maven-enforcer-plugin 3.3.0 breaking behavior for scope

When upgrading Spring Boot to 3.1 I got a transitive upgrade of maven-enforcer-plugin 3.3.0, breaking my build. The configuration of scopes for transitive dependencies behaves strangely.

Current configuration

<plugin>
    <groupId>org.apache.maven.plugins</groupId>
    <artifactId>maven-enforcer-plugin</artifactId>
    <executions>
        <execution>
            <id>enforce-banned-dependencies</id>
            <goals>
                <goal>enforce</goal>
            </goals>
            <configuration>
                <rules>
                    <bannedDependencies>
                        <excludes>
                            <exclude>org.apache.tomcat.embed:*:*:*:compile</exclude>
                    </bannedDependencies>
                </rules>
            </configuration>
        </execution>
    </executions>
</plugin>

Dependencies

<dependency>
    <groupId>org.springframework.boot</groupId>
    <artifactId>spring-boot-starter-validation</artifactId>
</dependency>

<dependency>
    <groupId>org.apache.tomcat.embed</groupId>
    <artifactId>tomcat-embed-el</artifactId>
    <scope>test</scope>
</dependency>

Error

[ERROR] Failed to execute goal org.apache.maven.plugins:maven-enforcer-plugin:3.3.0:enforce (enforce-banned-dependencies) on project enrollment-server: 
[ERROR] Rule 0: org.apache.maven.enforcer.rules.dependency.BannedDependencies failed with message:
[ERROR] com.example:test:war:1.0.0-SNAPSHOT
[ERROR]    org.springframework.boot:spring-boot-starter-validation:jar:3.1.0
[ERROR]       org.apache.tomcat.embed:tomcat-embed-el:jar:10.1.8 <--- banned via the exclude/include list

I have noticed, that there is an option <searchTransitive>false</searchTransitive> but it seems to me, that it ignores transitive dependencies completely. So the dependency is not checked but is attached. IMHO the main goal of this plugin was to control the content of the final artifact.

Downgrading to maven-enforcer-plugin 3.1.0 so far.

Full example:

<?xml version="1.0" encoding="UTF-8"?>
<project xmlns="http://maven.apache.org/POM/4.0.0"
         xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
    <modelVersion>4.0.0</modelVersion>

    <groupId>com.example</groupId>
    <artifactId>test</artifactId>
    <version>1.0-SNAPSHOT</version>

    <parent>
        <groupId>org.springframework.boot</groupId>
        <artifactId>spring-boot-starter-parent</artifactId>
        <version>3.1.0</version>
        <relativePath/> <!-- lookup parent from repository -->
    </parent>

    <dependencies>
        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-validation</artifactId>
        </dependency>

        <dependency>
            <groupId>org.apache.tomcat.embed</groupId>
            <artifactId>tomcat-embed-el</artifactId>
            <!--  Overriding scope of transitive dependency from spring-boot-starter-validation but new enforcer plugin does NOT respect that  -->
            <scope>test</scope>
        </dependency>
    </dependencies>

    <build>
        <plugins>
            <plugin>
                <groupId>org.apache.maven.plugins</groupId>
                <artifactId>maven-enforcer-plugin</artifactId>
                <!--  Working with 3.1.0 -->
                <!--  <version>3.1.0</version> -->
                <!--  Implicit version 3.3.0 breaks the build  -->
                <executions>
                    <execution>
                        <id>enforce-banned-dependencies</id>
                        <goals>
                            <goal>enforce</goal>
                        </goals>
                        <configuration>
                            <rules>
                                <bannedDependencies>
                                    <excludes>
                                        <exclude>org.apache.tomcat.embed:*:*:*:compile</exclude>
                                    </excludes>
                                </bannedDependencies>
                            </rules>
                        </configuration>
                    </execution>
                </executions>
            </plugin>
        </plugins>
    </build>

</project>

First maven-enforcer-plugin with the given rule is exactly doing what it should be doing means breaking the build based on the given dependencies which are not allowed based on the rules... tried both version exactly the same behaviour ... only the output looks a bit different...

