From 6bc1e86ab0a7a1ee02410e03c89afed64cc8c352 Mon Sep 17 00:00:00 2001 From: elharo Date: Tue, 7 Jul 2026 12:02:21 +0000 Subject: [PATCH 1/2] MDEP-1645: fix duplicated ignored dependencies in verbose analyze output filterDependencies returns the full input set when excludes is null or empty, telling callers that every artifact was excluded. This causes all artifacts to appear in both the warning and ignored sections when dependency:analyze -Dverbose runs with no ignoredDependencies configured. Return an empty set instead when no exclude patterns are provided, which correctly communicates that nothing was excluded. --- .../invoker.properties | 18 ++++++ .../pom.xml | 61 +++++++++++++++++++ .../src/main/java/test/App.java | 25 ++++++++ .../verify.groovy | 35 +++++++++++ .../analyze/AbstractAnalyzeMojo.java | 12 +++- 5 files changed, 150 insertions(+), 1 deletion(-) create mode 100644 src/it/projects/mdep-1645-verbose-no-duplicate-ignored/invoker.properties create mode 100644 src/it/projects/mdep-1645-verbose-no-duplicate-ignored/pom.xml create mode 100644 src/it/projects/mdep-1645-verbose-no-duplicate-ignored/src/main/java/test/App.java create mode 100644 src/it/projects/mdep-1645-verbose-no-duplicate-ignored/verify.groovy diff --git a/src/it/projects/mdep-1645-verbose-no-duplicate-ignored/invoker.properties b/src/it/projects/mdep-1645-verbose-no-duplicate-ignored/invoker.properties new file mode 100644 index 000000000..4bbc5ed10 --- /dev/null +++ b/src/it/projects/mdep-1645-verbose-no-duplicate-ignored/invoker.properties @@ -0,0 +1,18 @@ +# Licensed to the Apache Software Foundation (ASF) under one +# or more contributor license agreements. See the NOTICE file +# distributed with this work for additional information +# regarding copyright ownership. The ASF licenses this file +# to you under the Apache License, Version 2.0 (the +# "License"); you may not use this file except in compliance +# with the License. You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, +# software distributed under the License is distributed on an +# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY +# KIND, either express or implied. See the License for the +# specific language governing permissions and limitations +# under the License. + +invoker.goals = clean ${project.groupId}:${project.artifactId}:${project.version}:analyze diff --git a/src/it/projects/mdep-1645-verbose-no-duplicate-ignored/pom.xml b/src/it/projects/mdep-1645-verbose-no-duplicate-ignored/pom.xml new file mode 100644 index 000000000..9c2379113 --- /dev/null +++ b/src/it/projects/mdep-1645-verbose-no-duplicate-ignored/pom.xml @@ -0,0 +1,61 @@ + + + + + + 4.0.0 + + org.apache.maven.its.dependency + mdep-1645 + 1.0-SNAPSHOT + + Test + + Test dependency:analyze -Dverbose does not duplicate entries in ignored section + + + + UTF-8 + + + + + org.apache.commons + commons-text + 1.10.0 + + + + + + + + maven-dependency-plugin + @project.version@ + + true + + + + + + diff --git a/src/it/projects/mdep-1645-verbose-no-duplicate-ignored/src/main/java/test/App.java b/src/it/projects/mdep-1645-verbose-no-duplicate-ignored/src/main/java/test/App.java new file mode 100644 index 000000000..4d20ae366 --- /dev/null +++ b/src/it/projects/mdep-1645-verbose-no-duplicate-ignored/src/main/java/test/App.java @@ -0,0 +1,25 @@ +/* + * Licensed to the Apache Software Foundation (ASF) under one + * or more contributor license agreements. See the NOTICE file + * distributed with this work for additional information + * regarding copyright ownership. The ASF licenses this file + * to you under the Apache License, Version 2.0 (the + * "License"); you may not use this file except in compliance + * with the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, + * software distributed under the License is distributed on an + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + * KIND, either express or implied. See the License for the + * specific language governing permissions and limitations + * under the License. + */ +package test; +import org.apache.commons.lang3.StringUtils; +public class App { + public void test() { + System.out.println(StringUtils.capitalize("hello")); + } +} diff --git a/src/it/projects/mdep-1645-verbose-no-duplicate-ignored/verify.groovy