Maven dependency:tree doesn't show all transitive dependencies

Question

I was trying to parse some dependency trees via maven dependency:tree, and found some interesting cases:

I made a pom.xml to install org.glassfish.jersey.containers:jersey-container-servlet:2.19, here is the content:

<project> 
  <modelVersion>4.0.0</modelVersion> 
  <groupId> fake_id </groupId> 
  <artifactId> fake_id </artifactId> 
  <version>1.0.0</version> 
  <dependencies> 
    <dependency> 
      <groupId>org.glassfish.jersey.containers</groupId> 
      <artifactId>jersey-container-servlet</artifactId> 
      <version>2.19</version> 
    </dependency> 
  </dependencies> 
</project>

Before installing this package, I removed all folders in /home/${user}/.m2/repository in case the result to be affected by existing environment. Then I ran mvn dependency:tree -Dverbose, I got the following dependency tree:

fake_id:fake_id:jar:1.0.0
[INFO] \- org.glassfish.jersey.containers:jersey-container-servlet:jar:2.19:compile
[INFO]    +- org.glassfish.jersey.containers:jersey-container-servlet-core:jar:2.19:compile
[INFO]    |  +- org.glassfish.hk2.external:javax.inject:jar:2.4.0-b25:compile
[INFO]    |  +- (org.glassfish.jersey.core:jersey-common:jar:2.19:compile - omitted for duplicate)
[INFO]    |  +- (org.glassfish.jersey.core:jersey-server:jar:2.19:compile - omitted for duplicate)
[INFO]    |  \- (javax.ws.rs:javax.ws.rs-api:jar:2.0.1:compile - omitted for duplicate)
[INFO]    +- org.glassfish.jersey.core:jersey-common:jar:2.19:compile
[INFO]    |  +- (javax.ws.rs:javax.ws.rs-api:jar:2.0.1:compile - omitted for duplicate)
[INFO]    |  +- javax.annotation:javax.annotation-api:jar:1.2:compile
[INFO]    |  +- org.glassfish.jersey.bundles.repackaged:jersey-guava:jar:2.19:compile
[INFO]    |  +- org.glassfish.hk2:hk2-api:jar:2.4.0-b25:compile
[INFO]    |  |  +- org.glassfish.hk2:hk2-utils:jar:2.4.0-b25:compile
[INFO]    |  |  \- org.glassfish.hk2.external:aopalliance-repackaged:jar:2.4.0-b25:compile
[INFO]    |  +- (org.glassfish.hk2.external:javax.inject:jar:2.4.0-b25:compile - omitted for duplicate)
[INFO]    |  +- org.glassfish.hk2:hk2-locator:jar:2.4.0-b25:compile
[INFO]    |  |  +- (org.glassfish.hk2.external:javax.inject:jar:2.4.0-b25:compile - omitted for duplicate)
[INFO]    |  |  +- (org.glassfish.hk2.external:aopalliance-repackaged:jar:2.4.0-b25:compile - omitted for duplicate)
[INFO]    |  |  +- (org.glassfish.hk2:hk2-api:jar:2.4.0-b25:compile - omitted for duplicate)
[INFO]    |  |  +- (org.glassfish.hk2:hk2-utils:jar:2.4.0-b25:compile - omitted for duplicate)
[INFO]    |  |  \- org.javassist:javassist:jar:3.18.1-GA:compile
[INFO]    |  \- org.glassfish.hk2:osgi-resource-locator:jar:1.0.1:compile
[INFO]    +- org.glassfish.jersey.core:jersey-server:jar:2.19:compile
[INFO]    |  +- (org.glassfish.jersey.core:jersey-common:jar:2.19:compile - omitted for duplicate)
[INFO]    |  +- org.glassfish.jersey.core:jersey-client:jar:2.19:compile
[INFO]    |  |  +- (javax.ws.rs:javax.ws.rs-api:jar:2.0.1:compile - omitted for duplicate)
[INFO]    |  |  +- (org.glassfish.jersey.core:jersey-common:jar:2.19:compile - omitted for duplicate)
[INFO]    |  |  +- (org.glassfish.hk2:hk2-api:jar:2.4.0-b25:compile - omitted for duplicate)
[INFO]    |  |  +- (org.glassfish.hk2.external:javax.inject:jar:2.4.0-b25:compile - omitted for duplicate)
[INFO]    |  |  \- (org.glassfish.hk2:hk2-locator:jar:2.4.0-b25:compile - omitted for duplicate)
[INFO]    |  +- (javax.ws.rs:javax.ws.rs-api:jar:2.0.1:compile - omitted for duplicate)
[INFO]    |  +- org.glassfish.jersey.media:jersey-media-jaxb:jar:2.19:compile
[INFO]    |  |  +- (org.glassfish.jersey.core:jersey-common:jar:2.19:compile - omitted for duplicate)
[INFO]    |  |  +- (org.glassfish.hk2:hk2-api:jar:2.4.0-b25:compile - omitted for duplicate)
[INFO]    |  |  +- (org.glassfish.hk2.external:javax.inject:jar:2.4.0-b25:compile - omitted for duplicate)
[INFO]    |  |  +- (org.glassfish.hk2:hk2-locator:jar:2.4.0-b25:compile - omitted for duplicate)
[INFO]    |  |  \- (org.glassfish.hk2:osgi-resource-locator:jar:1.0.1:compile - omitted for duplicate)
[INFO]    |  +- (javax.annotation:javax.annotation-api:jar:1.2:compile - omitted for duplicate)
[INFO]    |  +- (org.glassfish.hk2:hk2-api:jar:2.4.0-b25:compile - omitted for duplicate)
[INFO]    |  +- (org.glassfish.hk2.external:javax.inject:jar:2.4.0-b25:compile - omitted for duplicate)
[INFO]    |  +- (org.glassfish.hk2:hk2-locator:jar:2.4.0-b25:compile - omitted for duplicate)
[INFO]    |  \- javax.validation:validation-api:jar:1.1.0.Final:compile
[INFO]    \- javax.ws.rs:javax.ws.rs-api:jar:2.0.1:compile

