[MDEP-947] optionally import listed “dependency packages” for analyse-only

[jira-importer]

Thorsten Glaser opened MDEP-947 and commented

I’m working through the Spring Boot tutorial, and it uses packages like org.springframework.boot:spring-boot-starter-web that contain empty JARs but a lot of dependencies.

Instead of doing…

<configuration>
        <ignoredUnusedDeclaredDependencies>
                <!-- importers in Spring Boot -->
                <ignoredUnusedDeclaredDependency>org.springframework.boot:spring-boot-starter-test</ignoredUnusedDeclaredDependency>
                <ignoredUnusedDeclaredDependency>org.springframework.boot:spring-boot-starter-web</ignoredUnusedDeclaredDependency>
        </ignoredUnusedDeclaredDependencies>
        <ignoredUsedUndeclaredDependencies>
                <!-- imported by Spring Boot -->
                <ignoredUsedUndeclaredDependency>org.springframework:spring-context</ignoredUsedUndeclaredDependency>
                <ignoredUsedUndeclaredDependency>org.springframework.boot:spring-boot-test</ignoredUsedUndeclaredDependency>
                <ignoredUsedUndeclaredDependency>org.springframework:spring-web</ignoredUsedUndeclaredDependency>
                <ignoredUsedUndeclaredDependency>org.springframework.boot:spring-boot</ignoredUsedUndeclaredDependency>
                <ignoredUsedUndeclaredDependency>org.junit.jupiter:junit-jupiter-api</ignoredUsedUndeclaredDependency>
                <ignoredUsedUndeclaredDependency>org.springframework.boot:spring-boot-autoconfigure</ignoredUsedUndeclaredDependency>
        </ignoredUsedUndeclaredDependencies>
</configuration>

… or replacing them by the depended-on packages, for convenience (when the user does want to allow relaxing the dependency rules for this), there could be something like…

<configuration>
  <importDependencyPackages>
    <importDependencyPackage>org.springframework.boot:spring-boot-starter-web</importDependencyPackage>
[…]

… with which I’d whitelist one or more specific dependencies I have for “ignore if this one is unused” and “ignore if any of its dependencies are used but undeclared” (but no warning if (also explicitly) declared).

Does this make sense?

---

No further details from MDEP-947