Conversation
elharo
changed the title
filterDependencies returns the full input set when excludes is null or empty, telling callers that every artifact was excluded. This causes all artifacts to appear in both the warning and ignored sections when dependency:analyze -Dverbose runs with no ignoredDependencies configured. Return an empty set instead when no exclude patterns are provided, which correctly communicates that nothing was excluded.
elharo
changed the title
There was a problem hiding this comment.
Pull request overview
Fixes incorrect dependency:analyze -Dverbose output where dependencies were erroneously reported under both warning sections and “Ignored …” sections when no ignored/exclude patterns are configured, by correcting the contract of filterDependencies() and adding an integration test to prevent regressions.
Changes:
- Fix
filterDependencies()to return an empty set (instead of the full input set) when no exclude patterns are provided. - Add a new IT project reproducing #1645 and verifying that “Ignored …” sections are not printed when nothing is configured to be ignored.
- Improve in-code documentation for
filterDependencies()with a clearer contract description.
Reviewed changes
Copilot reviewed 5 out of 5 changed files in this pull request and generated 1 comment.
Show a summary per file
| File | Description |
|---|---|
| src/main/java/org/apache/maven/plugins/dependency/analyze/AbstractAnalyzeMojo.java | Corrects filterDependencies() behavior for null/empty excludes and documents the method contract. |
| src/it/projects/mdep-1645-verbose-no-duplicate-ignored/verify.groovy | Verifies verbose analyze warnings appear and that “Ignored …” sections do not appear when not configured. |
| src/it/projects/mdep-1645-verbose-no-duplicate-ignored/src/main/java/test/App.java | Provides bytecode usage of a transitive dependency to trigger “used undeclared” in analyze. |
| src/it/projects/mdep-1645-verbose-no-duplicate-ignored/pom.xml | Declares commons-text and configures verbose output for the dependency plugin under test. |
| src/it/projects/mdep-1645-verbose-no-duplicate-ignored/invoker.properties | Runs the dependency:analyze goal for the new IT project. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Add an assertion for a class line that only appears in verbose output for used-undeclared dependencies. Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
dependency:analyze -Dverboseprints every dependency in both the warning section and the "Ignored" section when noignoredDependenciesare configured.fixes #1645
Root cause
filterDependencies()returns the full inputartifactsset whenexcludesis null or empty (line 563). The method is meant to return the artifacts that were excluded (matched an exclude pattern). When no patterns are given, nothing was excluded, so it should return an empty set. Returning the full set instead tells all 8 callers that "everything was excluded," filling the ignored sections with duplicates.Fix
One-line change in
AbstractAnalyzeMojo.java:563:instead of:
Integration test
Added
mdep-1645-verbose-no-duplicate-ignoredIT that:commons-text, usescommons-lang3(transitive)dependency:analyze -Dverbosewith noignoredDependenciesThe test fails at HEAD and passes with the fix.
PR contains: