Why is maven enforcer plugin failing with maven version 3.6.1 but passing with 3.6.2?

In one of my project, I am trying to use DependencyConvergence rule with maven enforcer plugin. I am observing that if I use Maven 3.6.1 then the enforcer is failing with the below error but the same has been working fine with maven 3.6.2.

Can someone let me know what is changed in Maven 3.6.2 that is causing DependencyConvergence to pass in 3.6.2 but fail in other maven versions less than 3.6.2?

I have placed a sample project on GitHub where this issue can be reproduced.

Debrajs-MacBook-Air:es-plugins debrajmanna$ java -version
java version "1.8.0_171"
Java(TM) SE Runtime Environment (build 1.8.0_171-b11)
Java HotSpot(TM) 64-Bit Server VM (build 25.171-b11, mixed mode)

maven-enforcer-plugin - 3.0.0-M2

Debrajs-MacBook-Air:es-plugins debrajmanna$ ~/Downloads/apache-maven-3.6.1/bin/mvn validate
[INFO] Scanning for projects...
[INFO] ------------------------------------------------------------------------
[INFO] Reactor Build Order:
[INFO]
[INFO] es-plugins                                                         [pom]
[INFO] dedup                                                              [jar]
[INFO]
[INFO] -----------------------< org.example:es-plugins >-----------------------
[INFO] Building es-plugins 1.0-SNAPSHOT                                   [1/2]
[INFO] --------------------------------[ pom ]---------------------------------
[INFO]
[INFO] --- maven-enforcer-plugin:3.0.0-M2:enforce (javaversion-dependencyconvergence) @ es-plugins ---
[INFO]
[INFO] -------------------------< org.example:dedup >--------------------------
[INFO] Building dedup 1.0-SNAPSHOT                                        [2/2]
[INFO] --------------------------------[ jar ]---------------------------------
[INFO]
[INFO] --- maven-enforcer-plugin:3.0.0-M2:enforce (javaversion-dependencyconvergence) @ dedup ---
[WARNING]
Dependency convergence error for com.carrotsearch.randomizedtesting:randomizedtesting-runner:2.7.1 paths to dependency are:
+-org.example:dedup:1.0-SNAPSHOT
  +-org.elasticsearch.test:framework:7.7.1
    +-com.carrotsearch.randomizedtesting:randomizedtesting-runner:2.7.1
and
+-org.example:dedup:1.0-SNAPSHOT
  +-org.elasticsearch.test:framework:7.7.1
    +-org.apache.lucene:lucene-test-framework:8.5.1
      +-com.carrotsearch.randomizedtesting:randomizedtesting-runner:2.7.2

[WARNING]
Dependency convergence error for commons-logging:commons-logging:1.2 paths to dependency are:
+-org.example:dedup:1.0-SNAPSHOT
  +-org.elasticsearch.test:framework:7.7.1
    +-org.elasticsearch.client:elasticsearch-rest-client:7.7.1
      +-org.apache.httpcomponents:httpclient:4.5.10
        +-commons-logging:commons-logging:1.2
and
+-org.example:dedup:1.0-SNAPSHOT
  +-org.elasticsearch.test:framework:7.7.1
    +-org.elasticsearch.client:elasticsearch-rest-client:7.7.1
      +-org.apache.httpcomponents:httpasyncclient:4.1.4
        +-commons-logging:commons-logging:1.2
and
+-org.example:dedup:1.0-SNAPSHOT
  +-org.elasticsearch.test:framework:7.7.1
    +-org.elasticsearch.client:elasticsearch-rest-client:7.7.1
      +-commons-logging:commons-logging:1.1.3
and
+-org.example:dedup:1.0-SNAPSHOT
  +-org.elasticsearch.test:framework:7.7.1
    +-org.elasticsearch.client:elasticsearch-rest-client-sniffer:7.7.1
      +-commons-logging:commons-logging:1.1.3
and
+-org.example:dedup:1.0-SNAPSHOT
  +-org.elasticsearch.test:framework:7.7.1
    +-commons-logging:commons-logging:1.1.3

[WARNING]
Dependency convergence error for org.apache.httpcomponents:httpcore:4.4.12 paths to dependency are:
+-org.example:dedup:1.0-SNAPSHOT
  +-org.elasticsearch.test:framework:7.7.1
    +-org.elasticsearch.client:elasticsearch-rest-client:7.7.1
      +-org.apache.httpcomponents:httpclient:4.5.10
        +-org.apache.httpcomponents:httpcore:4.4.12
and
+-org.example:dedup:1.0-SNAPSHOT
  +-org.elasticsearch.test:framework:7.7.1
    +-org.elasticsearch.client:elasticsearch-rest-client:7.7.1
      +-org.apache.httpcomponents:httpcore:4.4.12
and
+-org.example:dedup:1.0-SNAPSHOT
  +-org.elasticsearch.test:framework:7.7.1
    +-org.elasticsearch.client:elasticsearch-rest-client:7.7.1
      +-org.apache.httpcomponents:httpasyncclient:4.1.4
        +-org.apache.httpcomponents:httpcore:4.4.10
and
+-org.example:dedup:1.0-SNAPSHOT
  +-org.elasticsearch.test:framework:7.7.1
    +-org.elasticsearch.client:elasticsearch-rest-client-sniffer:7.7.1
      +-org.apache.httpcomponents:httpcore:4.4.12

[WARNING]
Dependency convergence error for org.apache.httpcomponents:httpclient:4.5.10 paths to dependency are:
+-org.example:dedup:1.0-SNAPSHOT
  +-org.elasticsearch.test:framework:7.7.1
    +-org.elasticsearch.client:elasticsearch-rest-client:7.7.1
      +-org.apache.httpcomponents:httpclient:4.5.10
and
+-org.example:dedup:1.0-SNAPSHOT
  +-org.elasticsearch.test:framework:7.7.1
    +-org.elasticsearch.client:elasticsearch-rest-client:7.7.1
      +-org.apache.httpcomponents:httpasyncclient:4.1.4
        +-org.apache.httpcomponents:httpclient:4.5.6
and
+-org.example:dedup:1.0-SNAPSHOT
  +-org.elasticsearch.test:framework:7.7.1
    +-org.elasticsearch.client:elasticsearch-rest-client-sniffer:7.7.1
      +-org.apache.httpcomponents:httpclient:4.5.10

[WARNING]
Dependency convergence error for org.apache.httpcomponents:httpcore-nio:4.4.10 paths to dependency are:
+-org.example:dedup:1.0-SNAPSHOT
  +-org.elasticsearch.test:framework:7.7.1
    +-org.elasticsearch.client:elasticsearch-rest-client:7.7.1
      +-org.apache.httpcomponents:httpasyncclient:4.1.4
        +-org.apache.httpcomponents:httpcore-nio:4.4.10
and
+-org.example:dedup:1.0-SNAPSHOT
  +-org.elasticsearch.test:framework:7.7.1
    +-org.elasticsearch.client:elasticsearch-rest-client:7.7.1
      +-org.apache.httpcomponents:httpcore-nio:4.4.12

[WARNING] Rule 0: org.apache.maven.plugins.enforcer.DependencyConvergence failed with message:
Failed while enforcing releasability. See above detailed error message.
[INFO] ------------------------------------------------------------------------
[INFO] Reactor Summary for es-plugins 1.0-SNAPSHOT:
[INFO]
[INFO] es-plugins ......................................... SUCCESS [  3.047 s]
[INFO] dedup .............................................. FAILURE [  0.856 s]
[INFO] ------------------------------------------------------------------------
[INFO] BUILD FAILURE
[INFO] ------------------------------------------------------------------------
[INFO] Total time:  4.131 s
[INFO] Finished at: 2020-08-29T11:41:55+05:30
[INFO] ------------------------------------------------------------------------
[ERROR] Failed to execute goal org.apache.maven.plugins:maven-enforcer-plugin:3.0.0-M2:enforce (javaversion-dependencyconvergence) on project dedup: Some Enforcer rules have failed. Look above for specific messages explaining why the rule failed. -> [Help 1]
[ERROR]
[ERROR] To see the full stack trace of the errors, re-run Maven with the -e switch.
[ERROR] Re-run Maven using the -X switch to enable full debug logging.
[ERROR]
[ERROR] For more information about the errors and possible solutions, please read the following articles:
[ERROR] [Help 1] http://cwiki.apache.org/confluence/display/MAVEN/MojoExecutionException
[ERROR]
[ERROR] After correcting the problems, you can resume the build with the command
[ERROR]   mvn <goals> -rf :dedup

The same is working fine with Maven 3.6.2.

