text: Details
  - Type:
  New Feature
  - Status: Reopened
  - Priority:
  Major
  - Resolution: Unresolved
  - Affects Version/s: None
  - Fix Version/s: needing-scrub-3.4.0-fallout
  -
  - Labels:None
  Description
  I depend on some libraries, which in turn depend on something
  (which in turn depend on something) that I don't want, because I declare
  some other artifact in my pom.xml.
  A concrete example: I don't want that the artifact "xerces" is imported in
  my project because I declare to depend on "xercesImpl" which ships newer
  libraries but with the same namespaces.
  I guess I would need an "exclude transitive dependency at all", either
  globally or from this and that artifact. I saw the <exclusions> tag, but it
  forces me to be very verbose and have exact control on what is required by a
  dependency.
  Issue Links
  - is duplicated by
  -
  -
  -
  -
  -
  -
  - is related to
  -
  - is superceded by
  -
  - relates to
  -
  -
  -
  -
  - mentioned in
  -
  Activity
  - All
  - Work Log
  - History
  - Activity
  - Transitions
  Adding another possibly featured way to configure:
  - disable all transitive deps for certain scopes
  (e.g.: I'ld like transitive deps marked for 'runtime' and 'compile', but not for 'test')
  The squeakiest tire get the oil first : That would be indeed a much wanted feature.
  Gilles
  Gilles Tabary
  Hi,!
  The main issue it that it can't be specified in the current pom model (4.0.0) and updates to the pom model require the next version aka 2.1.
  There is a way to detect these creeping in, in dependency:analyze-dep-mgt and in the next enforcer release, there will be a rule that can fail the build when any excluded dependencies are found in the build.
  I don't know, I will miss all of the late nights and long weekends I spend analyzing the dependency tree trying to get rid of one stupid JAR file that causes the application not to run properly. What will I do with all my extra time? Wow, maybe I can actually DEVELOP something.
  I can just agree to others here, this is indeed a VERY important feature. It would ease the development a lot. As if you currently have such a bogus dependency you'll have to copy and paste every possible exclusion to every dependency. This is really ugly and costs a lot of time.
  I'm currently also suffering from the lack of this feature and would be extremely grateful to see this one added
  Cheers,
  C
  It seems to me that the original problem would be solved better by artifact substitution or aliasing rather than more exclusions. e.g if you want to use something reasonable such as slf4j to imitate commons logging usage you want to replace any dependency on commons-logging with one on jcl-over-slf4j. Similarly you might want to swap spec implementations, say to use the geronimo ones no matter which copies the original projects were built against, or use geronimo's activation implementation instead of sun's. This isn't quite the same as what osgi gives you but is quite powerful.
  You are right David, that would solve the original problem in an elegant way. Is this an existing feature I missed or should we submit a new jira issue for this?
  Aliasing would be nice. But I would also like to be able to specify that, for example, junit-3.8.1 should NEVER be downloaded and never be resolved as a dependency for my projects. I don't ever want junit-3.8.1 and junit-4.5 to both be in the same classpath.
  This just became a total showstopper with SpringSource effectively cloning the entire maven dependency set in their "enterprise" repo.
  I know that's not maven's fault, but both global exclusions (e.g. as protections again known bad poms) and aliasing (to always substitute slf4j for clogging) would really fix a lot of problems that this has caused.
  That's a lovely development. If you use Nexus, you can control which artifacts come from a given repo so you can prevent the springsource repo from polluting your team. There's nothing that can be done inside maven for global exclusions until 3.0 since it requires a model change in the pom.
  It's a sad thing that this will never be available for backports because the pom model cannot be changed..
  Pierre,
  The pom format can't be changed until Maven 3.x. The alphas of 3.x are close by, but currently it's focused on 2.x compatibility with the new code and a process to handle pom model changes hasn't been built yet.
  Could this not be achieved via a new scope? I'm thinking:
  <dependency>
  <groupId>commons-logging</groupId>
  <artifactId>commons-logging</artifactId>
  <version>1.1.1</version>
  <scope>excluded</scope>
  </dependency>
  Semantics would be that any artifactId declared in this way would be guaranteed not to be on either the test or main runtime or compile time classpath, and neither would any of its transitive dependencies, and its transitive dependencies would not be added to the declaring pom's transitive dependencies, regardless of version number or where in the transitive dependency tree it occurred.
  (This is effectively how people are achieving the desired effect already, by using scope "provided" - but that has the negative that the artifact and all of its transitive dependencies are still on the compile classpath raising the possibility of errors only discovered at runtime.)
