Copy Page

You are not logged in. Any changes you make will be marked as anonymous. You may want to Log In if you already have an account. You can also Sign Up for a new account.

<h1>Dependency Mechanism</h1>

<h2> Dependency</h2>

A dependency is an artifact (piece of software) which your maven project uses ( depends on ). This usually comes in the form of a jar, but it may also be a zip file. These dependencies are stored in remote repositiries such as <code><a href="http://www.ibiblio.org/maven2">http://www.ibiblio.org/maven2</a></code> or <code><a href="http://repo1.maven.apache.org/maven2">http://repo1.maven.apache.org/maven2</a></code> ( which repositories to use can be specified via your pom, profile descriptor, and / or <code>settings.xml</code>). This is where Maven2 will look for your project's dependencies and download them automatically. These downloaded artifacts would then be stored in your local repository. By default, it would be in your \${<code>user.home}/.m2/repository/</code> ( unless you specified otherwise in your \${<code>M2_HOME}/conf/settings.xml</code> ). After downloading these artifacts to your local repository, maven would get your dependencies in there with the succeeding builds. However, Maven2 will still try to download from the repositories daily (by default) to check for updates.

A dependency is identified through its artifact key. The artifact key is that artifact's groupId, artifactId, and version. The groupId identifies under which group of artifacts that artifact belongs to, while the artifactId is the id of that artifact itself. The relationship between groupId and artifactid is analogous to that of Java's package and class. And of course, the version defines what version that artifact is. The version format maven uses by default is  following:

In some cases, artifact keys would be asked from you, and these are in this format.

But most of the time, you would be specifying dependencies in your POM.

In your POM, you can specify your dependencies inside the dependencies tag. For example, if we have a project my.group:my-project:1 that declares sample.group:sample-artifactA:1, sample.group:sample-artifactB:1, and sample.group:sample-artifactC:1 as its dependencies, we would declare it as

&lt;!-- artifact key of this maven project --&gt; 
  &lt;groupId&gt;my.group&lt;/groupId&gt; 
  &lt;artifactId&gt;my-project&lt;/artifactId&gt; 
  &lt;version&gt;1&lt;/version&gt;

&lt;!-- list of dependencies --&gt; 
  &lt;dependencies&gt;

&lt;!-- sample.group:sample-artifactA:1 --&gt; 
    &lt;dependency&gt; 
      &lt;groupId&gt;sample.group&lt;/groupId&gt; 
      &lt;artifactId&gt;sample-artifactA&lt;/artifactId&gt; 
      &lt;version&gt;1&lt;/version&gt; 
    &lt;/dependency&gt;

&lt;!-- sample.group:sample-artifactC:1 --&gt; 
    &lt;dependency&gt; 
      &lt;groupId&gt;sample.group&lt;/groupId&gt; 
      &lt;artifactId&gt;sample-artifactC&lt;/artifactId&gt; 
      &lt;version&gt;1&lt;/version&gt; 
    &lt;/dependency&gt; 
  &lt;/dependencies&gt;

&lt;/project&gt; </td></tr></table>

Our dependency tree would then be

This tree shows that our maven project my.group:my-project:1 has three dependencies directly under it: sample.group:sample-artifactA:1, sample.group:sample-artifactB:1 and sample.group:sample-artifactC:1. All of which would be automatically downloaded by Maven2 into your local repository and loaded in your classpath.

<h2> Inherited Dependencies</h2>

Dependencies of your pom's parent poms are also inherited. (I use the term &quot;parent poms&quot; to refer to a poms parent and the parent's parent and so forth through all the ancester poms.) Thus, if we have a my-group:my-parent:1 whose dependencies are sample.parent.group:my-artifactA:1 and sample.parent.group:my-artifactB:1

&lt;!-- artifact key of this maven project --&gt; 
  &lt;groupId&gt;my.group&lt;/groupId&gt; 
  &lt;artifactId&gt;my-parent&lt;/artifactId&gt; 
  &lt;version&gt;1&lt;/version&gt;

&lt;!-- list of dependencies --&gt; 
  &lt;dependencies&gt;

&lt;!-- sample.parent.group:sample-artifactA:1 --&gt; 
    &lt;dependency&gt; 
      &lt;groupId&gt;sample.parent.group&lt;/groupId&gt; 
      &lt;artifactId&gt;sample-artifactA&lt;/artifactId&gt; 
      &lt;version&gt;1&lt;/version&gt; 
    &lt;/dependency&gt;

&lt;!-- sample.parent.group:sample-artifactB:1 --&gt; 
    &lt;dependency&gt; 
      &lt;groupId&gt;sample.parent.group&lt;/groupId&gt; 
      &lt;artifactId&gt;sample-artifactB&lt;/artifactId&gt; 
      &lt;version&gt;1&lt;/version&gt; 
    &lt;/dependency&gt;

