Maven scope provided and transitive dependencies

Question

I have a dependency with one of the jar and i have marked it as provided in pom xml. It seems only some of the transitive dependency jar are marked as provided and not packaged with the war but others are still scope as compile and packaged with war libs.Do i need to explicitly mark the scope as provided for all the transitive dependencies.

Dependency in pom xml:

<dependency>
            <groupId>org.apache.camel</groupId>
            <artifactId>camel-ftp</artifactId>
            <scope>provided</scope>
</dependency>

Dependency tree:

[INFO] +- org.apache.camel:camel-ftp:jar:2.17.0.redhat-630262:provided
[INFO] |  +- com.jcraft:jsch:jar:0.1.54:provided
[INFO] |  +- commons-net:commons-net:jar:3.3.0.redhat-3:provided
[INFO] |  +- com.sun.xml.bind:jaxb-core:jar:2.2.11:compile
[INFO] |  \- com.sun.xml.bind:jaxb-impl:jar:2.2.11.redhat-2:compile
[INFO] +- org.apache.camel:camel-csv:jar:2.17.0.redhat-630262:provided

plugin version Details:

<maven.compiler.source>1.8</maven.compiler.source>
        <maven.compiler.target>1.8</maven.compiler.target>
        <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
        <cdi.api.version>1.2.0.redhat-2</cdi.api.version>
        <javax.inject.version>1.0.0.redhat-6</javax.inject.version>
        <sonar.host.url>http://vfrde2srta0401.agcs.biz:9000</sonar.host.url>
        <xerces.version>2.11.0-22</xerces.version>
        <xmlunit.version>1.6</xmlunit.version>
        <maven.compilerplugin.version>3.7.0</maven.compilerplugin.version>
        <maven.releaseplugin.version>2.5.3</maven.releaseplugin.version>
        <maven.warplugin.version>3.2.0</maven.warplugin.version>
        <maven.jarplugin.version>3.0.2</maven.jarplugin.version>
        <maven.surefireplugin.version>2.20.1</maven.surefireplugin.version>
        <maven.coberturaplugin.version>2.7</maven.coberturaplugin.version>

Answer 1

As a few people noted already, transitive dependencies of your provided scoped dependencies should get scope provided in your project. However, the scope can be changed to compile if you have other dependencies in scope compile that have the same transitive dependencies. In your case, these two:

[INFO] |  +- com.sun.xml.bind:jaxb-core:jar:2.2.11:compile
[INFO] |  \- com.sun.xml.bind:jaxb-impl:jar:2.2.11.redhat-2:compile

are probably pulled in transitively by another dependency in your pom than camel-ftp. You need to run mvn dependency:tree -Dverbose to get a hint of why these two got their scope updated to compile.

Answer 2

According to Maven documentation (see table), if you define a dependency with provided scope, transitive dependencies will have the following final scopes depending on their original scope:

• compile > provided
• provided > omitted
• runtime > provided
• test > omitted

A compile transitive dependency of your provided dependency should then be considered provided.