Wednesday, April 9, 2008

The Flaw with Maven's Transitive Dependencies

One of the key features in Maven2 is the support for transitive dependencies. While this is great and also necessary for running any code that depends on a jar that in turn depends on other jars, it has one serious flaw:

While transitive dependencies should be included in the classpath at runtime, those dependencies should not be included at compile time.

To illustrate why this is wrong, let's take an example:

We are developing module A, which depends on a third party jar, called "vacation-calculator", which in turn depends on Joda Time. Now, suppose that the developer of module A wants to use Joda Time. Happily he imports the Joda Time classes and everything works like a charm.

What happened here is that the developer introduced a new dependency, which will remain undocumented. There are two major problems with this:
  1. The day when the module A upgrades to a new version of the "vacation-calculator", which has replaced Joda Time with Schmoda Time, module A will no longer compile. Most likely, the developer will think that the new version of "vacation-calculator" broke backwards compatibility and confusion will ensue.
  2. If the developers decide that the "vacation-module" jar-file should be provided at runtime and thus change the scope to "provided", the code will no longer compile.
I think it would be fair to say that this is a major flaw in Maven's way of handling transitive dependencies. The argument that the developers should avoid using classes from transitive dependencies in their code is not convincing to me, since I have seen this happen too many times "by accident". A good build system should protect the developer from such accidents.

Having searched around quite a bit I have not found anyone else who points this out. Am I missing something or are people not seeing the forest for the trees?

4 comments:

Brian said...

Removing the transitive dependencies from the compile scope is something we have discussed for 2.1. This change needs to be made in a way to not break legacy builds and will probably be tied to a model version change.

In the meantime, you can detect and protect yourself from these classpath mistakes using the dependency:analyze and associated reports.

--Brian Fox
Apache Maven PMC
http://blogs.sonatype.com/brian/

Viktor Nordling said...

Cool, thanks for that Brian! I will definitely try the dependency:analyze goal, had never heard about it before... : )

Cheers!

otr said...

VIRUS REMOVAL

Is Your Computer Sluggish or Plagued With a Virus? – If So you Need Online Tech Repairs
As a leader in online computer repair, Online Tech Repairs Inc has the experience to deliver professional system optimization and virus removal.Headquartered in Great Neck, New York our certified technicians have been providing online computer repair and virus removal for customers around the world since 2004.
Our three step system is easy to use; and provides you a safe, unobtrusive, and cost effective alternative to your computer service needs. By using state-of-the-art technology our computer experts can diagnose, and repair your computer system through the internet, no matter where you are.
Our technician will guide you through the installation of Online Tech Repair Inc secure software. This software allows your dedicated computer expert to see and operate your computer just as if he was in the room with you. That means you don't have to unplug everything and bring it to our shop, or have a stranger tramping through your home.
From our remote location the Online Tech Repairs.com expert can handle any computer issue you want addressed, like:
• - System Optimization
• - How it works Software Installations or Upgrades
• - How it works Virus Removal
• - How it works Home Network Set-ups
Just to name a few.
If you are unsure of what the problem may be, that is okay. We can run a complete diagnostic on your system and fix the problems we encounter. When we are done our software is removed; leaving you with a safe, secure and properly functioning system. The whole process usually takes less than an hour. You probably couldn't even get your computer to your local repair shop that fast!
Call us now for a FREE COMPUTER DIAGONISTIC using DISCOUNT CODE (otr214428@gmail.com) on +1-914-613-3786 or chat with us on www.onlinetechrepairs.com.

otr said...

Problem: HP Printer not connecting to my laptop.
I had an issue while connecting my 2 year old HP printer to my brother's laptop that I had borrowed for starting my own business. I used a quick google search to fix the problem but that did not help me.
I then decided to get professional help to solve my problem. After having received many quotations from various companies, i decided to go ahead with Online Tech Repair (www.onlinetechrepairs.com).
Reasons I chose them over the others:
1) They were extremely friendly and patient with me during my initial discussions and responded promptly to my request.
2) Their prices were extremely reasonable.
3) They were ready and willing to walk me through the entire process step by step and were on call with me till i got it fixed.
How did they do it
1) They first asked me to state my problem clearly and asked me a few questions. This was done to detect any physical connectivity issues with the printer.
2) After having answered this, they confirmed that the printer and the laptop were functioning correctly.
3) They then, asked me if they could access my laptop remotely to troubleshoot the problem and fix it. I agreed.
4) One of the tech support executives accessed my laptop and started troubleshooting.
5) I sat back and watched as the tech support executive was navigating my laptop to spot the issue. The issue was fixed.
6) I was told that it was due to an older version of the driver that had been installed.
My Experience
I loved the entire friendly conversation that took place with them. They understood my needs clearly and acted upon the solution immediately. Being a technical noob,

sometimes find it difficult to communicate with tech support teams. It was a very different experience with the guys at Online Tech Repairs. You can check out their website www.onlinetechrepairs.com or call them on 1-914-613-3786.
Would definitely recommend this service to anyone who needs help fixing their computers.
Thanks a ton guys. Great Job....!!