Maven download unspecified jar file in pom

Question

I am using maven as project dependency management tool. I have project where I put xml file in maven with specific version but I downloaded the older version also.

Here I want to download spring-core 5.0.8 via this:

<dependency>
        <groupId>org.springframework</groupId>
        <artifactId>spring-core</artifactId>
        <version>5.0.8.RELEASE</version>
</dependency>

It also downloads the 3.0.6.RELEASE version of spring-core. How to skip this dependency? , this is my old pom, this also downloads the 3.0.6.

here is my pom.xml

<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd">
<modelVersion>4.0.0</modelVersion>
<groupId>com.guru.gurusahakari</groupId>
<artifactId>gurusahakari</artifactId>
<packaging>war</packaging>
<version>0.0.1-SNAPSHOT</version>
<url>http://maven.apache.org</url>



<properties>
    <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
    <tomee.version>2.0.0-SNAPSHOT</tomee.version>
    <version.shrinkwrap.resolver>2.0.0</version.shrinkwrap.resolver>
    <javaassist.version>3.21.0-GA</javaassist.version>
</properties>

<repositories>
    <repository>
        <id>apache-m2-snapshot</id>
        <name>Apache Snapshot Repository</name>
        <url>https://repository.apache.org/content/groups/snapshots</url>
    </repository>
</repositories>


<build>
    <sourceDirectory>src</sourceDirectory>
    <!-- <finalName>gurusahakari</finalName> -->
    <defaultGoal>install</defaultGoal>

    <plugins>
        <plugin>
            <groupId>org.apache.maven.plugins</groupId>
            <artifactId>maven-dependency-plugin</artifactId>
            <version>2.1</version>
            <executions>
                <execution>
                    <id>copy-test-libs</id>
                    <phase>process-test-resources</phase>
                    <configuration>
                        <artifactItems>
                            <artifactItem>
                                <groupId>javax.servlet</groupId>
                                <artifactId>jstl</artifactId>
                                <version>1.2</version>
                            </artifactItem>
                            <artifactItem>
                                <groupId>taglibs</groupId>
                                <artifactId>standard</artifactId>
                                <version>1.1.2</version>
                            </artifactItem>
                        </artifactItems>
                        <outputDirectory>
                            ${project.build.directory}/test-libs
                        </outputDirectory>
                        <stripVersion>true</stripVersion>
                    </configuration>
                    <goals>
                        <goal>copy</goal>
                    </goals>
                </execution>
            </executions>
        </plugin>
        <plugin>
            <groupId>org.apache.maven.plugins</groupId>
            <artifactId>maven-surefire-plugin</artifactId>
            <version>2.17</version>
            <configuration>
                <reuseForks>false</reuseForks> <!-- otherwise openejb embedded and tomee embedded shares the same context 
                    and EJBContainer is broken -->
            </configuration>
        </plugin>
        <plugin>
            <groupId>org.apache.maven.plugins</groupId>
            <artifactId>maven-compiler-plugin</artifactId>
            <version>3.8.0</version>
            <configuration>
                <source>1.8</source>
                <target>1.8</target>
            </configuration>
        </plugin>
        <plugin>
            <groupId>org.apache.maven.plugins</groupId>
            <artifactId>maven-eclipse-plugin</artifactId>
            <version>2.9</version>
            <configuration>
                <configuration>
                    <wtpapplicationxml>true</wtpapplicationxml>
                    <wtpversion>2.0</wtpversion>
                </configuration>
            </configuration>
        </plugin>

        <plugin>
            <groupId>org.apache.aries.blueprint</groupId>
            <artifactId>blueprint-maven-plugin</artifactId>
            <version>1.4.0</version>
            <configuration>
                <scanPaths>
                    <scanPath>org.opendaylight</scanPath>
                </scanPaths>
            </configuration>
            <dependencies>
                <dependency>
                    <!-- https://stackoverflow.com/questions/38825386/blueprint-maven-plugin-runtimeexception -->
                    <groupId>org.apache.xbean</groupId>
                    <artifactId>xbean-finder-shaded</artifactId>
                    <version>4.5</version>
                </dependency>
            </dependencies>
            <executions>
                <execution>
                    <goals>
                        <goal>blueprint-generate</goal>
                    </goals>
                </execution>
            </executions>
        </plugin>

