Skip to content

Maven 3.10 omits transitive dependencies of conflicting range-resolved dependencies #13430

Open

Description

@yakugama

Affected version

3.10

Bug description

Giving following pom.xml

<project xmlns="http://maven.apache.org/POM/4.0.0">
  <modelVersion>4.0.0</modelVersion>
  <groupId>repro</groupId>
  <artifactId>repro</artifactId>
  <version>1</version>
  <dependencies>
    <dependency>
      <groupId>io.github.cdklabs</groupId>
      <artifactId>cdknag</artifactId>
      <version>2.37.55</version>
    </dependency>
    <dependency>
      <groupId>software.amazon.awscdk</groupId>
      <artifactId>aws-cdk-lib</artifactId>
      <version>2.140.0</version>
    </dependency>
    <dependency>
      <groupId>org.junit.jupiter</groupId>
      <artifactId>junit-jupiter</artifactId>
      <version>5.13.2</version>
      <scope>test</scope>
    </dependency>
  </dependencies>
</project>

and a simple test

package repro;

import static org.junit.jupiter.api.Assertions.assertNotNull;

import org.junit.jupiter.api.Test;

class AwsCliAssetTest {

    // Fails with ClassNotFound/NoClassDefFoundError when cdk-asset-awscli-v1 is missing from the classpath.
    @Test
    void awsCliAssetModuleIsOnClasspath() throws Exception {
        assertNotNull(Class.forName("software.amazon.awscdk.cdk.asset.awscli.v1.$Module"));
    }
}

Under Maven 3.10

[INFO] -------------------------------------------------------
[INFO]  T E S T S
[INFO] -------------------------------------------------------
[INFO] Running repro.AwsCliAssetTest
[ERROR] Tests run: 1, Failures: 0, Errors: 1, Skipped: 0, Time elapsed: 0.036 s <<< FAILURE! -- in repro.AwsCliAssetTest
[ERROR] repro.AwsCliAssetTest.awsCliAssetModuleIsOnClasspath -- Time elapsed: 0.020 s <<< ERROR!
java.lang.ClassNotFoundException: software.amazon.awscdk.cdk.asset.awscli.v1.$Module
        at java.base/jdk.internal.loader.BuiltinClassLoader.loadClass(BuiltinClassLoader.java:580)
        at java.base/java.lang.ClassLoader.loadClass(ClassLoader.java:490)
        at java.base/java.lang.Class.forName0(Native Method)
        at java.base/java.lang.Class.forName(Class.java:467)
        at java.base/java.lang.Class.forName(Class.java:458)
        at repro.AwsCliAssetTest.awsCliAssetModuleIsOnClasspath(AwsCliAssetTest.java:12)
        at java.base/java.lang.reflect.Method.invoke(Method.java:565)
        at java.base/java.util.ArrayList.forEach(ArrayList.java:1604)
        at java.base/java.util.ArrayList.forEach(ArrayList.java:1604)

[INFO] 
[INFO] Results:
[INFO] 
[ERROR] Errors: 
[ERROR]   AwsCliAssetTest.awsCliAssetModuleIsOnClasspath:12 » ClassNotFound software.amazon.awscdk.cdk.asset.awscli.v1.$Module
[INFO] 
[ERROR] Tests run: 1, Failures: 0, Errors: 1, Skipped: 0
[INFO] 
[INFO] ------------------------------------------------------------------------
[ERROR] BUILD FAILURE
[INFO] ------------------------------------------------------------------------

Under Maven 3.9.12

[INFO] -------------------------------------------------------
[INFO]  T E S T S
[INFO] -------------------------------------------------------
[INFO] Running repro.AwsCliAssetTest
[INFO] Tests run: 1, Failures: 0, Errors: 0, Skipped: 0, Time elapsed: 0.031 s -- in repro.AwsCliAssetTest
[INFO] 
[INFO] Results:
[INFO] 
[INFO] Tests run: 1, Failures: 0, Errors: 0, Skipped: 0

The problem is that io.github.cdklabs:cdknag:2.37.55 specifies in its pom aws-cdk-lib with range [2.176.0,3.0.0).
Maven 3.10 should at least give an error like "No versions available" instead of silently compiling with missing transitive dependencies

Activity

  1. changed the title [-]Maven 3.10 does not report "No versions available"[/-] [+]Maven 3.10 omits transitive dependencies of conflicting range-resolved dependencies[/+] on Oct 13, 2026
  2. cstamas commented on Oct 14, 2026

    @cstamas
    Member

    @efegokdemir @gnodet weird that this issue is about 3.10 and PR is for master. OTOH, even the PR is about configuring resolver. Isnt this resolver 2.x bug instead?

  3. efegokdemir commented on Oct 14, 2026

    @efegokdemir
    Contributor

    You’re right — this belongs in Resolver 2.x, not as a Maven-wide versioned default. The reproducer fails on Maven 3.10.0 and 4.0.0-rc-7, but passes on 3.9.12. The targeted fix is proposed in Resolver #2208; Maven #13453 is closed as superseded.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    bugSomething isn't working

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions