I’m building a Confluence plugin with the following dependency:
<dependency>
<groupId>com.google.auth</groupId>
<artifactId>google-auth-library-oauth2-http</artifactId>
<version>1.12.1</version>
</dependency>
When this is added, I get an error from banned dependencies:
[INFO] --- confluence-maven-plugin:8.2.3:validate-banned-dependencies (default-validate-banned-dependencies) @ google-analytics-for-confluence ---
[INFO] validate banned dependencies
[WARNING] Rule 0: org.apache.maven.plugins.enforcer.BannedDependencies failed with message:
make sure platform artifacts are not bundled into plugin
Found Banned Dependency: com.google.code.findbugs:jsr305:jar:3.0.2
Found Banned Dependency: com.google.guava:guava:jar:26.0-jre
Found Banned Dependency: javax.annotation:javax.annotation-api:jar:1.3.2
Found Banned Dependency: org.apache.httpcomponents:httpclient:jar:4.5.13
Found Banned Dependency: org.apache.httpcomponents:httpcore:jar:4.4.13
Use 'mvn dependency:tree' to locate the source of the banned dependencies.
[INFO] ------------------------------------------------------------------------
[INFO] BUILD FAILURE
[INFO] ------------------------------------------------------------------------
[INFO] Total time: 10.834 s
[INFO] Finished at: 2022-11-03T15:54:11Z
[INFO] ------------------------------------------------------------------------
[ERROR] Failed to execute goal com.atlassian.maven.plugins:confluence-maven-plugin:8.2.3:validate-banned-dependencies (default-validate-banned-dependencies) on project google-analytics-for-confluence: Some Enforcer rules have failed. Look above for specific messages explaining why the rule failed. -> [Help 1]
[ERROR]
[ERROR] To see the full stack trace of the errors, re-run Maven with the -e switch.
[ERROR] Re-run Maven using the -X switch to enable full debug logging.
[ERROR]
[ERROR] For more information about the errors and possible solutions, please read the following articles:
[ERROR] [Help 1] http://cwiki.apache.org/confluence/display/MAVEN/MojoExecutionException
Each of the banned dependencies comes from a dependency in com.google.http-client:google-http-client (which com.google.auth:google-auth-library-oauth2-http is dependent on).
Whats the best way around this?
@aswan says in
Maven bans dependencies with no configuration:
When you have a legitimate reason for disabling this check, as in your situation, you can so do by adding this to your AMPS configuration:
<banningExcludes> <exclude>commons-io:commons-io</exclude> <exclude>com.foo:bar</exclude> ... </banningExcludes>But I’ll just reiterate that most AMPS users should not do this, they should use the dependencies that the platform provides.
So I could do this:
<banningExcludes>
<exclude>com.google.code.findbugs:jsr305</exclude>
<exclude>com.google.guava:guava</exclude>
<exclude>javax.annotation:javax.annotation-api</exclude>
<exclude>org.apache.httpcomponents:httpclient</exclude>
<exclude>org.apache.httpcomponents:httpcore</exclude>
</banningExcludes>
…but the question is, is there a better way?
Of course I have done this before, but it has been a while.
