<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body text="#000000" bgcolor="#FFFFFF">
<p><br>
</p>
<br>
<div class="moz-cite-prefix">On 5/12/17 2:52 PM, Rob Audenaerde
wrote:<br>
</div>
<blockquote type="cite"
cite="mid:CAPz8bx21FZxxoAa7S0T0X_1yacPSDK15iKEccvZpYHRb8Udjmg@mail.gmail.com">
<div dir="ltr">
<div><br>
</div>
<div><br>
</div>
<div>I created a minimal project that has similar dependencies
as the one where I have issues with. Below is the pom.xml.<br>
</div>
<div><br>
</div>
<div>When I run:</div>
<div>
<div> </div>
<div> mvn dependency:list | grep collections</div>
<div><br>
</div>
<div>This is the output:</div>
<div><br>
</div>
<div> [INFO]
commons-collections:commons-collections:jar:3.2.1:compile</div>
</div>
<div><br>
</div>
<div>Also, when printing the dependency:tree I see that there is
only one commons-collections: 3.2.1</div>
</div>
</blockquote>
<br>
Yes, you are correct. I see the same thing in a sandbox project. I
belatedly realize why this is. In all of our own code, we are
getting the 3.2.2 version by explicitly managing this dependency in
our parent POM. All our projects' POMs derive from this parent POM,
and so that's what is effective.<br>
<br>
However, in an external project that's just pulling in opensaml-*
deps in the usual fashion, and which does not inherit from our
parent POM, no such dependency management is going on. So Maven is
just resolving that dependency transitively based solely on our
explicit dependency on velocity, and that's 3.2.1.<br>
<br>
I don't know what, if anything, we can do about that. Or at least
that we'd be willing to do from a project management standpoint.
Off-hand I'm sure we could add an explicit commons-collections
dependency to the modules in OpenSAML (and the IdP) which use
Velocity to force the version explicitly, but that's probably messy
and seems undesirable. Maybe someone else on the team or the list
who understands Maven better than I do has another idea. <br>
<br>
And if we do make some change, that's obviously not going to fix
anything for the already-released 3.3.0. So...<br>
<br>
<blockquote type="cite"
cite="mid:CAPz8bx21FZxxoAa7S0T0X_1yacPSDK15iKEccvZpYHRb8Udjmg@mail.gmail.com">
<div dir="ltr">
<div><br>
</div>
<div>I think I might fix this by include more depedencies? (and
end up with one that has a higher commons-collections
version), but I strive to include as few as possible...<br>
</div>
</div>
</blockquote>
<br>
... I think the best thing you can do right now is to just declare
the 3.2.2 version in your own project's POM. I tested just adding a
dependency management section like below to my sandbox, and it works
for me:<br>
<br>
<tt> <dependencyManagement></tt><tt><br>
</tt><tt> <dependencies></tt><tt><br>
</tt><tt> <dependency></tt><tt><br>
</tt><tt>
<groupId>commons-collections</groupId></tt><tt><br>
</tt><tt>
<artifactId>commons-collections</artifactId></tt><tt><br>
</tt><tt> <version>3.2.2</version></tt><tt><br>
</tt><tt> </dependency></tt><tt><br>
</tt><tt> </dependencies></tt><tt><br>
</tt><tt> </dependencyManagement><br>
<br>
<br>
</tt>Which fixes things up:<br>
<br>
<tt># mvn dependency:tree -Dverbose -Dincludes=commons-collections</tt><tt><br>
</tt><tt><br>
</tt><tt><br>
</tt><tt>[INFO] --- maven-dependency-plugin:2.1:tree (default-cli) @
sandbox-v3 ---</tt><tt><br>
</tt><tt>[INFO] brent:sandbox-v3:jar:0.0.1-SNAPSHOT</tt><tt><br>
</tt><tt>[INFO] \-
org.opensaml:opensaml-saml-impl:jar:3.4.0-SNAPSHOT:compile</tt><tt><br>
</tt><tt>[INFO] \- org.apache.velocity:velocity:jar:1.7:compile</tt><tt><br>
</tt><tt>[INFO] \-
commons-collections:commons-collections:jar:3.2.2:compile (version
managed from 3.2.1)</tt><tt><br>
</tt><tt><br>
</tt><tt><br>
</tt><br>
</body>
</html>