意外的传递依赖版本答案

【问题标题】：Unexpected transitive dependency version意外的传递依赖版本
【发布时间】：2019-11-10 07:39:35
【问题描述】：

使用 Spring Boot 设置一个干净的 Maven 项目以使用 JUnit 4 和 5 进行测试我最终得到了这些依赖项：

<properties>
    <junit-jupiter.version>5.5.2</junit-jupiter.version>
    <spring-framework.version>5.2.0.RELEASE</spring-framework.version>
    <spring-boot.version>2.2.0.RELEASE</spring-boot.version>
</properties>
<dependencies>
    <dependency>
        <groupId>org.springframework.boot</groupId>
        <artifactId>spring-boot-starter-test</artifactId>
        <version>${spring-boot.version}</version>
    </dependency>
    <dependency>
        <groupId>org.springframework</groupId>
        <artifactId>spring-core</artifactId>
        <version>${spring-framework.version}</version>
    </dependency>
    <dependency>
        <groupId>org.openjfx</groupId>
        <artifactId>javafx-controls</artifactId>
        <version>11</version>
    </dependency>
    <dependency>
        <groupId>org.openjfx</groupId>
        <artifactId>javafx-swing</artifactId>
        <version>11</version>
    </dependency>
    <dependency>
        <groupId>junit</groupId>
        <artifactId>junit</artifactId>
        <version>4.12</version>
        <scope>test</scope>
    </dependency>
    <dependency>
        <groupId>org.junit.jupiter</groupId>
        <artifactId>junit-jupiter-engine</artifactId>
        <version>${junit-jupiter.version}</version>
    </dependency>
    <dependency>
        <groupId>org.junit.platform</groupId>
        <artifactId>junit-platform-launcher</artifactId>
        <version>1.2.0</version>
    </dependency>
    <dependency>
        <groupId>org.junit.vintage</groupId>
        <artifactId>junit-vintage-engine</artifactId>
        <version>${junit-jupiter.version}</version>
    </dependency>
    <dependency>
        <groupId>org.junit.jupiter</groupId>
        <artifactId>junit-jupiter-params</artifactId>
        <version>${junit-jupiter.version}</version>
    </dependency>
    <dependency>
        <groupId>org.junit.jupiter</groupId>
        <artifactId>junit-jupiter-api</artifactId>
        <version>${junit-jupiter.version}</version>
    </dependency>
</dependencies>

