org.sonarsource.java:sonar-java-plugin:7.22.0.31918 (the current latest version) has dependencies with invalid poms. For example, it depends on org.eclipse.platform:org.eclipse.equinox.preferences:3.10.100 which has <modelVersion>4.0</modelVersion> in its pom (The version must be 4.0.0 - not4.0). Eclipse fixed this problem with a new version of that artifact, see Gradle cannot build effective model because of failure in pom.xml · Issue #180 · eclipse-platform/eclipse.platform · GitHub for history and details.
For full background, you can reproduce this issue using Gradle, expressing a dependency on org.sonarsource.java:sonar-java-plugin, and having the io.spring.dependency-management plugin (this plugin makes the error more apparent).
I’m using gradle 8.1.1 (the current latest version).
$ ./gradlew dependencies
> Task :dependencies FAILED
------------------------------------------------------------
Root project 'example'
------------------------------------------------------------
annotationProcessor - Annotation processors and their dependencies for source set 'main'.
No dependencies
compileClasspath - Compile classpath for source set 'main'.
Errors occurred while build effective model from /home/candrews/.gradle/caches/modules-2/files-2.1/org.eclipse.platform/org.eclipse.equinox.preferences/3.10.100/43fe3c49d5a6a30090b7081015e4a57bd0a6cb98/org.eclipse.equinox.preferences-3.10.100.pom:
Errors occurred while build effective model from /home/candrews/.gradle/caches/modules-2/files-2.1/org.eclipse.platform/org.eclipse.core.contenttype/3.8.200/e2fdb068262514474d73f236adaa821d9c861786/org.eclipse.core.contenttype-3.8.200.pom:
FAILURE: Build failed with an exception.
* What went wrong:
Execution failed for task ':dependencies'.
> Cannot invoke "io.spring.gradle.dependencymanagement.org.apache.maven.model.Model.getGroupId()" because "effectiveModel" is null
* Try:
> Run with --stacktrace option to get the stack trace.
> Run with --info or --debug option to get more log output.
> Run with --scan to get full insights.
* Get more help at https://help.gradle.org
BUILD FAILED in 504ms
1 actionable task: 1 executed
The artifact and version is org.sonarsource.java:sonar-java-plugin:7.22.0.31918
Based on that which IDE and its version are you using?
The issue is reproducible in any IDE.
Are you in connected mode and if so which version of SonarQube are you using (or SonarCloud)?
One does not need to be connected to SonarQube or SonarCloud to reproduce this issue. The Gradle build I provided is enough to reproduce this issue without any Sonar connectivity, and in any IDE - I provided it in that way as a minimal reproducible example so it’s as easy as possible to reproduce and see the issue.
I suggest investigating the io.spring.dependency-management Gradle plugin. Alternatively, I recommend using Maven since it works correctly on all projects that add custom rules, and thus use the org.sonarsource.java:sonar-java-plugin dependency (see sonar java custom rules guide).
We are working on the update of the org.eclipse.jdt.core dependency. Unfortunately, it is not easy since the upgrade will force users to move to Java 17 runtime, and not all of them can do it on short notice. There are also unresolved bugs in org.eclipse.jdt.core that are stopping us from upgrading.
I hope you will find a suitable solution to your problem.
dependencyManagement {
// workaround for https://github.com/spring-gradle-plugins/dependency-management-plugin/issues/365
applyMavenExclusions = false
}
to the gradle build.
Arguably (and note that Spring isn’t taking this position) Spring is doing the right thing, as those POMs are invalid and thus failing because of them isn’t unreasonable.
We are working on the update of the org.eclipse.jdt.core dependency. Unfortunately, it is not easy since the upgrade will force users to move to Java 17 runtime, and not all of them can do it on short notice. There are also unresolved bugs in org.eclipse.jdt.core that are stopping us from upgrading.
I’m glad to hear that Sonar is working on addressing the real problem of those invalid POMs
Is there a Jira issue or something else that I could follow to know when Sonar rids itself of those dependencies with invalid POMs?
