275

dependency:tree can be used to see the dependency tree for a given project. But what I need is to see the dependency tree for a 3rd party artifact.

I guess I can create an empty project, but I'm looking for something easier (I need to do this for several artifacts).

Lii
  • 11,553
  • 8
  • 64
  • 88
IttayD
  • 28,271
  • 28
  • 124
  • 178
  • If you happen to need to do this *programmatically* from within *a plugin* (not exactly the *hierarchy* but the full *collection* of transitive dependencies - honoring dependencyManagement, exclusions etc), [check this approach](https://stackoverflow.com/questions/13200497/how-to-programmatically-list-all-transitive-dependencies-including-overridden-o#70823705) – Janaka Bandara Jan 23 '22 at 16:10

9 Answers9

382

1) Use maven dependency plugin

Create a simple project with pom.xml only. Add your dependency and run:

mvn dependency:tree

(Version for multi-module Maven project: mvn compile dependency:tree )

Unfortunately dependency mojo must use pom.xml or you get following error:

Cannot execute mojo: tree. It requires a project with an existing pom.xml, but the build is not using one.

2) Find pom.xml of your artifact in maven central repository

Dependencies are described In pom.xml of your artifact. Find it using maven infrastructure.

Go to https://search.maven.org/ and enter your groupId and artifactId.

Or you can go to https://repo1.maven.org/maven2/ and navigate first using plugins groupId, later using artifactId and finally using its version.

For example see org.springframework:spring-core

3) Use maven dependency plugin against your artifact

Part of dependency artifact is a pom.xml. That specifies it's dependency. And you can execute mvn dependency:tree on this pom.

BuZZ-dEE
  • 6,075
  • 12
  • 66
  • 96
amra
  • 16,125
  • 7
  • 50
  • 47
  • 6
    Like I said, I want to avoid the need to create a project – IttayD Jul 27 '10 at 20:13
  • 1
    you're not 'creating' a project, you're just downloading a POM file. – Sean Patrick Floyd Jul 27 '10 at 20:18
  • 2
    You don't have to create a new project. Just take a look into your local repository and find the atifact's pom.xml – amra Jul 27 '10 at 21:11
  • This does not work if the child module does not exist. e.g. ``` mvn -f ~/.m2/repository/org/jboss/shrinkwrap/descriptors/shrinkwrap-descriptors-parent/2.0.0-alpha-10/shrinkwrap-descriptors-parent-2.0.0-alpha-10.pom depen dency:tree [INFO] Scanning for projects... [ERROR] [ERROR] Some problems were encountered while processing the POMs: [ERROR] Child module ~/.m2/repository/org/jboss/shrinkwrap/descriptors/shrinkwrap-descriptors-parent/2.0.0-alpha-10/api-base of .../descriptors-parent/2.0.0-alpha-10/shrinkwrap-descriptors-parent-2.0.0-alpha-10.pom does not exist ``` – Ding-Yi Chen Nov 21 '16 at 00:24
  • Try to edit the particular pom file and temporary comment the missing submodule. – amra Nov 22 '16 at 22:23
  • Also to copy to a particular folder $ mvn dependency:copy-dependencies -DoutputDirectory=OUTPUT_DIR – absin Jul 18 '17 at 21:39
  • 1
    For multi-module Maven project (i.e. project with several `pom.xml` files) you might get error. Try `mvn compile dependency:tree` then. – izogfif Mar 13 '19 at 08:54
98

If you bother creating a sample project and adding your 3rd party dependency to that, then you can run the following in order to see the full hierarchy of the dependencies.

You can search for a specific artifact using this maven command:

mvn dependency:tree -Dverbose -Dincludes=[groupId]:[artifactId]:[type]:[version]

According to the documentation:

where each pattern segment is optional and supports full and partial * wildcards. An empty pattern segment is treated as an implicit wildcard.

Imagine you are trying to find 'log4j-1.2-api' jar file among different modules of your project:

mvn dependency:tree -Dverbose -Dincludes=org.apache.logging.log4j:log4j-1.2-api

more information can be found here.

