Maven is picking dependency of old version

Question

I am trying to integrate Maven - Spring MVC - Rest , but i am facing issue in which maven is not picking "spring-web/aop/beans/context/core"(version 4.3.12) dependency .

Instead of spring-web/aop/beans/context/core 4.3.12.RELEASE , maven is picking "spring-web/aop/beans/context/core" 2.5.6.SEC03 dependency. because of this "org.springframework.web.bind.annotation.RequestMapping;" is not getting resolve as it is not there in spring web 2.5.6.SEC03

Maven Version -> apache-maven-3.5.2

Maven env variables

pom.xml

    <?xml version="1.0" encoding="UTF-8"?>
<project xmlns="http://maven.apache.org/POM/4.0.0"
         xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
    <modelVersion>4.0.0</modelVersion>

    <groupId>org.portal</groupId>
    <artifactId>HumanResourcePortal</artifactId>
    <version>1.0-SNAPSHOT</version>
    <packaging>war</packaging>
    <build>
        <resources>
            <resource>
                <directory>src/main/resources</directory>
            </resource>
        </resources>

        <plugins>
            <plugin>
                <groupId>org.apache.maven.plugins</groupId>
                <artifactId>maven-war-plugin</artifactId>
                <version>2.1.1</version>
                <configuration>
                    <warName>${project.artifactId}-${project.version}</warName>
                    <outputDirectory>${project.basedir}/target</outputDirectory>
                </configuration>
            </plugin>
            <plugin>
                <artifactId>maven-clean-plugin</artifactId>
                <version>2.6.1</version>
                <configuration>
                    <filesets>
                        <fileset>
                            <directory>
                                /home/shivam/apache-tomcat-7.0.81/webapps/${project.artifactId}-${project.version}
                            </directory>
                        </fileset>
                        <fileset>
                            <directory>
                                /home/shivam/apache-tomcat-7.0.81/webapps
                            </directory>
                            <includes>
                                <include>
                                    ${project.artifactId}-${project.version}.{packaging}
                                </include>
                            </includes>
                       </fileset>
                    </filesets>
                </configuration>
            </plugin>
            <plugin>
                <groupId>org.apache.maven.plugins</groupId>
                <artifactId>maven-compiler-plugin</artifactId>
                <version>3.1</version>
                <configuration>
                    <source>1.8</source>
                    <target>1.8</target>
                </configuration>
            </plugin>
            <plugin>
                <artifactId>maven-resources-plugin</artifactId>
                <version>3.0.2</version>
                <executions>
                    <execution>
                        <id>copy-resources</id>
                        <phase>validate</phase>
                        <goals>
                            <goal>copy-resources</goal>
                        </goals>
                        <configuration>
                            <outputDirectory>/home/shivam/apache-tomcat-7.0.81/webapps</outputDirectory>
                            <resources>
                                <resource>
                                    <directory>${project.basedir}/target</directory>
                                    <includes>
                                        <include>${project.artifactId}-${project.version}.${packaging}</include>
                                        <include>${project.artifactId}-${project.version}</include>
                                    </includes>
                                </resource>
                            </resources>
                        </configuration>
                    </execution>
                </executions>
            </plugin>
        </plugins>
    </build>

    <dependencies>
        <dependency>
            <groupId>org.springframework</groupId>
            <artifactId>spring-core</artifactId>
            <version>4.3.12.RELEASE</version>
        </dependency>
        <dependency>
            <groupId>org.springframework</groupId>
            <artifactId>spring-context</artifactId>
            <version>4.3.12.RELEASE</version>
        </dependency>
        <dependency>
            <groupId>org.springframework</groupId>
            <artifactId>spring-aop</artifactId>
            <version>4.3.12.RELEASE</version>
        </dependency>
        <dependency>
            <groupId>org.springframework</groupId>
            <artifactId>spring-webmvc</artifactId>
            <version>4.3.12.RELEASE</version>
        </dependency>
        <dependency>
            <groupId>org.springframework</groupId>
            <artifactId>spring-web</artifactId>
            <version>4.3.12.RELEASE</version>
        </dependency>
        <dependency>
            <groupId>org.springframework</groupId>
            <artifactId>spring-orm</artifactId>
            <version>4.3.12.RELEASE</version>
        </dependency>
        <dependency>
            <groupId>com.thoughtworks.xstream</groupId>
            <artifactId>xstream</artifactId>
            <version>1.4.9</version>
        </dependency>
        <dependency>
            <groupId>com.sun.jersey</groupId>
            <artifactId>jersey-bundle</artifactId>
            <version>1.8</version>
        </dependency>
        <dependency>
            <groupId>com.sun.jersey</groupId>
            <artifactId>jersey-core</artifactId>
            <version>1.8</version>
        </dependency>
        <dependency>
            <groupId>com.sun.jersey</groupId>
            <artifactId>jersey-server</artifactId>
            <version>1.8</version>
        </dependency>
        <dependency>
            <groupId>com.sun.jersey</groupId>
            <artifactId>jersey-client</artifactId>
            <version>1.8</version>
        </dependency>
        <dependency>
            <groupId>com.sun.jersey.contribs</groupId>
            <artifactId>jersey-spring</artifactId>
            <version>1.8</version>
        </dependency>
        <dependency>
            <groupId>org.hibernate</groupId>
            <artifactId>hibernate-core</artifactId>
            <version>4.3.11.Final</version>
        </dependency>
        <dependency>
            <groupId>log4j</groupId>
            <artifactId>log4j</artifactId>
            <version>1.2.12</version>
        </dependency>
        <dependency>
            <groupId>com.oracle</groupId>
            <artifactId>ojdbc6</artifactId>
            <version>11.1.0.7.0</version>
        </dependency>
        <dependency>
            <groupId>org.springframework</groupId>
            <artifactId>spring-beans</artifactId>
            <version>4.3.12.RELEASE</version>
        </dependency>
        <dependency>
            <groupId>org.springframework</groupId>
            <artifactId>spring-web</artifactId>
            <version>4.3.12.RELEASE</version>
        </dependency>
    </dependencies>
</project>

after Running maven dependency tree

after running "mvn help:effectivePom"

Answer 1

Most probably, that outdated Spring version comes from jersey-spring transient dependencies. Try to use one of the latest versions.

Better options?

Well, first of all, you can use <dependencyManagement> section. It is used to lock the versions of the dependencies across the project. <dependencyManagement> will work with any artifacts.

Second, starting somewhere from 3.x releases Spring provides a Bill of Materials. BOM is a special concept in Maven, like a <dependencyManagement>, but it allows to lock multiple dependencies with one BOM import. BOMs are prepared and published for some popular libraries, like Spring or Camel.

Answer 2

Choosing dependency version that is closer to project root a known behavior of Maven dependency lookup. Let's imagine that you have the following dependency tree:

Your Project
- library-A-1.0.jar
-- library-B-1.5.jar (dependency of library-A)
- library-B-1.2.jar

The library set that maven will pick for you will be library-A-1.0.jar and library-B-1.2.jar (as this version is closer to project root at distance 1 compared to library-B-1.5.jar at disatnce 2).

The usual approach to resolve this kind of issues is to

1. Analyze your dependency tree with Maven Dependency Plug-in
2. Either define required library version closer to project root
3. Or exclude unwanted dependency in included artifact
4. Or move dependency higher in pom.xml file when at the same distance (first one will be used)