b/src/it/projects/mdep-1645-verbose-no-duplicate-ignored/verify.groovy new file mode 100644 index 000000000..f308fc2aa --- /dev/null +++ b/src/it/projects/mdep-1645-verbose-no-duplicate-ignored/verify.groovy @@ -0,0 +1,35 @@ +/* + * Licensed to the Apache Software Foundation (ASF) under one + * or more contributor license agreements. See the NOTICE file + * distributed with this work for additional information + * regarding copyright ownership. The ASF licenses this file + * to you under the Apache License, Version 2.0 (the + * "License"); you may not use this file except in compliance + * with the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, + * software distributed under the License is distributed on an + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + * KIND, either express or implied. See the License for the + * specific language governing permissions and limitations + * under the License. + */ + +File buildLog = new File( basedir, "build.log" ) +assert buildLog.exists() + +String log = buildLog.getText( "UTF-8" ) + +// warning sections should be present +assert log.contains( '[WARNING] Used undeclared dependencies found:' ) +assert log.contains( '[WARNING] org.apache.commons:commons-lang3:jar:3.12.0:compile' ) +assert log.contains( '[WARNING] Unused declared dependencies found:' ) +assert log.contains( '[WARNING] org.apache.commons:commons-text:jar:1.10.0:compile' ) + +// when no ignoredDependencies are configured, the ignored sections should not appear +assert !log.contains( 'Ignored used undeclared dependencies' ) +assert !log.contains( 'Ignored unused declared dependencies' ) + +return true diff --git a/src/main/java/org/apache/maven/plugins/dependency/analyze/AbstractAnalyzeMojo.java b/src/main/java/org/apache/maven/plugins/dependency/analyze/AbstractAnalyzeMojo.java index 56324c0af..15673ff46 100644 --- a/src/main/java/org/apache/maven/plugins/dependency/analyze/AbstractAnalyzeMojo.java +++ b/src/main/java/org/apache/maven/plugins/dependency/analyze/AbstractAnalyzeMojo.java @@ -21,6 +21,7 @@ import java.io.File; import java.io.StringWriter; import java.util.Arrays; +import java.util.Collections; import java.util.Iterator; import java.util.LinkedHashMap; import java.util.LinkedHashSet; @@ -558,9 +559,18 @@ private void writeScriptableOutput(Set artifacts) { } } + /** + * Removes artifacts matching any of the given exclude patterns from the source set + * and returns the removed artifacts. When {@code excludes} is null or empty, no + * artifacts are removed and an empty set is returned. + * + * @param artifacts the source set of artifacts (mutated in place) + * @param excludes exclude patterns, may be null or empty + * @return the artifacts that were removed from the source set + */ private Set filterDependencies(Set artifacts, String[] excludes) { if (excludes == null || excludes.length == 0) { - return artifacts; + return Collections.emptySet(); } ArtifactFilter filter = new StrictPatternExcludesArtifactFilter(Arrays.asList(excludes)); Set result = new LinkedHashSet<>(); From 468626eb3fb524c9aa59289883eaa397736b69aa Mon Sep 17 00:00:00 2001 From: Elliotte Rusty Harold Date: Tue, 7 Jul 2026 12:46:58 +0000 Subject: [PATCH 2/2] Potential fix for pull request finding Add an assertion for a class line that only appears in verbose output for used-undeclared dependencies. Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> --- .../mdep-1645-verbose-no-duplicate-ignored/verify.groovy | 1 + 1 file changed, 1 insertion(+) diff --git a/src/it/projects/mdep-1645-verbose-no-duplicate-ignored/verify.groovy b/src/it/projects/mdep-1645-verbose-no-duplicate-ignored/verify.groovy index f308fc2aa..69edae40e 100644 --- a/src/it/projects/mdep-1645-verbose-no-duplicate-ignored/verify.groovy +++ b/src/it/projects/mdep-1645-verbose-no-duplicate-ignored/verify.groovy @@ -25,6 +25,7 @@ String log = buildLog.getText( "UTF-8" ) // warning sections should be present assert log.contains( '[WARNING] Used undeclared dependencies found:' ) assert log.contains( '[WARNING] org.apache.commons:commons-lang3:jar:3.12.0:compile' ) +assert log.contains( '[WARNING] class org.apache.commons.lang3.StringUtils' ) assert log.contains( '[WARNING] Unused declared dependencies found:' ) assert log.contains( '[WARNING] org.apache.commons:commons-text:jar:1.10.0:compile' )