All 15 Build Tools: Maven & Gradle questions
More in Build Tools: Maven & Gradle
What is the standard Maven directory layout, and why does following this convention matter? What is the Maven build lifecycle, and what do the common phases (validate, compile, test, package, install, deploy) each do? How does Gradle's build script (build.gradle / build.gradle.kts) differ structurally from Maven's declarative XML pom.xml? What is the difference between Maven's <dependencies> scope values (compile, provided, runtime, test) and how do they affect what's included in the final packaged artifact? What is a Maven BOM (Bill of Materials), and how does it help manage consistent dependency versions across a multi-module project or organization? How do you manage different configurations for different environments (development, staging, production) using Maven profiles or Gradle's equivalent mechanisms? How do you configure the Maven Compiler Plugin to target a specific Java language version, and what's the difference between source, target, and release configuration? How does Maven's dependency resolution algorithm handle transitive dependency version conflicts, and what is the "nearest definition wins" rule? How does Gradle's incremental build and build cache mechanism achieve significantly faster rebuild times compared to Maven's default behavior? How would you configure a multi-module Maven or Gradle project, and what benefits does modularizing a large codebase this way provide?
Advertisement
Back to results for “Security”
Java › Build Tools: Maven & Gradle

How do you resolve a dependency version conflict manually in Maven using exclusions, and when would this be necessary despite the automatic nearest-wins resolution?

Intermediate

Answer

<exclusions> inside a <dependency> declaration explicitly prevents a specific transitive dependency from being pulled in through that particular parent dependency, useful when the automatic nearest-wins resolution selects an incompatible or vulnerable version, or when you want to substitute your own explicitly-declared version of that transitive dependency instead -- necessary in scenarios like a security vulnerability being patched in a newer version of a transitive library that the automatic resolution wouldn't otherwise select.
<dependency>
    <groupId>com.example</groupId>
    <artifactId>some-library</artifactId>
    <version>1.0.0</version>
    <exclusions>
        <exclusion>
            <groupId>com.fasterxml.jackson.core</groupId>
            <artifactId>jackson-databind</artifactId>
        </exclusion>
    </exclusions>
</dependency>

<!-- Now explicitly declare the desired, patched version yourself -->
<dependency>
    <groupId>com.fasterxml.jackson.core</groupId>
    <artifactId>jackson-databind</artifactId>
    <version>2.15.3</version>  <!-- patched for a known CVE -->
</dependency>
Real-world example A security audit flags a known CVE in a transitive jackson-databind version pulled in indirectly through a third-party library, resolved by explicitly excluding that transitive dependency and declaring the patched version directly, without needing to wait for the third-party library maintainer to update their own dependency.

Common follow-ups: How would you use `mvn dependency:tree` to identify exactly which parent dependency is pulling in the problematic transitive version?;What's the equivalent mechanism in Gradle for excluding a specific transitive dependency?

Security Headers Antiforgery & CSRF Protection;Diagnostics & Performance
All 15 Build Tools: Maven & Gradle questions