[MASSEMBLY-1031] Respect dependency mediation when resolving dependencySets

src/it/projects/dependency-sets/massembly-1008/pom.xml

@@ -23,6 +23,7 @@ under the License.
         <groupId>org.apache.maven.plugin.assembly.test</groupId>
         <artifactId>it-project-parent</artifactId>
         <version>1</version>
+        <relativePath>../../../it-project-parent/pom.xml</relativePath>
     </parent>
 
     <groupId>test</groupId>

src/it/projects/dependency-sets/massembly-1008/verify.groovy

@@ -19,18 +19,14 @@
 
 import java.io.*;
 
+// guava is absent from the runtime dependencySet: the nearer test-scoped guava 32.0.0-jre wins
+// version mediation and is then excluded by scope, while guice's transitive guava 31.0.1-jre is
+// omitted for the conflict. This is the runtime classpath Maven resolves.
 def expectedFilenames = [
         "aopalliance-1.0.jar",
-        "checker-qual-3.12.0.jar",
-        "error_prone_annotations-2.7.1.jar",
-        "failureaccess-1.0.1.jar",
-        "guava-31.0.1-jre.jar",
         "guice-6.0.0.jar",
-        "j2objc-annotations-1.3.jar",
         "jakarta.inject-api-2.0.1.jar",
-        "javax.inject-1.jar",
-        "jsr305-3.0.2.jar",
-        "listenablefuture-9999.0-empty-to-avoid-conflict-with-guava.jar"
+        "javax.inject-1.jar"
 ]
 
 File assemblyBasedir = new File( basedir, "target/massembly-1008-1-bin/" )

src/it/projects/dependency-sets/massembly-1026/pom.xml

@@ -0,0 +1,73 @@
+<?xml version="1.0"?>
+<!--
+Licensed to the Apache Software Foundation (ASF) under one
+or more contributor license agreements.  See the NOTICE file
+distributed with this work for additional information
+regarding copyright ownership.  The ASF licenses this file
+to you under the Apache License, Version 2.0 (the
+"License"); you may not use this file except in compliance
+with the License.  You may obtain a copy of the License at
+
+  http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing,
+software distributed under the License is distributed on an
+"AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+KIND, either express or implied.  See the License for the
+specific language governing permissions and limitations
+under the License.
+-->
+<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
+    <modelVersion>4.0.0</modelVersion>
+    <parent>
+        <groupId>org.apache.maven.plugin.assembly.test</groupId>
+        <artifactId>it-project-parent</artifactId>
+        <version>1</version>
+        <relativePath>../../../it-project-parent/pom.xml</relativePath>
+    </parent>
+
+    <groupId>test</groupId>
+    <artifactId>massembly-1026</artifactId>
+    <version>1</version>
+
+    <url>https://issues.apache.org/jira/browse/MASSEMBLY-1026</url>
+
+    <properties>
+        <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
+    </properties>
+
+    <dependencies>
+        <dependency>
+            <groupId>com.fasterxml.jackson.datatype</groupId>
+            <artifactId>jackson-datatype-guava</artifactId>
+            <version>2.7.3</version>
+            <scope>test</scope>
+        </dependency>
+        <dependency>
+            <groupId>com.google.inject</groupId>
+            <artifactId>guice</artifactId>
+            <version>6.0.0</version>
+        </dependency>
+    </dependencies>
+    <build>
+        <plugins>
+            <plugin>
+                <artifactId>maven-assembly-plugin</artifactId>
+                <executions>
+                    <execution>
+                        <id>assembly</id>
+                        <phase>package</phase>
+                        <goals>
+                            <goal>single</goal>
+                        </goals>
+                        <configuration>
+                            <descriptors>
+                                <descriptor>src/main/assembly/bin.xml</descriptor>
+                            </descriptors>
+                        </configuration>
+                    </execution>
+                </executions>
+            </plugin>
+        </plugins>
+    </build>
+</project>

