Jenkins WAR version in POM is overridden by transitive plugin dependency

[andreyakostov]

packager-config.yml:

bundle:
  groupId: com.test
  artifactId: jenkins
  vendor: andreyakostov
buildSettings:
  pom: pom.xml
  pomIgnoreRoot: true
  pomIncludeWar: true

pom.xml:

<project xmlns="http://maven.apache.org/POM/4.0.0"
  xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
  xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
  <modelVersion>4.0.0</modelVersion>

  <groupId>com.test</groupId>
  <artifactId>jenkins-plugins</artifactId>
  <version>1.0.0</version>
  <packaging>pom</packaging>

  <properties>
    <jenkins.version>2.190.1</jenkins.version>
    <java.level>8</java.level>
  </properties>

  <dependencies>
    <dependency>
      <groupId>org.jenkins-ci.plugins</groupId>
      <artifactId>resource-disposer</artifactId>
      <version>0.13</version>
    </dependency>
  </dependencies>

</project>

resource-disposer depends on jenkins-core 2.54, which overrides the version specified in the jenkins.version property.

[oleg-nenashev]

I confirm it is an issue. It comes due to building an effective POM which effectively leads to an override. Can be fixed easily by adjusting the checks orde

Workaround: Use https://github.com/jenkinsci/plugin-pom as a base POM which includes checks which prevent such situations

[andreyakostov]

Thanks, the workaround did the trick.

On a side note, would it help if resource-disposer declared a provided scope for jenkins-core? MavenHelper#listDependenciesFromPom lists only compile and runtime scoped dependencies.
To find the culprit I did a mvn dependency:tree and it was the only plugin I used that had a dependency to jenkins-core.

[oleg-nenashev]

Yes, please feel free to fix resource disposer or file an issue for it. https://github.com/jenkinsci/resource-disposer-plugin/blob/master/pom.xml#L59-L70 is a clear defect in the plugin metadata, Jenkins core must not be used like that

…

On Fri, Sep 27, 2019 at 4:00 PM Andreya ***@***.***> wrote: Thanks, the workaround did the trick. On a side note, would it help if resource-disposer declared a provided scope for jenkins-core? MavenHelper#listDependenciesFromPom lists only compile and runtime scoped dependencies. To find the culprit I did a mvn dependency:tree and it was the only plugin I used that had a dependency to jenkins-core. — You are receiving this because you commented. Reply to this email directly, view it on GitHub <#126?email_source=notifications&email_token=AAW4RIDVTVSDLMNZ4GCH4ALQLYGZBA5CNFSM4I3D6S22YY3PNVWWK3TUL52HS4DFVREXG43VMVBW63LNMVXHJKTDN5WW2ZLOORPWSZGOD7Y7UNY#issuecomment-535951927>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AAW4RIBX5AOJUUIU5JYGJW3QLYGZBANCNFSM4I3D6S2Q> .

[olivergondza]

Releasing resource-disposer-0.14 with the fix. Thanks for the heads-up.