Debrajs-MacBook-Air:es-plugins debrajmanna$ ~/Downloads/apache-maven-3.6.2/bin/mvn validate
[INFO] Scanning for projects...
[INFO] ------------------------------------------------------------------------
[INFO] Reactor Build Order:
[INFO]
[INFO] es-plugins                                                         [pom]
[INFO] dedup                                                              [jar]
[INFO]
[INFO] -----------------------< org.example:es-plugins >-----------------------
[INFO] Building es-plugins 1.0-SNAPSHOT                                   [1/2]
[INFO] --------------------------------[ pom ]---------------------------------
[INFO]
[INFO] --- maven-enforcer-plugin:3.0.0-M2:enforce (javaversion-dependencyconvergence) @ es-plugins ---
[INFO]
[INFO] -------------------------< org.example:dedup >--------------------------
[INFO] Building dedup 1.0-SNAPSHOT                                        [2/2]
[INFO] --------------------------------[ jar ]---------------------------------
[INFO]
[INFO] --- maven-enforcer-plugin:3.0.0-M2:enforce (javaversion-dependencyconvergence) @ dedup ---
[INFO] ------------------------------------------------------------------------
[INFO] Reactor Summary for es-plugins 1.0-SNAPSHOT:
[INFO]
[INFO] es-plugins ......................................... SUCCESS [  1.743 s]
[INFO] dedup .............................................. SUCCESS [  0.510 s]
[INFO] ------------------------------------------------------------------------
[INFO] BUILD SUCCESS
[INFO] ------------------------------------------------------------------------
[INFO] Total time:  2.462 s
[INFO] Finished at: 2020-08-29T11:42:06+05:30
[INFO] ------------------------------------------------------------------------

It's related to MENFORCER-195 and MNG-6713 which were bugs fixed in Maven 3.6.2.

If you are using 3.6.2, be careful because there was a further regression in this area which was not fixed until 3.6.3 (does not affect your example).

How I found those tickets:

Let's take a look at each of the failures individually. It makes sense to start with the first one:

Dependency convergence error for com.carrotsearch.randomizedtesting:randomizedtesting-runner:2.7.1 paths to dependency are:
+-org.example:dedup:1.0-SNAPSHOT
  +-org.elasticsearch.test:framework:7.7.1
    +-com.carrotsearch.randomizedtesting:randomizedtesting-runner:2.7.1
and
+-org.example:dedup:1.0-SNAPSHOT
  +-org.elasticsearch.test:framework:7.7.1
    +-org.apache.lucene:lucene-test-framework:8.5.1
      +-com.carrotsearch.randomizedtesting:randomizedtesting-runner:2.7.2

Let's look at the relevant part of org.elasticsearch.test:framework's POM:

<dependency>
    <groupId>com.carrotsearch.randomizedtesting</groupId>
    <artifactId>randomizedtesting-runner</artifactId>
    <version>2.7.1</version>
    <scope>compile</scope>
    <exclusions>
        <exclusion>
            <artifactId>*</artifactId>
            <groupId>*</groupId>
        </exclusion>
    </exclusions>
</dependency>

<dependency>
    <groupId>org.apache.lucene</groupId>
    <artifactId>lucene-test-framework</artifactId>
    <version>8.5.1</version>
    <scope>compile</scope>
    <exclusions>
        <exclusion>
          <artifactId>*</artifactId>
          <groupId>*</groupId>
      </exclusion>
    </exclusions>
</dependency>

Clearly we can see that all transitive dependencies of Lucene are supposed to be excluded. However, if we go back to this part of the error, the 2.7.2 version that the Enforcer plugin is complaining about is not even supposed to be in the dependency tree!

...
   +-org.apache.lucene:lucene-test-framework:8.5.1
        +-com.carrotsearch.randomizedtesting:randomizedtesting-runner:2.7.2

When I print the Maven dependency tree for both versions of Maven (3.6.1 and 3.6.2), the only instance of randomizedtesting-runner I see is the 2.7.1 version, so something fishy is going on here.

My intuition told me the wildcard exclusion was likely to be the culprit, so from there it was simply a matter of searching the release notes for something like "exclusion" or "wildcard". Turns out I was right.