Tracking transitive dependencies in Maven2

[Emilio Kazwell]

I'm trying to set up a pom.xml for a WAR that is currently building with ant. The way I have the pom set up right now there are some jars ending up in my WEB-INF/lib folder that my project does not actually need. I have a rather large number of dependencies and it would be a very time consuming task to manually inspect every dependency's pom.xml recursively to track down the path that leads to this dependency.

Is there a tool of some sort that can help me discover how I ended up with xyz.jar as an eventual dependency?

Thanks,

[Peter Johnson]

Look into JBoss Tattletale - it provides this type of dependency reporting.

[David Newton]

http://maven.apache.org/plugins/maven-dependency-plugin/tree-mojo.html

It'd be weird for non-dependencies to be put into the WAR, though; are you sure they're not required? Or perhaps they're required for a different phase (like test)?

[David Newton]

Note that tree's output includes the phase:

[INFO] [dependency:tree]
[INFO] com.opensymphony:xwork-core:jar:2.1.6-SNAPSHOT
[INFO] +- commons-logging:commons-logging:jar:1.1.1:compile
[INFO] +- commons-lang:commons-lang:jar:2.4:compile
[INFO] +- ognl:ognl:jar:2.7.3:compile
[INFO] |  \- jboss:javassist:jar:3.7.ga:compile
[INFO] +- asm:asm:jar:3.1:compile
[INFO] +- asm:asm-commons:jar:3.1:compile
[INFO] |  \- asm:asm-tree:jar:3.1:compile
[INFO] +- org.springframework:spring-core:jar:2.5.6:compile
[INFO] +- org.springframework:spring-aop:jar:2.5.6:compile
[INFO] |  \- aopalliance:aopalliance:jar:1.0:compile
[INFO] +- org.springframework:spring-aspects:jar:2.5.6:compile
[INFO] |  +- org.aspectj:aspectjrt:jar:1.6.1:compile
[INFO] |  \- org.aspectj:aspectjweaver:jar:1.6.1:compile
[INFO] +- org.springframework:spring-beans:jar:2.5.6:compile
[INFO] +- org.springframework:spring-context:jar:2.5.6:compile
[INFO] +- org.springframework:spring-context-support:jar:2.5.6:compile
[INFO] +- org.springframework:spring-web:jar:2.5.6:compile
[INFO] +- org.springframework:spring-test:jar:2.5.6:compile
[INFO] +- cglib:cglib-nodep:jar:2.1_3:compile
[INFO] +- junit:junit:jar:4.5:compile
[INFO] +- org.testng:testng:jar:jdk15:5.1:compile
[INFO] +- mockobjects:mockobjects-core:jar:0.09:test
[INFO] \- org.easymock:easymock:jar:2.4:test

Here there are only a few "test" libs, but you get the idea.

[Emilio Kazwell]

Thanks for the tool advice. These are both very cool.

David Newton wrote:http://maven.apache.org/plugins/maven-dependency-plugin/tree-mojo.html

It'd be weird for non-dependencies to be put into the WAR, though; are you sure they're not required? Or perhaps they're required for a different phase (like test)?

Yeah, so the thing is I'm building a JSF application and I'm ending up with ant-1.7.0 and ant-launcher-1.7.0 in my WEB-INF/lib. According to dependency:tree (ant entries at the bottom, axis2 at the top) these dependencies are showing up by way of Axis2. Axis2 is a dependency because I have some Axis2 web service clients (built by wsdl2java) as dependencies.

