Global dependency exclusions

From MNG-2031:

Transitive dependencies are cool, however, the limitations are very difficult to work around.

• specification dependencies
• jarjar dependencies (spring.jar includes all spring-xxx.jar, so no need to include them)
• remove warning on relocations for transitive dependencies (it's always difficult to tell users: that's not an error, and we can not do anything)
• poms on ibiblio are all in m2 and never change
• exclusions for transitive deps can be overriden if manually included

One cool feature would be to allow disabling transitive dependencies in the following ways:

• disable all transitive deps
• enable transitive dependencies only for modules of the same project
• enable transitive deps for specific groupIds
• disable transitive deps for specific groupIds
• have a tag/attribute to exclude all transitive deps for one dependency (instead of having list all exclusions)

Adding another possibly featured way to configure:

• disable all transitive deps for certain scopes

(e.g.: I'ld like transitive deps marked for 'runtime' and 'compile', but not for 'test')

The squeakiest tire get the oil first : That would be indeed a much wanted feature.

Gilles

Gilles Tabary

Hi,

I'm wondering why this, in my eyes, important feature won't be fixed in 2.0x but in 2.1 (next year)? The initial request is more than one year old!

My project depends on some jars but NOT on their dependencies. Neither at compile nor at test or runtime. Therefore it makes no sense to download these dependecies at all.

With the current mechanism of using the <exclusions/> element within each dependency separately causes a lot of boilerplate configuration steps. In my case for over 30 dependencies!

I like the idea of having a global <exclusion/> element within <dependencyManagement/> or allowing wildcards for artifactId and groupId or intrdoucing an attribute transitive="false" on the <dependency/> element.

Please make this a higher prio, thanks!

The main issue it that it can't be specified in the current pom model (4.0.0) and updates to the pom model require the next version aka 2.1.

There is a way to detect these creeping in, in dependency:analyze-dep-mgt and in the next enforcer release, there will be a rule that can fail the build when any excluded dependencies are found in the build.

I don't know, I will miss all of the late nights and long weekends I spend analyzing the dependency tree trying to get rid of one stupid JAR file that causes the application not to run properly. What will I do with all my extra time? Wow, maybe I can actually DEVELOP something.

I can just agree to others here, this is indeed a VERY important feature. It would ease the development a lot. As if you currently have such a bogus dependency you'll have to copy and paste every possible exclusion to every dependency. This is really ugly and costs a lot of time.

I'm currently also suffering from the lack of this feature and would be extremely grateful to see this one added
Cheers,
C

It seems to me that the original problem would be solved better by artifact substitution or aliasing rather than more exclusions. e.g if you want to use something reasonable such as slf4j to imitate commons logging usage you want to replace any dependency on commons-logging with one on jcl-over-slf4j. Similarly you might want to swap spec implementations, say to use the geronimo ones no matter which copies the original projects were built against, or use geronimo's activation implementation instead of sun's. This isn't quite the same as what osgi gives you but is quite powerful.

You are right David, that would solve the original problem in an elegant way. Is this an existing feature I missed or should we submit a new jira issue for this?

Aliasing would be nice. But I would also like to be able to specify that, for example, junit-3.8.1 should NEVER be downloaded and never be resolved as a dependency for my projects. I don't ever want junit-3.8.1 and junit-4.5 to both be in the same classpath.

This just became a total showstopper with SpringSource effectively cloning the entire maven dependency set in their "enterprise" repo.
I know that's not maven's fault, but both global exclusions (e.g. as protections again known bad poms) and aliasing (to always substitute slf4j for clogging) would really fix a lot of problems that this has caused.

That's a lovely development. If you use Nexus, you can control which artifacts come from a given repo so you can prevent the springsource repo from polluting your team. There's nothing that can be done inside maven for global exclusions until 3.0 since it requires a model change in the pom.

It's a sad thing that this will never be available for backports because the pom model cannot be changed..

