将传递依赖行为与 xml-api 混淆

Question

在我的项目中，我依赖于几个依赖于各种版本 xml-apis 的外部库。如果我使用 maven-enforcer-plugin to fail if there are version conflicts 我的构建失败。

在我开始之前，打印我的运行ning 应用程序的类路径给出 xml-apis:xml-apis:1.4.01

当我启用 maven-enforcer-plugin 时，我得到了这个，这是预期的

Dependency convergence error for xml-apis:xml-apis:1.3.04 paths to dependency are:

+-org.bbraile:bbraile:1.0-SNAPSHOT
  +-org.bbraile:utd:1.0-SNAPSHOT
    +-xalan:xalan:2.7.2
      +-xalan:serializer:2.7.2
        +-xml-apis:xml-apis:1.3.04
and
+-org.bbraile:bbraile:1.0-SNAPSHOT
  +-org.bbraile:utd:1.0-SNAPSHOT
    +-xml-apis:xml-apis:1.4.01
and
+-org.bbraile:bbraile:1.0-SNAPSHOT
  +-org.bbraile:utd:1.0-SNAPSHOT
    +-xerces:xercesImpl:2.11.0
      +-xml-apis:xml-apis:1.4.01
and
+-org.bbraile:bbraile:1.0-SNAPSHOT
  +-com.io7m.xom:xom:1.2.10
    +-xml-apis:xml-apis:1.3.03
and
+-org.bbraile:bbraile:1.0-SNAPSHOT
  +-org.apache.xmlgraphics:batik-transcoder:1.7
    +-org.apache.xmlgraphics:batik-bridge:1.7
      +-org.apache.xmlgraphics:batik-anim:1.7
        +-xml-apis:xml-apis:1.3.04
and
+-org.bbraile:bbraile:1.0-SNAPSHOT
  +-org.apache.xmlgraphics:batik-transcoder:1.7
    +-org.apache.xmlgraphics:batik-bridge:1.7
      +-org.apache.xmlgraphics:batik-css:1.7
        +-xml-apis:xml-apis:1.3.04
and
+-org.bbraile:bbraile:1.0-SNAPSHOT
  +-org.apache.xmlgraphics:batik-transcoder:1.7
    +-org.apache.xmlgraphics:batik-bridge:1.7
      +-org.apache.xmlgraphics:batik-ext:1.7
        +-xml-apis:xml-apis:1.3.04
and
+-org.bbraile:bbraile:1.0-SNAPSHOT
  +-org.apache.xmlgraphics:batik-transcoder:1.7
    +-org.apache.xmlgraphics:batik-bridge:1.7
      +-xml-apis:xml-apis:1.3.04
and
+-org.bbraile:bbraile:1.0-SNAPSHOT
  +-org.apache.xmlgraphics:batik-transcoder:1.7
    +-org.apache.xmlgraphics:batik-dom:1.7
      +-xml-apis:xml-apis:1.3.04
and
+-org.bbraile:bbraile:1.0-SNAPSHOT
  +-org.apache.xmlgraphics:batik-transcoder:1.7
    +-org.apache.xmlgraphics:batik-gvt:1.7
      +-xml-apis:xml-apis:1.3.04
and
+-org.bbraile:bbraile:1.0-SNAPSHOT
  +-org.apache.xmlgraphics:batik-transcoder:1.7
    +-org.apache.xmlgraphics:batik-svg-dom:1.7
      +-xml-apis:xml-apis:1.3.04
and
+-org.bbraile:bbraile:1.0-SNAPSHOT
  +-org.apache.xmlgraphics:batik-transcoder:1.7
    +-org.apache.xmlgraphics:batik-svggen:1.7
      +-xml-apis:xml-apis:1.3.04
and
+-org.bbraile:bbraile:1.0-SNAPSHOT
  +-org.apache.xmlgraphics:batik-transcoder:1.7
    +-xml-apis:xml-apis:1.3.04

要根据我阅读的内容解决此问题，我应该将其添加到我的 POM

<dependencyManagement>
    <dependencies>
        <dependency>
            <groupId>xml-apis</groupId>
            <artifactId>xml-apis</artifactId>
            <version>2.0.2</version>
        </dependency>
    </dependencies>
</dependencyManagement>

然后重新运行我的程序。它通过了 maven-enforcer-plugin 检查，但我的类路径说现在我运行ning xml-apis:xml-apis:1.0.b2。版本号怎么老了？为什么我的版本被忽略了？

将此添加到我的 POM，有或没有 <version> 标签都没有效果

<dependencies>
    <dependency>
        <groupId>xml-apis</groupId>
        <artifactId>xml-apis</artifactId>
        <version>2.0.2</version>
    </dependency>
</dependencies>

