Feat: Transitive dep manager

maven-core/src/main/java/org/apache/maven/internal/aether/DefaultRepositorySystemSessionFactory.java

@@ -39,7 +39,8 @@
 import org.apache.maven.eventspy.internal.EventSpyDispatcher;
 import org.apache.maven.execution.MavenExecutionRequest;
 import org.apache.maven.model.ModelBase;
-import org.apache.maven.repository.internal.MavenRepositorySystemUtils;
+import org.apache.maven.repository.internal.MavenSessionBuilderSupplier;
+import org.apache.maven.repository.internal.scopes.Maven3ScopeManagerConfiguration;
 import org.apache.maven.rtinfo.RuntimeInformation;
 import org.apache.maven.settings.Mirror;
 import org.apache.maven.settings.Proxy;
@@ -60,12 +61,15 @@
 import org.eclipse.aether.artifact.DefaultArtifact;
 import org.eclipse.aether.collection.DependencyCollectionContext;
 import org.eclipse.aether.collection.VersionFilter;
+import org.eclipse.aether.impl.scope.InternalScopeManager;
+import org.eclipse.aether.internal.impl.scope.ScopeManagerImpl;
 import org.eclipse.aether.repository.LocalRepository;
 import org.eclipse.aether.repository.LocalRepositoryManager;
 import org.eclipse.aether.repository.RepositoryPolicy;
 import org.eclipse.aether.repository.WorkspaceReader;
 import org.eclipse.aether.resolution.ResolutionErrorPolicy;
 import org.eclipse.aether.util.ConfigUtils;
+import org.eclipse.aether.util.graph.manager.TransitiveDependencyManager;
 import org.eclipse.aether.util.graph.version.ChainedVersionFilter;
 import org.eclipse.aether.util.graph.version.ContextualSnapshotVersionFilter;
 import org.eclipse.aether.util.graph.version.HighestVersionFilter;
@@ -149,6 +153,19 @@ public class DefaultRepositorySystemSessionFactory {
      */
     private static final String MAVEN_VERSION_FILTER = "maven.session.versionFilter";
 
+    /**
+     * User property for selecting dependency manager behavior regarding transitive dependencies and dependency
+     * management entries in their POMs. Maven 3 targeted full backward compatibility with Maven 2. Hence, it ignored
+     * dependency management entries in transitive dependency POMs. Maven 4 enables "transitivity" by default. Hence
+     * unlike Maven 3, it obeys dependency management entries deep in the dependency graph as well.
+     * <br/>
+     * Default (behave as whole Maven 3.x line): <code>"false"</code>.
+     *
+     * @since 3.10.0
+     */
+    public static final String MAVEN_RESOLVER_DEPENDENCY_MANAGER_TRANSITIVITY =
+            "maven.resolver.dependencyManagerTransitivity";
+
     private static final String MAVEN_RESOLVER_TRANSPORT_KEY = "maven.resolver.transport";
 
     private static final String MAVEN_RESOLVER_TRANSPORT_DEFAULT = "default";
@@ -195,11 +212,11 @@ public class DefaultRepositorySystemSessionFactory {
 
     private final GenericVersionScheme versionScheme = new GenericVersionScheme();
 
+    private final InternalScopeManager scopeManager = new ScopeManagerImpl(Maven3ScopeManagerConfiguration.INSTANCE);
+
     @SuppressWarnings("checkstyle:methodlength")
     public RepositorySystemSession.SessionBuilder newRepositorySession(MavenExecutionRequest request) {
-        RepositorySystemSession.SessionBuilder mainSessionBuilder = MavenRepositorySystemUtils.newSession(repoSystem);
-        mainSessionBuilder.setCache(request.getRepositoryCache());
-
+        // config
         Map<Object, Object> configProps = new LinkedHashMap<>();
         configProps.put(ConfigurationProperties.USER_AGENT, getUserAgent());
         configProps.put(ConfigurationProperties.INTERACTIVE, request.isInteractiveMode());
@@ -210,6 +227,10 @@ public RepositorySystemSession.SessionBuilder newRepositorySession(MavenExecutio
         configProps.putAll(request.getSystemProperties());
         configProps.putAll(request.getUserProperties());
 
+        RepositorySystemSession.SessionBuilder mainSessionBuilder =
+                new MavenSessionBuilderSupplier(repoSystem, scopeManager).get();
+        mainSessionBuilder.setCache(request.getRepositoryCache());
+
         mainSessionBuilder.setOffline(request.isOffline());
         mainSessionBuilder.setChecksumPolicy(request.getGlobalChecksumPolicy());
         if (request.isNoSnapshotUpdates()) {
@@ -254,6 +275,12 @@ public RepositorySystemSession.SessionBuilder newRepositorySession(MavenExecutio
             mainSessionBuilder.setVersionFilter(versionFilter);
         }
 
