Skip to content

Commit

Permalink
feat: support -dverbose argument when testing maven projects #5117
Browse files Browse the repository at this point in the history
- feat: support verbose for maven

Support passing -Dverbose to resolve omitted dependencies using maven-dependency-plugin.

When verbose is being used execute a specific version of the maven-dependency-plugin.
This is becuase on lower version of this plugin outputType=dot is not supported, and it will output a tree.

When verbose is on skip pruning and ensure all dependency lines are traversed fully, using breadth first, first in wins for version resolution.

- fix: record and use visited dependency information

In preparation for supporting -Dverbose the breadth first search needs to retain
previously visited dependency information.

At the moment we record whether a dependency has been seen (true/false)
based on the maven graph node id. This id contains the dependency version.
For example 'com.example:my-app:jar:jdk8:1.2.3:compile'.

However when maven is determining whether a dependency has already been
seen only four properties are used:

* groupId
* artifactId
* type
* classifier (optional)

These are the properties that uniquely identify a dependency in Maven.

Changing visited to be keyed by these four properties instead.

In addition we then record the parsed dependency for these visited dependencies
so that we can use that information when adding and connecting the dep-graph nodes.

The effect is that if a duplicate node is found, the previously visited version
is preferred regardless of what the duplicate node is set to.

This doesn't really effect the current implementation because maven-dependency-plugin
hides duplicates. Another PR will start to support -Dverbose where this becomes
important that we select the effective version being resolved by Maven.
  • Loading branch information
anthogez authored Mar 14, 2024
1 parent 9445c90 commit 1ef091f
Show file tree
Hide file tree
Showing 2 changed files with 13 additions and 10 deletions.
21 changes: 12 additions & 9 deletions package-lock.json

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

2 changes: 1 addition & 1 deletion package.json
Original file line number Diff line number Diff line change
Expand Up @@ -120,7 +120,7 @@
"snyk-go-plugin": "1.23.0",
"snyk-gradle-plugin": "4.1.0",
"snyk-module": "3.1.0",
"snyk-mvn-plugin": "3.1.0",
"snyk-mvn-plugin": "3.3.1",
"snyk-nodejs-lockfile-parser": "1.52.11",
"snyk-nuget-plugin": "2.4.1",
"snyk-php-plugin": "1.9.2",
Expand Down

0 comments on commit 1ef091f

Please sign in to comment.