5

Let's say I have a maven parent POM root which defines foo:bar:1.0.0 in dependency management. I have another parent POM parent which uses root as parent (just to add another layer to the example). Lastly I have a bill of materials bom which uses root as its parent but redefines foo:bar:2.0.0 in its dependency management.

In my project app I inherit from parent and then I import the BOM in the dependency management section of app

root (foo:bar:1.0.0) <- parent <- app+bom
 ^
 |
bom (foo:bar:2.0.0)

Which dependency management section wins? Which version of foo:bar do I get?

I know that if I were to directly include foo:bar in the dependency management section of app, it would override that inherited from the parent. But is importing a BOM in the dependency management section equivalent to directly including it in the dependency management section, and sufficient to override that of the parent? Or does the inherited foo:bar from the parent's dependency management take precedence?

Garret Wilson
  • 18,219
  • 30
  • 144
  • 272
  • Closest to the project I think. – K.Nicholas May 30 '19 at 19:02
  • 1
    Importing a bom is _not_ the same as putting them in the dependencyManagement directly, but weaker. I never found a document specifying the precedence and I just have a vague understanding through examples. – J Fabian Meier May 30 '19 at 19:24
  • 2
    If you are unsure about which dependencies in what versions get pulled into your project, you could try `mvn dependency:tree` or `mvn help:effective-pom`. – Robin479 Feb 12 '20 at 09:49

1 Answers1

8

According to the maven precedence rules, the version from the root will win and therefore you will get foo:bar:1.0.0, which you will be able to see if you look at the effective POM. I think that this makes a BOM project less effective since you cannot use it to override the version from the parent and have to declare the version in the app or in the parent.

The Precedence

So, there are multiple ways of deciding the versions, which means there is an order of precedence.

  • Versions provided in the direct declaration in POM take the highest precedence.
  • Version provided in parent pom takes second precedence.
  • Version from imported pom takes third place
  • Lastly, whatever we get from dependency mediation
Community
  • 1
  • 1
pyropunk51
  • 404
  • 6
  • 8
  • "According to the maven precedence rules …" Can you provide an authoritative reference? – Garret Wilson Sep 03 '19 at 13:49
  • I found this: https://www.baeldung.com/spring-maven-bom also the section on importing BOM on maven's site https://maven.apache.org/guides/introduction/introduction-to-dependency-mechanism.html#Importing_Dependencies but the precendence is only hinted at. – pyropunk51 Sep 27 '19 at 12:29
  • 1
    Well, it looks to be true in practice, just had a weird case and went to confirm. This is how it behaves - in my case imported pom is after parent pom and someone changed the parent pom... – Neikius Mar 16 '20 at 11:44
  • 1
    I wish there were an authoritative reference, but since multiple people are reporting that this is indeed how it works, I'll go ahead and mark this as the correct answer. – Garret Wilson Feb 26 '22 at 17:36