  Hi Robert,
  You are right to observe that the provided scope has the inconvenience of placing the thus "excluded" artifact on the project's class path within the IDE, in particular Eclipse. However, as far as I know, the artifact is effectively excluded during build time by Maven. The provided scope is unsatisfactory during development time within the IDE, i.e. within Eclipse or IDEA.
  Maven definitely makes provided scope dependencies available at compile time - otherwise no library compiled against the servlet api would compile. A good example in the logging context would be someone who desired to use slf4j-over-log4j instead of log4j. Making log4j itself have scope provided would have the desired runtime behaviour of excluding the log4j jar if any transitive dependency brought it in, thereby preventing any non-determinate behaviour depending on which version of the log4j classes the classloader loaded first; however, at compile time Maven would happily be able to compile code dependent on classes that are included in log4j but are not in slf4j-over-log4j, and the user would only discover the problem at runtime.
  D'oh! Thanks for the explanation.
  Hello,
  I gave a go at this new feature following
  Rob Elliot's idea of using a
  <scope>excluded</scope>
  . And it works a treat for me.
  I uploaded the maven changes + integration test as patches.
  Thanks,
  Jean-Noel
  Hi, I didn't review your patch thus I won't judge about it.
  I really dislike this idea to continue to play with the lake of control in old maven versions which will ignore things they don't know in the POM.
  For me such change must be done only in a new POM version and with all mechanisms to be used with previous and future maven versions.
  Did you test such POM with Maven 3.0.x ? I think it at least display a warning if there is a scope it doesn't know (I don't remember but perhaps it breaks the build).
  And when a maven version ignores it, what does it do ? It uses the compile scope ? #fail in that case, instead of excluding it, you explicitely add it (transitively)
  Cheers
  Hello,
  BTW the <scope>excluded</scope> solution doesn't really helps in any way to deal easily with excludes.
  It looks like a hard-wired work-around.
  Adding a <transitive>true|false</transitive> or a <handling>transitive|simple</handling> (maybe better to allow further unforeseen improvements) both at the level of all <dependencies></dependencies> or at the level of a single <dependency></dependency> wouldn't be hard to deal with (just a test to trigger the transitive search of the underlying tree) and would achieve the expected result.
  I thought that the pom model was supposed to evolve from version 3.0.x on?
  Regards.
  Pierre-Antoine.
  @Arnaud Sorry, I went for the easiest to implement. If you do not like it this way, fair enough, we can do it otherwise. I originally started with such change to the pom.xml:
  <project> <dependencies> <exclusions> <exclusion> <groupId>com.mycompany</groupId> <artifactId>myproject</artifactId> <classifier>optional</classifier> </exclusion> </exclusions> <dependency> ... </dependency> ... </dependencies> ... </project>
  No I did not test with older versions of maven.
  I saw that maven-3 has got some validation mechanism for the scope so I think it would reject it.
  For maven-2 I need to check. Indeed the following scenario would be catastrophic:
  "And when a maven version ignores it, what does it do ? It uses the compile scope ? #fail in that case, instead of excluding it, you explicitely add it (transitively)".
  I will test both of these and let you know.
  Same, it does not really matter to me which mechanism you prefer to use. Just tell me how you want it to look in the pom.xml and I can have a look at doing it.
  Jean-Noel
  Hi Arnaud,
  You were right, using <scope>excluded</scope> with older versions of maven (I used v2.2.1) gives the opposite result to what is intended. The excluded scope is ignored and replaced with a compile scope.
  How do you want to proceed now? I suppose we now need to do a pom.xml format change. If I understood correctly , this is scheduled for maven 3.1.
  Do you want to go for the solution I suggested in my last comment?
  Or do you want to do it differently?
  Please let me know your suggestions and I will try to implement it.
  Thanks,
  Jean-Noël
  Might be that this is already commented, but here's what we need:
  - Possibility to exclude transitive dependencies using groupId only (meaning all artifacts/versions within that groupId)
  - Another nice feature would be, a global pom setting that says: "Use transitive dependencies during compile, but not during packaging". Meaning: You can quickly get up developing code (getting all dependencies needed), but when bundling ex a war file, exclude trans. dep. because you want to control the war content.
  - Also a nice feature would be to turn off transitive dependencies all together
  I think there's some allusion to a version 5 of pom.xml, which would be interesting.
  If nothing else, I certainly support the idea of <scope>exclude</scope>.
  It is time that we got a release that solved some of the longest standing issues and gave us an opportunity to move forwards rather than to live with backwards compatibility that kills us.
  I love the idea of allowing a switch to change
  compile -> compile = compile
  to what was originally intended, that
  compile -> compile = runtime
  This would make many builds far more robust to changes in child dependencies.