&lt;/dependencies&gt;

&lt;/project&gt; </td></tr></table>

and if we make our my.group:my-project:1 inherit my.group:my-parent:1

&lt;modelVersion&gt;4.0.0&lt;/modelVersion&gt;

&lt;!-- artifact key of the parent project --&gt; 
  &lt;parent&gt; 
    &lt;groupId&gt;my.group&lt;/groupId&gt; 
    &lt;artifactId&gt;my.group&lt;/artifactId&gt; 
    &lt;version&gt;1&lt;/version&gt; 
  &lt;/parent&gt;

&lt;!-- list of dependencies --&gt; 
  &lt;dependencies&gt;

&lt;/project&gt; </td></tr></table>

our dependency tree would be

These inherited dependencies are automatically downloaded and included in your classpath by Maven2 as well.

<h2> Transitive Dependency </h2>

A direct dependency is a dependency that is defined your maven project  ( your pom, plus the dependencies of its parent poms ).

On the other hand, a transitive dependency is a dependency that is a dependency of your maven project's direct and inherited dependency. In our previous examples, my.group:my-project:1 has three direct dependencies and two inherited dependencies. However, those dependencies, may also have other dependencies. For example, sample.parent.group:sample-artifactA:1 my depend on sample.parent.group:sample-artifactAA:1 , sample.group:sample-artifactA:1 may depend on sample.group:sample-artifactAA:1, and sample.group:sample-artifactAB:2, while sample.group:sample-artifactC:1 may depend on sample.group:sample-artifactCA:1.

Moreover, these transitive dependencies may also have other dependencies, and so on.

<table class="wysiwyg-macro" data-macro-name="panel" style="background-image: url(/plugins/servlet/confluence/placeholder/macro-heading?definition=e3BhbmVsfQ&amp;locale=en_GB&amp;version=2); background-repeat: no-repeat;" data-macro-body-type="RICH_TEXT"><tr><td class="wysiwyg-macro-body">
 sample.group:my-project:1 
 |--  sample.parent.group:sample-artifactA:1 
 |     `--  sample.parent.group:sample-artifactAA:1 
 |            |-- sample.parent.group:sample-artifactAAA:1 
 |            |-- sample.parent.group:sample-artifactAAB:1 
 |            |    |-- sample.parent.group:sample-artifactAABA:1 
 |            |    |    `-- sample.parent.group:sample-artifactAABAA:1 
 |            |    `-- sample.parent.group:sample-artifactAABB:1 
 |            |-- sample.parent.group:sample-artifactAAC:1 
 |            |    `-- sample.parent.group:sample-artifactAACA:1 
 |            `-- sample.parent.group:sample-artifactAAD:1 
 |                  `-- sample.parent.group:sample-artifactAADA:1 
 |--  sample.parent.group:sample-artifactB:1 
 |--  sample.group:sample-artifactA:1 
 |    |--  sample.group:sample-artifactAA:1 
 |    `-- sample.group:sample-artifactAB:1 
 |          `-- sample.group:sample-artifactABA:1 
 |               `-- sample.group:sample-artifactABAA:1 
 |--  sample.group:sample-artifactB:1 
  `--  sample.group:sample-artifactC:1 
         `-- sample.group:sample-artifactCA:1 
               |-- sample.group:sample-artifactCAA:1 
               `-- sample.group:sample-artifactCAB:1 </td></tr></table>

These transitive dependencies are taken care of by Maven2 as well. Therefore, you don't have to declare in your pom these transitive dependencies because Maven2 will already traverse trhough your depedency tree and download these dependencies and include them in your classpath.

<h3>Transitive Dependency Exclusion </h3>

To exclude a transitive dependency from your direct dependency, you can use the &lt;exclusions&gt; tags. For example, to exclude sample.group:sample-artifactAB:1 and all its dependencies (direct and transitive), we can do the following

&lt;modelVersion&gt;4.0.0&lt;/modelVersion&gt;

&lt;!-- list of dependencies --&gt; 
  &lt;dependencies&gt;

&lt;!-- sample.group:sample-artifactB:1 --&gt; 
    &lt;dependency&gt; 
      &lt;groupId&gt;sample.group&lt;/groupId&gt; 
      &lt;artifactId&gt;sample-artifactB&lt;/artifactId&gt; 
      &lt;version&gt;1&lt;/version&gt; 
       &lt;exclusions&gt; 
         &lt;exclusion&gt; 
           &lt;groupId&gt;sample.group&lt;/groupId&gt; 
           &lt;artifactId&gt;sample-artifactAB&lt;/artifactId&gt; 
         &lt;/exclusion&gt; 
       &lt;/exclusions&gt; 
    &lt;/dependency&gt;

&lt;/project&gt;</td></tr></table>

<h2> Dependency Management</h2>

As we can see, dependencies must always declare their groupId, artifactId, and version. However, if you have several maven projects, and you want to control the version of their dependencies, you can use the &lt;dependencyManagement&gt; tag.