+        boolean dependencyManagerTransitivity =
+                ConfigUtils.getBoolean(configProps, false, MAVEN_RESOLVER_DEPENDENCY_MANAGER_TRANSITIVITY);
+        if (dependencyManagerTransitivity) {
+            mainSessionBuilder.setDependencyManager(new TransitiveDependencyManager(scopeManager));
+        }
+
         DefaultMirrorSelector mirrorSelector = new DefaultMirrorSelector();
         for (Mirror mirror : request.getMirrors()) {
             mirrorSelector.add(

maven-model-builder/src/main/java/org/apache/maven/model/validation/DefaultModelValidator.java

@@ -800,6 +800,7 @@ private void validateEffectiveDependencies(
                             d,
                             "provided",
                             "compile",
+                            "compile-only",
                             "runtime",
                             "test",
                             "system");
@@ -817,6 +818,7 @@ private void validateEffectiveDependencies(
                             d,
                             "provided",
                             "compile",
+                            "compile-only",
                             "runtime",
                             "test",
                             "system",

maven-resolver-provider/src/main/java/org/apache/maven/repository/internal/MavenRepositorySystemUtils.java

@@ -19,14 +19,11 @@
 package org.apache.maven.repository.internal;
 
 import org.eclipse.aether.DefaultRepositorySystemSession;
-import org.eclipse.aether.RepositorySystem;
-import org.eclipse.aether.RepositorySystemSession;
 import org.eclipse.aether.artifact.DefaultArtifactType;
 import org.eclipse.aether.collection.DependencyGraphTransformer;
 import org.eclipse.aether.collection.DependencyManager;
 import org.eclipse.aether.collection.DependencySelector;
 import org.eclipse.aether.collection.DependencyTraverser;
-import org.eclipse.aether.supplier.SessionBuilderSupplier;
 import org.eclipse.aether.util.artifact.DefaultArtifactTypeRegistry;
 import org.eclipse.aether.util.graph.manager.ClassicDependencyManager;
 import org.eclipse.aether.util.graph.selector.AndDependencySelector;
@@ -49,22 +46,15 @@
  * always use regular dependency injection to acquire the repository system.
  *
  * @author Benjamin Bentmann
+ * @deprecated Use {@link org.eclipse.aether.supplier.SessionBuilderSupplier} instead.
  */
+@Deprecated
 public final class MavenRepositorySystemUtils {
 
     private MavenRepositorySystemUtils() {
         // hide constructor
     }
 
-    /**
-     * Creates a new Maven repository system session builder.
-     *
-     * @return The new repository system session builder, never {@code null}.
-     */
-    public static RepositorySystemSession.SessionBuilder newSession(RepositorySystem repositorySystem) {
-        return new SessionBuilderSupplier(repositorySystem).get();
-    }
-
     /**
      * Creates a new Maven-like repository system session by initializing the session with values typical for
      * Maven-based resolution. In more detail, this method configures settings relevant for the processing of dependency

maven-resolver-provider/src/main/java/org/apache/maven/repository/internal/MavenSessionBuilderSupplier.java