src/it/projects/dependency-sets/massembly-1026/src/main/assembly/bin.xml

@@ -0,0 +1,33 @@
+<!--
+Licensed to the Apache Software Foundation (ASF) under one
+or more contributor license agreements.  See the NOTICE file
+distributed with this work for additional information
+regarding copyright ownership.  The ASF licenses this file
+to you under the Apache License, Version 2.0 (the
+"License"); you may not use this file except in compliance
+with the License.  You may obtain a copy of the License at
+
+  http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing,
+software distributed under the License is distributed on an
+"AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+KIND, either express or implied.  See the License for the
+specific language governing permissions and limitations
+under the License.
+-->
+<assembly>
+  <id>bin</id>
+  <formats>
+    <format>dir</format>
+  </formats>
+  <includeBaseDirectory>false</includeBaseDirectory>
+  <dependencySets>
+    <dependencySet>
+      <unpack>false</unpack>
+      <scope>runtime</scope>
+      <outputDirectory></outputDirectory>
+      <useProjectArtifact>false</useProjectArtifact>
+    </dependencySet>
+  </dependencySets>
+</assembly>

src/it/projects/dependency-sets/massembly-1026/verify.groovy

@@ -0,0 +1,45 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+import java.io.*;
+
+// guava 16.0 (from the test-scoped jackson-datatype-guava) wins version mediation over guice's
+// guava 31.0.1-jre and stays on the runtime classpath via guice.
+def expectedFilenames = [
+        "aopalliance-1.0.jar",
+        "guava-16.0.jar",
+        "guice-6.0.0.jar",
+        "jakarta.inject-api-2.0.1.jar",
+        "javax.inject-1.jar"
+]
+
+File assemblyBasedir = new File( basedir, "target/massembly-1026-1-bin/" )
+
+assert assemblyBasedir.listFiles().length == expectedFilenames.size()
+
+for ( fileName in expectedFilenames )
+{
+  File file = new File( assemblyBasedir, fileName )
+  assert file.isFile() // exists and is file
+}
+
+// the losing version must not be assembled
+assert !new File( assemblyBasedir, "guava-31.0.1-jre.jar" ).exists()
+
+return true

src/it/projects/dependency-sets/massembly-1031/pom.xml

@@ -0,0 +1,73 @@
+<?xml version="1.0"?>
+<!--
+Licensed to the Apache Software Foundation (ASF) under one
+or more contributor license agreements.  See the NOTICE file
+distributed with this work for additional information
+regarding copyright ownership.  The ASF licenses this file
+to you under the Apache License, Version 2.0 (the
+"License"); you may not use this file except in compliance
+with the License.  You may obtain a copy of the License at
+
+  http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing,
+software distributed under the License is distributed on an
+"AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+KIND, either express or implied.  See the License for the
+specific language governing permissions and limitations
+under the License.
+-->
+<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
+    <modelVersion>4.0.0</modelVersion>
+    <parent>
+        <groupId>org.apache.maven.plugin.assembly.test</groupId>
+        <artifactId>it-project-parent</artifactId>
+        <version>1</version>
+        <relativePath>../../../it-project-parent/pom.xml</relativePath>
+    </parent>
+
+    <groupId>test</groupId>
+    <artifactId>massembly-1031</artifactId>
+    <version>1</version>
+
+    <url>https://issues.apache.org/jira/browse/MASSEMBLY-1031</url>
+
+    <properties>
+        <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
+    </properties>
+
+    <dependencies>
+        <dependency>
+            <groupId>org.apache.commons</groupId>
+            <artifactId>commons-text</artifactId>
+            <version>1.12.0</version>
+        </dependency>
+        <dependency>
+            <groupId>org.apache.commons</groupId>
+            <artifactId>commons-lang3</artifactId>
+            <version>3.14.0</version>
+            <scope>provided</scope>
+        </dependency>
+    </dependencies>
+    <build>
+        <plugins>
+            <plugin>
+                <artifactId>maven-assembly-plugin</artifactId>
+                <executions>
+                    <execution>
+                        <id>assembly</id>
+                        <phase>package</phase>
+                        <goals>
+                            <goal>single</goal>
+                        </goals>
+                        <configuration>
+                            <descriptors>
+                                <descriptor>src/main/assembly/bin.xml</descriptor>
+                            </descriptors>
+                        </configuration>
+                    </execution>
+                </executions>
+            </plugin>
+        </plugins>
+    </build>
+</project>

