Maven Enforcer Plugin dependencyConvergence exemption ownership and build failure policy

Question

Maven has no native alert or notification subsystem, so build-time noise control is typically delegated to documented plugin rules such as the Enforcer Plugin dependencyConvergence check. The rule is usually declared in a parent POM and inherited across a multi-module reactor.

The configuration is version-sensitive and the rule can be applied to the whole reactor, which creates a design tension between signal and noise. There is no built-in constraint for limiting transitive depth or for defining who may approve an exemption, and the plugin configuration is inherited by child modules.

An unresolved decision is the permission boundary around exemptions and failure behavior. Without an ownership model for the exclusion list, convergence violations can become noisy or block unrelated teams, and strict enforcement can be inherited unintentionally.

What ownership or approval boundary should govern additions to the exclusion list? Should a convergence violation fail the build by default or be reported without failure? How should exceptions be scoped to avoid unintended inheritance in child modules?

Tasadduq Burney · Answer

Confirmed facts The Enforcer Plugin’s dependencyConvergence rule checks that all dependencies resolve to a single version. Exemptions are listed in the element, and the element decides whether a violation aborts the build (true) or only warns (false). Configuration placed in a parent POM is inherited by child modules unless overridden. Likely explanation Because the plugin provides no built‑in ownership model, any contributor can edit the exemption list, which can turn convergence violations into noise or block unrelated teams. The safest default is to treat a violation as a build failure and restrict who may modify the exemption list through an external ownership boundary (e.g., a CODEOWNERS rule or a designated POM owner). Steps for this case Identify the team or individual that owns the parent POM and add a CODEOWNERS entry granting that team exclusive permission to edit the list. Set true in the parent POM so the rule fails the build unless an exemption is approved. Keep the exemption list as small as possible and, if feasible, define it only in the module where the conflict originates to avoid unintended inheritance. Verify inheritance by running mvn help:effective-pom in a child module and confirming the Enforcer configuration appears. If a child module needs its own exemption, override the parent configuration or add a local block, ensuring the change passes through the same ownership review. Do you have a designated owner for the parent POM or a CODEOWNERS rule that can enforce who may edit the exemption list?

Maven Enforcer Plugin dependencyConvergence exemption ownership and build failure policy

1 answer

Confirmed facts

Likely explanation

Steps for this case

Your perspective belongs here.

0 question comments