What causes "Wildcard exclusions are not supported here" in quarkusio/quarkus?

Replace the wildcard exclusion with explicit groupId/artifactId of the transitive dependency to exclude

quarkusio/quarkus · error · IllegalStateException

Wildcard exclusions are not supported here

Error message

Wildcard exclusions are not supported here

What it means

DependencyUtils.getKey(Exclusion) converts a Maven <exclusion> into an ArtifactKey. Quarkus dependency keys are exact coordinates, so groupId or artifactId wildcards ('*') cannot be represented and trigger this IllegalStateException. The resolver needs a concrete key to filter dependencies.

Source

Thrown at independent-projects/bootstrap/maven-resolver/src/main/java/io/quarkus/bootstrap/util/DependencyUtils.java:36

import io.quarkus.bootstrap.resolver.maven.MavenArtifactResolver;
import io.quarkus.bootstrap.workspace.WorkspaceModule;
import io.quarkus.maven.dependency.ArtifactCoords;
import io.quarkus.maven.dependency.ArtifactKey;
import io.quarkus.maven.dependency.DependencyFlags;
import io.quarkus.maven.dependency.GACTV;
import io.quarkus.maven.dependency.ResolvedDependencyBuilder;
import io.quarkus.paths.PathList;

public class DependencyUtils {

    public static ArtifactKey getKey(Artifact artifact) {
        return ArtifactKey.of(artifact.getGroupId(), artifact.getArtifactId(),
                artifact.getClassifier(), getType(artifact));
    }

    public static ArtifactKey getKey(Exclusion exclusion) {
        if ("*".equals(exclusion.getGroupId()) || "*".equals(exclusion.getArtifactId())) {
            throw new IllegalStateException("Wildcard exclusions are not supported here");
        }
        return ArtifactKey.of(exclusion.getGroupId(), exclusion.getArtifactId(),
                exclusion.getClassifier(), exclusion.getExtension());
    }

    public static ArtifactCoords getCoords(Artifact artifact) {
        return new GACTV(artifact.getGroupId(), artifact.getArtifactId(),
                artifact.getClassifier(), getType(artifact), artifact.getVersion());
    }

    public static Map<ArtifactKey, Dependency> toMap(List<Dependency> deps) {
        final Map<ArtifactKey, Dependency> map = new HashMap<>(deps.size());
        for (Dependency dep : deps) {
            map.put(getKey(dep.getArtifact()), dep);
        }
        return map;
    }

View on GitHub (pinned to e1c734241f)

Solutions

Replace the wildcard exclusion with explicit groupId/artifactId of the transitive dependency to exclude
Use 'mvn dependency:tree' to identify the exact transitive artifacts needing exclusion
If the goal is excluding everything, exclude each known transitive artifact individually
Upgrade/align Quarkus so the problematic POM path is no longer processed with DependencyUtils.getKey, if applicable

Example fix

<!-- before -->
<exclusion>
  <groupId>*</groupId>
  <artifactId>*</artifactId>
</exclusion>
<!-- after -->
<exclusion>
  <groupId>commons-logging</groupId>
  <artifactId>commons-logging</artifactId>
</exclusion>

Defensive patterns

Strategy: validation

Validate before calling

void checkExclusions(Model pom) {
    for (Dependency d : pom.getDependencies()) {
        for (Exclusion x : d.getExclusions()) {
            if ("*".equals(x.getGroupId()) || "*".equals(x.getArtifactId()))
                throw new IllegalStateException("Wildcard exclusion in " + d.getArtifactId());
        }
    }
}

Try / catch

try {
    ArtifactKey key = DependencyUtils.getKey(exclusion);
} catch (IllegalStateException e) {
    log.warn("Replace wildcard exclusion with explicit coordinates");
}

Prevention

Never use groupId/artifactId '*' in <exclusion>
Use mvn dependency:tree to enumerate exact artifacts to exclude
Lint POMs for wildcard exclusions in CI
Keep exclusion lists minimal and specific

When it happens

Trigger: Declaring a dependency exclusion with <groupId>*</groupId> or <artifactId>*</artifactId> in a POM that Quarkus processes (e.g. application model building / dependency graph analysis in the workspace).

Common situations: Copy-pasted 'exclude everything' exclusions used to silence dependency convergence; migrating POMs from tooling that supports wildcard exclusions (newer Maven semantics) into Quarkus workspace analysis.

Related errors

AI-assisted analysis of quarkusio/quarkus@e1c734241f (2026-09-05). Data as JSON: /api/errors/75491153f526d21d. Report an issue: GitHub.