Maven implicit 'provided' dependencies not shown in 'dependency:tree'

Question

A colleague is trying to set up a new Spring project. The project explicitly depends on spring-security, which in turn (implicitly) depends on wss4j. When running the tests, he gets a problem with a missing class.

We've tracked the missing class to axis-saaj, a 'provided' scoped dependency of wss4j. When I run the dependency:tree maven target, it's not listed as a dependency of his project.

My understanding of 'provided' is this: It's resolved by Maven for the build, but not included in the deliverable, nor supplied by Maven (on the classpath) for any 'run' phases (running tests nor running the app itself through Maven).

So, where the 'provided' dependency is implicit to your project, Maven would ignore it completely since it's not actually building the deliverable that depends on the 'provided' artifact, and it's up to you to supply it for the run-time.

I've tested and dependency:tree lists provided dependencies if they are explicit dependencies of your project, but not if they're lower down the dependency tree.

I've told him to include the dependency as an explicit one (scoped 'runtime') for now, but obviously this will cause problems in a full runtime environment (it's not scoped 'provided' for nothing), but we need to know the dependencies to explicitly include them. Does anyone know of any way to get the full dependency list for a project?

Thanks

PS. I know I could also get him to explicitly rely on 'axis-saaj' with a scope of 'test', but this is not the issue, listing the dependencies is!

PPS. we're using Maven 3 for this

PPPS. I haven't included any pom text here as it would get too long. You can see this by creating a project an explicit dependency on (groupId) org.springframework.ws, (artifactId) spring-ws-security, (version)2.0.0.RELEASE.

Answer 1

mvn dependency:tree and mvn dependency:list give the "full dependency list" you're looking for. As you seem to correctly understand, provided-scope dependencies of your dependencies aren't eligible for "transitiveness", for lack of a better word, and therefore don't count as a dependency of your project. You seem to have a correct grasp of the situation, so I'm not sure what else you're asking. Try asking some specific questions and/or read over the basics of transitive dependencies, particularly the table a little way down the page which shows that provided dependencies are never included in transitiveness.

Answer 2

Did you check if this axis-saaj dependency is also optional=true?

The behavior you describe is exactly what optional implies, so it is correct that you need to add it.