SpringBoot Spring Boot Maven plugin packages test-scoped transitive dependencies into JAR

Spring Boot Maven plugin packages test-scoped transitive dependencies into JAR under some conditions.

Spring Boot version 2.7.x and 3.0.x

In the attached sample project, aws-java-sdk-core 1.11.479 (transitive test-scoped dependency) will be packaged in the JAR instead of 1.11.951 (transitive compile-scoped dependency).

It seems like this happens if the test-scoped dependency is fewer levels removed than the compile-scoped dependency, but it's not exactly clear.

Of course the easy solution is to remove the transitive dependency within the POM, but it seems like it should be fixed.

transitive-test-dependencies.zip

Comment From: OrangeDog

That sounds like standard Maven dependency resolution. The scope of the dependency doesn't matter - it always resolves to the nearest copy.

The solution is to manually resolve dependency conflicts using <dependencyManagement>.

Comment From: wilkinsona

As @orangedog has said, this is how Maven works. Repackaging asks Maven for the compile and runtime dependencies:

https://github.com/spring-projects/spring-boot/blob/fd4b7d7f7a9dfa9050e702a54a5ca1bf4df43716/spring-boot-project/spring-boot-tools/spring-boot-maven-plugin/src/main/java/org/springframework/boot/maven/RepackageMojo.java#L55-L58

This results in 1.11.479 and we cannot control that. You can, however, by using <dependencyManagement>.

You can see Maven's behavior without involving Spring Boot if you run mvn dependency:tree in your sample project:

[INFO] \- com.amazonaws:DynamoDBLocal:jar:1.12.0:test
[INFO]    +- org.antlr:antlr4-runtime:jar:4.7.2:test
[INFO]    +- commons-cli:commons-cli:jar:1.2:test
[INFO]    +- org.apache.commons:commons-lang3:jar:3.12.0:compile
[INFO]    +- com.almworks.sqlite4java:libsqlite4java-linux-i386:so:1.0.392:test
[INFO]    |  \- com.almworks.sqlite4java:sqlite4java:jar:1.0.392:test
[INFO]    +- com.almworks.sqlite4java:libsqlite4java-linux-amd64:so:1.0.392:test
[INFO]    +- com.almworks.sqlite4java:sqlite4java-win32-x64:dll:1.0.392:test
[INFO]    +- com.almworks.sqlite4java:sqlite4java-win32-x86:dll:1.0.392:test
[INFO]    +- com.almworks.sqlite4java:libsqlite4java-osx:dylib:1.0.392:test
[INFO]    +- com.amazonaws:aws-java-sdk-core:jar:1.11.479:compile
[INFO]    |  +- org.apache.httpcomponents:httpclient:jar:4.5.14:compile
[INFO]    |  |  \- commons-codec:commons-codec:jar:1.15:compile
[INFO]    |  +- software.amazon.ion:ion-java:jar:1.0.2:compile
[INFO]    |  +- com.fasterxml.jackson.dataformat:jackson-dataformat-cbor:jar:2.14.2:compile
[INFO]    |  \- joda-time:joda-time:jar:2.8.1:compile
[INFO]    +- org.apache.logging.log4j:log4j-api:jar:2.19.0:compile
[INFO]    +- org.apache.logging.log4j:log4j-core:jar:2.19.0:test
[INFO]    +- org.eclipse.jetty:jetty-client:jar:11.0.15:test
[INFO]    |  +- org.eclipse.jetty:jetty-http:jar:11.0.15:test
[INFO]    |  |  \- org.eclipse.jetty:jetty-util:jar:11.0.15:test
[INFO]    |  +- org.eclipse.jetty:jetty-io:jar:11.0.15:test
[INFO]    |  \- org.eclipse.jetty:jetty-alpn-client:jar:11.0.15:test
[INFO]    +- org.eclipse.jetty:jetty-server:jar:11.0.15:test
[INFO]    |  \- org.eclipse.jetty.toolchain:jetty-jakarta-servlet-api:jar:5.0.2:test
[INFO]    +- org.mockito:mockito-core:jar:4.8.1:test
[INFO]    |  +- net.bytebuddy:byte-buddy:jar:1.12.23:test
[INFO]    |  +- net.bytebuddy:byte-buddy-agent:jar:1.12.23:test
[INFO]    |  \- org.objenesis:objenesis:jar:3.2:test
[INFO]    \- com.google.guava:guava:jar:21.0:compile