[MNG-7561] never resolve version ranges with same lower and upper bound

[kwin]

Following this checklist to help us incorporate your
contribution quickly and easily:

• Make sure there is a JIRA issue filed
  for the change (usually before you start working on it). Trivial changes like typos do not
  require a JIRA issue. Your pull request should address just this issue, without
  pulling in other changes.
• Each commit in the pull request should have a meaningful subject line and body.
• Format the pull request title like [MNG-XXX] SUMMARY, where you replace MNG-XXX
  and SUMMARY with the appropriate JIRA issue. Best practice is to use the JIRA issue
  title in the pull request title and in the first line of the commit message.
• Write a pull request description that is detailed enough to understand what the pull request does, how, and why.
• Run mvn clean verify to make sure basic checks pass. A more thorough check will
  be performed on your pull request automatically.
• You have run the Core IT successfully.

If your pull request is about ~20 lines of code you don't need to sign an
Individual Contributor License Agreement if you are unsure
please ask on the developers list.

To make clear that you license your contribution under
the Apache License Version 2.0, January 2004
you have to acknowledge this by using the following check-box.

• I hereby declare this contribution to be licenced under the Apache License Version 2.0, January 2004

• In any other case, please file an Apache Individual Contributor License Agreement.

[cstamas]

IMHO this PR is wrong, as commented on issue https://issues.apache.org/jira/browse/MNG-7561?focusedCommentId=17616329&page=com.atlassian.jira.plugin.system.issuetabpanels%3Acomment-tabpanel#comment-17616329

[kwin]

why is this shortcut allowed for recommended versions (soft-requirements)?

[gnodet]

What happens if the artifact does not exist with the given version ?

[kwin]

The same as for soft-requirements, i.e. that would lead to an exception subsequently.

[michael-o]

IMHO this PR is wrong, as commented on issue https://issues.apache.org/jira/browse/MNG-7561?focusedCommentId=17616329&page=com.atlassian.jira.plugin.system.issuetabpanels%3Acomment-tabpanel#comment-17616329

I follow this reasoning.

[gnodet]

IMHO this PR is wrong, as commented on issue https://issues.apache.org/jira/browse/MNG-7561?focusedCommentId=17616329&page=com.atlassian.jira.plugin.system.issuetabpanels%3Acomment-tabpanel#comment-17616329

I follow this reasoning.

Agreed, but then I agree with @kwin that it also seems incorrect that for a non range version, no check is performed. I don't really see why the use case would really differ.

[gnodet]

@michael-o @cstamas I'm trying to understand how this works. If the VersionResolver returns a Set<String> for versions when given a range, and a single version when given a soft version, where is the fact that the selected version belongs to the enforced range in case of a dependency conflict ?

[cstamas]

IMHO this PR is wrong, as commented on issue https://issues.apache.org/jira/browse/MNG-7561?focusedCommentId=17616329&page=com.atlassian.jira.plugin.system.issuetabpanels%3Acomment-tabpanel#comment-17616329

I change my mind here, I believe I am wrong: VersionResolver is NOT ensuring that version exists, it simply uses metadata to "discover" available versions instead, so I change my mind: the PR seems ok

[kwin]

Some ITs fail with this PR as those also assume same upper/lower bound ranges should be resolved. Are those wrong?

[cstamas]

Hm, it fails due NPE?

Errors: 
Error:    MavenITmng0505VersionRangeTest.testitMNG505:66

....
java.lang.NullPointerException
    at org.apache.maven.repository.internal.DefaultVersionRangeResolver.resolveVersionRange (DefaultVersionRangeResolver.java:117)
    at org.eclipse.aether.internal.impl.collect.DependencyCollectorDelegate.cachedResolveRangeResult (DependencyCollectorDelegate.java:438)
...

?

[gnodet]

The test fails with an NPE on the modified line:

result.addVersion( versionConstraint.getRange().getLowerBound().getVersion() );

Given the earlier tests, it means versionConstraint.getRange().getLowerBound() == null and versionConstraint.getRange().getUpperBound() == null, so something like (,), not sure it's even valid...

Or does that happen so that the maven-resolver can obtain a list of existing versions for a given artifact, if none is provided, as done for plugin resolution ?

[jira-importer]

Resolve #8890