deps.edn Reference: mvn repositories from transitive deps are not supported

[Jarkko Saltiola]

Found out that a custom :mvn/repos declaration in dependency's deps.edn gets discarded when library is required from another project, e.g.

{:paths ["."]
 :mvn/repos {
             "jetbrains-repo" {:url "https://packages.jetbrains.team/maven/p/ij/intellij-dependencies"}
             }
 :deps {
        org.clojure/clojure {:mvn/version "1.12.0-alpha5"}
        org.jetbrains.pty4j/pty4j {:mvn/version "0.12.25"}
        }
}

is leading to errors on start when library using this deps.edn gets required from elsewhere:

Could not start nREPL server: Error building classpath. Could not find artifact org.jetbrains.pty4j:purejavacomm:jar:0.0.11.1 in central (https://repo1.maven.org/maven2/)

This gets fixed when child dependency's :mvn/repos declaration is moved to parent's deps.edn.

This works as designed as briefly explained here: https://clojurians.slack.com/archives/C6QH853H8/p1702616310402989.

Alex Miller: this is intentional - from a security point of view we've decided not to include mvn repositories from transitive deps in the parent and you need to re-include at use

Could have a note about it in the docs page https://clojure.org/reference/deps_edn also.

EDIT: another Slack thread from past: https://clojurians.slack.com/archives/C6QH853H8/p1652909624726889

[Alex Miller]

There is a note in the Maven procurers section, but I've added an additional note in the Maven deps section in 72be93c.

[Jarkko Saltiola]

@puredanger thank's, it is easier to spot now.