这会产生以下依赖关系树：

[INFO] ch.sahits.test:junit55:jar:1.0-SNAPSHOT
[INFO] +- org.springframework.boot:spring-boot-starter-test:jar:2.2.0.RELEASE:compile
[INFO] |  +- org.springframework.boot:spring-boot-starter:jar:2.2.0.RELEASE:compile
[INFO] |  |  +- org.springframework.boot:spring-boot:jar:2.2.0.RELEASE:compile
[INFO] |  |  |  \- org.springframework:spring-context:jar:5.2.0.RELEASE:compile
[INFO] |  |  |     +- org.springframework:spring-aop:jar:5.2.0.RELEASE:compile
[INFO] |  |  |     +- org.springframework:spring-beans:jar:5.2.0.RELEASE:compile
[INFO] |  |  |     \- org.springframework:spring-expression:jar:5.2.0.RELEASE:compile
[INFO] |  |  +- org.springframework.boot:spring-boot-autoconfigure:jar:2.2.0.RELEASE:compile
[INFO] |  |  +- org.springframework.boot:spring-boot-starter-logging:jar:2.2.0.RELEASE:compile
[INFO] |  |  |  +- ch.qos.logback:logback-classic:jar:1.2.3:compile
[INFO] |  |  |  |  \- ch.qos.logback:logback-core:jar:1.2.3:compile
[INFO] |  |  |  +- org.apache.logging.log4j:log4j-to-slf4j:jar:2.12.1:compile
[INFO] |  |  |  |  \- org.apache.logging.log4j:log4j-api:jar:2.12.1:compile
[INFO] |  |  |  \- org.slf4j:jul-to-slf4j:jar:1.7.28:compile
[INFO] |  |  +- jakarta.annotation:jakarta.annotation-api:jar:1.3.5:compile
[INFO] |  |  \- org.yaml:snakeyaml:jar:1.25:runtime
[INFO] |  +- org.springframework.boot:spring-boot-test:jar:2.2.0.RELEASE:compile
[INFO] |  +- org.springframework.boot:spring-boot-test-autoconfigure:jar:2.2.0.RELEASE:compile
[INFO] |  +- com.jayway.jsonpath:json-path:jar:2.4.0:compile
[INFO] |  |  +- net.minidev:json-smart:jar:2.3:compile
[INFO] |  |  |  \- net.minidev:accessors-smart:jar:1.2:compile
[INFO] |  |  |     \- org.ow2.asm:asm:jar:5.0.4:compile
[INFO] |  |  \- org.slf4j:slf4j-api:jar:1.7.25:compile
[INFO] |  +- jakarta.xml.bind:jakarta.xml.bind-api:jar:2.3.2:compile
[INFO] |  |  \- jakarta.activation:jakarta.activation-api:jar:1.2.1:compile
[INFO] |  +- org.junit.jupiter:junit-jupiter:jar:5.5.2:compile
[INFO] |  +- org.mockito:mockito-junit-jupiter:jar:3.1.0:compile
[INFO] |  +- org.assertj:assertj-core:jar:3.13.2:compile
[INFO] |  +- org.hamcrest:hamcrest:jar:2.1:compile
[INFO] |  +- org.mockito:mockito-core:jar:3.1.0:compile
[INFO] |  |  +- net.bytebuddy:byte-buddy:jar:1.9.10:compile
[INFO] |  |  +- net.bytebuddy:byte-buddy-agent:jar:1.9.10:compile
[INFO] |  |  \- org.objenesis:objenesis:jar:2.6:compile
[INFO] |  +- org.skyscreamer:jsonassert:jar:1.5.0:compile
[INFO] |  |  \- com.vaadin.external.google:android-json:jar:0.0.20131108.vaadin1:compile
[INFO] |  +- org.springframework:spring-test:jar:5.2.0.RELEASE:compile
[INFO] |  \- org.xmlunit:xmlunit-core:jar:2.6.3:compile
[INFO] +- org.springframework:spring-core:jar:5.2.0.RELEASE:compile
[INFO] |  \- org.springframework:spring-jcl:jar:5.2.0.RELEASE:compile
[INFO] +- org.openjfx:javafx-controls:jar:11:compile
[INFO] |  +- org.openjfx:javafx-controls:jar:linux:11:compile
[INFO] |  \- org.openjfx:javafx-graphics:jar:11:compile
[INFO] |     +- org.openjfx:javafx-graphics:jar:linux:11:compile
[INFO] |     \- org.openjfx:javafx-base:jar:11:compile
[INFO] |        \- org.openjfx:javafx-base:jar:linux:11:compile
[INFO] +- org.openjfx:javafx-swing:jar:11:compile
[INFO] |  \- org.openjfx:javafx-swing:jar:linux:11:compile
[INFO] +- junit:junit:jar:4.12:test
[INFO] |  \- org.hamcrest:hamcrest-core:jar:1.3:test
[INFO] +- org.junit.jupiter:junit-jupiter-engine:jar:5.5.2:compile
[INFO] |  +- org.apiguardian:apiguardian-api:jar:1.1.0:compile
[INFO] |  \- org.junit.platform:junit-platform-engine:jar:1.5.2:compile
[INFO] +- org.junit.platform:junit-platform-launcher:jar:1.2.0:compile
[INFO] +- org.junit.vintage:junit-vintage-engine:jar:5.5.2:compile
[INFO] +- org.junit.jupiter:junit-jupiter-params:jar:5.5.2:compile
[INFO] \- org.junit.jupiter:junit-jupiter-api:jar:5.5.2:compile
[INFO]    +- org.opentest4j:opentest4j:jar:1.2.0:compile
[INFO]    \- org.junit.platform:junit-platform-commons:jar:1.5.2:compile

