Maven enforcer dependency convergence is getting tripped up despite the fact that I have (or believe I have) excluded the offending dependencies.
Apache Maven 3.9.6 (bc0240f3c744dd6b6ec2920b3cd08dcc295161ae)
$ java --version
openjdk 21.0.1 2023-10-17 LTS
I’m using the maven-enforcer-plugin version 3.4.1, and I’m getting the following error when running mvn clean package.
[ERROR] Failed while enforcing releasability.
[ERROR]
[ERROR] Dependency convergence error for org.slf4j:slf4j-api:jar:1.7.7 paths to dependency are:
[ERROR] +-com.foo.traf:demo-app:jar:1.0-SNAPSHOT
[ERROR] +-com.microsoft.azure:msal4j-persistence-extension:jar:1.3.0:compile
[ERROR] +-org.slf4j:slf4j-api:jar:1.7.7:compile
[ERROR] and
[ERROR] +-com.foo.traf:demo-app:jar:1.0-SNAPSHOT
[ERROR] +-com.microsoft.azure:msal4j:jar:1.16.1:compile
[ERROR] +-org.slf4j:slf4j-api:jar:1.7.36:compile
[ERROR] and
[ERROR] +-com.foo.traf:demo-app:jar:1.0-SNAPSHOT
[ERROR] +-org.slf4j:slf4j-api:jar:2.0.13:compile
Here the the relevant snippets of pom file.
<dependency>
<groupId>com.microsoft.azure</groupId>
<artifactId>msal4j-persistence-extension</artifactId>
<version>1.3.0</version>
<exclusions>
<exclusion>
<artifactId>org.slf4j</artifactId>
<groupId>slf4j-api</groupId>
</exclusion>
and
<dependency>
<groupId>com.microsoft.azure</groupId>
<artifactId>msal4j</artifactId>
<version>1.16.1</version>
<exclusions>
<exclusion>
<artifactId>org.slf4j</artifactId>
<groupId>slf4j-api</groupId>
</exclusion>
And mvn dependency:tree seems to agree that slf4j:1.7.x is not included through those roots.
[INFO] +- com.microsoft.azure:msal4j-persistence-extension:jar:1.3.0:compile
[INFO] +- com.microsoft.azure:msal4j:jar:1.16.1:compile
[INFO] | +- com.nimbusds:oauth2-oidc-sdk:jar:11.9.1:compile
[INFO] | | +- com.github.stephenc.jcip:jcip-annotations:jar:1.0-1:compile
[INFO] | | +- com.nimbusds:content-type:jar:2.3:compile
[INFO] | | +- com.nimbusds:lang-tag:jar:1.7:compile
[INFO] | | - com.nimbusds:nimbus-jose-jwt:jar:9.37.3:compile
[INFO] | - net.minidev:json-smart:jar:2.5.0:compile
[INFO] | - net.minidev:accessors-smart:jar:2.5.0:compile
[INFO] | - org.ow2.asm:asm:jar:9.3:compile
What am I doing wrong and/or how do I work around this?