@@ -0,0 +1,156 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.apache.maven.repository.internal;
+
+import java.util.Arrays;
+import java.util.Locale;
+import java.util.function.Supplier;
+
+import org.apache.maven.utils.Os;
+import org.eclipse.aether.RepositorySystem;
+import org.eclipse.aether.RepositorySystemSession.CloseableSession;
+import org.eclipse.aether.RepositorySystemSession.SessionBuilder;
+import org.eclipse.aether.artifact.ArtifactTypeRegistry;
+import org.eclipse.aether.artifact.DefaultArtifactType;
+import org.eclipse.aether.collection.DependencyGraphTransformer;
+import org.eclipse.aether.collection.DependencyManager;
+import org.eclipse.aether.collection.DependencySelector;
+import org.eclipse.aether.collection.DependencyTraverser;
+import org.eclipse.aether.impl.scope.InternalScopeManager;
+import org.eclipse.aether.internal.impl.scope.ManagedDependencyContextRefiner;
+import org.eclipse.aether.internal.impl.scope.ManagedScopeDeriver;
+import org.eclipse.aether.internal.impl.scope.ManagedScopeSelector;
+import org.eclipse.aether.internal.impl.scope.OptionalDependencySelector;
+import org.eclipse.aether.internal.impl.scope.ScopeDependencySelector;
+import org.eclipse.aether.resolution.ArtifactDescriptorPolicy;
+import org.eclipse.aether.util.artifact.DefaultArtifactTypeRegistry;
+import org.eclipse.aether.util.artifact.JavaScopes;
+import org.eclipse.aether.util.graph.manager.ClassicDependencyManager;
+import org.eclipse.aether.util.graph.selector.AndDependencySelector;
+import org.eclipse.aether.util.graph.selector.ExclusionDependencySelector;
+import org.eclipse.aether.util.graph.transformer.ChainedDependencyGraphTransformer;
+import org.eclipse.aether.util.graph.transformer.ConfigurableVersionSelector;
+import org.eclipse.aether.util.graph.transformer.ConflictResolver;
+import org.eclipse.aether.util.graph.transformer.SimpleOptionalitySelector;
+import org.eclipse.aether.util.graph.traverser.FatArtifactTraverser;
+import org.eclipse.aether.util.repository.SimpleArtifactDescriptorPolicy;
+
+import static java.util.Objects.requireNonNull;
+
+/**
+ * A simple {@link Supplier} of {@link SessionBuilder} instances, that on each call supplies newly
+ * constructed instance. To create session out of builder, use {@link SessionBuilder#build()}. For proper closing
+ * of sessions, use {@link CloseableSession#close()} method on built instance(s).
+ * <p>
+ * Extend this class and override methods to customize, if needed.
+ *
+ * @since 3.10.0
+ */
+public class MavenSessionBuilderSupplier implements Supplier<SessionBuilder> {
+    protected final RepositorySystem repositorySystem;
+    protected final InternalScopeManager scopeManager;
+
+    public MavenSessionBuilderSupplier(RepositorySystem repositorySystem, InternalScopeManager scopeManager) {
+        this.repositorySystem = requireNonNull(repositorySystem);
+        this.scopeManager = requireNonNull(scopeManager);
+    }
+
+    protected void configureSessionBuilder(SessionBuilder session) {
+        session.setSystemProperties(System.getProperties());
+        boolean caseSensitive = !Os.IS_WINDOWS;
+        System.getenv().forEach((key, value) -> {
+            key = "env." + (caseSensitive ? key : key.toUpperCase(Locale.ENGLISH));
+            session.setSystemProperty(key, value);
+        });
+        session.setScopeManager(scopeManager);
+        session.setDependencyTraverser(getDependencyTraverser());
+        session.setDependencyManager(getDependencyManager());
+        session.setDependencySelector(getDependencySelector());
+        session.setDependencyGraphTransformer(getDependencyGraphTransformer());
+        session.setArtifactTypeRegistry(getArtifactTypeRegistry());
+        session.setArtifactDescriptorPolicy(getArtifactDescriptorPolicy());
+    }
+
+    protected InternalScopeManager getScopeManager() {
+        return this.scopeManager;
+    }
+
+    protected DependencyTraverser getDependencyTraverser() {
+        return new FatArtifactTraverser();
+    }
+
+    protected DependencyManager getDependencyManager() {
+        return new ClassicDependencyManager(getScopeManager());
+    }
+
+    protected DependencySelector getDependencySelector() {
+        return new AndDependencySelector(
+                ScopeDependencySelector.legacy(null, Arrays.asList(JavaScopes.TEST, JavaScopes.PROVIDED)),
+                OptionalDependencySelector.fromDirect(),
+                new ExclusionDependencySelector());
+    }
+
+    protected DependencyGraphTransformer getDependencyGraphTransformer() {
+        return new ChainedDependencyGraphTransformer(
+                new ConflictResolver(
+                        new ConfigurableVersionSelector(),
+                        new ManagedScopeSelector(getScopeManager()),
+                        new SimpleOptionalitySelector(),
+                        new ManagedScopeDeriver(getScopeManager())),
+                new ManagedDependencyContextRefiner(getScopeManager()));
+    }
+
+    protected ArtifactTypeRegistry getArtifactTypeRegistry() {
+        DefaultArtifactTypeRegistry stereotypes = new DefaultArtifactTypeRegistry();
+        stereotypes.add(new DefaultArtifactType("pom"));
+        stereotypes.add(new DefaultArtifactType("maven-plugin", "jar", "", "java"));
+        stereotypes.add(new DefaultArtifactType("jar", "jar", "", "java"));
+        stereotypes.add(new DefaultArtifactType("ejb", "jar", "", "java"));
+        stereotypes.add(new DefaultArtifactType("ejb-client", "jar", "client", "java"));
+        stereotypes.add(new DefaultArtifactType("test-jar", "jar", "tests", "java"));
+        stereotypes.add(new DefaultArtifactType("javadoc", "jar", "javadoc", "java"));
+        stereotypes.add(new DefaultArtifactType("java-source", "jar", "sources", "java", false, false));
+        stereotypes.add(new DefaultArtifactType("war", "war", "", "java", false, true));
+        stereotypes.add(new DefaultArtifactType("ear", "ear", "", "java", false, true));
+        stereotypes.add(new DefaultArtifactType("rar", "rar", "", "java", false, true));
+        stereotypes.add(new DefaultArtifactType("par", "par", "", "java", false, true));
+        return stereotypes;
+    }
+
+    protected ArtifactDescriptorPolicy getArtifactDescriptorPolicy() {
+        return new SimpleArtifactDescriptorPolicy(true, true);
+    }
+
+    /**
+     * Creates a new Maven-like repository system session by initializing the session with values typical for
+     * Maven-based resolution. In more detail, this method configures settings relevant for the processing of dependency
+     * graphs, most other settings remain at their generic default value. Use the various setters to further configure
+     * the session with authentication, mirror, proxy and other information required for your environment. At least,
+     * local repository manager needs to be configured to make session be able to create session instance.
+     *
+     * @return SessionBuilder configured with minimally required things for "Maven-based resolution". At least LRM must
+     * be set on builder to make it able to create session instances.
+     */
+    @Override
+    public SessionBuilder get() {
+        SessionBuilder builder = repositorySystem.createSessionBuilder();
+        configureSessionBuilder(builder);
+        return builder;
+    }
+}