Exclusions defined in dependencyManagement don't apply transitively

[ghost]

I believe that this is a manifestation of https://github.com/coursier/coursier/issues/853 in rules_jvm_external.

org.apache.axis2:axis2-kernel:1.5.1 (pom) contains a dependencyManagement block which defines a transitive exclusion on xml-apis:xml-apis via org.apache.ws.commons.axiom:axiom-api:1.2.8. However, Bazel projects using rules_jvm_external to integrate axis2-kernel still end up with xml-apis in the dependency graph and on the classpath.

Steps to reproduce

$ cat WORKSPACE
load("@bazel_tools//tools/build_defs/repo:http.bzl", "http_archive")

RULES_JVM_EXTERNAL_TAG = "2.7"
RULES_JVM_EXTERNAL_SHA = "f04b1466a00a2845106801e0c5cec96841f49ea4e7d1df88dc8e4bf31523df74"

http_archive(
    name = "rules_jvm_external",
    strip_prefix = "rules_jvm_external-%s" % RULES_JVM_EXTERNAL_TAG,
    sha256 = RULES_JVM_EXTERNAL_SHA,
    url = "https://github.com/bazelbuild/rules_jvm_external/archive/%s.zip" % RULES_JVM_EXTERNAL_TAG,
)

load("@rules_jvm_external//:defs.bzl", "maven_install")

maven_install(
    artifacts = [
        "org.apache.axis2:axis2-kernel:1.5.1",
    ],
    repositories = [
        "https://jcenter.bintray.com/",
        "https://maven.google.com",
        "https://repo1.maven.org/maven2",
    ],
)
$ cat BUILD.bazel
java_library(
    name = "java_test_deps",
    exports = [
        "@maven//:org_apache_axis2_axis2_kernel",
    ],
)
$ bazel cquery --noimplicit_deps 'deps(:java_test_deps)' | grep xml.apis
@maven//:xml_apis_xml_apis (b67bdc290fb31b127eacf7a9889db436)

[jin]

Thanks for the repro. Yeah, looks like it's an issue with Coursier. Does using maven.artifacts(exclusions) or excluded_artifacts serve as a good enough workaround here?

load("@bazel_tools//tools/build_defs/repo:http.bzl", "http_archive")

RULES_JVM_EXTERNAL_TAG = "2.7"
RULES_JVM_EXTERNAL_SHA = "f04b1466a00a2845106801e0c5cec96841f49ea4e7d1df88dc8e4bf31523df74"

http_archive(
    name = "rules_jvm_external",
    strip_prefix = "rules_jvm_external-%s" % RULES_JVM_EXTERNAL_TAG,
    sha256 = RULES_JVM_EXTERNAL_SHA,
    url = "https://github.com/bazelbuild/rules_jvm_external/archive/%s.zip" % RULES_JVM_EXTERNAL_TAG,
)

load("@rules_jvm_external//:defs.bzl", "maven_install")
load("@rules_jvm_external//:specs.bzl", "maven")

maven_install(
    artifacts = [
        maven.artifact(
            "org.apache.axis2",
            "axis2-kernel",
            "1.5.1",
            exclusions = [
                "xml-apis:xml-apis",
            ]
        )
    ],
    repositories = [
        "https://jcenter.bintray.com/",
        "https://maven.google.com",
        "https://repo1.maven.org/maven2",
    ],
)

[ghost]

Thanks for the repro. Yeah, looks like it's an issue with Coursier. Does using maven.artifacts(exclusions) or excluded_artifacts serve as a good enough workaround here?

Good question. I'd say "sorta". Power users can use exclusions and continue to make progress. But Bazel/rje newbs will run into some trouble figuring out why their bazel test command fails---first they have to figure out that their classpath has a bogus dependency, and then they have to examine their environment to learn how that dependency crept in.

[jin]

@beasleyr-vmw very good point. I've pinged upstream.