Maven install transitive dependencies

Question

I have a project, and I need to install a library on Maven so that I can use it on said project. The problem I ran into is that said library, say libA, has a dependency itself, libB, which is also a third party one.

I have added both to my local repository by using this code:

mvn install:install-file -Dfile=VerBDConverter.jar -DgroupId=verbdconverter
-DartifactId=verbdconverter -Dversion=1.00 -Dpackaging=jar -DgeneratePom=true  

Did the same for the lib 2. Problem is that, when I go to my project's pom and add the < dependency > for libA, Maven is not picking up libB.

Question: It should be, after all, Maven should get libA's dependencies, but it didn't.

Answer 1

It should be, after all, Maven should get libA's dependencies, but it didn't.

No, in your case Maven will not know out of the blue which transitive dependencies libA would require, because libA was manually installed and there is no trace of libB anywhere.

Normally, transitive dependencies are dependencies defined in the dependencies section of the .pom file available as part of a deployed application. The .pom file is essentially a copy of the original pom.xml file, renamed to reflect the library name (i.e. artifactId-version.jar, then artifactId-version.pom).

When resolving a dependency, maven will also check its .pom file and as such get information about its dependencies (which become transitive dependencies) and build (and fetch) the required dependencies graph for it (that is, re-iterate the same process for each and every declared dependency).

From official Maven - Introduction to the dependency mechanism

This feature is facilitated by reading the project files of your dependencies from the remote repositories specified. In general, all dependencies of those projects are used in your project, as are any that the project inherits from its parents, or from its dependencies, and so on.

Note: bold is mine. project files are normally the pom.xml files, renamed into *.pom files once related artifacts are uploaded to a Maven repository (or installed into the local Maven cache).

---

From your question, you used -DgeneratePom=true, hence you didn't pass libA' pom.xml file, but a new one was automatically generated

Generate a minimal POM for the artifact if none is supplied via the parameter pomFile. Defaults to true if there is no existing POM in the local repository yet.

The autogenerated .pom file will be almost empty (Maven coordinates (groupId, artifactId, version) but no dependencies section in it), hence Maven will treat libA as library with no transitive dependencies: it cannot find any, it cannot guess neither.

---

You hence have four solutions (in order of recommendation):

• In corporate environment, set-up an enterprise Maven repository (like Arifactory, Nexus or Apache Archivia) and properly deploy these libraries to it, or
• Re-install libA using the pomFile option, or
• Manually add the dependencies section to the generated .pom file and add libB to it, or
• Explicitly declare libB in your consumer pom.xml file

---

For further reading on SO:

• Why Maven is looking for .pom file when .jar is present in the repository?