Maven dependencyManagement version ignored in transitive dependencies

Question

Maven is transitively pulling in version 16 of guava, even though I have a <dependencyManagement> section which specifies version 18.

The quick summary:

• gwizard-example depends on gwizard-config
• gwizard-config has a parent pom, gwizard-parent
• gwizard-parent has <dependencyManagement> which specifies version 18 of guava

Thankfully this is an opensource project, so you can see the poms directly: gwizard-parent, gwizard-config, gwizard-example. However, here's the important bit in gwizard-parent:

<properties>     <guava.version>18.0</guava.version> </properties>  <dependencyManagement>     <dependencies>         <dependency>             <groupId>com.google.guava</groupId>             <artifactId>guava</artifactId>             <version>${guava.version}</version>         </dependency>     </dependencies> </dependencyManagement> 

...and the no-frills dependency declared in gwizard-example:

<properties>     <gwizard.version>0.5</gwizard.version> </properties>  <dependencies>     <dependency>         <groupId>org.gwizard</groupId>         <artifactId>gwizard-config</artifactId>         <version>${gwizard.version}</version>     </dependency> </dependencies> 

The dependency tree for gwizard-config shows guava 18 correctly:

[INFO] --- maven-dependency-plugin:2.8:tree (default-cli) @ gwizard-config --- [INFO] org.gwizard:gwizard-config:jar:0.5 [INFO] +- com.google.inject:guice:jar:4.0-beta5:compile [INFO] |  \- com.google.guava:guava:jar:18.0:compile 

However, the dependency tree for gwizard-example shows guava 16 (which causes problems):

[INFO] --- maven-dependency-plugin:2.8:tree (default-cli) @ gwizard-example --- [INFO] org.gwizard:gwizard-example:jar:1.0-SNAPSHOT [INFO] +- org.gwizard:gwizard-config:jar:0.5:compile [INFO] |  +- com.google.inject:guice:jar:4.0-beta5:compile [INFO] |  |  \- com.google.guava:guava:jar:16.0.1:compile 

This is using Maven v3.2.5. I am baffled. Help?

Possibly related: dependencyManagement in parent ignored

UPDATE: The poms linked on github are changing; adding a dependency to gwizard-services (which directly declares a guava dep) in gwizard-example "fixed" the problem. There's still some sort of bad underlying behavior here.

UPDATE: Created this JIRA issue

Answer 1

There is a simple thing. A dependencyManagement does not declare a dependency which is really used it's only defining versions etc. which can be used.

If you define something like this it will not result in a change.

<properties>     <guava.version>18.0</guava.version> </properties>  <dependencyManagement>     <dependencies>         <dependency>             <groupId>com.google.guava</groupId>             <artifactId>guava</artifactId>             <version>${guava.version}</version>         </dependency>     </dependencies> </dependencyManagement> 

If you really like to overwrite the version which is used in you tree you need to define a real dependency: So based on the above definition you need to add the following as well:

<dependencies>     <dependency>         <groupId>com.google.guava</groupId>         <artifactId>guava</artifactId>     </dependency> </dependencies> 

If you have added this please check afterwards via mvn dependency:tree.