Dependency convergence problem

[nielsbasjes]

While updating this library in my project to the latest 6.3.0 version I was confronted with several dependency convergence errors.
I have this check in my project: https://maven.apache.org/enforcer/enforcer-rules/dependencyConvergence.html (here: https://github.com/nielsbasjes/codeowners/blob/main/pom.xml#L392)

Proposal: You also include this check in your build and from there this problem should no longer occur.

[ERROR] Failed to execute goal org.apache.maven.plugins:maven-enforcer-plugin:3.6.2:enforce (Check build environment requirements) on project codeowners-validator: 
[ERROR] Rule 4: org.apache.maven.enforcer.rules.dependency.DependencyConvergence failed with message:
[ERROR] Failed while enforcing releasability.
[ERROR] 
[ERROR] Dependency convergence error for com.fasterxml.jackson.core:jackson-databind:jar:2.18.6. Paths to dependency are:
[ERROR] +-nl.basjes.codeowners:codeowners-validator:jar:1.14.2-SNAPSHOT
[ERROR]   +-org.gitlab4j:gitlab4j-api:jar:6.3.0:compile
[ERROR]     +-org.gitlab4j:gitlab4j-models:jar:6.3.0:compile
[ERROR]       +-com.fasterxml.jackson.core:jackson-databind:jar:2.18.6:compile
[ERROR] and
[ERROR] +-nl.basjes.codeowners:codeowners-validator:jar:1.14.2-SNAPSHOT
[ERROR]   +-org.gitlab4j:gitlab4j-api:jar:6.3.0:compile
[ERROR]     +-org.glassfish.jersey.media:jersey-media-json-jackson:jar:3.1.10:compile
[ERROR]       +-com.fasterxml.jackson.core:jackson-databind:jar:2.18.0:compile
[ERROR] and
[ERROR] +-nl.basjes.codeowners:codeowners-validator:jar:1.14.2-SNAPSHOT
[ERROR]   +-org.gitlab4j:gitlab4j-api:jar:6.3.0:compile
[ERROR]     +-org.glassfish.jersey.media:jersey-media-json-jackson:jar:3.1.10:compile
[ERROR]       +-com.fasterxml.jackson.module:jackson-module-jakarta-xmlbind-annotations:jar:2.18.0:compile
[ERROR]         +-com.fasterxml.jackson.core:jackson-databind:jar:2.18.0:compile
[ERROR] 
[ERROR] 
[ERROR] Dependency convergence error for com.fasterxml.jackson.core:jackson-annotations:jar:2.18.6. Paths to dependency are:
[ERROR] +-nl.basjes.codeowners:codeowners-validator:jar:1.14.2-SNAPSHOT
[ERROR]   +-org.gitlab4j:gitlab4j-api:jar:6.3.0:compile
[ERROR]     +-org.gitlab4j:gitlab4j-models:jar:6.3.0:compile
[ERROR]       +-com.fasterxml.jackson.core:jackson-annotations:jar:2.18.6:compile
[ERROR] and
[ERROR] +-nl.basjes.codeowners:codeowners-validator:jar:1.14.2-SNAPSHOT
[ERROR]   +-org.gitlab4j:gitlab4j-api:jar:6.3.0:compile
[ERROR]     +-org.gitlab4j:gitlab4j-models:jar:6.3.0:compile
[ERROR]       +-com.fasterxml.jackson.core:jackson-databind:jar:2.18.6:compile
[ERROR]         +-com.fasterxml.jackson.core:jackson-annotations:jar:2.18.6:compile
[ERROR] and
[ERROR] +-nl.basjes.codeowners:codeowners-validator:jar:1.14.2-SNAPSHOT
[ERROR]   +-org.gitlab4j:gitlab4j-api:jar:6.3.0:compile
[ERROR]     +-org.glassfish.jersey.media:jersey-media-json-jackson:jar:3.1.10:compile
[ERROR]       +-com.fasterxml.jackson.core:jackson-annotations:jar:2.18.0:compile
[ERROR] and
[ERROR] +-nl.basjes.codeowners:codeowners-validator:jar:1.14.2-SNAPSHOT
[ERROR]   +-org.gitlab4j:gitlab4j-api:jar:6.3.0:compile
[ERROR]     +-org.glassfish.jersey.media:jersey-media-json-jackson:jar:3.1.10:compile
[ERROR]       +-com.fasterxml.jackson.module:jackson-module-jakarta-xmlbind-annotations:jar:2.18.0:compile
[ERROR]         +-com.fasterxml.jackson.core:jackson-annotations:jar:2.18.0:compile
[ERROR] 
[ERROR] 
[ERROR] Dependency convergence error for com.fasterxml.jackson.core:jackson-core:jar:2.18.6. Paths to dependency are:
[ERROR] +-nl.basjes.codeowners:codeowners-validator:jar:1.14.2-SNAPSHOT
[ERROR]   +-org.gitlab4j:gitlab4j-api:jar:6.3.0:compile
[ERROR]     +-org.gitlab4j:gitlab4j-models:jar:6.3.0:compile
[ERROR]       +-com.fasterxml.jackson.core:jackson-databind:jar:2.18.6:compile
[ERROR]         +-com.fasterxml.jackson.core:jackson-core:jar:2.18.6:compile
[ERROR] and
[ERROR] +-nl.basjes.codeowners:codeowners-validator:jar:1.14.2-SNAPSHOT
[ERROR]   +-org.gitlab4j:gitlab4j-api:jar:6.3.0:compile
[ERROR]     +-org.glassfish.jersey.media:jersey-media-json-jackson:jar:3.1.10:compile
[ERROR]       +-com.fasterxml.jackson.module:jackson-module-jakarta-xmlbind-annotations:jar:2.18.0:compile
[ERROR]         +-com.fasterxml.jackson.core:jackson-core:jar:2.18.0:compile
[ERROR] 

