Import Dependency Management with Exclusion

Question

I have a beautiful BOM with a lot of dependencies in its dependencyManagement section and I would like to create another BOM that imports all that dependencies except one. I tried doing this:

... in my dependencyManagement section
<dependency>
    <groupId>org.springframework.boot</groupId>
    <artifactId>spring-boot-dependencies</artifactId>
    <version>${spring-boot-version}</version>
    <type>pom</type>
    <scope>import</scope>

    <exclusions>
        <exclusion>
        <groupId>com.google.code.gson</groupId>
        <artifactId>gson</artifactId>
        </exclusion>
    </exclusions>
</dependency>
...

The POM is formally correct and everything compiles. But the exclusion is simply ignored. What am I missing? Is this approach correct?

I'm using Maven 3+.

You may need to provide the whole pom.xml, at the least the DependencyManagement and Dependencies sections — alexbt, Sep 01 '16 at 21:15
Also, type this "mvn dependency:tree -Dverbose -Dincludes=com.google.code.gson:gson" to show us where the dependency is really comming from — alexbt, Sep 02 '16 at 01:06
With [Maven 3.4.0 this will be supported](https://issues.apache.org/jira/browse/MNG-5600) but unfortaneltey currently not. — khmarbaise, Sep 02 '16 at 06:02
Still not in Maven 3.5.2 Release as on date, this should be in the next maven version as the patch for this: https://issues.apache.org/jira/browse/MNG-5600 has been pulled into master — Deepak, Mar 01 '18 at 09:16
Some recent activity https://github.com/apache/maven/pull/295, fingers crossed it will land in Maven 3.7! — levant pied, Jan 03 '20 at 22:32
@khmarbaise Maven 3.4.0 has been a long time - what happened? — Lonzak, Apr 17 '23 at 15:03
@Lonzak Take a look here: https://maven.apache.org/docs/history.html — khmarbaise, Apr 17 '23 at 15:13
@khmarbaise Sure maven version 3.4.0 was skipped. But then MNG-5600 could have been in 3.5, 3.6, 3.8 or 3.9 but unfortunately it isn't. — Lonzak, Apr 18 '23 at 07:02

score 24 · Accepted Answer · answered Dec 14 '17 at 20:48

24

Exclusion at import won't work, try excluding it from the actual user of the dependency

answered Dec 14 '17 at 20:48

Filmon Gebreyesus

422
5
9

I am facing the same issue. My maven version is 3.5.2. Just wanted to check is this feature added in maven in their latest version, so that i can exclude the dependency. – Sam Nov 09 '18 at 05:17
1

I misunderstood this, so for anyone reading, exclusions do work inside the dependencies declared at dependencyManagement tag, as long as they are not of the import (which only works with pom) – BugsOverflow Apr 24 '23 at 06:12

neilireson · Answer 2 · 2023-05-22T20:55:28.673

Exclusions are still not implemented for dependencyManagement import as of current maven 3.9.2. However you can include a project specific "Bill Of Materials" (BOM) as the first dependency in the dependencyManagement section, i.e.

<dependencyManagement>
    <dependencies>
        <dependency>
            <groupId>my-group</groupId>
            <artifactId>my-group-project-bom</artifactId>
            <version>${project.version}</version>
            <type>pom</type>
            <scope>import</scope>
        </dependency>

        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-dependencies</artifactId>
            <version>${spring-boot.version}</version>
            <type>pom</type>
            <scope>import</scope>
        </dependency>
    </dependencies>
</dependencyManagement>

You can then specify all the necessary artifact versions in your project BOM which will take precedence over the spring-boot dependency versions.

exclusions inside dependencyManagement do work, as long as they are not of scope import — BugsOverflow, Apr 24 '23 at 06:14

Import Dependency Management with Exclusion

2 Answers2

Linked