Skip to content

Maven 3.10 omits transitive dependencies of conflicting range-resolved dependencies #13430

Open

Description

@yakugama

Affected version

3.10

Bug description

Giving following pom.xml

<project xmlns="http://maven.apache.org/POM/4.0.0">
  <modelVersion>4.0.0</modelVersion>
  <groupId>repro</groupId>
  <artifactId>repro</artifactId>
  <version>1</version>
  <dependencies>
    <dependency>
      <groupId>io.github.cdklabs</groupId>
      <artifactId>cdknag</artifactId>
      <version>2.37.55</version>
    </dependency>
    <dependency>
      <groupId>software.amazon.awscdk</groupId>
      <artifactId>aws-cdk-lib</artifactId>
      <version>2.140.0</version>
    </dependency>
    <dependency>
      <groupId>org.junit.jupiter</groupId>
      <artifactId>junit-jupiter</artifactId>
      <version>5.13.2</version>
      <scope>test</scope>
    </dependency>
  </dependencies>
</project>

and a simple test

package repro;

import static org.junit.jupiter.api.Assertions.assertNotNull;

import org.junit.jupiter.api.Test;

class AwsCliAssetTest {

    // Fails with ClassNotFound/NoClassDefFoundError when cdk-asset-awscli-v1 is missing from the classpath.
    @Test
    void awsCliAssetModuleIsOnClasspath() throws Exception {
        assertNotNull(Class.forName("software.amazon.awscdk.cdk.asset.awscli.v1.$Module"));
    }
}

Under Maven 3.10

[INFO] -------------------------------------------------------
[INFO]  T E S T S
[INFO] -------------------------------------------------------
[INFO] Running repro.AwsCliAssetTest
[ERROR] Tests run: 1, Failures: 0, Errors: 1, Skipped: 0, Time elapsed: 0.036 s <<< FAILURE! -- in repro.AwsCliAssetTest
[ERROR] repro.AwsCliAssetTest.awsCliAssetModuleIsOnClasspath -- Time elapsed: 0.020 s <<< ERROR!
java.lang.ClassNotFoundException: software.amazon.awscdk.cdk.asset.awscli.v1.$Module
        at java.base/jdk.internal.loader.BuiltinClassLoader.loadClass(BuiltinClassLoader.java:580)
        at java.base/java.lang.ClassLoader.loadClass(ClassLoader.java:490)
        at java.base/java.lang.Class.forName0(Native Method)
        at java.base/java.lang.Class.forName(Class.java:467)
        at java.base/java.lang.Class.forName(Class.java:458)
        at repro.AwsCliAssetTest.awsCliAssetModuleIsOnClasspath(AwsCliAssetTest.java:12)
        at java.base/java.lang.reflect.Method.invoke(Method.java:565)
        at java.base/java.util.ArrayList.forEach(ArrayList.java:1604)
        at java.base/java.util.ArrayList.forEach(ArrayList.java:1604)

[INFO] 
[INFO] Results:
[INFO] 
[ERROR] Errors: 
[ERROR]   AwsCliAssetTest.awsCliAssetModuleIsOnClasspath:12 » ClassNotFound software.amazon.awscdk.cdk.asset.awscli.v1.$Module
[INFO] 
[ERROR] Tests run: 1, Failures: 0, Errors: 1, Skipped: 0
[INFO] 
[INFO] ------------------------------------------------------------------------
[ERROR] BUILD FAILURE
[INFO] ------------------------------------------------------------------------

Under Maven 3.9.12

[INFO] -------------------------------------------------------
[INFO]  T E S T S
[INFO] -------------------------------------------------------
[INFO] Running repro.AwsCliAssetTest
[INFO] Tests run: 1, Failures: 0, Errors: 0, Skipped: 0, Time elapsed: 0.031 s -- in repro.AwsCliAssetTest
[INFO] 
[INFO] Results:
[INFO] 
[INFO] Tests run: 1, Failures: 0, Errors: 0, Skipped: 0

The problem is that io.github.cdklabs:cdknag:2.37.55 specifies in its pom aws-cdk-lib with range [2.176.0,3.0.0).
Maven 3.10 should at least give an error like "No versions available" instead of silently compiling with missing transitive dependencies

Activity

  1. changed the title [-]Maven 3.10 does not report "No versions available"[/-] [+]Maven 3.10 omits transitive dependencies of conflicting range-resolved dependencies[/+] on Oct 13, 2026
  2. cstamas commented on Oct 14, 2026

    @cstamas
    Member

    @efegokdemir @gnodet weird that this issue is about 3.10 and PR is for master. OTOH, even the PR is about configuring resolver. Isnt this resolver 2.x bug instead?

  3. efegokdemir commented on Oct 14, 2026

    @efegokdemir
    Contributor

    You’re right — this belongs in Resolver 2.x, not as a Maven-wide versioned default. The reproducer fails on Maven 3.10.0 and 4.0.0-rc-7, but passes on 3.9.12. The targeted fix is proposed in Resolver #2208; Maven #13453 is closed as superseded.

  4. agoffer commented on Oct 18, 2026

    @agoffer

    Second real-world reproducer, same root cause as Resolver #2208 as far as I can tell

    Affected: Maven 3.10.0 (Resolver 2.0.24). Not affected: Maven 3.9.16.

    Our project declares com.google.guava:guava:33.5.0-jre directly. A dependency’s published POM declares Guava as [15, 32) (runtime scope).

    On 3.10.0, dependency:tree -Dverbose shows 33.5.0-jre as “omitted for conflict with 31.1-jre”, and 31.1-jre has no children (failureaccess, checker-qual and so on are missing). On 3.9 the same version is selected, with all its children. The build succeeds, and we found the problem as a runtime failure after a deployment.

    On 3.10.0 the children come back with -Daether.dependencyCollector.bf.skipper=false, with =versioned, or with -Daether.dependencyCollector.impl=df. Only the default (versionless) loses them. In a CI log we also saw the POMs of 85 in-range Guava versions fetched, but none of their dependencies.

    This matches the root cause in #2208. Workaround that works for us: pin the version in dependencyManagement.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    bugSomething isn't working

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions