Repository navigation
Maven 3.10 omits transitive dependencies of conflicting range-resolved dependencies #13430
Copy link
Copy link
Open
Labels
bugSomething isn't workingSomething isn't working
Description
Affected version
3.10
Bug description
Giving following pom.xml
<project xmlns="http://maven.apache.org/POM/4.0.0">
<modelVersion>4.0.0</modelVersion>
<groupId>repro</groupId>
<artifactId>repro</artifactId>
<version>1</version>
<dependencies>
<dependency>
<groupId>io.github.cdklabs</groupId>
<artifactId>cdknag</artifactId>
<version>2.37.55</version>
</dependency>
<dependency>
<groupId>software.amazon.awscdk</groupId>
<artifactId>aws-cdk-lib</artifactId>
<version>2.140.0</version>
</dependency>
<dependency>
<groupId>org.junit.jupiter</groupId>
<artifactId>junit-jupiter</artifactId>
<version>5.13.2</version>
<scope>test</scope>
</dependency>
</dependencies>
</project>
and a simple test
package repro;
import static org.junit.jupiter.api.Assertions.assertNotNull;
import org.junit.jupiter.api.Test;
class AwsCliAssetTest {
// Fails with ClassNotFound/NoClassDefFoundError when cdk-asset-awscli-v1 is missing from the classpath.
@Test
void awsCliAssetModuleIsOnClasspath() throws Exception {
assertNotNull(Class.forName("software.amazon.awscdk.cdk.asset.awscli.v1.$Module"));
}
}
Under Maven 3.10
[INFO] -------------------------------------------------------
[INFO] T E S T S
[INFO] -------------------------------------------------------
[INFO] Running repro.AwsCliAssetTest
[ERROR] Tests run: 1, Failures: 0, Errors: 1, Skipped: 0, Time elapsed: 0.036 s <<< FAILURE! -- in repro.AwsCliAssetTest
[ERROR] repro.AwsCliAssetTest.awsCliAssetModuleIsOnClasspath -- Time elapsed: 0.020 s <<< ERROR!
java.lang.ClassNotFoundException: software.amazon.awscdk.cdk.asset.awscli.v1.$Module
at java.base/jdk.internal.loader.BuiltinClassLoader.loadClass(BuiltinClassLoader.java:580)
at java.base/java.lang.ClassLoader.loadClass(ClassLoader.java:490)
at java.base/java.lang.Class.forName0(Native Method)
at java.base/java.lang.Class.forName(Class.java:467)
at java.base/java.lang.Class.forName(Class.java:458)
at repro.AwsCliAssetTest.awsCliAssetModuleIsOnClasspath(AwsCliAssetTest.java:12)
at java.base/java.lang.reflect.Method.invoke(Method.java:565)
at java.base/java.util.ArrayList.forEach(ArrayList.java:1604)
at java.base/java.util.ArrayList.forEach(ArrayList.java:1604)
[INFO]
[INFO] Results:
[INFO]
[ERROR] Errors:
[ERROR] AwsCliAssetTest.awsCliAssetModuleIsOnClasspath:12 » ClassNotFound software.amazon.awscdk.cdk.asset.awscli.v1.$Module
[INFO]
[ERROR] Tests run: 1, Failures: 0, Errors: 1, Skipped: 0
[INFO]
[INFO] ------------------------------------------------------------------------
[ERROR] BUILD FAILURE
[INFO] ------------------------------------------------------------------------
Under Maven 3.9.12
[INFO] -------------------------------------------------------
[INFO] T E S T S
[INFO] -------------------------------------------------------
[INFO] Running repro.AwsCliAssetTest
[INFO] Tests run: 1, Failures: 0, Errors: 0, Skipped: 0, Time elapsed: 0.031 s -- in repro.AwsCliAssetTest
[INFO]
[INFO] Results:
[INFO]
[INFO] Tests run: 1, Failures: 0, Errors: 0, Skipped: 0
The problem is that io.github.cdklabs:cdknag:2.37.55 specifies in its pom aws-cdk-lib with range [2.176.0,3.0.0).
Maven 3.10 should at least give an error like "No versions available" instead of silently compiling with missing transitive dependencies
Reactions are currently unavailable
Metadata
Metadata
Assignees
Labels
bugSomething isn't workingSomething isn't working
Activity
[-]Maven 3.10 does not report "No versions available"[/-][+]Maven 3.10 omits transitive dependencies of conflicting range-resolved dependencies[/+]cstamas commentedon Oct 14, 2026
@efegokdemir @gnodet weird that this issue is about 3.10 and PR is for master. OTOH, even the PR is about configuring resolver. Isnt this resolver 2.x bug instead?
efegokdemir commentedon Oct 14, 2026
You’re right — this belongs in Resolver 2.x, not as a Maven-wide
versioneddefault. The reproducer fails on Maven 3.10.0 and 4.0.0-rc-7, but passes on 3.9.12. The targeted fix is proposed in Resolver #2208; Maven #13453 is closed as superseded.agoffer commentedon Oct 18, 2026
Second real-world reproducer, same root cause as Resolver #2208 as far as I can tell
Affected: Maven 3.10.0 (Resolver 2.0.24). Not affected: Maven 3.9.16.
Our project declares
com.google.guava:guava:33.5.0-jredirectly. A dependency’s published POM declares Guava as[15, 32)(runtime scope).On 3.10.0,
dependency:tree -Dverboseshows 33.5.0-jre as “omitted for conflict with 31.1-jre”, and 31.1-jre has no children (failureaccess, checker-qual and so on are missing). On 3.9 the same version is selected, with all its children. The build succeeds, and we found the problem as a runtime failure after a deployment.On 3.10.0 the children come back with
-Daether.dependencyCollector.bf.skipper=false, with=versioned, or with-Daether.dependencyCollector.impl=df. Only the default (versionless) loses them. In a CI log we also saw the POMs of 85 in-range Guava versions fetched, but none of their dependencies.This matches the root cause in #2208. Workaround that works for us: pin the version in
dependencyManagement.Fix skipping of version-range candidates (#2208)