This is a very much awaited feature. And though I like a lot tools of the like of Nexus (Artifactory is also very nice BTW), I think Maven should provide these mechanisms and that maybe 2.1 release was a bit rushed in this prospect.

Is there a timeframe for 3.0 already?

Why is this not planned for 2.2 for example?

Oh, and BTW: my simple wishes http://blog.zepag.org/2009/05/my-wishes-for-better-maven-2.html

Pierre,

The pom format can't be changed until Maven 3.x. The alphas of 3.x are close by, but currently it's focused on 2.x compatibility with the new code and a process to handle pom model changes hasn't been built yet.

Could this not be achieved via a new scope? I'm thinking:
<dependency>
<groupId>commons-logging</groupId>
<artifactId>commons-logging</artifactId>
<version>1.1.1</version>
<scope>excluded</scope>
</dependency>

Semantics would be that any artifactId declared in this way would be guaranteed not to be on either the test or main runtime or compile time classpath, and neither would any of its transitive dependencies, and its transitive dependencies would not be added to the declaring pom's transitive dependencies, regardless of version number or where in the transitive dependency tree it occurred.

(This is effectively how people are achieving the desired effect already, by using scope "provided" - but that has the negative that the artifact and all of its transitive dependencies are still on the compile classpath raising the possibility of errors only discovered at runtime.)

Hi Robert,

You are right to observe that the provided scope has the inconvenience of placing the thus "excluded" artifact on the project's class path within the IDE, in particular Eclipse. However, as far as I know, the artifact is effectively excluded during build time by Maven. The provided scope is unsatisfactory during development time within the IDE, i.e. within Eclipse or IDEA.

Maven definitely makes provided scope dependencies available at compile time - otherwise no library compiled against the servlet api would compile. A good example in the logging context would be someone who desired to use slf4j-over-log4j instead of log4j. Making log4j itself have scope provided would have the desired runtime behaviour of excluding the log4j jar if any transitive dependency brought it in, thereby preventing any non-determinate behaviour depending on which version of the log4j classes the classloader loaded first; however, at compile time Maven would happily be able to compile code dependent on classes that are included in log4j but are not in slf4j-over-log4j, and the user would only discover the problem at runtime.

D'oh! Thanks for the explanation.

Hello,

I gave a go at this new feature following
Rob Elliot's idea of using a

<scope>excluded</scope>

. And it works a treat for me.

I uploaded the maven changes + integration test as patches.

Thanks,
Jean-Noel

Hi, I didn't review your patch thus I won't judge about it.
I really dislike this idea to continue to play with the lake of control in old maven versions which will ignore things they don't know in the POM.
For me such change must be done only in a new POM version and with all mechanisms to be used with previous and future maven versions.
Did you test such POM with Maven 3.0.x ? I think it at least display a warning if there is a scope it doesn't know (I don't remember but perhaps it breaks the build).
And when a maven version ignores it, what does it do ? It uses the compile scope ? #fail in that case, instead of excluding it, you explicitely add it (transitively)

Cheers

Hello,

BTW the <scope>excluded</scope> solution doesn't really helps in any way to deal easily with excludes.
It looks like a hard-wired work-around.
Adding a <transitive>true|false</transitive> or a <handling>transitive|simple</handling> (maybe better to allow further unforeseen improvements) both at the level of all <dependencies></dependencies> or at the level of a single <dependency></dependency> wouldn't be hard to deal with (just a test to trigger the transitive search of the underlying tree) and would achieve the expected result.

I thought that the pom model was supposed to evolve from version 3.0.x on?

Regards.

Pierre-Antoine.

@Arnaud Sorry, I went for the easiest to implement. If you do not like it this way, fair enough, we can do it otherwise. I originally started with such change to the pom.xml:

<project>
    <dependencies>
        <exclusions>
            <exclusion>
                <groupId>com.mycompany</groupId>
                <artifactId>myproject</artifactId>
                <classifier>optional</classifier>
            </exclusion>
        </exclusions>
        <dependency>
            ...
        </dependency>
        ...
    </dependencies>
    ...
</project>

No I did not test with older versions of maven.
I saw that maven-3 has got some validation mechanism for the scope so I think it would reject it.
For maven-2 I need to check. Indeed the following scenario would be catastrophic:
"And when a maven version ignores it, what does it do ? It uses the compile scope ? #fail in that case, instead of excluding it, you explicitely add it (transitively)".
I will test both of these and let you know.