 
[INFO] |  +- org.apache.axis2:axis2:jar:1.4.1:compile
[INFO] |  \- org.apache.axis2:axis2-xmlbeans:jar:1.4.1:compile
[INFO] |     +- org.apache.axis2:axis2-codegen:jar:1.4.1:compile
[INFO] |     |  +- org.apache.axis2:axis2-kernel:jar:1.4.1:compile
[INFO] |     |  |  +- javax.servlet:servlet-api:jar:2.3:compile
[INFO] |     |  |  +- commons-httpclient:commons-httpclient:jar:3.1:compile
[INFO] |     |  |  +- org.apache.httpcomponents:httpcore:jar:4.0-beta1:compile
[INFO] |     |  |  +- org.apache.httpcomponents:httpcore-nio:jar:4.0-beta1:compile
[INFO] |     |  |  +- wsdl4j:wsdl4j:jar:1.6.2:compile
[INFO] |     |  |  +- backport-util-concurrent:backport-util-concurrent:jar:3.1:compile
[INFO] |     |  |  +- org.apache.ws.commons.schema:XmlSchema:jar:1.4.2:compile
[INFO] |     |  |  +- org.apache.neethi:neethi:jar:2.0.4:compile
[INFO] |     |  |  +- org.apache.woden:woden-api:jar:1.0M8:compile
[INFO] |     |  |  |  \- xerces:xmlParserAPIs:jar:2.6.0:compile
[INFO] |     |  |  +- org.apache.woden:woden-impl-dom:jar:1.0M8:compile
[INFO] |     |  |  +- annogen:annogen:jar:0.1.0:compile
[INFO] |     |  |  \- org.apache.geronimo.specs:geronimo-jms_1.1_spec:jar:1.1:compile
[INFO] |     |  \- org.apache.axis2:axis2-adb:jar:1.4.1:compile
[INFO] |     +- org.apache.ant:ant:jar:1.7.0:compile
[INFO] |     +- org.apache.ant:ant-launcher:jar:1.7.0:compile

I'm certainly not going to be calling ant from my application, and I've been running this app for quite a while without these jars on my classpath. When you create an Axis2 client with wsdl2java a build.xml script is generated as well. This build.xml uses all of the content of your Axis2/lib folder as the build classpath. Instead of manually adding all of these (many) jars as dependencies to the pom.xml I created for this Axis2 client when migrating to Maven2 I just added Axis2 and this, I guess, is the result. I'm thinking I'll just specify excluding files as needed, because I think that it will be less work and less verbose then specifying all the files I do need.

Does this seem like improper use of Maven's dependency management?

[Leroy J Brown]

.

[Emilio Kazwell]

In this situation the Axis2 dependency I have declared actually has a packaging of "pom". Maybe I cannot expect my build to be free of unnecessary components knowing that, however without wsdl2java enumerating the compile and run-time required jars for clients built by that tool it is difficult to cut it off at less than all of Axis2, and if that documentation exists I am unable to locate it.

[Tim Holloway]

You may not be calling Ant from your application, but that doesn't mean that the WSDL compiler might not be doing so.

There are ways in a POM to indicate optional adjuncts, but when the component is listed with a "compile" scope, either it's actually in danger of being invoked at some point (Murphy says, when it's most inconvenient), or someone's been sloppy with the dependency setup.

I'll admit that I have had Axis bite me on version conflicts, but that was 5 years ago.

[Emilio Kazwell]

Tim,

I should have been a little more specific. As the WAR was previously being built, the entire contents of the /lib folder of the Axis2 install was put on the classpath in one way or another because of the way the build.xml's classpath works as mentioned previously, (and because that is the only information I could find on these generated client's dependencies). Ant is not in this folder so I would presume that Ant is not being used by the web service client. I think the primary locus of sloppiness here the just a lack of easy to find documentation on the dependencies of wsdl2java clients. Though there are also other things going on in Axis2's dependency tree, such as references to the same version of java specifications by different modules where one points to the sun jar and another points to the apache geronimo spec jar, which lead me to believe that the Axis2 Maven layout was not very well implemented on its own.

[Tim Holloway]

I think maybe some of this is the usual muddle that happens when a number of people experiment in a number of different ways and you end up with what is basically a set of overlapping, incompatible/dead projects all in one area.

I just took a quick look at the Maven Apache Axis2 repo. I think I'd try including just the axis2-webapp module in the POM, let it suck in any downstream dependencies and add other stuff if/as needed.

Also, looking at the POM for axis2-webapp, I see that apparently it explicitly excludes Ant, which sounds promising.

[Emilio Kazwell]

Thanks Tim,
I'll look at that module.