Maven downloads the whole internet

[webjars]

Maven downloads the whole internet

[jamesward]

Thanks for reporting. Woah... jQuery 3.3.0 has erroneous dependencies:
https://github.com/jquery/jquery/blob/3.3.0/package.json#L26-L31

Also I discovered that in your error there is a semver string that is not getting converted correctly:
https://github.com/npm/npm-registry-client/blob/v7.4.6/package.json#L25
https://search.maven.org/#artifactdetails%7Corg.webjars.npm%7Cnpm-registry-client%7C7.4.6%7Cjar

As a temporary workaround you can try to force jquery to resolve to 3.3.1 instead of 3.3.0.

Welcome to the world of JavaScript package fun. :)

[ptahchiev]

Any update here? I cannot build my project at all :(

[jamesward]

You'll need to override your dependency graph to use jquery 3.3.1 instead.

I am working on fixing the semver bug above but that alone won't fix your issue since the releases are immutable.

[jamesward]

I've released an updated npm-registry-client version 7.4.6-1 that has the correct version range.

[ptahchiev]

Hi @jamesward I'm really sorry but I don't consider this fixed. I once again tried my build with magicsuggest dependnency and this is the result:

https://gist.github.com/ptahchiev/8331d84e242ce831bb081c7214ff5edc

15 minutes!! This build usually lasts 40 seconds.

As you can see this build downloads a ton of unneeded NPM webjars (I don't want them and they were not downloaded before, I don't understand why are they now downloaded as I have not changed anything in my pom.xml) and at the end if fails with:

No versions available for org.webjars.npm:spdx-exceptions:jar:[2.0.0,3) within specified range -> [Help 1]

[jamesward]

@ptahchiev Did you override the jquery dependency and verify it is resolving to 3.3.1?

[ptahchiev]

@jamesward I did not override anything :( I just ran mvn clean compile. It was working like this before so i figured out it should still work like this after your fix.

[jamesward]

The fix was for a bad SemVer range conversion so not directly related to your issue but uncovered by it. Somewhere in your dep graph it is resolving to jquery 3.3.0 which pulls in the giant dependency tree. You can sleuth out why that resolution is happening and walk up the tree to try to figure out where to change things to change the resolution to 3.3.1. Or you can just override the jquery dep.

[jamesward]

BTW, many NPM packages use version ranges which makes it hard to uncover why the graph is resolving in the way it is. You can use a Maven plugin to explore this graph if you want to understand what is happening and why.