java - 为什么未指定版本的netty已经阴影到jar中了？

Question

netty版本在pom文件中声明。

<netty.version>4.0.36.Final</netty.version>

maven的shade插件声明如下:

 <plugin>
    <groupId>org.apache.maven.plugins</groupId>
      <artifactId>maven-shade-plugin</artifactId>
            <version>2.3</version>
            <configuration>
                <createDependencyReducedPom>false</createDependencyReducedPom>
                <filters>
                    <filter>
                        <artifact>client</artifact>
                        <includes>
                            <include>**/*.class</include>
                        </includes>
                    </filter>
                    <filter>
                        <artifact>*:*</artifact>
                        <excludes>
                            <exclude>META-INF/*.SF</exclude>
                            <exclude>META-INF/*.DSA</exclude>
                            <exclude>META-INF/*.RSA</exclude>
                        </excludes>
                    </filter>
                </filters>
            </configuration>
            <executions>
                <execution>
                    <phase>package</phase>
                    <goals>
                        <goal>shade</goal>
                    </goals>
                    <configuration>
                        <transformers>
                            <transformer
                                    implementation="org.apache.maven.plugins.shade.resource.ManifestResourceTransformer">
                                <mainClass>io.Client</mainClass>
                            </transformer>
                        </transformers>
                    </configuration>
                </execution>
            </executions>      
  </plugin>        

但是，我发现编译日志中包含了另一个版本的 netty。我无法理解这种情况。

[INFO] --- maven-shade-plugin:2.3:shade (default) @ client ---
[INFO] Including io.netty:netty-all:jar:4.0.36.Final in the shaded jar.
[INFO] Including io.netty:netty:jar:3.7.0.Final in the shaded jar.
[INFO] Including com.fasterxml.jackson.core:jackson-core:jar:2.5.1 in the shaded jar.
[INFO] Including com.fasterxml.jackson.core:jackson-databind:jar:2.5.1 in the shaded jar.
[INFO] Including com.fasterxml.jackson.core:jackson-annotations:jar:2.5.0 in the shaded jar.

Answer 1

您可以使用 - 分析项目的依赖关系树来了解 io.netty:netty Artifact 的来源

mvn dependency:tree

只是为了使用日志中指定的版本和 Artifact 进行重现 -

Including io.netty:netty-all:jar:4.0.36.Final

以下依赖

<dependency>
    <groupId>io.netty</groupId>
    <artifactId>netty-all</artifactId>
    <version>4.0.36.Final</version>
</dependency>

我的示例日志结果如下 -

[INFO] --- maven-shade-plugin:2.3:shade (default) @ netty-sample --- 
[INFO] Including io.netty:netty-all:jar:4.0.36.Final in the shaded jar.

[INFO] No artifact matching filter client

注意:日志中没有 io.netty:netty:jar:3.7.0.Final。