Maven implicit 'provided' dependencies not shown in 'dependency:tree'

Tag: maven Author: seenlou Date: 2011-03-06

A colleague is trying to set up a new Spring project. The project explicitly depends on spring-security, which in turn (implicitly) depends on wss4j. When running the tests, he gets a problem with a missing class.

We've tracked the missing class to axis-saaj, a 'provided' scoped dependency of wss4j. When I run the dependency:tree maven target, it's not listed as a dependency of his project.

My understanding of 'provided' is this: It's resolved by Maven for the build, but not included in the deliverable, nor supplied by Maven (on the classpath) for any 'run' phases (running tests nor running the app itself through Maven).

So, where the 'provided' dependency is implicit to your project, Maven would ignore it completely since it's not actually building the deliverable that depends on the 'provided' artifact, and it's up to you to supply it for the run-time.

I've tested and dependency:tree lists provided dependencies if they are explicit dependencies of your project, but not if they're lower down the dependency tree.

I've told him to include the dependency as an explicit one (scoped 'runtime') for now, but obviously this will cause problems in a full runtime environment (it's not scoped 'provided' for nothing), but we need to know the dependencies to explicitly include them. Does anyone know of any way to get the full dependency list for a project?


PS. I know I could also get him to explicitly rely on 'axis-saaj' with a scope of 'test', but this is not the issue, listing the dependencies is!

PPS. we're using Maven 3 for this

PPPS. I haven't included any pom text here as it would get too long. You can see this by creating a project an explicit dependency on (groupId), (artifactId) spring-ws-security, (version)2.0.0.RELEASE.

did you resolved this problem?
No. The project was put on hold because of changes in priority within the wider organisation (it was a Government department, and after an election priorities were changed). Also, I got moved to another section.

Best Answer

mvn dependency:tree and mvn dependency:list give the "full dependency list" you're looking for. As you seem to correctly understand, provided-scope dependencies of your dependencies aren't eligible for "transitiveness", for lack of a better word, and therefore don't count as a dependency of your project. You seem to have a correct grasp of the situation, so I'm not sure what else you're asking. Try asking some specific questions and/or read over the basics of transitive dependencies, particularly the table a little way down the page which shows that provided dependencies are never included in transitiveness.


I do have an understanding of the nature of transitive dependencies, but the actual problem is that there is no way to get a definitive list of the dependencies I need to provide for testing/runtime/etc. if implicit dependencies have 'provided' dependencies(without manually going through each and every POM file becasue there is no way to see this information from Maven
You normally just do exactly what you did: run it, see if it works, and if it doesn't, find the artifact you need to provide the class. Maven can only do so much for you, and even manually inspecting/parsing the poms won't tell you which "provided" or "optional" dependencies you really need. There are some things you just have to know. In this particular case, SAAJ would be "provided" because it's part of the JEE spec and thus will be provided by any conforming container. It's the same situation as a library that depends on the servlet api. That should be a "provided" dependency as well.
Thanks. I figured it was something like that. That doesn't help to identify the libraries you need to provide on building the artifacts though. Ah well.

Other Answer1

Did you check if this axis-saaj dependency is also optional=true?

The behavior you describe is exactly what optional implies, so it is correct that you need to add it.