在不同的模块/项目上，我确实有这些依赖项：

<dependencies>
    <!-- Module dependencies -->
    <dependency>
        <groupId>${project.groupId}</groupId>
        <artifactId>OpenPatricianUtilities</artifactId>
    </dependency>
    <dependency>
        <groupId>ch.sahits.game</groupId>
        <artifactId>GameEvent</artifactId>
    </dependency>
    <dependency>
        <groupId>ch.sahits.game</groupId>
        <artifactId>MarvinFXEssentials</artifactId>
        <scope>test</scope>
    </dependency>
    <!-- Spring Framework -->

    <dependency>
        <groupId>org.springframework.boot</groupId>
        <artifactId>spring-boot</artifactId>
    </dependency>
    <dependency>
        <groupId>org.springframework.boot</groupId>
        <artifactId>spring-boot-autoconfigure</artifactId>
    </dependency>
    <dependency>
        <groupId>org.springframework</groupId>
        <artifactId>spring-oxm</artifactId>
    </dependency>
    <dependency>
        <groupId>org.glassfish.jaxb</groupId>
        <artifactId>jaxb-runtime</artifactId>
    </dependency>
    <!-- Other libraries -->

    <dependency>
        <groupId>com.google.guava</groupId>
        <artifactId>guava</artifactId>
    </dependency>
    <dependency>
        <groupId>org.projectlombok</groupId>
        <artifactId>lombok</artifactId>
        <scope>provided</scope>
    </dependency>
    <dependency>
        <groupId>ch.sahits</groupId>
        <artifactId>sahitsUtil</artifactId>
    </dependency>

    <!-- Test -->

    <dependency>
        <groupId>org.springframework.boot</groupId>
        <artifactId>spring-boot-starter-test</artifactId>
        <scope>test</scope>
    </dependency>
    <dependency>
        <groupId>ch.sahits.game</groupId>
        <artifactId>OpenPatricianData</artifactId>
        <scope>test</scope>
    </dependency>
    <dependency>
        <groupId>ch.sahits.game</groupId>
        <artifactId>OpenPatricianTestUtilities</artifactId>
        <scope>test</scope>
    </dependency>
</dependencies>