Revising our my.group:my-parent:1 into my.group:my-parent:2 to use dependencyManagement, we will have the following:

&lt;!-- list of dependencies --&gt; 
  &lt;dependencies&gt;

&lt;/dependencies&gt;

&lt;!-- dependency management --&gt; 
  &lt;dependencyManagement&gt;

&lt;!-- sample.parent.group:sample-artifactA:1 --&gt; 
    &lt;dependency&gt; 
      &lt;groupId&gt;sample.parent.group&lt;/groupId&gt; 
      &lt;artifactId&gt;sample-artifactA&lt;/artifactId&gt; 
      &lt;version&gt;1&lt;/version&gt; 
    &lt;/dependency&gt;

&lt;/dependencyManagement&gt;

&lt;/project&gt; </td></tr></table>

As for the dependeny tree of our my.group:my-project:2 (which has the same pom content as version 1 except that version 2 inherits from my.group:my-parent:2 instead of my.group:my-parent:1), this would have no difference. Our depdency tree (excluding the transitive nodes) would still be

However, if we create a my.group:my-parent:3 such that there is no dependencies tag,

&lt;!-- dependency management --&gt; 
  &lt;dependencyManagement&gt;

&lt;!-- sample.parent.group:sample-artifactA:1 --&gt; 
    &lt;dependency&gt; 
      &lt;groupId&gt;sample.parent.group&lt;/groupId&gt; 
      &lt;artifactId&gt;sample-artifactA&lt;/artifactId&gt; 
      &lt;version&gt;1&lt;/version&gt; 
    &lt;/dependency&gt;

&lt;/dependencyManagement&gt;

&lt;/project&gt; </td></tr></table>

and let it be inherited by my.group:my-project:3, its dependency tree would be

Note that  both sample.parent.group:sample-artifactA:1 and sample.parent.group:sample-artifactB:1 were not inherited. That's because they are not dependencies of the parent project. The parent project simply declared how its subprojects would resolve the versioning of these dependencies.

But if we would have my.group:my-project:3.1 that has the following POM

&lt;modelVersion&gt;4.0.0&lt;/modelVersion&gt;

&lt;!-- list of dependencies --&gt; 
  &lt;dependencies&gt;

&lt;!-- sample.parent.group:sample-artifactA --&gt; 
    &lt;dependency&gt; 
      &lt;groupId&gt;sample.parent.group&lt;/groupId&gt; 
      &lt;artifactId&gt;sample-artifactA&lt;/artifactId&gt; 
    &lt;/dependency&gt;

&lt;/dependencies&gt;

&lt;/project&gt; </td></tr></table>

The versionless artifact key, sample.parent.group:sample-artifactA, would be resolved via the dependencyManagement thus resulting into the following dependency tree:

Notice that even though the version for sample.parent.group:sample-artifactA was not mentioned in the dependencies tag, it was still resolved by matching it with the one declared in the dependencyManagement. Without the dependencyManagement, this project would have a build failure stating that a POM dependencies is lacking version.

<h2>Version Resolution </h2>

Maven2 first merges your pom with its parent poms. (And the parent's parent and so forth.) The dependencies declared in your pom would override those declared in any of its parent poms. The same goes for the dependencyManagement. The dependencyManagement would be merged with the dependencyManagement of your parent poms, and if there are conflicts, the dependencyManagement of your pom would be prioritized.

Versionless dependencies would be resolved by matching their groupId and artifactId with the dependencyManagment, and using the version declared in there for those versionless dependencies.

For the dependencies with same groupId and same artifactId but different versions, the version of the dependency closest to the root of the dependency tree (which is the maven project you invoked your mvn command on) would be used. So if we have a transitive depedency three levels deep, and another transitive dependency (with the same groupId and artifactId) two levels deep. The one closer to the root, which is the later, would be prioritizd over the former.

<h3>What if name-x.jar and name-y.jar in my package lib</h3>

Most probably, it was a residue of a previous build, or it came from another plugin such as maven-dependency-plugin, maven-assembly-plugin, maven-antrun-plugin, etc.

<h2>Viewing a maven project's dependency tree</h2>

To generate a dependency tree report, use mvn project-info-reports:dependencies. This would generate an html file in your target\site\dependencies.html.

Also, if you doubt the output of the project-info-reports:dependencies, you can add -X to your mvn command (i.e. mvn -X package) and trace the debug logs to find the transitive dependency you are looking for.