Netty dependencies of different versions used

[Spikhalskiy]

Now async http client uses netty-reactive-streams 1.0.4 which depends on io.netty:netty-handler:4.0.34.Final, while the main netty version in project is 4.0.36.Final

Suggested fix: exclude netty-handler from netty-reactive-streams dependency and add separately with correct version

[slandelle]

Thanks!

BTW, versions are properly picked in my env as netty-code-http also depends on netty-handler, but arrives first in the build chain, before netty-reactive-streams. At least that's how maven/aether works, but maybe other tools such as gradle have an issue.

[Spikhalskiy]

I found it by:

[INFO] --- maven-enforcer-plugin:1.4:enforce (enforce) @ our_artifact ---
[WARNING]
Dependency convergence error for io.netty:netty-handler:4.0.36.Final paths to dependency are:
+-our_artifact
  +-org.asynchttpclient:async-http-client:2.0.2
    +-io.netty:netty-codec-http:4.0.36.Final
      +-io.netty:netty-handler:4.0.36.Final
and
+-our_artifact
  +-org.asynchttpclient:async-http-client:2.0.2
    +-com.typesafe.netty:netty-reactive-streams:1.0.4
      +-io.netty:netty-handler:4.0.34.Final
[WARNING] Rule 0: org.apache.maven.plugins.enforcer.DependencyConvergence failed with message:
Failed while enforcing releasability the error(s) are [
Dependency convergence error for io.netty:netty-handler:4.0.36.Final paths to dependency are:
+-our_artifact
  +-org.asynchttpclient:async-http-client:2.0.2
    +-io.netty:netty-codec-http:4.0.36.Final
      +-io.netty:netty-handler:4.0.36.Final
and
+-our_artifact
  +-org.asynchttpclient:async-http-client:2.0.2
    +-com.typesafe.netty:netty-reactive-streams:1.0.4
      +-io.netty:netty-handler:4.0.34.Final

[slandelle]

OK. So actually, this is more a warning that the dependency tree is not clean (I fully agree), than a bug that actually happen (conflicting versions at runtime).

[Spikhalskiy]

Right, no actual bugs based on it. For us, it just caused build fails because of our build flow setup.

[Spikhalskiy]

Actually, it didn't fix this warning. With new release it's still presented.

[WARNING] Rule 0: org.apache.maven.plugins.enforcer.DependencyConvergence failed with message:
Failed while enforcing releasability the error(s) are [
Dependency convergence error for io.netty:netty-handler:4.0.36.Final paths to dependency are:
+-our_artifact
  +-org.asynchttpclient:async-http-client:2.0.3
    +-io.netty:netty-codec-http:4.0.36.Final
      +-io.netty:netty-handler:4.0.36.Final
and
+-our_artifact
  +-org.asynchttpclient:async-http-client:2.0.3
    +-com.typesafe.netty:netty-reactive-streams:1.0.4
      +-io.netty:netty-handler:4.0.34.Final
]

Looks like only exclusion will help to fix this plugin rule

[slandelle]

I don't know if that's a maven-enforcing-plugin bug, or just a rule being too strict, but I strongly disagree there's anything wrong with our dependency tree now that we have a dependency management for netty-handler.

IMO, that's something to ask the the plugin maintainers, but there's no reason to add an exclusion, so we won't.

[Spikhalskiy]

https://issues.apache.org/jira/browse/MENFORCER-252

[slandelle]

Padding was dropped in your issue against maven-enforcer-plugin so I'm afraid they will think that all deps have the same root dependency level (which they don't, that's the point). It looks like this:

+-our_artifact
+-org.asynchttpclient:async-http-client:2.0.3
+-io.netty:netty-codec-http:4.0.36.Final
+-io.netty:netty-handler:4.0.36.Final
and
+-our_artifact
+-org.asynchttpclient:async-http-client:2.0.3
+-com.typesafe.netty:netty-reactive-streams:1.0.4
+-io.netty:netty-handler:4.0.34.Final

Also, the important thing is that there's a dependencyManagement in AHC forcing netty-handler:4.0.36.Final.

[slandelle]

I suspect that maven-enforcer-plugin has its own dependency tree resolution algorithm, distinct from the aether one (until maven 3, plugins couldn't access it, so they had to reimplement) and that it's buggy.

[Spikhalskiy]

@slandelle Thanks, fixed formatting. About enforcing - already included in the description. Let's see.