However, both org.glassfish.hk2:hk2-api:2.4.0-b25 and org.glassfish.hk2:hk2-utils:2.4.0-b25 have a direct dependency on javax.inject:javex.inject, but javax.inject:javex.injectdidn't show in the output dependency tree. Dependency section in the two pom.xml looks like:

...
<dependency>
<groupId>javax.inject</groupId>
<artifactId>javax.inject</artifactId>
</dependency>
...

To validate whether javax.inject:javax.inject was an real dependency in the tree, I removed the /home/${user}/.m2/javax/inject folder in case , and ran mvn dependency:tree -Dverbose again, and I found it indeed has downloaded javax.inject:javax.inject:1 again, here is the log.

[INFO] Building fake_id 1.0.0
[INFO] ------------------------------------------------------------------------
Downloading: https://repo.maven.apache.org/maven2/javax/inject/javax.inject/1/javax.inject-1.pom
Downloaded: https://repo.maven.apache.org/maven2/javax/inject/javax.inject/1/javax.inject-1.pom (612 B at 0.5 KB/sec)
[INFO] 
[INFO] --- maven-dependency-plugin:2.8:tree (default-cli) @ fake_id ---
[INFO] fake_id:fake_id:jar:1.0.0
[INFO] \- org.glassfish.jersey.containers:jersey-container-servlet:jar:2.19:compile
[INFO]    +- org.glassfish.jersey.containers:jersey-container-servlet-core:jar:2.19:compile
[INFO]    |  +- org.glassfish.hk2.external:javax.inject:jar:2.4.0-b25:compile
[INFO]    |  +- (org.glassfish.jersey.core:jersey-common:jar:2.19:compile - omitted for duplicate)
[INFO]    |  +- (org.glassfish.jersey.core:jersey-server:jar:2.19:compile - omitted for duplicate)
[INFO]    |  \- (javax.ws.rs:javax.ws.rs-api:jar:2.0.1:compile - omitted for duplicate)
[INFO]    +- org.glassfish.jersey.core:jersey-common:jar:2.19:compile
[INFO]    |  +- (javax.ws.rs:javax.ws.rs-api:jar:2.0.1:compile - omitted for duplicate)
[INFO]    |  +- javax.annotation:javax.annotation-api:jar:1.2:compile
[INFO]    |  +- org.glassfish.jersey.bundles.repackaged:jersey-guava:jar:2.19:compile
[INFO]    |  +- org.glassfish.hk2:hk2-api:jar:2.4.0-b25:compile
[INFO]    |  |  +- org.glassfish.hk2:hk2-utils:jar:2.4.0-b25:compile
[INFO]    |  |  \- org.glassfish.hk2.external:aopalliance-repackaged:jar:2.4.0-b25:compile
[INFO]    |  +- (org.glassfish.hk2.external:javax.inject:jar:2.4.0-b25:compile - omitted for duplicate)
[INFO]    |  +- org.glassfish.hk2:hk2-locator:jar:2.4.0-b25:compile
[INFO]    |  |  +- (org.glassfish.hk2.external:javax.inject:jar:2.4.0-b25:compile - omitted for duplicate)
[INFO]    |  |  +- (org.glassfish.hk2.external:aopalliance-repackaged:jar:2.4.0-b25:compile - omitted for duplicate)
[INFO]    |  |  +- (org.glassfish.hk2:hk2-api:jar:2.4.0-b25:compile - omitted for duplicate)
