Wednesday, April 9, 2008

The Flaw with Maven's Transitive Dependencies

One of the key features in Maven2 is the support for transitive dependencies. While this is great and also necessary for running any code that depends on a jar that in turn depends on other jars, it has one serious flaw:

While transitive dependencies should be included in the classpath at runtime, those dependencies should not be included at compile time.

To illustrate why this is wrong, let's take an example:

We are developing module A, which depends on a third party jar, called "vacation-calculator", which in turn depends on Joda Time. Now, suppose that the developer of module A wants to use Joda Time. Happily he imports the Joda Time classes and everything works like a charm.

What happened here is that the developer introduced a new dependency, which will remain undocumented. There are two major problems with this:
  1. The day when the module A upgrades to a new version of the "vacation-calculator", which has replaced Joda Time with Schmoda Time, module A will no longer compile. Most likely, the developer will think that the new version of "vacation-calculator" broke backwards compatibility and confusion will ensue.
  2. If the developers decide that the "vacation-module" jar-file should be provided at runtime and thus change the scope to "provided", the code will no longer compile.
I think it would be fair to say that this is a major flaw in Maven's way of handling transitive dependencies. The argument that the developers should avoid using classes from transitive dependencies in their code is not convincing to me, since I have seen this happen too many times "by accident". A good build system should protect the developer from such accidents.

Having searched around quite a bit I have not found anyone else who points this out. Am I missing something or are people not seeing the forest for the trees?

3 comments:

Brian Fox said...

Removing the transitive dependencies from the compile scope is something we have discussed for 2.1. This change needs to be made in a way to not break legacy builds and will probably be tied to a model version change.

In the meantime, you can detect and protect yourself from these classpath mistakes using the dependency:analyze and associated reports.

--Brian Fox
Apache Maven PMC
http://blogs.sonatype.com/brian/

V said...

Cool, thanks for that Brian! I will definitely try the dependency:analyze goal, had never heard about it before... : )

Cheers!

otr said...

Problem: HP Printer not connecting to my laptop.
I had an issue while connecting my 2 year old HP printer to my brother's laptop that I had borrowed for starting my own business. I used a quick google search to fix the problem but that did not help me.
I then decided to get professional help to solve my problem. After having received many quotations from various companies, i decided to go ahead with Online Tech Repair (www.onlinetechrepairs.com).
Reasons I chose them over the others:
1) They were extremely friendly and patient with me during my initial discussions and responded promptly to my request.
2) Their prices were extremely reasonable.
3) They were ready and willing to walk me through the entire process step by step and were on call with me till i got it fixed.
How did they do it
1) They first asked me to state my problem clearly and asked me a few questions. This was done to detect any physical connectivity issues with the printer.
2) After having answered this, they confirmed that the printer and the laptop were functioning correctly.
3) They then, asked me if they could access my laptop remotely to troubleshoot the problem and fix it. I agreed.
4) One of the tech support executives accessed my laptop and started troubleshooting.
5) I sat back and watched as the tech support executive was navigating my laptop to spot the issue. The issue was fixed.
6) I was told that it was due to an older version of the driver that had been installed.
My Experience
I loved the entire friendly conversation that took place with them. They understood my needs clearly and acted upon the solution immediately. Being a technical noob,

sometimes find it difficult to communicate with tech support teams. It was a very different experience with the guys at Online Tech Repairs. You can check out their website www.onlinetechrepairs.com or call them on 1-914-613-3786.
Would definitely recommend this service to anyone who needs help fixing their computers.
Thanks a ton guys. Great Job....!!