Using the maven-enforcer-plugin version 3.1.0 produces the same failure like this:

[INFO] -----------------< com.soebes.spring.example:employee >-----------------
[INFO] Building Employee Demo Application 0.0.1-SNAPSHOT
[INFO]   from pom.xml
[INFO] --------------------------------[ jar ]---------------------------------
[INFO] 
[INFO] --- maven-clean-plugin:3.2.0:clean (default-clean) @ employee ---
[INFO] 
[INFO] --- maven-enforcer-plugin:3.1.0:enforce (enforce-banned-dependencies) @ employee ---
[ERROR] Rule 0: org.apache.maven.plugins.enforcer.BannedDependencies failed with message:
Found Banned Dependency: org.apache.tomcat.embed:tomcat-embed-websocket:jar:10.1.8
Found Banned Dependency: org.apache.tomcat.embed:tomcat-embed-el:jar:10.1.8
Found Banned Dependency: org.apache.tomcat.embed:tomcat-embed-core:jar:10.1.8
Use 'mvn dependency:tree' to locate the source of the banned dependencies.
[INFO] ------------------------------------------------------------------------
[INFO] BUILD FAILURE
[INFO] ------------------------------------------------------------------------
[INFO] Total time:  0.447 s
[INFO] Finished at: 2023-06-12T12:53:26+02:00
[INFO] ------------------------------------------------------------------------
[ERROR] Failed to execute goal org.apache.maven.plugins:maven-enforcer-plugin:3.1.0:enforce (enforce-banned-dependencies) on project employee: Some Enforcer rules have failed. Look above for specific messages explaining why the rule failed. -> [Help 1]

As the maven-enforcer-plugin version 3.3.0 does:

[INFO] 
[INFO] --- maven-clean-plugin:3.2.0:clean (default-clean) @ employee ---
[INFO] 
[INFO] --- maven-enforcer-plugin:3.3.0:enforce (enforce-banned-dependencies) @ employee ---
[INFO] ------------------------------------------------------------------------
[INFO] BUILD FAILURE
[INFO] ------------------------------------------------------------------------
[INFO] Total time:  0.405 s
[INFO] Finished at: 2023-06-12T12:55:35+02:00
[INFO] ------------------------------------------------------------------------
[ERROR] Failed to execute goal org.apache.maven.plugins:maven-enforcer-plugin:3.3.0:enforce (enforce-banned-dependencies) on project employee: 
[ERROR] Rule 0: org.apache.maven.enforcer.rules.dependency.BannedDependencies failed with message:
[ERROR] com.soebes.spring.example:employee:jar:0.0.1-SNAPSHOT
[ERROR]    org.springframework.boot:spring-boot-starter-web:jar:3.1.0
[ERROR]       org.springframework.boot:spring-boot-starter-tomcat:jar:3.1.0
[ERROR]          org.apache.tomcat.embed:tomcat-embed-core:jar:10.1.8 <--- banned via the exclude/include list
[ERROR]          org.apache.tomcat.embed:tomcat-embed-el:jar:10.1.8 <--- banned via the exclude/include list
[ERROR]          org.apache.tomcat.embed:tomcat-embed-websocket:jar:10.1.8 <--- banned via the exclude/include list
[ERROR] 
[ERROR] -> [Help 1]
[ERROR] 
[ERROR] To see the full stack trace of the errors, re-run Maven with the -e switch.
[ERROR] Re-run Maven using the -X switch to enable full debug logging.
[ERROR] 

Update:

If you exclude the tomcat dependency via:

<!-- language:language-xml -->

<dependency>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter-web</artifactId>
<exclusions>
<exclusion>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter-tomcat</artifactId>
</exclusion>
</exclusions>
</dependency>

But you must be careful because you need something else which supports servlet etc.

If you need to overwrite the sope of dependency (which means change the scope) you have to do that in a dependencyManagement section...

<!-- language:language-xml -->

  <dependency>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-dependencies</artifactId>
<version>${spring.boot.version}</version>
<scope>import</scope>
<type>pom</type>
</dependency>
<dependency>
<groupId>org.apache.tomcat.embed</groupId>
<artifactId>tomcat-embed-el</artifactId>
<!--  Overriding scope of transitive dependency from spring-boot-starter-validation but new enforcer plugin does NOT respect that  -->
<scope>test</scope>
</dependency>

That needed to done with each dependency you want to change the scope for...