        <plugin>
            <groupId>org.apache.openejb.maven</groupId>
            <artifactId>tomee-maven-plugin</artifactId>
            <version>2.0.0-SNAPSHOT</version>
            <configuration>
                <tomeeClassifier>plus</tomeeClassifier>
                <args>-Xmx512m -XX:PermSize=256m</args>
            </configuration>
        </plugin>
    </plugins>
</build>

<dependencies>
    <dependency>
        <groupId>org.codehaus.jackson</groupId>
        <artifactId>jackson-mapper-asl</artifactId>
        <version>1.9.7</version>
    </dependency>
    <dependency>
        <groupId>org.codehaus.jackson</groupId>
        <artifactId>jackson-core-asl</artifactId>
        <version>1.9.7</version>
    </dependency>

    <dependency>
        <groupId>junit</groupId>
        <artifactId>junit</artifactId>
        <version>3.8.1</version>
        <scope>test</scope>
    </dependency>


    <!-- validation jar -->
    <!-- https://mvnrepository.com/artifact/javax.validation/validation-api -->
    <dependency>
        <groupId>javax.validation</groupId>
        <artifactId>validation-api</artifactId>
        <version>2.0.1.Final</version>
    </dependency>


    <dependency>
        <groupId>org.hibernate</groupId>
        <artifactId>hibernate-validator</artifactId>
        <version>4.0.2.GA</version>
    </dependency>

    <!-- https://mvnrepository.com/artifact/org.apache.bval/bval-jsr303 -->
    <dependency>
        <groupId>org.apache.bval</groupId>
        <artifactId>bval-jsr303</artifactId>
        <version>0.5</version>
    </dependency>


    <!-- https://mvnrepository.com/artifact/org.springframework.session/spring-session -->
    <dependency>
        <groupId>org.springframework.session</groupId>
        <artifactId>spring-session</artifactId>
        <version>1.0.0.RELEASE</version>
    </dependency>


    <!-- https://mvnrepository.com/artifact/org.springframework/spring-context-support -->
    <dependency>
        <groupId>org.springframework</groupId>
        <artifactId>spring-context-support</artifactId>
        <version>4.3.8.RELEASE</version>
    </dependency>

    <!-- https://mvnrepository.com/artifact/net.sf.jasperreports/jasperreports -->
    <dependency>
        <groupId>net.sf.jasperreports</groupId>
        <artifactId>jasperreports</artifactId>
        <version>6.1.0</version>
    </dependency>

    <!-- https://mvnrepository.com/artifact/org.springframework/spring-webmvc -->
    <dependency>
        <groupId>org.springframework</groupId>
        <artifactId>spring-webmvc</artifactId>
        <version>4.3.8.RELEASE</version>
    </dependency>

    <!-- https://mvnrepository.com/artifact/org.springframework/spring-core -->
    <dependency>
        <groupId>org.springframework</groupId>
        <artifactId>spring-core</artifactId>
        <version>4.3.8.RELEASE</version>
    </dependency>


    <!-- https://mvnrepository.com/artifact/javax.servlet/javax.servlet-api -->
    <dependency>
        <groupId>javax.servlet</groupId>
        <artifactId>javax.servlet-api</artifactId>
        <version>4.0.1</version>
        <scope>provided</scope>
    </dependency>

    <!-- https://mvnrepository.com/artifact/commons-codec/commons-codec -->
    <dependency>
        <groupId>commons-codec</groupId>
        <artifactId>commons-codec</artifactId>
        <version>1.9</version>
    </dependency>

    <!-- https://mvnrepository.com/artifact/com.sun.xml.messaging.saaj/saaj-impl -->
    <dependency>
        <groupId>com.sun.xml.messaging.saaj</groupId>
        <artifactId>saaj-impl</artifactId>
        <version>1.3.18</version>
    </dependency>

