+-com.ing.wbs.toolkit:wbs-toolkit-tpa-httpclient:jar:5.5.0
  +-com.ing.apisdk:toolkit-connectivity-transport-http_2.12:jar:20.1.0:compile
    +-com.twitter:finagle-http_2.12:jar:22.2.0:compile
      +-io.netty:netty-tcnative-boringssl-static:jar:2.0.50.Final:compile
        +-io.netty:netty-tcnative-boringssl-static:jar:linux-x86_64:2.0.48.Final:compile

So it seems that the netty-tcnative-boringssl-static library has a dependency to an older version of an architecture-specific version of itself; still, maven-enforcer thinks it's just an older version of itself and flags it as an issue.

0

There are 0 answers