Two versions of library dependency in Maven

Question

In my pom.xml I have

<dependency>
    <groupId>org.json</groupId>
    <artifactId>json</artifactId>
    <version>20170516</version>
</dependency>

And my Program needs and uses this version om JSON.

import org.json.JSONObject;

When I put in

final JsonObject jsonObject = new JsonObject();
System.out.println( jsonObject.getClass().getPackage().getImplementationVersion());

I get

20170516

Okay, alright. (Note: This is a class of the program, not the test!)

Now I run my Unittest (Mockito, JUnit) with mvn test. I get an error, which is related to the JSONObject version. And the log says:

0.0.20131108.vaadin1

I found out, that this version comes from this dependency

<dependency>
    <groupId>org.skyscreamer</groupId>
    <artifactId>jsonassert</artifactId>
    <version>1.5.0</version>
    <scope>test</scope>
</dependency>

If I delete it, my test works fine.

But now other tests fail, which uses this dependency

import static org.springframework.test.web.servlet.request.MockMvcRequestBuilders.*;
import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.*;

and in pom.xml

<dependency>
    <groupId>org.springframework</groupId>
    <artifactId>spring-test</artifactId>
    <version>4.3.4.RELEASE</version>
</dependency>

How can I configure maven, that the program uses JSON version 20170516, but spring-test can still use jsonassert?

Even if almost the same name, I don't think this is a duplicate of

two versions of dependencies in maven

-- Edit 1

mvn dependency:tree | grep json 
[INFO] +- org.skyscreamer:jsonassert:jar:1.5.0:test 
[INFO] |  \- com.vaadin.external.google:android-json:jar:0.0.20131108.vaadin1:test 
[INFO] +- com.jayway.jsonpath:json-path-assert:jar:2.2.0:test 
[INFO] |  +- com.jayway.jsonpath:json-path:jar:2.2.0:test 
[INFO] |  |  \- net.minidev:json-smart:jar:2.2.1:test 
[INFO] +- org.json:json:jar:20170516:compile

"how can I configure maven, that the program uses JSON version 20170516, but spring-test can still use jsonassert" Is maven [dependency scope](https://maven.apache.org/guides/introduction/introduction-to-dependency-mechanism.html#Dependency_Scope) what you're looking for? You could make certain versions used during tests and other versions using in compiling and building. — xtratic, Dec 20 '18 at 15:19
No, that does not help. As I wrote, the critical point where the newer version of JsonObject is used is in the class, not in the test of that class. — Paflow, Dec 20 '18 at 15:31

score 5 · Answer 1 · answered Dec 20 '18 at 15:20

you need to add the dependencies that you want to enforce specific version when there is conflict in dependencyManagement. This ensures the maven uses 20170516 version of json dependency even though jsonassert depends different version.

    <dependencyManagement>
    <dependencies>
        <dependency>
        <groupId>org.json</groupId>
        <artifactId>json</artifactId>
        <version>20170516</version>
        </dependency>
        <dependency>
            <groupId>org.skyscreamer</groupId>
            <artifactId>jsonassert</artifactId>
            <version>1.5.0</version>
            <scope>test</scope>
        </dependency>
    </dependencies>
    </dependencyManagement>

Please see Differences between dependencyManagement and dependencies in Maven

or you can use <exclusions> to exclude a child dependency.

I removed the two from and put your code under , but now I get a lot of errors. — Paflow, Dec 20 '18 at 15:46
you shouldn't remove the above from `dependencies`. You should keep them and you need to to include them in the `dependencyManagement` as well. — user51, Dec 20 '18 at 15:51

Karol Dowbecki · Accepted Answer · 2018-12-20T15:51:34.413

2

Unless spring-test or jsonassert will shade the org.json:json dependency internally in the future version you are stuck having to use one version of org.json:json across the classpath.

Not all Java dependencies are compatible, see classpath hell.

You can try defining a Dependency Exclusion for the problematic version but this can potentially brake jsonassert dependency:

<dependency>
  <groupId>org.skyscreamer</groupId>
  <artifactId>jsonassert</artifactId>
  <version>1.5.0</version>
  <scope>test</scope>
  <exclusions>
    <exclusion>
      <groupId>com.vaadin.external.google</groupId>
      <artifactId>android-json</artifactId>
    </exclusion>
  </exclusions>
</dependency>

edited Dec 20 '18 at 15:51

answered Dec 20 '18 at 15:19

Karol Dowbecki

43,645
9
78
111

A added this exclusion, but I still get version 0.0.20131108.vaadin1 of JSON in test context. – Paflow Dec 20 '18 at 15:42
`mvn dependency:tree` and you have to exclude every single one. Do note that it might be a bad idea, the libraries might brake. – Karol Dowbecki Dec 20 '18 at 15:44
@Paflow updated the answer, exclusion should match the artifact `groupId` and `artifactId`. – Karol Dowbecki Dec 20 '18 at 15:52
Did the trick. As the usages of JSONAssert are quite clear (all tests which use mockMvc), I think I can take the risk. – Paflow Dec 20 '18 at 16:39

Two versions of library dependency in Maven

2 Answers2