Same, it does not really matter to me which mechanism you prefer to use. Just tell me how you want it to look in the pom.xml and I can have a look at doing it.

Jean-Noel

Hi Arnaud,

You were right, using <scope>excluded</scope> with older versions of maven (I used v2.2.1) gives the opposite result to what is intended. The excluded scope is ignored and replaced with a compile scope.

How do you want to proceed now? I suppose we now need to do a pom.xml format change. If I understood correctly , this is scheduled for maven 3.1.

Do you want to go for the solution I suggested in my last comment?
http://jira.codehaus.org/browse/MNG-1977?focusedCommentId=277793&page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel#comment-277793

Or do you want to do it differently?

Please let me know your suggestions and I will try to implement it.

Thanks,
Jean-Noël

Might be that this is already commented, but here's what we need:

• Possibility to exclude transitive dependencies using groupId only (meaning all artifacts/versions within that groupId)
• Another nice feature would be, a global pom setting that says: "Use transitive dependencies during compile, but not during packaging". Meaning: You can quickly get up developing code (getting all dependencies needed), but when bundling ex a war file, exclude trans. dep. because you want to control the war content.
• Also a nice feature would be to turn off transitive dependencies all together

I think there's some allusion to a version 5 of pom.xml, which would be interesting.

If nothing else, I certainly support the idea of <scope>exclude</scope>.

It is time that we got a release that solved some of the longest standing issues and gave us an opportunity to move forwards rather than to live with backwards compatibility that kills us.

I love the idea of allowing a switch to change

compile -> compile = compile

to what was originally intended, that

compile -> compile = runtime

This would make many builds far more robust to changes in child dependencies.

@Morten: I think that "Include transitive dependencies during packaging" should rather be a feature of war, shade and other packaging plugins. There must already be enough information available to plugins through project meta-data, because maven-assembly-plugin has already got an option to filter out transitive dependencies.

@Neale: I agree that it would make a lot of sense to promote transitive compile dependencies into runtime scope, but unfortunately that does not solve the problem of polluting the runtime scope with unwanted transitive dependencies.
More flexible exclusion mechanism using patterns or some other configuration is still needed.

compile -> compile = runtime

This would make many builds far more robust to changes in child dependencies.

You can simulate this if you use a global master pom. Then you would not only set the version in the depMgmt, but also the scope of all deps to runtime. That will have the same effect, you would have to set compile scope explicitly everywhere in our project. Been there and reverted it ... you'll see yourself, if you try

Thanks for the feedback guys.

My use case is as simple as that: I want to exclude some transitive dependencies accross all dependencies to allow compiling GWT code. Otherwise I get the error "the input line is too long" on windows. So far we have to exclude the same transitive dependencies for all the dependencies where they exist which can be as many as 8 today. Not nice :-/, hence why I am looking at this solution. A simple global exclude would solve the problem for us.

It looks to me the code I did is good enough to handle my use case. I just need to know how the Maven team wants this configuration to look in the pom.xml file and then I can look at doing it.

Hello,

I gave another go at this issue.
This time, I specified the exclusions in the pom.xml file by following this approach:

<project>
  <dependencies>
    ...
  </dependencies>
  ...
  <exclusions>
    <exclusion>
      <groupId>com.mycompany</groupId>
      <artifactId>myproject</artifactId>
    </exclusion>
  </exclusions>

  ...
</project>

Please let me know what you think of these patches.

Thanks,
Jean-Noel

+1 to this, though i'm not sure if maven is still being actively developed ?

JvZ - why not Maven 3.1 for this? It's highly voted and there's a patch, yet no comment on the patch has been made. That's not good for goodwill