yangjj-iso commented on issue #7679: URL: https://github.com/apache/shenyu/issues/7679#issuecomment-6211596947
As requested in [the #6602 rollout decision](https://github.com/apache/shenyu/issues/6602#issuecomment-6211156464), here is the verified `shenyu-common` minimal reproduction. Tested at `297ac6f849857bd0c2ad368709013e98494b0330` (`2.7.2-SNAPSHOT`), using the Maven wrapper (3.6.3) and JDK 21.0.10. Invoke the dependency rules explicitly; this does not require editing any POM or enabling them in the #6602 version-guardrail change: ```bash ./mvnw -B -ntp -pl shenyu-common -am \ org.apache.maven.plugins:maven-enforcer-plugin:3.6.3:enforce \ -Denforcer.rules=dependencyConvergence,requireUpperBoundDeps ``` On Windows, use `.\mvnw.cmd` and put the arguments on one line (quote the `-Denforcer.rules=...` argument in PowerShell). The root, `shenyu-register-center`, and `shenyu-register-protocol` pass. The command exits **1** at `shenyu-common`, with these failures: | Rule | Artifact | Dependency paths / versions | | --- | --- | --- | | `dependencyConvergence` | `org.checkerframework:checker-qual` | `shenyu-common -> caffeine:2.9.3 -> checker-qual:3.19.0` versus `shenyu-common -> guava:32.0.0-jre -> checker-qual:3.33.0` | | `dependencyConvergence` | `com.google.errorprone:error_prone_annotations` | `gson:2.13.2 -> 2.41.0`, `caffeine:2.9.3 -> 2.10.0`, and `guava:32.0.0-jre -> 2.18.0` | | `requireUpperBoundDeps` | `org.checkerframework:checker-qual` | Resolved 3.19.0 is below Guava's requested 3.33.0. | | `requireUpperBoundDeps` | `org.slf4j:slf4j-api` | Resolved/managed 2.0.13 is below `shenyu-common -> oshi-core:6.10.0 -> slf4j-api:2.0.17`. | Representative output: ```text shenyu ............................................. SUCCESS shenyu-register-center ............................. SUCCESS shenyu-register-protocol ........................... SUCCESS shenyu-common ...................................... FAILURE Rule 0: org.apache.maven.enforcer.rules.dependency.DependencyConvergence failed Rule 1: org.apache.maven.enforcer.rules.dependency.RequireUpperBoundDeps failed ``` For a non-blocking whole-reactor inventory using the same explicit rules: ```bash ./mvnw -B -ntp \ org.apache.maven.plugins:maven-enforcer-plugin:3.6.3:enforce \ -Denforcer.rules=dependencyConvergence,requireUpperBoundDeps \ -Denforcer.fail=false ``` The last override is for collecting all diagnostics; a successful exit in that mode does not establish that the graph is aligned. A plain `validate` after the scoped #6602 change checks toolchain versions only, so it will not reproduce these dependency errors. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