src/it/projects/dependency-sets/massembly-1031/src/main/assembly/bin.xml

@@ -0,0 +1,32 @@
+<!--
+Licensed to the Apache Software Foundation (ASF) under one
+or more contributor license agreements.  See the NOTICE file
+distributed with this work for additional information
+regarding copyright ownership.  The ASF licenses this file
+to you under the Apache License, Version 2.0 (the
+"License"); you may not use this file except in compliance
+with the License.  You may obtain a copy of the License at
+
+  http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing,
+software distributed under the License is distributed on an
+"AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+KIND, either express or implied.  See the License for the
+specific language governing permissions and limitations
+under the License.
+-->
+<assembly>
+  <id>bin</id>
+  <formats>
+    <format>dir</format>
+  </formats>
+  <includeBaseDirectory>false</includeBaseDirectory>
+  <dependencySets>
+    <dependencySet>
+      <unpack>false</unpack>
+      <outputDirectory></outputDirectory>
+      <useProjectArtifact>false</useProjectArtifact>
+    </dependencySet>
+  </dependencySets>
+</assembly>

src/it/projects/dependency-sets/massembly-1031/verify.groovy

@@ -0,0 +1,41 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+import java.io.*;
+
+// commons-lang3 is excluded: the direct provided declaration wins mediation over the transitive
+// compile one pulled in by commons-text, so only commons-text remains on the runtime classpath.
+def expectedFilenames = [
+        "commons-text-1.12.0.jar"
+]
+
+File assemblyBasedir = new File( basedir, "target/massembly-1031-1-bin/" )
+
+assert assemblyBasedir.listFiles().length == expectedFilenames.size()
+
+for ( fileName in expectedFilenames )
+{
+  File file = new File( assemblyBasedir, fileName )
+  assert file.isFile() // exists and is file
+}
+
+// commons-lang3 is provided and must be excluded
+assert !new File( assemblyBasedir, "commons-lang3-3.14.0.jar" ).exists()
+
+return true

src/main/java/org/apache/maven/plugins/assembly/artifact/DefaultDependencyResolver.java

@@ -52,7 +52,6 @@
 import org.eclipse.aether.RepositorySystem;
 import org.eclipse.aether.RepositorySystemSession;
 import org.eclipse.aether.collection.CollectRequest;
-import org.eclipse.aether.graph.DefaultDependencyNode;
 import org.eclipse.aether.graph.Dependency;
 import org.eclipse.aether.graph.DependencyFilter;
 import org.eclipse.aether.graph.DependencyNode;
@@ -213,13 +212,14 @@ private Set<Artifact> resolveTransitive(
             RepositorySystemSession repositorySession, String scope, MavenProject project)
             throws org.eclipse.aether.resolution.DependencyResolutionException {
 
-        // scope dependency filter
-        DependencyFilter scoopeDependencyFilter = DependencyFilterUtils.classpathFilter(scope);
+        DependencyFilter scopeDependencyFilter = DependencyFilterUtils.classpathFilter(scope);
 
-        // get project dependencies filtered by requested scope
+        // Collect every declared dependency and apply the scope filter only when resolving below.
+        // Filtering declared dependencies by scope first would drop ones that win mediation - a
+        // nearer version, or a direct provided dependency that also appears transitively - leaving
+        // a graph that disagrees with the resolved compile/runtime classpath.
         List<Dependency> dependencies = project.getDependencies().stream()
                 .map(d -> RepositoryUtils.toDependency(d, repositorySession.getArtifactTypeRegistry()))
-                .filter(d -> scoopeDependencyFilter.accept(new DefaultDependencyNode(d), null))
                 .collect(Collectors.toList());
 
         List<Dependency> managedDependencies = Optional.ofNullable(project.getDependencyManagement())
@@ -235,7 +235,7 @@ private Set<Artifact> resolveTransitive(
         collectRequest.setDependencies(dependencies);
         collectRequest.setRootArtifact(RepositoryUtils.toArtifact(project.getArtifact()));
 
-        DependencyRequest request = new DependencyRequest(collectRequest, scoopeDependencyFilter);
+        DependencyRequest request = new DependencyRequest(collectRequest, scopeDependencyFilter);
 
         DependencyResult dependencyResult = repositorySystem.resolveDependencies(repositorySession, request);