咨询dependency:tree -Dverbose=true -Dincludes=xml-apis给出如下，暗示2.0.2

org.bbraile:bbraile:jar:1.0-SNAPSHOT
+- org.bbraile:utd:jar:1.0-SNAPSHOT:compile
|  +- xalan:xalan:jar:2.7.2:compile
|  |  \- xalan:serializer:jar:2.7.2:compile
|  |     \- (xml-apis:xml-apis:jar:2.0.2:compile - version managed from 1.0.b2; omitted for duplicate)
|  +- (xml-apis:xml-apis:jar:2.0.2:compile - version managed from 1.0.b2; omitted for conflict with 1.0.b2)
|  \- xerces:xercesImpl:jar:2.11.0:compile
|     \- (xml-apis:xml-apis:jar:2.0.2:compile - version managed from 1.0.b2; omitted for duplicate)
+- com.io7m.xom:xom:jar:1.2.10:compile
|  \- (xml-apis:xml-apis:jar:2.0.2:compile - version managed from 1.0.b2; omitted for duplicate)
+- org.apache.xmlgraphics:batik-transcoder:jar:1.7:compile
|  +- org.apache.xmlgraphics:batik-bridge:jar:1.7:compile
|  |  +- org.apache.xmlgraphics:batik-anim:jar:1.7:compile
|  |  |  +- (xml-apis:xml-apis:jar:2.0.2:compile - version managed from 1.0.b2; omitted for duplicate)
|  |  |  \- (xml-apis:xml-apis-ext:jar:1.3.04:compile - omitted for duplicate)
|  |  +- org.apache.xmlgraphics:batik-css:jar:1.7:compile
|  |  |  +- (xml-apis:xml-apis:jar:2.0.2:compile - version managed from 1.0.b2; omitted for duplicate)
|  |  |  \- (xml-apis:xml-apis-ext:jar:1.3.04:compile - omitted for duplicate)
|  |  +- org.apache.xmlgraphics:batik-ext:jar:1.7:compile
|  |  |  \- (xml-apis:xml-apis:jar:2.0.2:compile - version managed from 1.0.b2; omitted for duplicate)
|  |  +- (xml-apis:xml-apis:jar:2.0.2:compile - version managed from 1.0.b2; omitted for duplicate)
|  |  \- (xml-apis:xml-apis-ext:jar:1.3.04:compile - omitted for duplicate)
|  +- org.apache.xmlgraphics:batik-dom:jar:1.7:compile
|  |  +- (xml-apis:xml-apis:jar:2.0.2:compile - version managed from 1.0.b2; omitted for duplicate)
|  |  \- (xml-apis:xml-apis-ext:jar:1.3.04:compile - omitted for duplicate)
|  +- org.apache.xmlgraphics:batik-gvt:jar:1.7:compile
|  |  \- (xml-apis:xml-apis:jar:2.0.2:compile - version managed from 1.0.b2; omitted for duplicate)
|  +- org.apache.xmlgraphics:batik-svg-dom:jar:1.7:compile
|  |  +- (xml-apis:xml-apis:jar:2.0.2:compile - version managed from 1.0.b2; omitted for duplicate)
|  |  \- (xml-apis:xml-apis-ext:jar:1.3.04:compile - omitted for duplicate)
|  +- org.apache.xmlgraphics:batik-svggen:jar:1.7:compile
|  |  \- (xml-apis:xml-apis:jar:2.0.2:compile - version managed from 1.0.b2; omitted for duplicate)
|  +- (xml-apis:xml-apis:jar:2.0.2:compile - version managed from 1.0.b2; omitted for duplicate)
|  \- xml-apis:xml-apis-ext:jar:1.3.04:compile
\- xml-apis:xml-apis:jar:2.0.2:compile

为什么我在 dependencyManagment 中的显式版本被忽略了？为什么设置会降低我的类路径上的版本？我怎样才能通过 maven-enforcer-plugin 最新的 xml-apis 版本？

Answer 1

事实证明这不是 maven 问题，这是 xml-api 的问题。截至今天，这就是 xml-apis:xml-apis 在 Maven Central

中的样子

如果你仔细看，2.0.2 不是最新版本，1.4.01 是！当其他人和他们的 IDE 认为 2 大于 1 时，xml-apis 倒退了。

这非常令人困惑且不明显，因此希望有人觉得这很有用。

将传递依赖行为与 xml-api 混淆

Confusing transitive dependency behavior with xml-apis

java

dependency-management

maven