Maven Dependency Tree - Some dependencies of Spring use old version

Question

I do not have so much experience with Maven (I apologies in advance, if you will find the following scenario trivial). In POM.xml, I specified Spring version:

<properties>
...
    <spring.version>4.3.6.RELEASE</spring.version>
</properties>

and then, I use it for all the Spring dependencies:

...
    <dependency>
        <groupId>org.springframework</groupId>
        <artifactId>spring-aop</artifactId>
        <version>${spring.version}</version>
    </dependency>
...

But when I execute: mvn dependency:tree , I can see that some dependencies (for example: spring-core) use old version numbers. Can you explain this please.

Tracking admin$ mvn dependency:tree
[INFO] Scanning for projects...
[INFO]                                                                         
[INFO] ------------------------------------------------------------------------
[INFO] Building Tracking 1.0-SNAPSHOT
[INFO] ------------------------------------------------------------------------
[INFO] 
[INFO] --- maven-dependency-plugin:3.0.0:tree (default-cli) @ Tracking ---
[INFO] com.mycompany:Tracking:war:1.0-SNAPSHOT
[INFO] +- javax.persistence:persistence-api:jar:1.0.2:compile
[INFO] +- javax.validation:validation-api:jar:1.1.0.Final:compile
[INFO] +- javax.servlet:javax.servlet-api:jar:3.0.1:provided
[INFO] +- com.sun.jersey:jersey-server:jar:1.2:compile
[INFO] |  +- com.sun.jersey:jersey-core:jar:1.2:compile
[INFO] |  |  \- javax.ws.rs:jsr311-api:jar:1.1.1:compile
[INFO] |  \- asm:asm:jar:3.1:compile
[INFO] +- com.sun.jersey.contribs:jersey-spring:jar:1.17:compile
[INFO] |  \- com.sun.jersey:jersey-servlet:jar:1.17:compile
[INFO] +- org.springframework:spring-aop:jar:3.0.0.RC3:compile
[INFO] |  +- aopalliance:aopalliance:jar:1.0:compile
[INFO] |  \- org.springframework:spring-asm:jar:3.0.0.RC3:compile
[INFO] +- org.springframework:spring-aspects:jar:4.3.6.RELEASE:compile
[INFO] |  \- org.aspectj:aspectjweaver:jar:1.8.9:compile
[INFO] +- org.springframework:spring-beans:jar:3.0.0.RC3:compile
[INFO] +- org.springframework:spring-context:jar:3.0.0.RC3:compile
[INFO] +- org.springframework:spring-context-support:jar:4.3.6.RELEASE:compile
[INFO] +- org.springframework:spring-core:jar:3.0.0.RC3:compile
[INFO] |  \- commons-logging:commons-logging:jar:1.1.1:compile
[INFO] +- org.springframework:spring-expression:jar:4.3.6.RELEASE:compile
[INFO] +- org.springframework:spring-instrument:jar:4.3.6.RELEASE:compile
[INFO] +- org.springframework:spring-instrument-tomcat:jar:4.3.6.RELEASE:compile
[INFO] +- org.springframework:spring-jdbc:jar:4.3.6.RELEASE:compile
[INFO] +- org.springframework:spring-jms:jar:4.3.6.RELEASE:compile
[INFO] +- org.springframework:spring-messaging:jar:4.3.6.RELEASE:compile
[INFO] +- org.springframework:spring-orm:jar:4.3.6.RELEASE:compile
[INFO] +- org.springframework:spring-oxm:jar:4.3.6.RELEASE:compile
[INFO] +- org.springframework:spring-test:jar:4.3.6.RELEASE:compile
[INFO] +- org.springframework:spring-tx:jar:4.3.6.RELEASE:compile
[INFO] +- org.springframework:spring-web:jar:3.0.0.RC3:compile
[INFO] +- org.springframework:spring-webmvc:jar:4.3.6.RELEASE:compile
[INFO] +- org.springframework:spring-webmvc-portlet:jar:4.3.6.RELEASE:compile
[INFO] +- org.springframework:spring-websocket:jar:4.3.6.RELEASE:compile
[INFO] +- javax.servlet.jsp.jstl:javax.servlet.jsp.jstl-api:jar:1.2.1:compile
[INFO] +- mysql:mysql-connector-java:jar:5.1.6:compile
[INFO] +- xerces:xercesImpl:jar:2.11.0:compile
[INFO] +- cglib:cglib:jar:3.2.4:compile
[INFO] |  +- org.ow2.asm:asm:jar:5.1:compile
[INFO] |  \- org.apache.ant:ant:jar:1.9.6:compile
[INFO] |     \- org.apache.ant:ant-launcher:jar:1.9.6:compile
[INFO] +- org.apache.commons:commons-lang3:jar:3.5:compile
[INFO] +- org.liquibase:liquibase-maven-plugin:jar:3.0.4:compile
[INFO] |  +- org.apache.maven:maven-plugin-api:jar:2.0:compile
[INFO] |  +- org.apache.maven:maven-project:jar:2.0:compile
[INFO] |  |  +- org.apache.maven:maven-profile:jar:2.0:compile
[INFO] |  |  +- org.apache.maven:maven-model:jar:2.0:compile
[INFO] |  |  +- org.apache.maven:maven-artifact-manager:jar:2.0:compile
[INFO] |  |  |  +- org.apache.maven:maven-repository-metadata:jar:2.0:compile
[INFO] |  |  |  \- org.apache.maven.wagon:wagon-provider-api:jar:1.0-alpha-5:compile
[INFO] |  |  +- org.codehaus.plexus:plexus-utils:jar:1.0.4:compile
[INFO] |  |  +- org.apache.maven:maven-artifact:jar:2.0:compile
[INFO] |  |  \- org.codehaus.plexus:plexus-container-default:jar:1.0-alpha-8:compile
[INFO] |  |     +- junit:junit:jar:3.8.1:compile
[INFO] |  |     \- classworlds:classworlds:jar:1.1-alpha-2:compile
[INFO] |  \- org.liquibase:liquibase-core:jar:3.0.4:compile
[INFO] +- org.yaml:snakeyaml:jar:1.18:compile
[INFO] \- xml-apis:xml-apis:jar:1.4.01:compile
[INFO] ------------------------------------------------------------------------
[INFO] BUILD SUCCESS
[INFO] ------------------------------------------------------------------------
[INFO] Total time: 7.200 s
[INFO] Finished at: 2017-02-26T18:02:17+02:00
[INFO] Final Memory: 17M/220M
[INFO] ------------------------------------------------------------------------
Tracking admin$ 

Answer 1

If you want to use artifacts with version matching ${spring.version} , you need to provide core dependencies manually. Some Spring dependencies use artifacts with older versions.

Also useful thing is dependency exclusion which you can use here to say strictly to Maven that you don't want to use specific dependency from other dependencies.

Example of exclusion:

<dependencies>
    <dependency>
      <groupId>sample.spring</groupId>
      <artifactId>spring-something</artifactId>
      <version>${spring.version}</version>
      <exclusions>
        <exclusion>
          <groupId>sample.spring</groupId> <!-- exclude spring-other from spring-something -->
          <artifactId>spring-other</artifactId>
        </exclusion>
      </exclusions>
    </dependency>
</dependencies>