Dependency Convergence Issue

[josecoelho96]

Describe the bug

Our build process uses the maven-enforcer-plugin plugin and it started to show isssues when we imported the aws sdk.

Expected Behavior

No dependency convergence issues.

Current Behavior

Currently, our pom.xml looks like this (a section of it):

<dependencyManagement>
  <dependencies>
    <dependency>
      <groupId>software.amazon.awssdk</groupId>
      <artifactId>bom</artifactId>
      <version>2.20.94</version>
      <type>pom</type>
      <scope>import</scope>
    </dependency>
  </dependencies>
</dependencyManagement>

<dependencies>
  <dependency>
    <groupId>software.amazon.awssdk</groupId>
    <artifactId>s3</artifactId>
    <exclusions>
      <exclusion>
        <groupId>software.amazon.awssdk</groupId>
        <artifactId>netty-nio-client</artifactId>
      </exclusion>
      <exclusion>
        <groupId>software.amazon.awssdk</groupId>
        <artifactId>apache-client</artifactId>
      </exclusion>
	</exclusions>
  </dependency>
  <dependency>
    <groupId>software.amazon.awssdk</groupId>
    <artifactId>apache-client</artifactId>
    <exclusions>
      <exclusion>
        <groupId>commons-logging</groupId>
        <artifactId>commons-logging</artifactId>
      </exclusion>
    </exclusions>
  </dependency>
</dependencies>

The output of maven-enforce-plugin is:

[WARNING] 
Dependency convergence error for commons-codec:commons-codec:1.11 paths to dependency are:
+-com.some.modulea:0.0.2-SNAPSHOT
  +-com.some.moduleb:0.0.2-SNAPSHOT
    +-software.amazon.awssdk:apache-client:2.20.94
      +-org.apache.httpcomponents:httpclient:4.5.13
        +-commons-codec:commons-codec:1.11
and
+-com.some.modulea:0.0.2-SNAPSHOT
  +-com.some.moduleb:0.0.2-SNAPSHOT
    +-software.amazon.awssdk:apache-client:2.20.94
      +-commons-codec:commons-codec:1.15

Reproduction Steps

Executing mvn install with the mvn-enforcer-plugin (with the rule <dependencyConvergence/> )

Possible Solution

No response

Additional Information/Context

No response

AWS Java SDK version used

2.20.94

JDK version used

openjdk version "11.0.19"

Operating System and version

Ubuntu 22.04

[debora-ito]

@josecoelho96 thank you for reaching out.

If you search for "enforce dependency convergence" in this repo you'll see we had previous reports of this. We don't consider it a bug because we don't use the plugin in our builds.

We are tracking the feature request to enable it here - #2669.

[github-actions]

⚠️COMMENT VISIBILITY WARNING⚠️

Comments on closed issues are hard for our team to see.
If you need more assistance, please open a new issue that references this one.
If you wish to keep having a conversation with other community members under this issue feel free to do so.