[MDEP-762] `mvn compile dependency:tree` and `mvn package dependency:tree` outputs different result

[jira-importer]

sify21 opened MDEP-762 and commented

I made a sample project here.

mvn compile dependency:tree

resolves one version of snappy-java

org.xerial.snappy:snappy-java:jar:1.1.4:compile

However,

mvn package dependency:tree

resolves two version of snappy-java

org.xerial.snappy:snappy-java:jar:1.1.4:compile
org.xerial.snappy:snappy-java:jar:1.1.7.2:compile

 

---

Affects: 3.0.2

Attachments:

• output1 (141.55 kB)
• output2 (151.44 kB)

[jira-importer]

Michael Osipov commented

Please paste both output.

[jira-importer]

sify21 commented

Michael Osipov sorry for late reply

output for mvn compile dependency:tree

[^output1]

output for mvn pacakge dependency:tree

[^output2]

[wilx]

I reproduced this using the linked sify21/mvntest project, isolating the affected abc-flink module. This is not caused by dependency:tree; it is a side effect of the old Maven Shade Plugin modifying the in-memory Maven project while creating the dependency-reduced POM.

With Maven 3.9.16 and the current maven-dependency-plugin (3.11.1-SNAPSHOT):

• Shade 3.0.0 and 3.2.0 reproduce the report: the compile tree selects snappy-java:1.1.4, while the tree after package selects 1.1.7.2.
• Shade 3.2.2, 3.4.0, and 3.6.2 produce identical compile/package trees, selecting 1.1.4.

The old Shade implementation adds an exclusion for flink-runtime_2.11 to the direct, provided flink-streaming-java_2.11 dependency and modifies the corresponding Maven-owned dependency object. The later dependency:tree invocation therefore no longer sees this path:

flink-streaming-java_2.11 (provided)
\- flink-runtime_2.11 (provided)
   \- snappy-java:1.1.4

Once that path is removed, the remaining Kafka path selects snappy-java:1.1.7.2. Scope mediation explains the version change, but dependency:tree is accurately reporting the already-modified project graph.

This specific problem was fixed by MSHADE-311 in Maven Shade Plugin 3.2.2, which stopped adding exclusions for provided transitive dependencies. Upgrading the Shade Plugin resolves the reproducer; disabling createDependencyReducedPom is a workaround for older versions.

I think this issue can be closed as fixed in Maven Shade Plugin 3.2.2; no Maven Dependency Plugin change is needed.