net.bytebuddy:byte-buddy upper bound issue with 3010.vec758b_8e7da_3

[jonesbusy]

Jenkins and plugins versions report

All

What Operating System are you using (both controller, and any agents involved in the problem)?

All

Reproduction steps

Hi,

This is not exactly an issue with the bom but I've seen upper bound issue on some recent bom update

https://ci.jenkins.io/job/Plugins/job/postgresql-fingerprint-storage-plugin/job/PR-313/1/console

05:28:37  Require upper bound dependencies error for net.bytebuddy:byte-buddy:1.12.18 paths to dependency are:
05:28:37  +-io.jenkins.plugins:postgresql-fingerprint-storage:267.v11ef13b_908c8
05:28:37    +-org.jenkins-ci.plugins:database:230.v701f20b_8b_f95
05:28:37      +-org.hibernate:hibernate-entitymanager:5.6.15.Final
05:28:37        +-net.bytebuddy:byte-buddy:1.12.18
05:28:37  and
05:28:37  +-io.jenkins.plugins:postgresql-fingerprint-storage:267.v11ef13b_908c8
05:28:37    +-org.jenkins-ci.plugins:jackson2-api:2.17.0-379.v02de8ec9f64c
05:28:37      +-com.fasterxml.jackson.core:jackson-databind:2.17.0
05:28:37        +-net.bytebuddy:byte-buddy:1.14.9
05:28:37  and
05:28:37  +-io.jenkins.plugins:postgresql-fingerprint-storage:267.v11ef13b_908c8
05:28:37    +-org.jenkins-ci.plugins:database:230.v701f20b_8b_f95
05:28:37      +-org.hibernate:hibernate-entitymanager:5.6.15.Final
05:28:37        +-org.hibernate:hibernate-core:5.6.15.Final
05:28:37          +-net.bytebuddy:byte-buddy:1.12.18

I happen when database plugin and jackson2-api are in the classpath

My feeling is that perhaps byte-buddy deserve and API plugin ?

Regards,

Expected Results

No issue when bumping bom version

Actual Results

05:28:37  Require upper bound dependencies error for net.bytebuddy:byte-buddy:1.12.18 paths to dependency are:
05:28:37  +-io.jenkins.plugins:postgresql-fingerprint-storage:267.v11ef13b_908c8
05:28:37    +-org.jenkins-ci.plugins:database:230.v701f20b_8b_f95
05:28:37      +-org.hibernate:hibernate-entitymanager:5.6.15.Final
05:28:37        +-net.bytebuddy:byte-buddy:1.12.18
05:28:37  and
05:28:37  +-io.jenkins.plugins:postgresql-fingerprint-storage:267.v11ef13b_908c8
05:28:37    +-org.jenkins-ci.plugins:jackson2-api:2.17.0-379.v02de8ec9f64c
05:28:37      +-com.fasterxml.jackson.core:jackson-databind:2.17.0
05:28:37        +-net.bytebuddy:byte-buddy:1.14.9
05:28:37  and
05:28:37  +-io.jenkins.plugins:postgresql-fingerprint-storage:267.v11ef13b_908c8
05:28:37    +-org.jenkins-ci.plugins:database:230.v701f20b_8b_f95
05:28:37      +-org.hibernate:hibernate-entitymanager:5.6.15.Final
05:28:37        +-org.hibernate:hibernate-core:5.6.15.Final
05:28:37          +-net.bytebuddy:byte-buddy:1.12.18

Anything else?

No

Are you interested in contributing a fix?

I can create the API plugin and perform the needed PR

[basil]

Yes, a library plugin is our traditional solution to this problem. The one thing I am surprised about is that we don't see the same Enforcer error in the sample-plugin/ directory in BOM, which is designed to catch cases like this. Come to think of it, the last time I had to add an exclusion to sample-plugin/pom.xml was in March of 2023. I can't immediately see why that Enforcer error occurs in postgresql-fingerprint-storage-plugin but not in sample-plugin. Might be worth thinking about that further, or looking into #683.

[basil]

I took a look at the dependency trees of both postgresql-fingerprint-storage-plugin and sample-plugin and found that the standard conflict resolution algorithm is picking different winners in each case, with Enforcer correctly complaining in postgresql-fingerprint-storage-plugin that the winner was too old and Enforcer correctly not complaining in sample-plugin because the winner was the new version. From this I can only conclude that sample-plugin has grown to be too large of a tree to be useful as a real integration test. In the absence of smaller test cases as described by #683, we will likely continue to find Enforcer errors that come up in real use cases that do not come up in the artificial use case of sample-plugin.

[basil]

I am going to close this ticket because the only action item from the perspective of BOM is to improve test quality as described in #683. I agree that the action item from the perspective of the abovementioned plugins is to turn byte-buddy into a library plugin as mentioned in the issue report.