Resolves #973: NPE if actual version is null for a dependency

[andrzejj0]

In case a dependency version is specified in dependencyManagement, a dependency can be versionless.

Dependency updates goals would then attempt to find an updated version to a versionless dependency, which would fail with an NPE or, if that is prevented, an attempt would have been made to find an update to version specified as [,0], which would be any version.

Preventing both issues.

@slawekjaranowski please review.

[andrzejj0]

@slawekjaranowski The plugin itself must define a dependency version in its dependencies or dependency management.

This does trigger the error and will be helped with the patch.

For this to work though as an it, the plugin needs to be executed.

    <pluginManagement>
      <plugins>
        <plugin>
          <groupId>com.github.spotbugs</groupId>
          <artifactId>spotbugs-maven-plugin</artifactId>
          <version>4.7.3.4</version>
          <dependencies>
            <!-- overwrite dependency on spotbugs if you want to
            specify the version of spotbugs -->
            <dependency>
              <groupId>com.github.spotbugs</groupId>
              <artifactId>spotbugs</artifactId>
            </dependency>
          </dependencies>
        </plugin>
      </plugins>
    </pluginManagement>

In this case, it does define the dependency on com.github.spotbugs:spotbugs:${spotbugsVersion}. -- see https://repo1.maven.org/maven2/com/github/spotbugs/spotbugs-maven-plugin/4.7.3.4/spotbugs-maven-plugin-4.7.3.4.pom

EDIT: No, it will still fail if we actually try executing the plugin

[andrzejj0]

@slawekjaranowski Ok, so I guess this is another edge case: the pom.xml will fail when we try executing the actual plugin as it is invalid -- lacks version. However, this faulty pom.xml will cause an NPE on the versions plugin if we try bumping the versions. So, maybe let's allow this faulty pom.xml as the goal here is not to execute the plugin, but to make the versions plugin not fail while processing the pom.

[slawekjaranowski]

@slawekjaranowski Ok, so I guess this is another edge case: the pom.xml will fail when we try executing the actual plugin as it is invalid -- lacks version. However, this faulty pom.xml will cause an NPE on the versions plugin if we try bumping the versions. So, maybe let's allow this faulty pom.xml as the goal here is not to execute the plugin, but to make the versions plugin not fail while processing the pom.

Sounds reasonable - we only need comments on IT tah such configurations is not working

[slawekjaranowski]

Dropped my test commit 😄

[andrzejj0]

Added a description. Did not squash :)