Apache dependency convergence issues

[Venorcis]

Describe the bug

Both the Apache httpcore as well as the commons-codec are included with different versions by different modules.

Expected Behavior

Versions to converge succesfully.

Current Behavior

Rule 5: org.apache.maven.enforcer.rules.dependency.DependencyConvergence failed with message: Failed while enforcing releasability.
Dependency convergence error for org.apache.httpcomponents:httpcore:jar:4.4.13 paths to dependency are:
  +-software.amazon.awssdk:s3:jar:2.26.29:compile
    +-software.amazon.awssdk:apache-client:jar:2.26.29:runtime
      +-org.apache.httpcomponents:httpclient:jar:4.5.13:runtime
        +-org.apache.httpcomponents:httpcore:jar:4.4.13:runtime
and
  +-software.amazon.awssdk:s3:jar:2.26.29:compile
    +-software.amazon.awssdk:apache-client:jar:2.26.29:runtime
      +-org.apache.httpcomponents:httpcore:jar:4.4.16:runtime

Rule 12: org.apache.maven.enforcer.rules.dependency.RequireUpperBoundDeps failed with message: Failed while enforcing RequireUpperBoundDeps.
Require upper bound dependencies error for commons-codec:commons-codec:1.17.0 [runtime] paths to dependency are:
  +-software.amazon.awssdk:s3:2.26.29
    +-software.amazon.awssdk:apache-client:2.26.29 [runtime] (managed) <-- software.amazon.awssdk:apache-client:2.26.29 [runtime]
      +-commons-codec:commons-codec:1.17.0 [runtime] (managed) <-- commons-codec:commons-codec:1.17.1 [runtime]
and
  +-software.amazon.awssdk:s3:2.26.29
    +-software.amazon.awssdk:apache-client:2.26.29 [runtime] (managed) <-- software.amazon.awssdk:apache-client:2.26.29 [runtime]
      +-org.apache.httpcomponents:httpclient:4.5.13 [runtime]
        +-commons-codec:commons-codec:1.17.0 [runtime] (managed) <-- commons-codec:commons-codec:1.11 [runtime]

Reproduction Steps

Build with dependencyConvergence enabled in the maven-enforcer-plugin

Possible Solution

No response

Additional Information/Context

2.26.22 is the last working version

AWS Java SDK version used

2.26.29

JDK version used

openjdk version "21.0.4" 2024-07-16 LTS

Operating System and version

Ubuntu 22.04.4 LTS

[debora-ito]

As I mentioned in the previous issue, we don't enforce dependency convergence, but we know we could improve the experience.

[debora-ito]

Let's use #2669 to track this feature request.

[github-actions]

This issue is now closed. Comments on closed issues are hard for our team to see.
If you need more assistance, please open a new issue that references this one.