导致这个依赖树：

[INFO] ch.sahits.game:OpenPatricianModel:jar:1.1.0-SNAPSHOT
[INFO] +- ch.sahits.game:OpenPatricianUtilities:jar:1.1.0-SNAPSHOT:compile
[INFO] |  +- org.springframework:spring-context:jar:5.2.0.RELEASE:compile
[INFO] |  |  +- org.springframework:spring-aop:jar:5.2.0.RELEASE:compile
[INFO] |  |  \- org.springframework:spring-expression:jar:5.2.0.RELEASE:compile
[INFO] |  +- org.springframework:spring-beans:jar:5.2.0.RELEASE:compile
[INFO] |  +- org.springframework.boot:spring-boot-starter-logging:jar:2.2.0.RELEASE:compile
[INFO] |  |  +- ch.qos.logback:logback-classic:jar:1.2.3:compile
[INFO] |  |  |  \- ch.qos.logback:logback-core:jar:1.2.3:compile
[INFO] |  |  +- org.apache.logging.log4j:log4j-to-slf4j:jar:2.12.1:compile
[INFO] |  |  |  \- org.apache.logging.log4j:log4j-api:jar:2.12.1:compile
[INFO] |  |  \- org.slf4j:jul-to-slf4j:jar:1.7.28:compile
[INFO] |  +- org.openjfx:javafx-controls:jar:11:compile
[INFO] |  |  +- org.openjfx:javafx-controls:jar:linux:11:compile
[INFO] |  |  \- org.openjfx:javafx-graphics:jar:11:compile
[INFO] |  |     +- org.openjfx:javafx-graphics:jar:linux:11:compile
[INFO] |  |     \- org.openjfx:javafx-base:jar:11:compile
[INFO] |  |        \- org.openjfx:javafx-base:jar:linux:11:compile
[INFO] |  +- commons-io:commons-io:jar:2.6:compile
[INFO] |  +- com.thoughtworks.xstream:xstream:jar:1.4.11:compile
[INFO] |  |  +- xmlpull:xmlpull:jar:1.1.3.1:compile
[INFO] |  |  \- xpp3:xpp3_min:jar:1.1.4c:compile
[INFO] |  +- javax.xml.bind:jaxb-api:jar:2.3.1:compile
[INFO] |  \- javax.annotation:javax.annotation-api:jar:1.3.2:compile
[INFO] +- ch.sahits.game:GameEvent:jar:1.1.0-SNAPSHOT:compile
[INFO] +- ch.sahits.game:MarvinFXEssentials:jar:1.1.0-SNAPSHOT:test
[INFO] |  +- junit:junit:jar:4.12:test
[INFO] |  |  \- org.hamcrest:hamcrest-core:jar:2.1:test
[INFO] |  \- org.openjfx:javafx-fxml:jar:11:test
[INFO] |     \- org.openjfx:javafx-fxml:jar:linux:11:test
[INFO] +- org.springframework.boot:spring-boot:jar:2.2.0.RELEASE:compile
[INFO] |  \- org.springframework:spring-core:jar:5.2.0.RELEASE:compile
[INFO] |     \- org.springframework:spring-jcl:jar:5.2.0.RELEASE:compile
[INFO] +- org.springframework.boot:spring-boot-autoconfigure:jar:2.2.0.RELEASE:compile
[INFO] +- org.springframework:spring-oxm:jar:5.2.0.RELEASE:compile
[INFO] +- org.glassfish.jaxb:jaxb-runtime:jar:2.3.1:compile
[INFO] |  +- org.glassfish.jaxb:txw2:jar:2.3.2:compile
[INFO] |  +- com.sun.istack:istack-commons-runtime:jar:3.0.7:compile
[INFO] |  +- org.jvnet.staxex:stax-ex:jar:1.8:compile
[INFO] |  +- com.sun.xml.fastinfoset:FastInfoset:jar:1.2.15:compile
[INFO] |  \- javax.activation:javax.activation-api:jar:1.2.0:compile
[INFO] +- com.google.guava:guava:jar:24.1-jre:compile
[INFO] |  +- com.google.code.findbugs:jsr305:jar:1.3.9:compile
[INFO] |  +- org.checkerframework:checker-compat-qual:jar:2.0.0:compile
[INFO] |  +- com.google.errorprone:error_prone_annotations:jar:2.1.3:compile
[INFO] |  +- com.google.j2objc:j2objc-annotations:jar:1.1:compile
[INFO] |  \- org.codehaus.mojo:animal-sniffer-annotations:jar:1.14:compile
[INFO] +- org.projectlombok:lombok:jar:1.18.10:provided
[INFO] +- ch.sahits:sahitsUtil:jar:1.3.3:compile
[INFO] |  +- org.apache.commons:commons-lang3:jar:3.9:compile
[INFO] |  +- org.mockito:mockito-junit-jupiter:jar:3.1.0:compile
[INFO] |  \- commons-cli:commons-cli:jar:1.4:compile
[INFO] +- org.springframework.boot:spring-boot-starter-test:jar:2.2.0.RELEASE:test
[INFO] |  +- org.springframework.boot:spring-boot-starter:jar:2.2.0.RELEASE:test
[INFO] |  |  +- jakarta.annotation:jakarta.annotation-api:jar:1.3.5:test
[INFO] |  |  \- org.yaml:snakeyaml:jar:1.25:test
[INFO] |  +- org.springframework.boot:spring-boot-test:jar:2.2.0.RELEASE:test
[INFO] |  +- org.springframework.boot:spring-boot-test-autoconfigure:jar:2.2.0.RELEASE:test
[INFO] |  +- com.jayway.jsonpath:json-path:jar:2.4.0:test
[INFO] |  |  +- net.minidev:json-smart:jar:2.3:test
[INFO] |  |  |  \- net.minidev:accessors-smart:jar:1.2:test
[INFO] |  |  |     \- org.ow2.asm:asm:jar:5.0.4:test
[INFO] |  |  \- org.slf4j:slf4j-api:jar:1.7.28:compile
[INFO] |  +- jakarta.xml.bind:jakarta.xml.bind-api:jar:2.3.2:test
[INFO] |  |  \- jakarta.activation:jakarta.activation-api:jar:1.2.1:test
[INFO] |  +- org.junit.jupiter:junit-jupiter:jar:5.5.2:test
[INFO] |  +- org.junit.vintage:junit-vintage-engine:jar:5.5.2:test
[INFO] |  |  +- org.apiguardian:apiguardian-api:jar:1.1.0:test
[INFO] |  |  \- org.junit.platform:junit-platform-engine:jar:1.5.2:test
[INFO] |  +- org.assertj:assertj-core:jar:3.13.2:test
[INFO] |  +- org.hamcrest:hamcrest:jar:2.1:test
[INFO] |  +- org.mockito:mockito-core:jar:3.1.0:compile
[INFO] |  |  +- net.bytebuddy:byte-buddy:jar:1.10.1:compile
[INFO] |  |  +- net.bytebuddy:byte-buddy-agent:jar:1.10.1:compile
[INFO] |  |  \- org.objenesis:objenesis:jar:2.6:compile
[INFO] |  +- org.skyscreamer:jsonassert:jar:1.5.0:test
[INFO] |  |  \- com.vaadin.external.google:android-json:jar:0.0.20131108.vaadin1:test
[INFO] |  +- org.springframework:spring-test:jar:5.2.0.RELEASE:test
[INFO] |  \- org.xmlunit:xmlunit-core:jar:2.6.3:test
[INFO] +- ch.sahits.game:OpenPatricianData:jar:1.1.0-SNAPSHOT:test
[INFO] \- ch.sahits.game:OpenPatricianTestUtilities:jar:1.1.0-SNAPSHOT:test
[INFO]    +- org.openjfx:javafx-swing:jar:11:test
[INFO]    |  \- org.openjfx:javafx-swing:jar:linux:11:test
[INFO]    +- org.junit.jupiter:junit-jupiter-engine:jar:5.5.2:test
[INFO]    +- org.junit.platform:junit-platform-launcher:jar:1.5.2:test
[INFO]    +- org.junit.jupiter:junit-jupiter-params:jar:5.5.2:test
[INFO]    \- org.junit.jupiter:junit-jupiter-api:jar:5.5.2:test
[INFO]       +- org.opentest4j:opentest4j:jar:1.2.0:test
[INFO]       \- org.junit.platform:junit-platform-commons:jar:1.5.2:test

