Question

When there is a conflict in the dependency tree (same artifact but different versions) then, AFAIK, Maven will resolve the conflict by selecting the highest version of the dependency and will omit the ‘old’ ones.

However, when the newer version is a SNAPSHOT then apparently it will choose the older stable version over the SNAPSHOT.

In my case: some-artifact: 0.5.0-SNAPSHOTS (omitted for conflict with 0.4.0) => version 0.4.0 is picked over the wanted 0.5.0-SNAPSHOT.

I assume this functions as designed but I don’t understand the reason why. Next to that, any idea if there is a way to tell Maven to take the SNAPSHOT over the stable version?

Answer 1

Your assumption about Maven’s always selecting the highest version isn’t accurate. Artifacts are chosen based on a number of factors including depth of the dependency in the tree, order in the tree, whether the dependency is a snapshot or a release, and dependency management, which pretty much overrides everything else.

Unfortunately, I don’t know of any one, definitive source of information on Maven’s dependency resolution algorithms. You’ll find bits and pieces of it scattered all over. A few handy references:

• Introduction to the Dependency Mechanism gives an overview of the topic with a good, if short, section on Transitive Dependencies and how they’re selected from a dependency tree.
• The Sonatype Maven book has a more thorough section on Project Dependencies in general that will add a lot to your knowledge about the subject.
• An earlier section of that same book discusses Project Versions, which is strongly related to this problem and has a good section on SNAPSHOT versions, though not as much as I could wish on how they play into dependency resolution.
• Project Relationships talks about the coordinate system and how project inheritance affects what dependencies get included.
• Finally, the POM Reference is a good jumping-off point for almost anything to do with the pom. There’s at least a brief description of every pom element that can help you understand enough to be able to begin searching for more info effectively.

As for some practical advice, the output of mvn dependency:tree is highly useful in discovering why a particular version of a dependency was chosen. It’ll often even tell you something like “foo:bar:1.2 (was 1.1)”. Once you figure out where the errant version is coming from, there are a number of ways to ensure a specific dependency version is used for a project:

• Exclude wrongly-versioned dependencies from other dependencies that are causing them to be included in the build.
• Add an explicit top-level dependency to your pom instead of relying on a transitive dependency.
• List the dependency in the dependencyManagement section of your pom (scroll down a bit from this link) to force the dependency to have the specified characteristics, regardless of what level of transitive dependency it is. Use this option with care, as dependencyManagement is viral, in that other projects depending on your project will be “infected” with your dependency management. There’s also a good section on dependency management in the pom reference.