Maven: Unrequested jars polluting my lib folder

Question

I have a spring project and I noticed that the size of the project was higher than what I expected. I opened the generated jar files that was produced via mvn clean install in the lib folder. I noticed that there were a lot of jars in there that I never requested for example, junit.jar , mockito-core.jar , android-json.jar and more are included in my lib directory which I never requested.

Where are these unnecessary, rogue jars coming from?

---

My pom.xml is the following:

<project xmlns="http://maven.apache.org/POM/4.0.0"
    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">

    <modelVersion>4.0.0</modelVersion>
    <groupId>com.att.onem</groupId>
    <artifactId>SearchSMSHistory</artifactId>
    <version>1.0</version>
    <packaging>jar</packaging>

    <name>SMSSearchService</name>
    <description>SMS Search Service</description>

    <parent>
        <groupId>org.springframework.boot</groupId>
        <artifactId>spring-boot-starter-parent</artifactId>
        <version>1.5.10.RELEASE</version>
        <relativePath /> <!-- lookup parent from repository -->
    </parent>

    <properties>
        <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
        <project.reporting.outputEncoding>UTF-8</project.reporting.outputEncoding>
        <java.version>1.8</java.version>
    </properties>

    <dependencies>
        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-web</artifactId>
            <!-- Exclude Spring Boot's Default Logging -->
            <exclusions>
                <exclusion>
                    <groupId>org.springframework.boot</groupId>
                    <artifactId>spring-boot-starter-logging</artifactId>
                </exclusion>
            </exclusions>
        </dependency>
        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-test</artifactId>
        </dependency>
        <dependency>
            <groupId>com.oracle</groupId>
            <artifactId>ojdbc7</artifactId>
            <version>12.1.0.1</version>
        </dependency>
        <dependency>
            <groupId>commons-pool</groupId>
            <artifactId>commons-pool</artifactId>
        </dependency>
        <dependency>
            <groupId>org.springframework.cloud</groupId>
            <artifactId>spring-cloud-starter-config</artifactId>
            <version>1.4.2.RELEASE</version>
        </dependency>
        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-jdbc</artifactId>
        </dependency>
        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-devtools</artifactId>
            <optional>true</optional>
        </dependency>

        <!-- Add Log4j2 Dependency -->
        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-log4j2</artifactId>
         </dependency>

        <!-- Needed for Async Logging with Log4j 2 -->
        <dependency>
            <groupId>com.lmax</groupId>
            <artifactId>disruptor</artifactId>
            <version>3.3.6</version>
        </dependency>

        <!-- Swagger dependencies -->



        <dependency>
            <groupId>com.github.ulisesbocchio</groupId>
            <artifactId>jasypt-spring-boot-starter</artifactId>
            <version>2.0.0</version>
        </dependency>
    </dependencies>

    <build>
        <finalName>smshistory</finalName>
        <plugins>
            <plugin>
                <groupId>org.springframework.boot</groupId>
                <artifactId>spring-boot-maven-plugin</artifactId>
            </plugin>
            <plugin>
                <groupId>org.apache.maven.plugins</groupId>
                <artifactId>maven-compiler-plugin</artifactId>
                <configuration>
                    <source>1.8</source>
                    <target>1.8</target>
                </configuration>
            </plugin>
        </plugins>
    </build>


</project>

Answer 1

You need to define the <scope> tag for test dependencies.

    <dependency>
        <groupId>org.springframework.boot</groupId>
        <artifactId>spring-boot-starter-test</artifactId>
        <scope>test</scope>
    </dependency>

From the Maven documentation:

There are 6 scopes available:

compile This is the default scope, used if none is specified. Compile dependencies are available in all classpaths of a project. Furthermore, those dependencies are propagated to dependent projects.

provided This is much like compile, but indicates you expect the JDK or a container to provide the dependency at runtime. For example, when building a web application for the Java Enterprise Edition, you would set the dependency on the Servlet API and related Java EE APIs to scope provided because the web container provides those classes. This scope is only available on the compilation and test classpath, and is not transitive.

runtime This scope indicates that the dependency is not required for compilation, but is for execution. It is in the runtime and test classpaths, but not the compile classpath.

test This scope indicates that the dependency is not required for normal use of the application, and is only available for the test compilation and execution phases. This scope is not transitive.

system This scope is similar to provided except that you have to provide the JAR which contains it explicitly. The artifact is always available and is not looked up in a repository.

import (only available in Maven 2.0.9 or later) This scope is only supported on a dependency of type pom in the section. It indicates the dependency to be replaced with the effective list of dependencies in the specified POM's section. Since they are replaced, dependencies with a scope of import do not actually participate in limiting the transitivity of a dependency.

https://maven.apache.org/guides/introduction/introduction-to-dependency-mechanism.html

Answer 2

You can examine your transitive dependencies using mvn dependency:tree . I pared down your dependencies to just the starter spring libraries and this is all the dependencies you pull in.