[INFO]    |  |  +- (org.glassfish.hk2:hk2-utils:jar:2.4.0-b25:compile - omitted for duplicate)
[INFO]    |  |  \- org.javassist:javassist:jar:3.18.1-GA:compile
[INFO]    |  \- org.glassfish.hk2:osgi-resource-locator:jar:1.0.1:compile
[INFO]    +- org.glassfish.jersey.core:jersey-server:jar:2.19:compile
[INFO]    |  +- (org.glassfish.jersey.core:jersey-common:jar:2.19:compile - omitted for duplicate)
[INFO]    |  +- org.glassfish.jersey.core:jersey-client:jar:2.19:compile
[INFO]    |  |  +- (javax.ws.rs:javax.ws.rs-api:jar:2.0.1:compile - omitted for duplicate)
[INFO]    |  |  +- (org.glassfish.jersey.core:jersey-common:jar:2.19:compile - omitted for duplicate)
[INFO]    |  |  +- (org.glassfish.hk2:hk2-api:jar:2.4.0-b25:compile - omitted for duplicate)
[INFO]    |  |  +- (org.glassfish.hk2.external:javax.inject:jar:2.4.0-b25:compile - omitted for duplicate)
[INFO]    |  |  \- (org.glassfish.hk2:hk2-locator:jar:2.4.0-b25:compile - omitted for duplicate)
[INFO]    |  +- (javax.ws.rs:javax.ws.rs-api:jar:2.0.1:compile - omitted for duplicate)
[INFO]    |  +- org.glassfish.jersey.media:jersey-media-jaxb:jar:2.19:compile
[INFO]    |  |  +- (org.glassfish.jersey.core:jersey-common:jar:2.19:compile - omitted for duplicate)
[INFO]    |  |  +- (org.glassfish.hk2:hk2-api:jar:2.4.0-b25:compile - omitted for duplicate)
[INFO]    |  |  +- (org.glassfish.hk2.external:javax.inject:jar:2.4.0-b25:compile - omitted for duplicate)
[INFO]    |  |  +- (org.glassfish.hk2:hk2-locator:jar:2.4.0-b25:compile - omitted for duplicate)
[INFO]    |  |  \- (org.glassfish.hk2:osgi-resource-locator:jar:1.0.1:compile - omitted for duplicate)
[INFO]    |  +- (javax.annotation:javax.annotation-api:jar:1.2:compile - omitted for duplicate)
[INFO]    |  +- (org.glassfish.hk2:hk2-api:jar:2.4.0-b25:compile - omitted for duplicate)
[INFO]    |  +- (org.glassfish.hk2.external:javax.inject:jar:2.4.0-b25:compile - omitted for duplicate)
[INFO]    |  +- (org.glassfish.hk2:hk2-locator:jar:2.4.0-b25:compile - omitted for duplicate)
[INFO]    |  \- javax.validation:validation-api:jar:1.1.0.Final:compile
[INFO]    \- javax.ws.rs:javax.ws.rs-api:jar:2.0.1:compile
[INFO] ------------------------------------------------------------------------
[INFO] BUILD SUCCESS
[INFO] ------------------------------------------------------------------------
[INFO] Total time: 2.439 s
[INFO] Finished at: 2020-03-17T14:58:44+08:00
[INFO] Final Memory: 20M/596M

As far as I have explored, I didn't find any other constraints on javax.inject:javax.inject (such as exclusion, option, etc.). So I what I want to ask is why javax.inject:javax.inject are ignored by mvn dependency:tree, and is this any solution that I can get this package in dependency tree?

Thanks for your time and kind reply!

To make up the result without -Dverbose:

[INFO] Building fake_id 1.0.0
[INFO] ------------------------------------------------------------------------
Downloading: https://repo.maven.apache.org/maven2/javax/inject/javax.inject/1/javax.inject-1.pom
Downloaded: https://repo.maven.apache.org/maven2/javax/inject/javax.inject/1/javax.inject-1.pom (612 B at 0.5 KB/sec)
[INFO] 
[INFO] --- maven-dependency-plugin:2.8:tree (default-cli) @ fake_id ---
[INFO] fake_id:fake_id:jar:1.0.0
[INFO] \- org.glassfish.jersey.containers:jersey-container-servlet:jar:2.19:compile
[INFO]    +- org.glassfish.jersey.containers:jersey-container-servlet-core:jar:2.19:compile
[INFO]    |  \- org.glassfish.hk2.external:javax.inject:jar:2.4.0-b25:compile
[INFO]    +- org.glassfish.jersey.core:jersey-common:jar:2.19:compile
[INFO]    |  +- javax.annotation:javax.annotation-api:jar:1.2:compile
[INFO]    |  +- org.glassfish.jersey.bundles.repackaged:jersey-guava:jar:2.19:compile
[INFO]    |  +- org.glassfish.hk2:hk2-api:jar:2.4.0-b25:compile
[INFO]    |  |  +- org.glassfish.hk2:hk2-utils:jar:2.4.0-b25:compile
[INFO]    |  |  \- org.glassfish.hk2.external:aopalliance-repackaged:jar:2.4.0-b25:compile
[INFO]    |  +- org.glassfish.hk2:hk2-locator:jar:2.4.0-b25:compile
[INFO]    |  |  \- org.javassist:javassist:jar:3.18.1-GA:compile
[INFO]    |  \- org.glassfish.hk2:osgi-resource-locator:jar:1.0.1:compile
[INFO]    +- org.glassfish.jersey.core:jersey-server:jar:2.19:compile
[INFO]    |  +- org.glassfish.jersey.core:jersey-client:jar:2.19:compile
[INFO]    |  +- org.glassfish.jersey.media:jersey-media-jaxb:jar:2.19:compile
[INFO]    |  \- javax.validation:validation-api:jar:1.1.0.Final:compile
[INFO]    \- javax.ws.rs:javax.ws.rs-api:jar:2.0.1:compile
[INFO] ------------------------------------------------------------------------
[INFO] BUILD SUCCESS
[INFO] ------------------------------------------------------------------------

score 0 · Answer 1 · answered Mar 17 '20 at 07:43

0

The description of the verbose option says (https://maven.apache.org/plugins/maven-dependency-plugin/tree-mojo.html):

Whether to include omitted nodes in the serialized dependency tree. Notice this feature actually uses Maven 2 algorithm and may give wrong results when used with Maven 3

answered Mar 17 '20 at 07:43

J Fabian Meier

33,516
10
64
142

Thanks for your kind reply! But even if I removed `-Dverbose`, I still get the same result. I think the problem is not about `verbose`, what I mean is that the tree calculated out by `mvn dependency:tree` has missed or ignored some packages in transitive dependencies. – Victor Liu Mar 17 '20 at 07:53
Then please edit the question and add the results you get when _not_ using verbose. – J Fabian Meier Mar 17 '20 at 07:55
Thanks for your time and kind remind, already add the results without `-Dverbose`. – Victor Liu Mar 17 '20 at 08:06

Maven dependency:tree doesn't show all transitive dependencies

1 Answers1