[MENFORCER-466] RequireUpperBoundDeps fails on provided dependencies since 3.2.1 (original) (raw)

The attached pom.xml works fine for

mvn enforcer:enforce -Dversion.maven-enforcer-plugin=3.1.0

but

mvn enforcer:enforce -Dversion.maven-enforcer-plugin=3.2.1

fails with

Rule 0: org.apache.maven.enforcer.rules.dependency.RequireUpperBoundDeps failed with message: Failed while enforcing RequireUpperBoundDeps. The error(s) are [ Require upper bound dependencies error for org.apache.maven:maven-model:3.8.5 [provided] paths to dependency are: +-com.canda.maven:mvnbase-maven-plugin:1.0.0-local-SNAPSHOT   +-org.apache.maven:maven-plugin-api:3.8.5 [provided]     +-org.apache.maven:maven-model:3.8.5 [provided] and +-com.canda.maven:mvnbase-maven-plugin:1.0.0-local-SNAPSHOT   +-org.apache.maven:maven-core:3.8.7 [provided]     +-org.apache.maven:maven-model:3.8.7 [provided] and +-com.canda.maven:mvnbase-maven-plugin:1.0.0-local-SNAPSHOT   +-org.apache.maven:maven-core:3.8.7 [provided]     +-org.apache.maven:maven-model-builder:3.8.7 [provided]       +-org.apache.maven:maven-model:3.8.7 [provided] and +-com.canda.maven:mvnbase-maven-plugin:1.0.0-local-SNAPSHOT   +-org.apache.maven:maven-core:3.8.7 [provided]     +-org.apache.maven:maven-resolver-provider:3.8.7 [provided]       +-org.apache.maven:maven-model:3.8.7 [provided]

Similar to dependencyConvergence ( https://issues.apache.org/jira/browse/MENFORCER-407?page=com.atlassian.jira.plugin.system.issuetabpanels%3Acomment-tabpanel&focusedCommentId=17683326#comment-17683326 ) the updated plugin

seems to check "provided" dependencies for upperBounds.

All provided dependencies (at least the transitive ones?) needs to be ignored by RequireUpperBoundDeps.