    <dependency>
        <groupId>org.slf4j</groupId>
        <artifactId>slf4j-log4j12</artifactId>
        <version>1.7.11</version>
    </dependency>
    <dependency>
        <groupId>log4j</groupId>
        <artifactId>log4j</artifactId>
        <version>1.2.17</version>
    </dependency>
    <dependency>
        <groupId>javax.servlet</groupId>
        <artifactId>jstl</artifactId>
        <version>1.2</version>
    </dependency>

    <!-- jackson data biending -->
    <dependency>
        <groupId>com.fasterxml.jackson.core</groupId>
        <artifactId>jackson-databind</artifactId>
        <version>2.5.0</version>
    </dependency>
    <dependency>
        <groupId>com.fasterxml.jackson.core</groupId>
        <artifactId>jackson-annotations</artifactId>
        <version>2.5.0</version>
    </dependency>
    <dependency>
        <groupId>com.fasterxml.jackson.core</groupId>
        <artifactId>jackson-core</artifactId>
        <version>2.5.0</version>
    </dependency>

    <!-- Apache Commons FileUpload -->
    <dependency>
        <groupId>commons-fileupload</groupId>
        <artifactId>commons-fileupload</artifactId>
        <version>1.3.1</version>
    </dependency>

    <!-- Apache Commons IO -->
    <dependency>
        <groupId>commons-io</groupId>
        <artifactId>commons-io</artifactId>
        <version>2.4</version>
    </dependency>


    <dependency>
        <groupId>junit</groupId>
        <artifactId>junit</artifactId>
        <version>3.8.1</version>
        <scope>test</scope>
    </dependency>

    <!-- https://mvnrepository.com/artifact/org.json/json -->
    <dependency>
        <groupId>org.json</groupId>
        <artifactId>json</artifactId>
        <version>20160810</version>
    </dependency>
</dependencies>

here is the result of mvn dependency:tree -Dverbose -Dincludes=spring-core.

[INFO] Scanning for projects...
[WARNING] 
[WARNING] Some problems were encountered while building the effective model for com.guru.gurusahakari:gurusahakari:war:0.0.1-SNAPSHOT
[WARNING] 'dependencies.dependency.(groupId:artifactId:type:classifier)' must be unique: junit:junit:jar -> duplicate declaration of version 3.8.1 @ line 284, column 15
[WARNING]  
[WARNING] It is highly recommended to fix these problems because they threaten the stability of your build.
 [WARNING] 
 [WARNING] For this reason, future Maven versions might no longer support building such malformed projects.
 [WARNING] 
  [INFO]                                                                         
   [INFO] ------------------------------------------------------------------------
   [INFO] Building gurusahakari 0.0.1-SNAPSHOT
   [INFO] ------------------------------------------------------------------------
    [INFO] 
   [INFO] --- maven-dependency-plugin:2.1:tree (default-cli) @ gurusahakari ---
     [INFO] ------------------------------------------------------------------------
   [INFO] BUILD SUCCESS
   [INFO] ------------------------------------------------------------------------
   [INFO] Total time: 5.987 s
   [INFO] Finished at: 2018-08-15T09:59:09+05:45
    [INFO] Final Memory: 11M/158M
    [INFO] ------------------------------------------------------------------------

Answer 1

In order to be more assertive I would need to take a look at your pom.xml.

But there is an oficial way to deal with situations like this. Just add a tag like the following in your pom:

<!-- Your actual dependencies -->
<dependencies>
   <dependency>
      <groupId>org.springframework</groupId>
      <artifactId>spring-core</artifactId>
   </dependency>
</dependencies>

<!-- Constraints you put on your direct and transitive dependencies -->
<dependencyManagement>
   <dependencies>
      <dependency>
         <groupId>org.springframework</groupId>
         <artifactId>spring-core</artifactId>
         <version>5.0.8.RELEASE</version>
      </dependency>
   </dependencies>
</dependencyManagement>

This will override the dependencies to use this specific version.