How to override the version numbers from Spring Boot when importing a BOM pom?

Question

How do I override the version numbers being imported by Spring Boot, without manually setting each artifact in the dependency management section?

<properties>
    <spring.boot.version>1.5.7.RELEASE</spring.boot.version>
    <jackson.version>2.9.1</jackson.version>
</properties>
<dependencyManagement>
    <dependencies>
        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-dependencies</artifactId>
            <version>${spring.boot.version}</version>
            <type>pom</type>
            <scope>import</scope>
        </dependency>
        <dependency>
            <groupId>com.fasterxml.jackson</groupId>
            <artifactId>jackson-bom</artifactId>
            <version>${jackson.version}</version>
            <type>pom</type>
            <scope>import</scope>
        </dependency>
    </dependencies>
</dependencyManagement>

However, when I run

mvn dependency:tree "-Dincludes=com.fasterxml.jackson.*" -Dverbose

the output

[INFO] ------------------------------------------------------------------------
[INFO] Building dpt-domain-core 1.0.0
[INFO] ------------------------------------------------------------------------
[INFO]
[INFO] --- maven-dependency-plugin:2.8:tree (default-cli) @ dpt-domain-core ---
[INFO] net.initech.dpt:dpt-domain-core:jar:1.0.0
[INFO] +- com.fasterxml.jackson.core:jackson-annotations:jar:2.8.0:compile
[INFO] +- com.fasterxml.jackson.core:jackson-core:jar:2.8.10:compile
[INFO] +- com.fasterxml.jackson.core:jackson-databind:jar:2.8.10:compile
[INFO] |  +- (com.fasterxml.jackson.core:jackson-annotations:jar:2.8.0:compile - omitted for duplicate)
[INFO] |  \- (com.fasterxml.jackson.core:jackson-core:jar:2.8.10:compile - omitted for duplicate)
[INFO] \- com.fasterxml.jackson.datatype:jackson-datatype-jsr310:jar:2.8.10:compile
[INFO]    +- (com.fasterxml.jackson.core:jackson-annotations:jar:2.8.0:compile - omitted for duplicate)
[INFO]    +- (com.fasterxml.jackson.core:jackson-core:jar:2.8.10:compile - omitted for duplicate)
[INFO]    \- (com.fasterxml.jackson.core:jackson-databind:jar:2.8.10:compile - omitted for duplicate)

Where 2.8.10 is the value of jackson.version that org.springframework.boot:spring-boot-dependencies:1.5.7.RELEASE:pom defines.

However, if I explicitly add

<dependency>
    <groupId>com.fasterxml.jackson.core</groupId>
    <artifactId>jackson-core</artifactId>
    <version>${jackson.version}</version>
</dependency>
<dependency>
    <groupId>com.fasterxml.jackson.core</groupId>
    <artifactId>jackson-databind</artifactId>
    <version>${jackson.version}</version>
</dependency>
<dependency>
    <groupId>com.fasterxml.jackson.datatype</groupId>
    <artifactId>jackson-datatype-jsr310</artifactId>
    <version>${jackson.version}</version>
</dependency>
<dependency>
    <groupId>com.fasterxml.jackson.core</groupId>
    <artifactId>jackson-annotations</artifactId>
    <version>${jackson.version}</version>
</dependency>

to my dependency management section, then it resolves correctly to:

[INFO] ------------------------------------------------------------------------
[INFO] Building dpt-domain-core 1.0.0
[INFO] ------------------------------------------------------------------------
[INFO]
[INFO] --- maven-dependency-plugin:2.8:tree (default-cli) @ dpt-domain-core ---
[INFO] org.autodatacorp.dpt:dpt-domain-core:jar:1.0.0
[INFO] +- com.fasterxml.jackson.core:jackson-annotations:jar:2.9.1:compile
[INFO] +- com.fasterxml.jackson.core:jackson-core:jar:2.9.1:compile
[INFO] +- com.fasterxml.jackson.core:jackson-databind:jar:2.9.1:compile
[INFO] \- com.fasterxml.jackson.datatype:jackson-datatype-jsr310:jar:2.9.1:compile
[INFO] ------------------------------------------------------------------------

Which is perplexing, since that seems like it should be the equivalent of doing an import of com.fasterxml.jackson:jackson-bom:2.9.1:pom should be the equivalent of pasting the contents of that code into manually.

I even tried

<dependency>                                                                                  
    <groupId>org.springframework.boot</groupId>                                               
    <artifactId>spring-boot-dependencies</artifactId>                                         
    <version>${spring.boot.version}</version>                                                 
    <exclusions>                                                                              
        <exclusion>                                                                           
            <groupId>com.fasterxml.jackson</groupId>                                          
            <artifactId>jackson-bom</artifactId>                                              
        </exclusion>                                                                          
    </exclusions>                                                                             
    <type>pom</type>                                                                          
    <scope>import</scope>                                                                     
</dependency>

but with no effect.

PS - incase it matters, the Maven I am using is:

Apache Maven 3.3.9 (bb52d8502b132ec0a5a3f4c09453c07478323dc5; 2015-11-10T11:41:47-05:00)
Java version: 9, vendor: Oracle Corporation

If you want to override the only options are either `dependencies` or `dependencyManagement`. Overriding a property won't work, that will only work when using the `spring-boot-starter-parent` as a parent. — M. Deinum, Sep 28 '17 at 18:00
@M.Deinum is there any way to get my Jackson BOM import to trump Spring Boot? — Sled, Sep 28 '17 at 18:01
You could try switching the order. Also excluding the bom on spring boot won't matter as afaik spring doesn't use the bom. — M. Deinum, Sep 28 '17 at 18:01
Whats incorrect in explicitly overriding the version of the dependency? Could you explain *equivalent of doing an import of com.fasterxml.jackson:jackson-bom:2.9.1:pom* ? — Naman, Sep 28 '17 at 18:08
@nullpointer I don't want to have to specify each artifact from the `jackson-bom` that might be used somewhere in the project or by any of my dependencies. — Sled, Sep 28 '17 at 18:17
@ArtB you would override what you want to, nothing other than that. — Naman, Sep 28 '17 at 18:19
@nullpointer I want to override all Jackson files to be version 2.9.1 — Sled, Sep 28 '17 at 18:20
@ArtB, In that case, did you try stating a property with the same name as in the bom with different value (2.9.1)? — Naman, Sep 28 '17 at 18:22
Also, make sure since you are using Java 9 with `maven`, you must use updated versions of the plugins as listed [Java+9+-+Jigsaw](https://cwiki.apache.org/confluence/display/MAVEN/Java+9+-+Jigsaw) as compatible with the latest java version. — Naman, Sep 28 '17 at 18:23

Darren Forsythe · Accepted Answer · 2021-01-28T11:47:09.617

22

You can re-order your BOM imports and this will work. Place Jackson BOM before the Spring Boot BOM. Quick example https://github.com/Flaw101/gsonconverter/blob/feature/jackson_override/pom.xml
If you use the Spring Boot Parent POM you just need to override their property jackson.version to override versions of other frameworks/libraries

This is also documented by Spring Boot,

https://docs.spring.io/platform/docs/current/reference/html/getting-started-overriding-versions.html

A couple of additional links,

https://docs.spring.io/spring-boot/docs/current/reference/html/using-boot-build-systems.html#using-boot-maven-parent-pom

https://docs.spring.io/spring-boot/docs/current/reference/html/using-boot-build-systems.html#using-boot-maven-without-a-parent

edited Jan 28 '21 at 11:47

answered Sep 28 '17 at 18:24

Darren Forsythe

10,712
4
43
54

A page specifically about this: https://docs.spring.io/platform/docs/current/reference/html/getting-started-overriding-versions.html – Ondra Žižka Jan 28 '21 at 02:08
Could you please provide more detail about 1. ? It works but i don't understand why the order matters – lnthai2002 May 05 '22 at 15:19
https://maven.apache.org/guides/introduction/introduction-to-dependency-mechanism.html talks about this in detail, but essentially its just how maven dependency resolution works – Darren Forsythe May 05 '22 at 15:34

score 8 · Answer 2 · answered Feb 24 '21 at 22:32

Adding jackson-bom.version to your properties section of the pom.xml file should update jackson dependencies. This will override jackson version in the Spring Boot Parent POM.

<properties>
    <jackson-bom.version>2.12.1</jackson-bom.version>
</properties>

Using jackson.version is not going to work. Please see https://github.com/spring-projects/spring-boot/issues/17808

How to override the version numbers from Spring Boot when importing a BOM pom?

2 Answers2

Linked