Why does my war file contain a dependency not in my tree?

Question

I have an app that I build with maven.

First, I run mvn clean.

Then, after I build it, I'm finding that I get 2 copies of the jackson-databind jar:

ls target/ROOT/WEB-INF/lib | grep jackson
jackson-annotations-2.8.9.jar
jackson-core-2.8.9.jar
jackson-databind-2.4.4.jar
jackson-databind-2.8.9.jar

However, when I run

mvn dependency:tree

I only see reference to

com.fasterxml.jackson.core:jackson-databind:jar:2.8.9:compile

Even if I run mvn dependency:tree -Dverbose=true, there's no sign of 2.4.4 in the tree

What gives? Am I misunderstanding the report, because we're clearly pulling in 2.4.4 for some reason?

Put another way (to keep this less broad), how can maven be pulling in a dependency that isn't listed in the dependency tree?

What do you see when you run the command with the [verbose](https://maven.apache.org/plugins/maven-dependency-plugin/tree-mojo.html#verbose) flag set to `true`? (`-Dverbose=true`) — avojak, Jan 18 '18 at 16:44
Possibly related: https://stackoverflow.com/questions/35588952/display-omitted-versions-in-maven-dependencytree — avojak, Jan 18 '18 at 16:45
Did you run `mvn clean` to make sure no old dependencies are there from earlier builds? — user944849, Jan 18 '18 at 16:57
If you haven't found a clue of the other than there is something different wrong...Please show your pom file...make `mvn clean package` make an `unzip -t XYZ.war` and take a look there if the other versions are there...Without the real project it's hard to find the issue.. — khmarbaise, Jan 18 '18 at 19:43

Dancrumb · Accepted Answer · 2018-01-18T18:01:23.637

The source of the rogue file is a WAR dependency, not a JAR dependency.

I don't believe these are visible on the tree because they are not 'resolved', per se... they are just copied over.

Doing

find target/ -name jackson-databind-\*.jar

Lists them all. They show up in the target/war/work directory which gives you a pointer to where they are coming from.

Excluding them needs to be done in the configuration of the maven-war-plugin:

<configuration>                                                           
    <overlays>                                                            
        <overlay>                                                         
            <groupId>com.group</groupId>                                 
            <artifactId>artifact-you-depend-on</artifactId>                 
            <excludes>                                                    
                <exclude>WEB-INF/lib/jackson-databind-2.4.4.jar</exclude> 
            </excludes>                                                   
        </overlay>                                                        
    </overlays>                                                           
</configuration>

Wrong way. Better is to give them scope: provided...manual excludes is a smell... — khmarbaise, Jan 18 '18 at 19:41

Why does my war file contain a dependency not in my tree?

1 Answers1