maven dependency without version

Question

Recently I've been working on some improvements in a project developed some time ago, and here's what I found. A lot of dependencies in the pom files go without versions specified, and yet they are resolved. The project consists of 1 root module and 2 submodules. The Aggregator pattern is used, meaning there's no dependencyManagement section at all. The upper-project simply aggregates 2 modules and that's all it does. Subprojects don't refer to it as to a parent. They have a different parent. What I can't grasp is that neither subprojects themselves nor their parent(as a matter of fact, it doesn't have dependencyManagement either) specify versions for some of the dependencies. For instance:

<dependency>
    <groupId>javax.mail</groupId>
    <artifactId>javax.mail-api</artifactId>
</dependency>
<dependency>
    <groupId>com.sun.mail</groupId>
    <artifactId>javax.mail</artifactId>
</dependency>
<dependency>
    <groupId>com.sun.mail</groupId>
    <artifactId>imap</artifactId>
</dependency>
<dependency>
    <groupId>org.slf4j</groupId>
    <artifactId>jcl-over-slf4j</artifactId>
</dependency>
<dependency>
    <groupId>org.slf4j</groupId>
    <artifactId>jul-to-slf4j</artifactId>
</dependency>
<dependency>
    <groupId>ch.qos.logback</groupId>
    <artifactId>logback-classic</artifactId>
</dependency>

Can someone help me figure this out? Is maven handling versioning with some default strategy? What is that default strategy?

It is impossible for maven to work without defining versions of the artifacts. They should be defined somewhere in `dependencyManagement` tag either in the submodule or parent. Please check your pom hierarchy. Use mvn help:effective-pom — Ozgen, Apr 06 '15 at 17:47
Have you checked via `mvn help:effective-pom -Doutput=result.xml` and check if there is no dependencyManagement. — khmarbaise, Apr 06 '15 at 17:48
Could they be transitively referenced from somewhere? Would be the worst case, because you would not have any clue about your versions. — sschrass, Apr 06 '15 at 17:55

score 61 · Accepted Answer · edited Jan 25 '19 at 15:27

Ok, I think I'm gonna answer it myself. Of course I took a look at dependency:tree, but all the dependencies that I mentioned were first-level members of the tree. What I failed to notice right away, is that dependencyManagement is not present in the parent, but it is however present in the submodules, and what is more interesting it contains:

        <dependency>
            <groupId>io.spring.platform</groupId>
            <artifactId>platform-bom</artifactId>
            <version>1.0.2.RELEASE</version>
            <type>pom</type>
            <scope>import</scope>
        </dependency>

I've never used Spring IO Platform before, so this is a totally new concept for me. As it turns out the platform includes quite a few preconfigured dependencies: http://docs.spring.io/platform/docs/current/reference/htmlsingle/#appendix-dependency-versions

This is not Spring related but the maven BOM "bill of Materials" pattern, which is used to define dependencies required for using some library. See [Maven dependency Mechanism](https://maven.apache.org/guides/introduction/introduction-to-dependency-mechanism.html) — estani, Dec 02 '16 at 12:06

score 35 · Answer 2 · answered Apr 06 '15 at 17:55

35

It is impossible for maven to work without defining versions of the artifacts. They should be defined somewhere in dependencyManagement tag either in the submodule or parent. Please check your pom hierarchy. Use mvn help:effective-pom in the submodule directory of the project. Also you can use mvn dependency:tree in order to find out which artifacts - along with full artifact information including version numbers - are resolved in the result of dependency management.

answered Apr 06 '15 at 17:55

Ozgen

1,072
10
19

7

Is it possible for maven to pull automatically the latest version? – Rishabh Agarwal Nov 01 '19 at 15:35
4

What do you mean by "impossible"? Is an error reported? Is the artifact silently excluded? – Alan Snyder Sep 22 '20 at 16:08

score 11 · Answer 3 · answered Nov 06 '19 at 08:19

11

Use

mvn -P<my_profile_of_interest> help:effective-pom -Dverbose

Verbose mode (Since: 3.2.0) adds XML comments containing precise reference to a place where dependency declaration is coming from.

answered Nov 06 '19 at 08:19

radzimir

1,178
13
10

score 8 · Answer 4 · answered Sep 02 '20 at 22:39

Each maven dependency defined in the pom must have a version either directly or indirectly for example, through dependencyManagement or parent. That being said, if the version is not given, then the version provided in the dependencyManagement or the parent pom will be used.

For example: in the pom (only important sections are mentioned) given below, no version is provided for the artifact jstl. However, in the "mvn dependency:tree", it shows that jstl version 1.2 is included. And looking at the spring-boot-starter-parent, for the version 2.3.3.RELEASE pom, it includes jstl version 1.2.

<parent>
    <groupId>org.springframework.boot</groupId>
    <artifactId>spring-boot-starter-parent</artifactId>
    <version>1.3.3.RELEASE</version>
</parent>

<dependencies>
   ....
   <dependency>
       <groupId>javax.servlet</groupId>
       <artifactId>jstl</artifactId>
   </dependency>
   ....
</dependencies>

And if there is no dependency management, what happens then? — Alan Snyder, Sep 22 '20 at 16:09

score 1 · Answer 5 · answered Feb 26 '22 at 07:31

In my case if i was using Spring boot starter parent to manage all dependency and lombok version is managed by Spring boot , This problem was coming due to higher java version JAVA 11 . I exported JAVA 8 in to my compile time environment and after using JAVA 8 this problem was gone.

maven dependency without version

5 Answers5

Linked