I ran into an issue compile a jar with many dependencies, in particular overlapping versions of snakeyaml (we need 1.11, some dependency was pulling in 1.9). We ran mvn dependency:tree but we did not see the offending secondary version in any of the output. On further inspection, is was jruby-complete that was then pulling in snakeyaml. Why didn't mvn dependency:tree show us this level of drill down:
[INFO] | | +- org.apache.hbase:hbase-it:jar:0.98.6-cdh5.2.5:compile
[INFO] | | | +- (org.apache.hbase:hbase-common:jar:0.98.6-cdh5.2.5:compile - omitted for duplicate)
[INFO] | | | +- (org.apache.hbase:hbase-protocol:jar:0.98.6-cdh5.2.5:compile - omitted for duplicate)
[INFO] | | | +- (org.apache.hbase:hbase-client:jar:0.98.6-cdh5.2.5:compile - omitted for duplicate)
[INFO] | | | +- org.apache.hbase:hbase-shell:jar:0.98.6-cdh5.2.5:compile
[INFO] | | | | +- (org.apache.hbase:hbase-common:jar:0.98.6-cdh5.2.5:compile - omitted for duplicate)
[INFO] | | | | +- (org.apache.hbase:hbase-protocol:jar:0.98.6-cdh5.2.5:compile - omitted for duplicate)
[INFO] | | | | +- (org.apache.hbase:hbase-client:jar:0.98.6-cdh5.2.5:compile - omitted for duplicate)
[INFO] | | | | +- (org.apache.hbase:hbase-prefix-tree:jar:0.98.6-cdh5.2.5:runtime - omitted for duplicate)
[INFO] | | | | +- (org.apache.hbase:hbase-server:jar:0.98.6-cdh5.2.5:compile - omitted for duplicate)
[INFO] | | | | +- (org.apache.hbase:hbase-hadoop-compat:jar:0.98.6-cdh5.2.5:compile - omitted for duplicate)
[INFO] | | | | +- (org.apache.hbase:hbase-hadoop2-compat:jar:0.98.6-cdh5.2.5:compile - omitted for duplicate)
[INFO] | | | | +- (com.yammer.metrics:metrics-core:jar:2.2.0:compile - omitted for duplicate)
[INFO] | | | | +- (commons-logging:commons-logging:jar:1.1.1:compile - omitted for conflict with 1.2)
[INFO] | | | | +- org.jruby:jruby-complete:jar:1.6.8:compile
>>>>>>> WHY ARE THERE NO DEPENDENCIES HERE? >>>>>>>>>
[INFO] | | | | +- (org.cloudera.htrace:htrace-core:jar:2.04:compile - omitted for duplicate)
[INFO] | | | | +- (org.apache.hadoop:hadoop-common:jar:2.5.0-cdh5.2.5:compile - omitted for duplicate)
Why wasn't the dependencies of jruby-complete listed in the tree? Does mvn dependency:tree only gfo to a certain depth? What are the rules here? If mvn dependency:tree had simply shown us its snakeyaml dependency we could have saved a couple hours of complex debugging.