Repository navigation
Maven 3.10 omits transitive dependencies of conflicting range-resolved dependencies #13430
Copy link
Copy link
Open
Labels
bugSomething isn't workingSomething isn't working
Description
Affected version
3.10
Bug description
Giving following pom.xml
<project xmlns="http://maven.apache.org/POM/4.0.0">
<modelVersion>4.0.0</modelVersion>
<groupId>repro</groupId>
<artifactId>repro</artifactId>
<version>1</version>
<dependencies>
<dependency>
<groupId>io.github.cdklabs</groupId>
<artifactId>cdknag</artifactId>
<version>2.37.55</version>
</dependency>
<dependency>
<groupId>software.amazon.awscdk</groupId>
<artifactId>aws-cdk-lib</artifactId>
<version>2.140.0</version>
</dependency>
<dependency>
<groupId>org.junit.jupiter</groupId>
<artifactId>junit-jupiter</artifactId>
<version>5.13.2</version>
<scope>test</scope>
</dependency>
</dependencies>
</project>
and a simple test
package repro;
import static org.junit.jupiter.api.Assertions.assertNotNull;
import org.junit.jupiter.api.Test;
class AwsCliAssetTest {
// Fails with ClassNotFound/NoClassDefFoundError when cdk-asset-awscli-v1 is missing from the classpath.
@Test
void awsCliAssetModuleIsOnClasspath() throws Exception {
assertNotNull(Class.forName("software.amazon.awscdk.cdk.asset.awscli.v1.$Module"));
}
}
Under Maven 3.10
[INFO] -------------------------------------------------------
[INFO] T E S T S
[INFO] -------------------------------------------------------
[INFO] Running repro.AwsCliAssetTest
[ERROR] Tests run: 1, Failures: 0, Errors: 1, Skipped: 0, Time elapsed: 0.036 s <<< FAILURE! -- in repro.AwsCliAssetTest
[ERROR] repro.AwsCliAssetTest.awsCliAssetModuleIsOnClasspath -- Time elapsed: 0.020 s <<< ERROR!
java.lang.ClassNotFoundException: software.amazon.awscdk.cdk.asset.awscli.v1.$Module
at java.base/jdk.internal.loader.BuiltinClassLoader.loadClass(BuiltinClassLoader.java:580)
at java.base/java.lang.ClassLoader.loadClass(ClassLoader.java:490)
at java.base/java.lang.Class.forName0(Native Method)
at java.base/java.lang.Class.forName(Class.java:467)
at java.base/java.lang.Class.forName(Class.java:458)
at repro.AwsCliAssetTest.awsCliAssetModuleIsOnClasspath(AwsCliAssetTest.java:12)
at java.base/java.lang.reflect.Method.invoke(Method.java:565)
at java.base/java.util.ArrayList.forEach(ArrayList.java:1604)
at java.base/java.util.ArrayList.forEach(ArrayList.java:1604)
[INFO]
[INFO] Results:
[INFO]
[ERROR] Errors:
[ERROR] AwsCliAssetTest.awsCliAssetModuleIsOnClasspath:12 » ClassNotFound software.amazon.awscdk.cdk.asset.awscli.v1.$Module
[INFO]
[ERROR] Tests run: 1, Failures: 0, Errors: 1, Skipped: 0
[INFO]
[INFO] ------------------------------------------------------------------------
[ERROR] BUILD FAILURE
[INFO] ------------------------------------------------------------------------
Under Maven 3.9.12
[INFO] -------------------------------------------------------
[INFO] T E S T S
[INFO] -------------------------------------------------------
[INFO] Running repro.AwsCliAssetTest
[INFO] Tests run: 1, Failures: 0, Errors: 0, Skipped: 0, Time elapsed: 0.031 s -- in repro.AwsCliAssetTest
[INFO]
[INFO] Results:
[INFO]
[INFO] Tests run: 1, Failures: 0, Errors: 0, Skipped: 0
The problem is that io.github.cdklabs:cdknag:2.37.55 specifies in its pom aws-cdk-lib with range [2.176.0,3.0.0).
Maven 3.10 should at least give an error like "No versions available" instead of silently compiling with missing transitive dependencies
Reactions are currently unavailable
Metadata
Metadata
Assignees
Labels
bugSomething isn't workingSomething isn't working
Activity
[-]Maven 3.10 does not report "No versions available"[/-][+]Maven 3.10 omits transitive dependencies of conflicting range-resolved dependencies[/+]cstamas commentedon Oct 14, 2026
@efegokdemir @gnodet weird that this issue is about 3.10 and PR is for master. OTOH, even the PR is about configuring resolver. Isnt this resolver 2.x bug instead?
efegokdemir commentedon Oct 14, 2026
You’re right — this belongs in Resolver 2.x, not as a Maven-wide
versioneddefault. The reproducer fails on Maven 3.10.0 and 4.0.0-rc-7, but passes on 3.9.12. The targeted fix is proposed in Resolver #2208; Maven #13453 is closed as superseded.