How to exclude transitive dependencies of spring-boot-dependencies from maven import scope

Question

I have the following in my Spring Boot application pom as per the documentation:

  <dependencyManagement>
    <dependencies>
      <!-- Spring -->
      <dependency>
        <groupId>org.springframework.boot</groupId>
        <artifactId>spring-boot-dependencies</artifactId>
        <version>${spring-boot.version}</version>
        <type>pom</type>
        <scope>import</scope>
      </dependency>
    </dependencies>
  </dependencyManagement>

I need to use use dependencyManagement and <scope>import</scope> because I need to use a standard corporate base pom.

However, it doesn't seem possible to exclude transitive dependencies of spring-boot-dependencies. In my particular case, Spring Boot 1.2.1.RELEASE is bringing in a version of Jetty that is too new with respect to some of my other <dependencies>. I tried using an <exclusion> of the form:

  <dependencyManagement>
    <dependencies>
      <!-- Spring -->
      <dependency>
        <groupId>org.springframework.boot</groupId>
        <artifactId>spring-boot-starter-parent</artifactId>
        <version>${spring-boot.version}</version>
        <type>pom</type>
        <scope>import</scope>

        <!-- Doesn't work -->
        <exclusions>
          <exclusion>
            <groupId>org.eclipse.jetty</groupId>
            <artifactId>*</artifactId>
          </exclusion>
        </exclusions>

      </dependency>

    </dependencies>
  </dependencyManagement>

using Maven 3.2.1's wildcard support, but it doesn't seem to take effect.

Is there a solution to this problem other than explicitly overriding all the Jetty dependencies? There are many Jetty libraries and that approach would be quite brittle. Furthermore, it appears I would need to do the same with Jetty's transitive dependencies as well.

Answer 1

According to the Spring Boot Maven Plugin 2.3.1.RELEASE documentation, to override individual dependencies, you need to add entries in the dependencyManagement section of your project before the spring-boot-dependencies entry.

  <dependencyManagement>
    <dependencies>
      <!-- Your jetty version dependency -->
      <dependency>
        <groupId>org.eclipse.jetty</groupId>
        <artifactId>*</artifactId>
        <version>${jetty.version}</version>
      </dependency>

      <!-- Spring -->
      <dependency>
        <groupId>org.springframework.boot</groupId>
        <artifactId>spring-boot-starter-parent</artifactId>
        <version>${spring-boot.version}</version>
        <type>pom</type>
        <scope>import</scope>
      </dependency>
    </dependencies>
  </dependencyManagement>

Answer 2

Looks like this isn't possible with Maven import scope:

The import scope can be used to include dependency management information from a remote POM into the current project. One of the limitations of this is that it does not allow additional excludes to be defined for a multi module project.

Likewise, there is a confirmation from the Spring Boot documentation:

If you have added spring-boot-dependencies in your own dependencyManagement section with <scope>import</scope> you have to redefine the artifact yourself [...].