  @Morten: I think that "Include transitive dependencies during packaging" should rather be a feature of war, shade and other packaging plugins. There must already be enough information available to plugins through project meta-data, because maven-assembly-plugin has already got an option to filter out transitive dependencies.
  @Neale: I agree that it would make a lot of sense to promote transitive compile dependencies into runtime scope, but unfortunately that does not solve the problem of polluting the runtime scope with unwanted transitive dependencies.
  More flexible exclusion mechanism using patterns or some other configuration is still needed.
  compile -> compile = runtime
  This would make many builds far more robust to changes in child dependencies.
  You can simulate this if you use a global master pom. Then you would not only set the version in the depMgmt, but also the scope of all deps to runtime. That will have the same effect, you would have to set compile scope explicitly everywhere in our project. Been there and reverted it ... you'll see yourself, if you try
  Thanks for the feedback guys.
  My use case is as simple as that: I want to exclude some transitive dependencies accross all dependencies to allow compiling GWT code. Otherwise I get the error "the input line is too long" on windows. So far we have to exclude the same transitive dependencies for all the dependencies where they exist which can be as many as 8 today. Not nice :-/, hence why I am looking at this solution. A simple global exclude would solve the problem for us.
  It looks to me the code I did is good enough to handle my use case. I just need to know how the Maven team wants this configuration to look in the pom.xml file and then I can look at doing it.
  Hello,
  I gave another go at this issue.
  This time, I specified the exclusions in the pom.xml file by following this approach:
  <project> <dependencies> ... </dependencies> ... <exclusions> <exclusion> <groupId>com.mycompany</groupId> <artifactId>myproject</artifactId> </exclusion> </exclusions> ... </project>
  Please let me know what you think of these patches.
  Thanks,
  Jean-Noel
  +1 to this, though i'm not sure if maven is still being actively developed ?
  JvZ - why not Maven 3.1 for this? It's highly voted and there's a patch, yet no comment on the patch has been made. That's not good for goodwill
  A real world problem needs a solution. Is there any real intention to adress this?
  8 years, 155 votes, 5 duplicates and 4 patches later I wonder: should I be proud or embarrassed that the issue is still unresolved?
  i just lost 2 days peppering my poms with individual exclusions. can we please have this feature?
  It has been always a problem for anyone who hates common loggings
  Really, this is a MUST-HAVE.
  When using log4j2 there is a Jakarta Commons Logging Bridge that has the full commons-logging.jar as a dependency.
  That means the global exclusion needs to make sure that I can exclude all transitive deps to "commons-logging", except for the log4j-jcl.jar.
  Maybe like this:
  <project> <exclusions> <exclusion> <groupId>commons-logging</groupId> <artifactId>commons-logging</artifactId> </exclusion> </exclusions> </project>
  and for the log4j-jcl dependency:
  <dependency> <groupId>org.apache.logging.log4j</groupId> <artifactId>log4j-jcl</artifactId> <version>${log4j2.version}</version> <inclusions> <!-- ... --> </inclusions> </dependency>
  Starting with Maven 3.2.1 there is simply a solution which excludes all transitve dependencies:
  <dependencies> <dependency> <groupId>org.apache.maven</groupId> <artifactId>maven-embedder</artifactId> <version>3.1.0</version> <exclusions> <exclusion> <groupId>*</groupId> <artifactId>*</artifactId> </exclusion> </exclusions> </dependency> ... </dependencies>
  maven-embedder,it's aim to embeded maven?,where can i find some more details about this maven plugin.here too little infos.
  Starting with Maven 3.4, you can manage dependencies to optional in dependency management. That is the same as excluding them globally when not explicitly declared as a direct dependency.
  This has been revert for 3.4 and got postponed for 3.5.
  Looking at the original ask, the correct solution is, rather that global exclusions, the ability to say X supplies Y as in something along the lines of either MNG-177 or MNG-5652
  IMHO a global excludes both complicates things for users as well as acting as a siren's call... applying exclusions is really an indication that somebody has done something wrong. We should not remove the ability to apply one-off per dependency fix-ups... individual projects can and will make mistakes from time to time... but a global exclusion, to my mind, indicates that the project that declares the global exclusion has made a mistake... they should just fix the mistake, rather than continue to propagate it further
  Not targetted for 3.5.0
  Also, people are actually deploying high availability maven repositories containing only "99-version-does-not-exist" of empty artifacts ( ) just to get around this problem. This shows how badly this is needed..
  From
  MNG-2031:
  Transitive dependencies are cool, however, the limitations are very difficult to work around.
  One cool feature would be to allow disabling transitive dependencies in the following ways: