Finding out about a dependency in Maven

Question

I see the following dependency being used in a Maven project:

But I searched in the Maven repository I couldn't find this groupId or artifactId.
Any thoughts on what this could be? Or what can I do to figure out?

Answer 1

Dependency resolution on old dependencies is always fun! The dependency you're seeking is in the rough range of 18 years old. You have to get a very old JAR that was compiled with an ancient JDK so that it can be used as a dependency for another package running on a contemporary JDK. Despite the age, this could possibly work.

This dependency still exists, but instead of version 1.0 it is now passing version 23.2.0.0 with a different groupId.

You have four options:

1. (Most robust) Update the code that is using the dependency if you are developing against it. In that case, you would point Maven to the newest version (different Group ID) and try to adapt to the latest changes in the API, like perhaps new package, class and method names, not to mention method signatures. (This is not a slam dunk and may be harder than it sounds.)
2. Get the Maven coordinates from a third-party repository -- not Maven Central because it's not hosted there. However, only one repo I could locate hosts this artifact at this version, and the repo appears offline. Note that you'll have to configure that third-party repository in your POM or Maven settings.
3. Try a modest update. Generally, in consideration of the Group ID changes and the age of the artifact, really new versions won't work out of the box. So find something between version 1.0 and 23.x, kind of older with the same groupId, and just try it. Here's a version 10.x that can be tested, but it's hosted on a third-party repository -- CERN (trustworthy). (See 2 above for configuring this.)
4. Find the file somewhere (here, here, or maybe Oracle archives) and download it to a local directory in your Git repo where you can commit it. Then you can use the dependency from disk using this syntax. (Another option is installing it to your workstation's local Maven artifact repository, but if you have to share the Git repo with others that's perhaps an esoteric step too far.)

All this, and the software may run but you may still run into issues with newer XML packages being shadowed by newer JDK built-ins or other unusual problems (other missing packages used by xmlparserv2) or even security issues. These also can be potentially resolved by excluding/including other dependencies but this is begging the law of diminishing returns for fairness.