[GRADLE-3115] POM exclusions not used for dependencies Created: 01/Jul/14  Updated: 10/Feb/17  Resolved: 10/Feb/17

Status: Resolved
Project: Gradle
Affects Version/s: None
Fix Version/s: None

Type: Bug
Reporter: Gradle Forums Assignee: Unassigned
Resolution: Won't Fix Votes: 2


 Description   

I have a dependency on a project that includes the following dependency in its POM file:

<dependency>
<groupId>org.example</groupId>
<artifactId>example</artifactId>
<version>1.2.3</version>
<scope>runtime</scope>
<exclusions>
<exclusion>
<groupId>*</groupId>
<artifactId>*</artifactId>
</exclusion>
</exclusions>
</dependency>

when I add this project as a dependency in my `build.gradle` file I would expect `gradle dependencies` to show only:

my-project -> other-project -> example:1.2.3

but instead all the transitive dependencies of `example:1.2.3` are also listed. It looks as if the `exclusions` tag in the POM file is simply ignored by the gradle dependency resolution.

Is there a solution to this problem? Did I misunderstand anything?

 Comments   
Comment by Gradle Forums [ 01/Jul/14 ]

As far as I know, `*` is not a valid notation for exclusions in Maven POMs. Where did you get this from?

Comment by Gradle Forums [ 01/Jul/14 ]

http://maven.apache.org/pom.html#Excl... - see second example

Comment by Tobias Bieniek [ 03/Jul/14 ]

If I read the source right then GradlePomModuleDescriptorBuilder.java:263 and the following lines are responsible for adding the exclusion rules read from the POM file. For matching the ExactPatternMatcher class is used, which however delegates to the AnyMatcher class if the match expression is "*" (see AbstractPatternMatcher). This sounds like exactly the right thing to do to solve this issue, but something apparently doesn't work. Is there a way to further test and/or debug this?

Comment by Benjamin Muschko [ 15/Nov/16 ]

As announced on the Gradle blog we are planning to completely migrate issues from JIRA to GitHub.

We intend to prioritize issues that are actionable and impactful while working more closely with the community. Many of our JIRA issues are inactionable or irrelevant. We would like to request your help to ensure we can appropriately prioritize JIRA issues you’ve contributed to.

Please confirm that you still advocate for your JIRA issue before December 10th, 2016 by:

  • Checking that your issues contain requisite context, impact, behaviors, and examples as described in our published guidelines.
  • Leave a comment on the JIRA issue or open a new GitHub issue confirming that the above is complete.

We look forward to collaborating with you more closely on GitHub. Thank you for your contribution to Gradle!

Comment by Benjamin Muschko [ 10/Feb/17 ]

Thanks again for reporting this issue. We haven't heard back from you after our inquiry from November 15th. We are closing this issue now. Please create an issue on GitHub if you still feel passionate about getting it resolved.

Generated at Wed Jun 30 12:40:24 CDT 2021 using Jira 8.4.2#804003-sha1:d21414fc212e3af190e92c2d2ac41299b89402cf.