两者都在版本 3.1.0 中通过 spring-boot-starter-test 定义 Mockito。然而，项目 junit55 具有版本 1.9.10 的字节伙伴依赖性，而 OpenPatricianModel 在版本 1.10.1 中具有它。这个依赖在项目中没有明确定义。

我怎么可能对 OpenPatricianModel 有不同的 byte-buddy 依赖关系，我怎样才能找出它来自哪里。

【问题讨论】：

确实很奇怪。您是否明确定义了任何存储库？或者您的任何父项目是否定义了可能导致不同 pom 文件用于 mockito 的存储库？（应该是一个不太可能的原因，因为这是一个发布版本）
@ernest_k：没有明确定义存储库。 junit55 没有父 pom，而 OpenPatricianModel 有一个处理依赖管理的。

标签： java maven mockito dependency-management

【解决方案1】：

byte-buddy 依赖项至少比org.springframework.boot:spring-boot-starter-test 多一个依赖项被传递性地拉入。您可以通过OpenPatricianModel 的依赖关系树中的字节伙伴范围看到这一点。注意范围是compile 而不是test。

找出哪个依赖项将其引入的最佳方法是在您的 spring-boot-starter-test 声明中添加 byte-buddy 依赖项的排除项。比如：

<dependency>
    <groupId>org.springframework.boot</groupId>
    <artifactId>spring-boot-starter-test</artifactId>
    <scope>test</scope>
    <exclusions>
        <exclusion>
            <groupId>net.bytebuddy</groupId>
            <artifactId>byte-buddy</artifactId>
        </exclusion>
        <exclusion>
            <groupId>net.bytebuddy</groupId>
            <artifactId>byte-buddy-agent</artifactId>
        </exclusion>
    </exclusions>
</dependency>

然后，通过再次运行mvn dependency:tree，您应该能够看到哪个其他依赖项正在拉入字节伙伴。请注意，可能不止一个，在这种情况下，您将不得不再次进行相同的练习。

【讨论】：