Dependency convergence problem

[nielsbasjes]

While updating this library in my project to the latest 6.3.0 version I was confronted with several dependency convergence errors.
I have this check in my project: https://maven.apache.org/enforcer/enforcer-rules/dependencyConvergence.html (here: https://github.com/nielsbasjes/codeowners/blob/main/pom.xml#L392)

Proposal: You also include this check in your build and from there this problem should no longer occur.

[ERROR] Failed to execute goal org.apache.maven.plugins:maven-enforcer-plugin:3.6.2:enforce (Check build environment requirements) on project codeowners-validator: 
[ERROR] Rule 4: org.apache.maven.enforcer.rules.dependency.DependencyConvergence failed with message:
[ERROR] Failed while enforcing releasability.
[ERROR] 
[ERROR] Dependency convergence error for com.fasterxml.jackson.core:jackson-databind:jar:2.18.6. Paths to dependency are:
[ERROR] +-nl.basjes.codeowners:codeowners-validator:jar:1.14.2-SNAPSHOT
[ERROR]   +-org.gitlab4j:gitlab4j-api:jar:6.3.0:compile
[ERROR]     +-org.gitlab4j:gitlab4j-models:jar:6.3.0:compile
[ERROR]       +-com.fasterxml.jackson.core:jackson-databind:jar:2.18.6:compile
[ERROR] and
[ERROR] +-nl.basjes.codeowners:codeowners-validator:jar:1.14.2-SNAPSHOT
[ERROR]   +-org.gitlab4j:gitlab4j-api:jar:6.3.0:compile
[ERROR]     +-org.glassfish.jersey.media:jersey-media-json-jackson:jar:3.1.10:compile
[ERROR]       +-com.fasterxml.jackson.core:jackson-databind:jar:2.18.0:compile
[ERROR] and
[ERROR] +-nl.basjes.codeowners:codeowners-validator:jar:1.14.2-SNAPSHOT
[ERROR]   +-org.gitlab4j:gitlab4j-api:jar:6.3.0:compile
[ERROR]     +-org.glassfish.jersey.media:jersey-media-json-jackson:jar:3.1.10:compile
[ERROR]       +-com.fasterxml.jackson.module:jackson-module-jakarta-xmlbind-annotations:jar:2.18.0:compile
[ERROR]         +-com.fasterxml.jackson.core:jackson-databind:jar:2.18.0:compile
[ERROR] 
[ERROR] 
[ERROR] Dependency convergence error for com.fasterxml.jackson.core:jackson-annotations:jar:2.18.6. Paths to dependency are:
[ERROR] +-nl.basjes.codeowners:codeowners-validator:jar:1.14.2-SNAPSHOT
[ERROR]   +-org.gitlab4j:gitlab4j-api:jar:6.3.0:compile
[ERROR]     +-org.gitlab4j:gitlab4j-models:jar:6.3.0:compile
[ERROR]       +-com.fasterxml.jackson.core:jackson-annotations:jar:2.18.6:compile
[ERROR] and
[ERROR] +-nl.basjes.codeowners:codeowners-validator:jar:1.14.2-SNAPSHOT
[ERROR]   +-org.gitlab4j:gitlab4j-api:jar:6.3.0:compile
[ERROR]     +-org.gitlab4j:gitlab4j-models:jar:6.3.0:compile
[ERROR]       +-com.fasterxml.jackson.core:jackson-databind:jar:2.18.6:compile
[ERROR]         +-com.fasterxml.jackson.core:jackson-annotations:jar:2.18.6:compile
[ERROR] and
[ERROR] +-nl.basjes.codeowners:codeowners-validator:jar:1.14.2-SNAPSHOT
[ERROR]   +-org.gitlab4j:gitlab4j-api:jar:6.3.0:compile
[ERROR]     +-org.glassfish.jersey.media:jersey-media-json-jackson:jar:3.1.10:compile
[ERROR]       +-com.fasterxml.jackson.core:jackson-annotations:jar:2.18.0:compile
[ERROR] and
[ERROR] +-nl.basjes.codeowners:codeowners-validator:jar:1.14.2-SNAPSHOT
[ERROR]   +-org.gitlab4j:gitlab4j-api:jar:6.3.0:compile
[ERROR]     +-org.glassfish.jersey.media:jersey-media-json-jackson:jar:3.1.10:compile
[ERROR]       +-com.fasterxml.jackson.module:jackson-module-jakarta-xmlbind-annotations:jar:2.18.0:compile
[ERROR]         +-com.fasterxml.jackson.core:jackson-annotations:jar:2.18.0:compile
[ERROR] 
[ERROR] 
[ERROR] Dependency convergence error for com.fasterxml.jackson.core:jackson-core:jar:2.18.6. Paths to dependency are:
[ERROR] +-nl.basjes.codeowners:codeowners-validator:jar:1.14.2-SNAPSHOT
[ERROR]   +-org.gitlab4j:gitlab4j-api:jar:6.3.0:compile
[ERROR]     +-org.gitlab4j:gitlab4j-models:jar:6.3.0:compile
[ERROR]       +-com.fasterxml.jackson.core:jackson-databind:jar:2.18.6:compile
[ERROR]         +-com.fasterxml.jackson.core:jackson-core:jar:2.18.6:compile
[ERROR] and
[ERROR] +-nl.basjes.codeowners:codeowners-validator:jar:1.14.2-SNAPSHOT
[ERROR]   +-org.gitlab4j:gitlab4j-api:jar:6.3.0:compile
[ERROR]     +-org.glassfish.jersey.media:jersey-media-json-jackson:jar:3.1.10:compile
[ERROR]       +-com.fasterxml.jackson.module:jackson-module-jakarta-xmlbind-annotations:jar:2.18.0:compile
[ERROR]         +-com.fasterxml.jackson.core:jackson-core:jar:2.18.0:compile
[ERROR] 

