Maven - Dependencies vs DependencyManagement

In this article, I am going to talk about maven’s core parts, Dependencies and DependencyManagement (especially sub moduling wise).

Let’s start with what dependencies section is in a pom file. Dependencies part is where we define our dependencies that we are going to use in our project. For instance, if we want to use Guava utilities in our project we add it to our pom as follows

<dependencies>
    <dependency>
        <groupId>com.google.guava</groupId>
        <artifactId>guava</artifactId>
        <version>30.1.1-jre</version>
    </dependency>
</dependencies>

There is an import point we are going to use when comparing the two. Dependencies we add under dependencies tag will be directly conveyed to sub modules of the module we add dependencies. So the module which has the following pom will directly have dependency guava with the version defined in parent dependency.

<?xml version="1.0" encoding="UTF-8"?>
<project xmlns="http://maven.apache.org/POM/4.0.0"
         xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
    <modelVersion>4.0.0</modelVersion>

    <groupId>org.example</groupId>
    <artifactId>child</artifactId>
    <version>1.0-SNAPSHOT</version>

    <parent>
        <groupId>org.example</groupId>
        <artifactId>parent</artifactId>
        <version>1.0-SNAPSHOT</version>
    </parent>
</project>

Then, we have dependency management section. Unlike dependencies, the dependencies under dependency management tag are not going to be conveyed to sub module but it will be a version template for it. When you put a dependency under dependency management, you need to define your dependency under sub module without version because it will use the version the parent defined. Here we have example for it

<dependencyManagement> 
    <dependencies>
        <dependency>
            <groupId>com.google.guava</groupId>
            <artifactId>guava</artifactId>
            <version>30.1.1-jre</version>
        </dependency>
    </dependencies>
</dependencyManagement>

Let us have a look at full parent pom

<?xml version="1.0" encoding="UTF-8"?>
<project xmlns="http://maven.apache.org/POM/4.0.0"
         xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
    <modelVersion>4.0.0</modelVersion>

    <groupId>org.example</groupId>
    <artifactId>parent</artifactId>
    <version>1.0-SNAPSHOT</version>

    <dependencies>
        <dependency>
            <groupId>com.google.guava</groupId>
            <artifactId>guava</artifactId>
            <version>30.1.1-jre</version>
        </dependency>
    </dependencies>
</project>

With the above parent pom, child pom (see second snippet) will get the guava dependency and will able to use it without adding anything to the pom. When we change the above pom to the following, child will not be able to use guava.

<?xml version="1.0" encoding="UTF-8"?>
<project xmlns="http://maven.apache.org/POM/4.0.0"
         xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
    <modelVersion>4.0.0</modelVersion>

    <groupId>org.example</groupId>
    <artifactId>parent</artifactId>
    <version>1.0-SNAPSHOT</version>

    <dependencyManagement>
        <dependencies>
            <dependency>
                <groupId>com.google.guava</groupId>
                <artifactId>guava</artifactId>
                <version>30.1.1-jre</version>
            </dependency>
        </dependencies>
    </dependencyManagement>
</project>

If child wants to use guava, it has to add dependency explicitly as follows

<?xml version="1.0" encoding="UTF-8"?>
<project xmlns="http://maven.apache.org/POM/4.0.0"
         xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
    <modelVersion>4.0.0</modelVersion>

    <groupId>org.example</groupId>
    <artifactId>child</artifactId>
    <version>1.0-SNAPSHOT</version>

    <parent>
        <groupId>org.example</groupId>
        <artifactId>parent</artifactId>
        <version>1.0-SNAPSHOT</version>
    </parent>

    <dependencies>
        <dependency>
            <groupId>com.google.guava</groupId>
            <artifactId>guava</artifactId>
        </dependency>
    </dependencies>
</project>

If you need a more concrete example, most Spring Boot projects have the following parent to centralize dependencies. By this, you will not have to worry about version conflicts as parent module already provides compatible versions for related dependencies.

<parent>
    <groupId>org.springframework.boot</groupId>
    <artifactId>spring-boot-starter-parent</artifactId>
    <version>2.2.5.RELEASE</version>
    <relativePath/>
</parent>

To sum it up, we use dependency management to create template for versioning the dependencies and use dependencies section to pass dependency down to child modules.

In this tutorial, I talked about one of the core concepts of maven. I hope you find it useful and enjoy it.