Avoid child dependencies override parent dependencies using Maven 3

Question

I'm using multiple spring based maven repositories in a web project, and I'm having problems with the dependencies used by child POM.

I have a parent POM like this:

<dependencyManagement>
    <dependencies>

        <!-- SPRING -->            
        <dependency>
            <groupId>org.springframework</groupId>
            <artifactId>spring-framework-bom</artifactId>
            <version>4.3.0.RELEASE</version>
            <type>pom</type>
            <scope>import</scope>
        </dependency>

        <!-- SPRING SECURITY -->

        <dependency>
            <groupId>org.springframework.security</groupId>
            <artifactId>spring-security-bom</artifactId>
            <version>4.1.0.RELEASE</version>
            <type>pom</type>
            <scope>import</scope>
        </dependency>

        <!-- SPRING BOOT -->
        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-dependencies</artifactId>
            <version>1.3.5.RELEASE</version>
            <type>pom</type>
            <scope>import</scope>
        </dependency>

        <!-- SPRING WS -->

        <dependency>
            <groupId>org.springframework.ws</groupId>
            <artifactId>spring-ws-core</artifactId>
            <version>2.2.3.RELEASE</version>
        </dependency>

        <dependency>
            <groupId>org.springframework.ws</groupId>
            <artifactId>spring-ws-security</artifactId>
            <version>2.2.3.RELEASE</version>
        </dependency>
        <!-- OTHER DEPENDENCIES OMITTED -->
    </dependencies>
</dependencyManagement>

And a child POM like this:

<dependencies>
    <dependency>
        <groupId>org.springframework.ws</groupId>
        <artifactId>spring-ws-security</artifactId>
        <exclusions>
            <exclusion>
                <groupId>org.springframework</groupId>
                <artifactId>spring-core</artifactId>
            </exclusion>
        </exclusions>
    </dependency>

    <dependency>
        <groupId>org.springframework</groupId>
        <artifactId>spring-core</artifactId>
    </dependency>
    <!-- OTHER DEPENDENCIES OMITTED -->
</dependencies>

As far as my understanding of maven exclusion goes, this should avoid the overriding of the parent POM version, but due to the fact that spring-ws-security depends on a lower version of spring-core (4.0.9) whose method have been changed I can't deploy the app on a tomcat local server because of a NoSuchMethodError Exception, which can be also triggered when the app is actually deployed but the dependences to the old spring-core version remains.

How can I avoid this overriding of dependencies? Or is there some way of using both dependencies (which as far as I've searched is not secure)?

Links visited already:

Similar problem, but from child to parent,

Exclusions example

Just a few mentions, I've visited others as well but forgot the links.

Edit: spring-ws dependencies use spring 4.0.9 which is overriding the 4.3.0 version (the one I need to use) I've defined in the parent POM.

+- org.springframework.ws:spring-ws-core:jar:2.2.3.RELEASE:compile
[INFO] |  |  |  +- org.springframework:spring-oxm:jar:4.3.0.RELEASE:compile (version managed from 4.0.9.RELEASE)
[INFO] |  |  |  +- org.springframework:spring-web:jar:4.3.0.RELEASE:compile (version managed from 4.0.9.RELEASE)
[INFO] |  |  |  \- org.springframework:spring-webmvc:jar:4.3.0.RELEASE:compile (version managed from 4.0.9.RELEASE)

Please list what versions of libraries you are getting and what versions you want to get. You can run `mvn dependency:tree` to list dependencies. — Anton Koscejev, Jul 09 '16 at 08:47
So based on your comment to Sundaraj's answer I'm not sure what exactly are you trying to achieve. Do you want those spring-* artifacts to be version 4.3 or 4.0? You're getting 4.3 due to your parent, but you're saying you don't want child project to change that, so you want to get 4.3? But spring-ws 2.2 is not binary compatible with spring 4.3 and requires an older version. So you either need to use 4.0 in child (defined in parent or overridden in child), or you need some version of spring-ws that is binary compatible with spring 4.3. What exactly do you want help with? — Anton Koscejev, Jul 10 '16 at 10:00
I'm sorry for the misunderstanding @AntonKoscejev, I want to use the 4.3 because other dependencies use that version, except for spring-ws which is not compatible and requires an older version, what I want is spring-ws to coexist with my other dependencies, that's the reason I was trying to make exclusions, otherwise the 4.3 is overriden by the 4.0 when not using a BOM, when using it (which is this case) the 4.3 version is mandatory and spring-ws can't find some of the old version methods. — Felipe Murillo, Jul 11 '16 at 12:43
You can't have two different versions of the same dependency on classpath. Well, you can, but only using very complicated techniques that you don't want to get into under normal circumstances like these. So do you want a project with spring-ws to use spring 4.0 (e.g., being finally distributed with spring 4.0 libraries), while other projects use spring 4.3 (are distributed with spring 4.3)? If that's the case, you can define dependency management section in your project that uses spring-ws, and use it to override whatever you want from parent, including overriding spring bom version. — Anton Koscejev, Jul 11 '16 at 13:00
Thanks for the answer @AntonKoscejev, but that will be a bad practice in my project due to the project which use spring-ws is a child of the project where dependecyManagement is defined, and the dependecyManagement is suposed to be declared only in the parent POM. For now I've decided to change some logic to make the app work. — Felipe Murillo, Jul 14 '16 at 16:55

score 1 · Answer 1 · edited Jun 20 '20 at 09:12

1

You can simply do explicit override in your child pom by mentioning the version 4.0.9, like below.

 <dependency>
        <groupId>org.springframework</groupId>
        <artifactId>spring-core</artifactId>
        <version>4.0.9</version>
 </dependency>

As quoted below, this version will affect the child-of-child pom, if any.

Forcing a version

A version will always be honoured if it is declared in the current POM with a particular version - however, it should be noted that this will also affect other poms downstream if it is itself depended on using transitive dependencies.

edited Jun 20 '20 at 09:12

Community

1
1

answered Jul 07 '16 at 22:54

Sundararaj Govindasamy

8,180
5
44
77

Thanks for the quick answer Sundararaj, but the problem is I don't want to override the version within the child POM, basically what I want is the version not to be overrided, that's the reason I was excluding the dependency version spring-ws use. – Felipe Murillo Jul 08 '16 at 16:02

Avoid child dependencies override parent dependencies using Maven 3

1 Answers1