[nielsbasjes]

Yes, I know the plugin I use is for Maven and not Gradle.
I assume something similar exists for Gradle.

[jmini]

If I summarize what I understood from your issue:

In gitlab4j the dependency is defined to:

• jackson 2.18.6.
• jersey to 3.1.10.

And jersey 3.1.10 has a dependency to jackson 2.18.0.

And maven is complaining about this?

[nielsbasjes]

Yes, that is correct.
Because of the way this may affect a running application there is a check in the maven-enforcer-plugin which allows for checking if this is an issue that can cause problems in down stream applications. This is what is showing these errors.

[jmini]

To be honest I am not sure how to solve this.

For me gradle or maven are solving this nicely. Even Jersey 3.1.11 has a dependency on Jackson 2.18.0 and not 2.18.6. Using the latest patch version in gitlab4j (2.18.6 and not 2.18.0) seems a better practice to me.

I am not familiar with the maven-enforcer-plugin, but can't you instruct him how to solve this kind of conflicts?

[nielsbasjes]

So the key problem is that in this kind of situation it is up to the build tool of the final application to make a choice which version is actually used.

This means that it is very likely that because your project uses gradle and mine used maven that the end result is different that what your testing actually used; simply because both tools may have possibly made a different choice.

To illustrate: gradle may have picked version 2 (which has a bug fixed) and maven picks version 1 (which still has a bug) which leads to all your tests pass and my final application fail.

For this reason I have included the maven-enforcer-plugin in my maven projects and enabled this check.

In Maven (I'm unsure about Gradle) this can be mitigated by excluding the conflicting transient dependencies (see https://maven.apache.org/enforcer/enforcer-rules/dependencyConvergence.html ) and if needed include them again as a direct dependency with a predictable version. Or use the dependencyManagement route.

Then when you test the application you are certain your part in the downstream projects has actually been tested with the desired library versions.

Which is what I had to do https://github.com/nielsbasjes/codeowners/blob/main/codeowners-validator/pom.xml#L66-L111

[jmini]

If I rephrase differently you are saying, you recommend me to downgrade the Jackson version from 2.18.6 to 2.18.0, just to be aligned with the version declared in Jersey.
The update was done by someone being annoyed by the usage of 2.18.0 due to a declared vulnerability in this version #1316, and I think this is correct.

In a perfect world (almost nobody is doing this in the java ecosystem) jersey should have a dependency to [2.18.0, 2.19.0) which is supported by Maven. I think Jackson is following the semver approach. So at the end Jersey do not care about which patch jackson version is used within the range. But this approach is not really popular in the java ecosystem (and this isn't a maven/gradle question).

I don't think I will change that. Maybe both versions will be aligned next time the jersey version is updated 🤞 .

[nielsbasjes]

No, I do not want you to downgrade anything.

What I do in my Maven projects is when I get an error as shown I look at the dependencies at hand and effectively tell maven to ignore the transient dependencies that are too old and explicitly tell it I want the latest version.

This way any users of my libraries do not get this dependency convergence error in their project because the pom of my library already has the instructions for maven how to make the correct choice.