Maven pulls antlr jar which does not show in dependency:tree

user_815409 0
Viewed 223

I have multiple versions of antlr in my Maven / Java project and I am trying to understand which dependency in the project's pom.xml is pulling which version.

Under my .m2 directory I see three different antlr versions:

~/.m2/repository/antlr/antlr/2.7.2/antlr-2.7.2.jar
~/.m2/repository/antlr/antlr/2.7.7/antlr-2.7.7.jar
~/.m2/repository/.../org.apache.servicemix.bundles.antlr-2.7.7_5.jar

If I run

$ mvn dependency:tree

from the project's root directory, I get:

[INFO] +- org.apache.directory.api:api-all:jar:2.0.0.AM2:compile
[INFO] |  +- ...:org.apache.servicemix.bundles.antlr:jar:2.7.7_5:compile
...
[INFO] +- org.hibernate:hibernate-agroal:pom:5.3.7.Final:compile
[INFO] |  +- io.agroal:agroal-pool:jar:0.4:compile
[INFO] |  +- org.hibernate:hibernate-core:jar:5.3.7.Final:compile
...
[INFO] |  |  +- antlr:antlr:jar:2.7.7:compile

So, Maven finds version 2.7.7_5 (pulled by org.apache.directory.api:api-all) and version 2.7.7 (pulled by org.hibernate:hibernate-agroal) but no version 2.7.2. This version is not listed in the project pom.xml directly.

I deleted the folder .m2/repository/antlr/antlr/2.7.2 and ran

$ mvn compile

from the project's root folder. This immediately downloaded version 2.7.2 again:

[INFO] Scanning for projects...
...
Downloading from central: https://repo.maven.apache.org/maven2/antlr/antlr/2.7.2/antlr-2.7.2.pom
Downloaded from central: https://repo.maven.apache.org/maven2/antlr/antlr/2.7.2/antlr-2.7.2.pom (145 B at 331 B/s)

And, again, mvn dependency:tree shows nothing about version 2.7.2. How can this be? Why does mvn pull a JAR-version that does not show in the project's dependencies? How to find out which dependency in the pom.xml file is pulling this JAR-file?

I have been searching the documentation for the past three hours but I have no clue at the moment.

antlr maven java
2 Answers

Dependencies can also come from plugins, try running dependency:resolve-plugins to resolve all plugins along with their dependencies:

mvn dependency:resolve-plugins

Besides that, the other thing you can probably do is run mvn with -X option for debugging.

user_10642450

Two main possibilities:

  • if only the POM appears in .m2/repository, then this is just part of the dependency resolution process of Maven.
  • if the POM and the JAR appear, and the JAR is not in the dependency tree, then it is likely that a maven plugin pulls the JAR into .m2/repository.

Generally, there is nothing to worry if you find unexpected JARs in your local repository.

user_9274930
Related