Build the Maven dependency tree with Maven Resolver instead of maven-dependency-tree

[slachiewicz]

DependencyTreeFactory still built trees with maven-dependency-tree 2.2 (2014), whose DependencyTreeBuilder goes through maven-compat's legacy ArtifactCollector — the TODO: check alternative for deprecated maven components in that class. This replaces it with Maven Resolver's own verbose collection and drops the bundled jar.

• DependencyTreeFactory collects the project's dependencies with ConflictResolver in verbose mode, using a session from the new MavenEmbedder.newRepositorySession() (settings, mirrors, workspace reader, offline flag).
• The result is a NetBeans-owned org.netbeans.modules.maven.embedder.tree.DependencyNode and DependencyNodeVisitor, keeping the part of the old API NetBeans uses, so the 15 classes in maven, maven.graph and maven.repository only change imports.
• Mapping: winners are INCLUDED; a loser whose winner is an ancestor is OMITTED_FOR_CYCLE; same base version as the winner is OMITTED_FOR_DUPLICATE; otherwise OMITTED_FOR_CONFLICT, with the winner as related artifact.

Behaviour differences:

• Resolver removes cycle losers even in verbose mode, so OMITTED_FOR_CYCLE is effectively never produced.
• The scope filter now prunes subtrees; the old builder accepted a filter but never applied it.
• Nodes use identity equality, so lookups no longer break when a node's hash changes after mutation.

Compatibility: maven.embedder goes to 2.90 and no longer exports org.apache.maven.shared.dependency.{tree,tree.traversal,graph,graph.filter,graph.traversal} to friends. That is incompatible for any friend module compiling against those packages. None of the external friends in project.xml uses them: GitHub code search finds no reference in jeddict (jeddict-modeler, jeddict-extensions), sqe-team/sqe, vaadin/netbeans-plugin (archived), NbAppEngine or the netbeans-contrib selenium module. apisupport.installer.maven and maven.util are former NetBeans modules no longer in the tree, and jbi.fuji.support and android.maven have no public source. The change is recorded in apichanges.xml.

apichanges.xml now uses apichanges-1.1.dtd, whose year list already covers 2026.

Not tested manually in a running IDE (dependency graph, exclude dependency, create library dialogs).

Verified: ant -f java/maven.embedder test → DependencyTreeFactoryTest 5/5 and the existing embedder tests green; ant -f java/maven test → 418 tests, 0 failures; ant -Dcluster.config=java verify-libs-and-licenses → 0 failures.

Assisted-by: Claude Opus 5.5

[mbien]

checked a few friend packages I could still find

inactive:

• https://github.com/sqe-team/sqe
• https://github.com/vaadin/netbeans-plugin

active, but no DependencyNode usage used as needle

• https://github.com/jeddict/jeddict-modeler cc @jGauravGupta

most of the other stuff looks like modules within this repo (some of it doesn't exist anymore too, e.g org.netbeans.modules.apisupport.installer.maven)

-> we should be fine

[slachiewicz]

Switched apichanges.xml to apichanges-1.1.dtd and dropped the DTD change. The description now has the friends research: none of the external friends uses the dropped org.apache.maven.shared.dependency.* packages. That covers jeddict (jeddict-modeler, jeddict-extensions), sqe, the archived vaadin plugin, NbAppEngine and the netbeans-contrib selenium module. apisupport.installer.maven and maven.util no longer exist, and jbi.fuji.support and android.maven have no public source.

[slachiewicz]

Can't believe it's green. Or too early to celebrate?

[mbien]

Can't believe it's green. Or too early to celebrate?

its a good sign from the CI gremlins! Some of the CI jobs are a bit brittle and need restarts, so a single failure wouldn't necessarily mean its a regression.

We would create the release branches for NB 32 this week (~15th). I think #9642 has a small chance to make it still in - mostly because its not clear if anyone tested it beside me. Putting NB 33 milestone on this PR here.

Thanks a lot for helping with this btw!

[slachiewicz]

We would create the release branches for NB 32 this week (~15th). I think #9642 has a small chance to make it still in - mostly because its not clear if anyone tested it beside me. Putting NB 33 milestone on this PR here.

To early with 3.10 yet. Wait for few more patch releases - i'll take look next week to report/fix issues with upgrade