[nielsbasjes]

Yes, I know the plugin I use is for Maven and not Gradle.
I assume something similar exists for Gradle.

[jmini]

If I summarize what I understood from your issue:

In gitlab4j the dependency is defined to:

• jackson 2.18.6.
• jersey to 3.1.10.

And jersey 3.1.10 has a dependency to jackson 2.18.0.

And maven is complaining about this?

[nielsbasjes]

Yes, that is correct.
Because of the way this may affect a running application there is a check in the maven-enforcer-plugin which allows for checking if this is an issue that can cause problems in down stream applications. This is what is showing these errors.

[jmini]

To be honest I am not sure how to solve this.

For me gradle or maven are solving this nicely. Even Jersey 3.1.11 has a dependency on Jackson 2.18.0 and not 2.18.6. Using the latest patch version in gitlab4j (2.18.6 and not 2.18.0) seems a better practice to me.

I am not familiar with the maven-enforcer-plugin, but can't you instruct him how to solve this kind of conflicts?

[nielsbasjes]

So the key problem is that in this kind of situation it is up to the build tool of the final application to make a choice which version is actually used.

This means that it is very likely that because your project uses gradle and mine used maven that the end result is different that what your testing actually used; simply because both tools may have possibly made a different choice.

To illustrate: gradle may have picked version 2 (which has a bug fixed) and maven picks version 1 (which still has a bug) which leads to all your tests pass and my final application fail.

For this reason I have included the maven-enforcer-plugin in my maven projects and enabled this check.

In Maven (I'm unsure about Gradle) this can be mitigated by excluding the conflicting transient dependencies (see https://maven.apache.org/enforcer/enforcer-rules/dependencyConvergence.html ) and if needed include them again as a direct dependency with a predictable version. Or use the dependencyManagement route.

Then when you test the application you are certain your part in the downstream projects has actually been tested with the desired library versions.

Which is what I had to do https://github.com/nielsbasjes/codeowners/blob/main/codeowners-validator/pom.xml#L66-L111