Plugins with an undeclared but transitive dependency on plexus-utils via a core artifact get wrong version of p-u

• Complexity:

  Intermediate

An excerpt from a plugin's dependency tree

[INFO] org.apache.maven.plugins:maven-resources-plugin:maven-plugin:2.2
[INFO] +- org.apache.maven:maven-plugin-api:jar:2.0:compile
[INFO] +- org.apache.maven:maven-project:jar:2.0:compile
[INFO] |  +- org.codehaus.plexus:plexus-utils:jar:1.0.4:compile

Note that the plugin has an indirect dependency on plexus-utils:1.0.4 via maven-project.

Maven curently filters out core artifacts and their transitive dependencies from the plugin realm. Given the above example, this also removes plexus-utils from the plugin artifacts. Maven 2.x injects plexus-utils:1.1 instead, Maven 3.x injects the plexus-utils from its distro. In both cases, the plugin ends up with a different version of plexus-utils than it was compiled/tested with, giving rise to linkage errors or wrong plugin behavior.

The issue is theoretically not limited to plexus-utils but it's the most prominent example.