Affected version
3.6.3
Bug description
The docs for requireUpperBoundDeps state (emphasis mine):
excludes - specify the dependencies that will be ignored. The format is groupId[:artifactId]
includes - specify the dependencies that will be checked. If not empty only these will be checked. The format is groupId[:artifactId]
... but in fact, the artifactId is not optional. We tried to narrow a plugin execution to only report on our team's first-party dependencies, by just including our own groupId in the execution, but when we tested it, it did not detect any of the known upper bound problems. We were only able to get it to work by specifying our artifactId values as well, which means we would have to specify every artifactId that we own. (This means, e.g., we can't reliably apply this enforcement in a central place without perpetually adjusting its includes every time we create a new shared component.)
I took a quick glance at RequireUpperBoundDeps.java and it appears to only check whether the include values directly match the visited dependencies, which is contrary to the docs (and prevents my use case).
The fix would be to make the artifactId truly optional when filtering dependencies for consideration, just like many of the other rules do: e.g., bannedDependencies works fine in this regard. Probably RequireUpperBoundDeps.java should be doing something like those rules: Predicate<Artifact> shouldInclude = ArtifactUtils.prepareDependencyArtifactMatcher(includes) instead of just a direct match comparison.
(My guess is that excludes probably has the same problem here, but I did not test it.)
Affected version
3.6.3
Bug description
The docs for requireUpperBoundDeps state (emphasis mine):
... but in fact, the
artifactIdis not optional. We tried to narrow a plugin execution to only report on our team's first-party dependencies, by just including our owngroupIdin the execution, but when we tested it, it did not detect any of the known upper bound problems. We were only able to get it to work by specifying ourartifactIdvalues as well, which means we would have to specify every artifactId that we own. (This means, e.g., we can't reliably apply this enforcement in a central place without perpetually adjusting its includes every time we create a new shared component.)I took a quick glance at RequireUpperBoundDeps.java and it appears to only check whether the include values directly match the visited dependencies, which is contrary to the docs (and prevents my use case).
The fix would be to make the artifactId truly optional when filtering dependencies for consideration, just like many of the other rules do: e.g., bannedDependencies works fine in this regard. Probably RequireUpperBoundDeps.java should be doing something like those rules:
Predicate<Artifact> shouldInclude = ArtifactUtils.prepareDependencyArtifactMatcher(includes)instead of just a direct match comparison.(My guess is that
excludesprobably has the same problem here, but I did not test it.)