Edit: The verbose flag has been reintroduced in version 3.2.0. You can use the specific version as below:

mvn org.apache.maven.plugins:maven-dependency-plugin:3.2.0:tree -Dverbose=true 
Kayvan Tehrani
  • 3,070
  • 2
  • 32
  • 46
  • 5
    Great suggestion! `-Dverbose` was enough to show me the full tree I needed. Piping the output to `less` or similar and doing a quick search works great if you can't remember the `includes` flag or don't want to provide the full or wildcarded `groupId` :) – jocull Jun 29 '18 at 13:11
  • 1
    This isn't working without a pom.xml present that contains the artefact you are looking at. Otherwise you get `[ERROR] Failed to execute goal org.apache.maven.plugins:maven-dependency-plugin:2.8:tree (default-cli): Goal requires a project to execute but there is no POM in this directory (...). Please verify you invoked Maven from the correct directory. -> [Help 1]` – Eisenknurr Apr 10 '19 at 07:01
  • 5
    -Dverbose has been deprecated in the dependency plugin, so this does not work anymore unless you're using a pretty old version. – toolforger Jan 21 '20 at 07:48
  • Thanks. Very nice answer. Does `org.apache.logging.log4j:log4j-1.2-api:jar:2.17.1` in the result mean log4j version 1 or 2? – mercury Mar 18 '22 at 06:39
  • @mercury This is Log4j 1.x Compatibility API. This bridge allows applications coded to use Log4j 1.2 API to use Log4j 2 instead. – Kayvan Tehrani Mar 19 '22 at 14:10
  • @toolforger Can you please share the latest option for -Dverbose? – Prashanth Debbadwar Apr 06 '22 at 13:03
  • 1
    @PrashanthDebbadwar unfortunately, the option was simply removed without a replacement. You'll have to go into the dependency:tree documentation to find out if it has been reintroduced in some form since 2020, I don't have the time to check. – toolforger Apr 07 '22 at 07:11
20

The solution is to call dependency:tree with the artifact's pom.xml file:

mvn -f "$HOME/.m2/repository/$POM_PATH" dependency:tree

See also How to list the transitive dependencies of an artifact from a repository?

Community
  • 1
  • 1
Matthias M
  • 12,906
  • 17
  • 87
  • 116
  • This might not work with artifacts downloaded from a central repository, because of 'distributionManagement.status'. It is added by the central repository on upload. And this will make dependency:tree fail validation on the pom file. See https://issues.apache.org/jira/browse/MNG-3178 – Arnaud Jeansen Sep 07 '17 at 13:03
15

If anyone using IntelliJ wants to see dependency tree directly in IDE then they can install Maven Helper Plugin plugin.

Once installed open pom.xml and you would able to see Dependency Analyze tab like below. It also provides option to see dependency that is conflicted only and also as a tree structure.

enter image description here

desertnaut
  • 57,590
  • 26
  • 140
  • 166
rns
  • 1,047
  • 10
  • 25
6

The for-artifact goal of the depgraph-maven-plugin should do what you want. To get a dependency graph of org.jboss.ws:jbossws-common-tools:1.3.2.Final you simply do

mvn com.github.ferstl:depgraph-maven-plugin:3.3.0:for-artifact -DgroupId=org.jboss.ws -DartifactId=jbossws-common-tools -Dversion=1.3.2.Final -DgraphFormat=text -DshowGroupIds=true -DshowVersions=true

and you get

org.jboss.ws:jbossws-common-tools:1.3.2.Final:compile
+- org.jboss.ws:jbossws-api:1.1.2.Final:compile
+- org.apache.ant:ant:1.7.1:provided
|  \- org.apache.ant:ant-launcher:1.7.1:provided
+- gnu.getopt:java-getopt:1.0.13:provided
+- log4j:log4j:1.2.14:provided
\- junit:junit:3.8.2:test

without the need to create a Maven project or use and IDE or online app.

Philippe Marschall
  • 4,452
  • 1
  • 34
  • 52
5

If you use a current version of m2eclipse (which you should if you use eclipse and maven):

Select the menu entry

Navigate -> Open Maven POM

and enter the artifact you are looking for.

The pom will open in the pom editor, from which you can select the tab Dependency Hierarchy to view the dependency hierarchy (as the name suggests :-) )

Sean Patrick Floyd
  • 292,901
  • 67
  • 465
  • 588
5

When using IntelliJ, you have a one-click tool for Maven dependency exploration: https://www.jetbrains.com/help/idea/work-with-maven-dependencies.html

Results: enter image description here

Vaiden
  • 15,728
  • 7
  • 61
  • 91
2

You can filter a specific artifact using the -Dincludes flag:

mvn dependency:tree -Dincludes=<artifact>

You can find more information here

Azhwani
  • 79
  • 1
  • 3
  • 7
1

If your artifact is not a dependency of a given project, your best bet is to use a repository search engine. Many of them describes the dependencies of a given artifact.

Community
  • 1
  • 1
Pascal Thivent
  • 562,542
  • 136
  • 1,062
  • 1,124