Question

当我使用程序集插件时，我得到了一个意外版本的依赖项（1.5.8），但没有其他地方。在我的pom中我有：

    <dependency>
        <groupId>org.slf4j</groupId>
        <artifactId>slf4j-log4j12</artifactId>
        <version>1.6.0</version>
    </dependency>

当我运行dependency:tree或dependency:list时，我看到的是正确的版本，只有正确的版本。当我在Eclipse中检查时，我只看到了正确的版本。

在我的assembly.xml中，我有：

<dependencySets>
    <dependencySet>
        <outputDirectory>lib</outputDirectory>
    </dependencySet>
</dependencySets>

在结果zip中，我得到slf4j-log4j12-1.5.8.jar。不知道这是从哪里来的。有什么帮助吗？

使用maven 3.0.4。

Answer 1

这是由于'坏'程序集插件版本（2.2-beta-5）。我的pom.xml没有指定插件版本。当我明确地将其标记为2.4（或者当你阅读它时的最新版本！）时，插件会提取正确的依赖关系。

获得的经验教训 - 如果您在构建中收到以下警告：

[WARNING] 'build.plugins.plugin.version' for org.apache.maven.plugins:maven-whatever-plugin is missing
It is highly recommended to fix these problems because they threaten the stability of your build.

..解决它！

Answer 2

您可以尝试从maven存储库中删除错误的JAR（slf4j-log4j12-1.5.8.jar）并在其中添加正确的JAR（slf4j-log4j12-1.6.0.jar）。然后使用--offline开关运行构建。在maven试图获取错误的JAR的那一刻，构建将失败并且maven将向您展示它正在尝试获取它的传递依赖性。然后使用以下方法将其从transistive依赖项中排除：
```
<exclusions>
  <exclusion>
    <artifactId>slf4j-api</artifactId>
    <groupId>slf4j-log4j12</groupId>
  </exclusion>
</exclusions>
```

检查您获得的JAR是否具有正确的groupId。有些人为~~愚蠢和邪恶~~特殊目的创建了常见JAR的副本，这可能会使maven感到困惑。特别是，请检查您是否未获得org.jboss.resteasy:slf4j-log4j12。您可以使用maven-enforcer-plugin禁止不需要的依赖项，如下所示：

<plugin>
  <groupId>org.apache.maven.plugins</groupId>
  <artifactId>maven-enforcer-plugin</artifactId>
  <version>1.0</version>
  <executions>
    <execution>
      <id>enforce-banned-dependencies</id>
      <goals>
         <goal>enforce</goal>
      </goals>
      <configuration>
        <rules>
          <bannedDependencies>
            <excludes>
              <exclude>org.slf4j:slf4j-log4j12:1.5.8</exclude> <!-- Wrong version, dude! -->
              <exclude>commons-logging:*</exclude> <!-- Worst, stupidest, lamest logging framework ever! -->
              <exclude>org.jboss.resteasy:slf4j-simple</exclude> <!-- Evil JAR duplication. -->
              <exclude>org.jboss.resteasy:slf4j-api</exclude> <!-- Evil JAR duplication. -->
              <exclude>org.jboss.resteasy:slf4j-log4j12</exclude> <!-- Evil JAR duplication. -->
              <exclude>org.jboss.resteasy:jackson-core-asl</exclude> <!-- Evil JAR duplication. -->
              <exclude>org.jboss.resteasy:jackson-mapper-asl</exclude> <!-- Evil JAR duplication. -->
              <exclude>org.jboss.resteasy:jackson-core-lgpl</exclude> <!-- Evil JAR duplication. -->
              <exclude>org.jboss.resteasy:jackson-mapper-lgpl</exclude> <!-- Evil JAR duplication. -->
              <exclude>org.codehaus.jackson:jackson-core-lgpl</exclude> <!-- Two distinct packages for the exact same thing always creates conflicts. We want the ASL one. -->
              <exclude>org.codehaus.jackson:jackson-mapper-lgpl</exclude> <!-- Two distinct packages for the exact same thing always creates conflicts. We want the ASL one. -->
              <exclude>velocity-tools:velocity-tools</exclude> <!-- Was renamed. -->
              <exclude>velocity:velocity</exclude> <!-- Was renamed. -->
              <exclude>struts:struts</exclude> <!-- Was renamed. -->
              <exclude>javassist:javassist</exclude> <!-- Was renamed. -->
              <exclude>axis:*</exclude> <!-- Was renamed to org.apache.axis:* and wsdl4j:wsdl4j . -->
              <exclude>commons-beanutils:commons-beanutils-core</exclude> <!-- Redundant package. -->
              <exclude>xpp3:xpp3_min</exclude> <!-- Redundant package. -->
              <exclude>xml-apis:xml-apis:2.0.0</exclude> <!-- Bad package, for some strange reason 2.0.x is inferior to 1.4.x. -->
              <exclude>xml-apis:xml-apis:2.0.2</exclude> <!-- Bad package, for some strange reason 2.0.x is inferior to 1.4.x. -->
              <exclude>quartz:quartz</exclude> <!-- Was renamed. -->
            </excludes>
          </bannedDependencies>
        </rules>
      </configuration>
    </execution>
  </executions>
</plugin>

maven组件错误依赖

2 个答案: