0

I have a spring boot project (2.1.3) in which I had to add a jar file supplied by one of our partners (Referred with com.aesenc group id). I added it as a system scoped dependency even though it is against the recommendation as this repo already had other system scoped dependencies (will address this in future). This broke one of the API calls due to a transitive dependency in the parnter-supplied jar (commons-codec). Spring boot started using this commons-codec instead of the one that came with the spring bom. To resolve the issue I added exclusion to the system scoped dependency

<dependency>
   <groupId>aesenc.group</groupId>
   <artifactId>com.aesenc</artifactId>
   <version>1.0</version>
   <scope>system</scope>
   <exclusions>
      <exclusion>  <!-- declare the exclusion here -->
         <groupId>commons-codec</groupId>
         <artifactId>commons-codec</artifactId>
      </exclusion>
   </exclusions>
   <systemPath>${basedir}/src/main/resources/libs/AESEnc/AESEnc.jar</systemPath>
</dependency>

This didn't solve the issue. So after going through the maven documentation I added commons-codec updated version as a dependency in the current project to make it an immediate child in the dependency graph

<dependency>
   <groupId>commons-codec</groupId>
   <artifactId>commons-codec</artifactId>
   <version>1.15</version>
</dependency>

This alone also didn't solve the issue. But by moving it above the com.aesenc in the pom file the issue got resolved. So I'm confused about my understanding of how dependency resolution is happening in Maven.

This didn't work:

My project +
           |
           +-aesenc-+
           |        |
           |        +commons-codec-v1.10
           |
           +commons-codec-v1.15

My assumption is that this is how the dependency tree is and just by adding v1.15 as a dependency would have solved the issue irrespective of the ordering of it in pom.

This worked:

My project +
           |
           +commons-codec-v1.15
           |
           +-aesenc-+
                    |
                    +commons-codec-v1.10

Would like to know where my assumptions have gone wrong.

user11666461
  • 761
  • 7
  • 12
  • I don't think it is worth the effort to try to "fix" this while using system scope dependencies. First, remove the system scope dependencies, then try to make it work. – J Fabian Meier Jan 28 '21 at 11:53
  • [System scope dependencies are deprecated](https://maven.apache.org/guides/introduction/introduction-to-dependency-mechanism.html#System_Dependencies) second system scope dependencies can not have transitive dependencies neither you can exclude things. First I strongly recommend to remove system scoped dependencies and put them into a repository manager and consume them from there. If you create appropriate pom files for them you can use exclusion etc. The resolving of dependencies is done based on the strategy nearest wins... – khmarbaise Jan 29 '21 at 07:59

0 Answers0