[INFO] com.att.onem:SearchSMSHistory:jar:1.0
[INFO] +- org.springframework.boot:spring-boot-starter-web:jar:1.5.10.RELEASE:compile
[INFO] |  +- org.springframework.boot:spring-boot-starter:jar:1.5.10.RELEASE:compile
[INFO] |  |  \- org.yaml:snakeyaml:jar:1.17:runtime
[INFO] |  +- org.springframework.boot:spring-boot-starter-tomcat:jar:1.5.10.RELEASE:compile
[INFO] |  |  +- org.apache.tomcat.embed:tomcat-embed-core:jar:8.5.27:compile
[INFO] |  |  |  \- org.apache.tomcat:tomcat-annotations-api:jar:8.5.27:compile
[INFO] |  |  +- org.apache.tomcat.embed:tomcat-embed-el:jar:8.5.27:compile
[INFO] |  |  \- org.apache.tomcat.embed:tomcat-embed-websocket:jar:8.5.27:compile
[INFO] |  +- org.hibernate:hibernate-validator:jar:5.3.6.Final:compile
[INFO] |  |  +- javax.validation:validation-api:jar:1.1.0.Final:compile
[INFO] |  |  +- org.jboss.logging:jboss-logging:jar:3.3.1.Final:compile
[INFO] |  |  \- com.fasterxml:classmate:jar:1.3.4:compile
[INFO] |  +- com.fasterxml.jackson.core:jackson-databind:jar:2.8.10:compile
[INFO] |  |  +- com.fasterxml.jackson.core:jackson-annotations:jar:2.8.0:compile
[INFO] |  |  \- com.fasterxml.jackson.core:jackson-core:jar:2.8.10:compile
[INFO] |  +- org.springframework:spring-web:jar:4.3.14.RELEASE:compile
[INFO] |  |  +- org.springframework:spring-aop:jar:4.3.14.RELEASE:compile
[INFO] |  |  +- org.springframework:spring-beans:jar:4.3.14.RELEASE:compile
[INFO] |  |  \- org.springframework:spring-context:jar:4.3.14.RELEASE:compile
[INFO] |  \- org.springframework:spring-webmvc:jar:4.3.14.RELEASE:compile
[INFO] |     \- org.springframework:spring-expression:jar:4.3.14.RELEASE:compile
[INFO] +- org.springframework.boot:spring-boot-starter-test:jar:1.4.2.RELEASE:compile
[INFO] |  +- org.springframework.boot:spring-boot-test:jar:1.5.10.RELEASE:compile
[INFO] |  +- org.springframework.boot:spring-boot-test-autoconfigure:jar:1.5.10.RELEASE:compile
[INFO] |  +- com.jayway.jsonpath:json-path:jar:2.2.0:compile
[INFO] |  |  +- net.minidev:json-smart:jar:2.2.1:compile
[INFO] |  |  |  \- net.minidev:accessors-smart:jar:1.1:compile
[INFO] |  |  |     \- org.ow2.asm:asm:jar:5.0.3:compile
[INFO] |  |  \- org.slf4j:slf4j-api:jar:1.7.25:compile
[INFO] |  +- junit:junit:jar:4.12:compile
[INFO] |  +- org.assertj:assertj-core:jar:2.6.0:compile
[INFO] |  +- org.mockito:mockito-core:jar:1.10.19:compile
[INFO] |  |  \- org.objenesis:objenesis:jar:2.1:runtime
[INFO] |  +- org.hamcrest:hamcrest-core:jar:1.3:compile
[INFO] |  +- org.hamcrest:hamcrest-library:jar:1.3:compile
[INFO] |  +- org.skyscreamer:jsonassert:jar:1.4.0:compile
[INFO] |  |  \- com.vaadin.external.google:android-json:jar:0.0.20131108.vaadin1:compile
[INFO] |  +- org.springframework:spring-core:jar:4.3.14.RELEASE:compile
[INFO] |  \- org.springframework:spring-test:jar:4.3.14.RELEASE:compile
[INFO] +- org.springframework.cloud:spring-cloud-starter-config:jar:1.4.2.RELEASE:compile
[INFO] |  +- org.springframework.cloud:spring-cloud-starter:jar:1.3.2.RELEASE:compile
[INFO] |  |  +- org.springframework.cloud:spring-cloud-context:jar:1.3.2.RELEASE:compile
[INFO] |  |  |  \- org.springframework.security:spring-security-crypto:jar:4.2.4.RELEASE:compile
[INFO] |  |  +- org.springframework.cloud:spring-cloud-commons:jar:1.3.2.RELEASE:compile
[INFO] |  |  |  \- org.apache.httpcomponents:httpclient:jar:4.5.5:compile
[INFO] |  |  |     +- org.apache.httpcomponents:httpcore:jar:4.4.9:compile
[INFO] |  |  |     \- commons-codec:commons-codec:jar:1.10:compile
[INFO] |  |  \- org.springframework.security:spring-security-rsa:jar:1.0.3.RELEASE:compile
[INFO] |  |     \- org.bouncycastle:bcpkix-jdk15on:jar:1.55:compile
[INFO] |  |        \- org.bouncycastle:bcprov-jdk15on:jar:1.55:compile
[INFO] |  \- org.springframework.cloud:spring-cloud-config-client:jar:1.4.2.RELEASE:compile
[INFO] +- org.springframework.boot:spring-boot-starter-jdbc:jar:1.4.2.RELEASE:compile
[INFO] |  +- org.apache.tomcat:tomcat-jdbc:jar:8.5.27:compile
[INFO] |  |  \- org.apache.tomcat:tomcat-juli:jar:8.5.27:compile
[INFO] |  \- org.springframework:spring-jdbc:jar:4.3.14.RELEASE:compile
[INFO] |     \- org.springframework:spring-tx:jar:4.3.14.RELEASE:compile
[INFO] +- org.springframework.boot:spring-boot-devtools:jar:1.4.2.RELEASE:compile
[INFO] |  +- org.springframework.boot:spring-boot:jar:1.5.10.RELEASE:compile
[INFO] |  \- org.springframework.boot:spring-boot-autoconfigure:jar:1.5.10.RELEASE:compile
[INFO] \- org.springframework.boot:spring-boot-starter-log4j2:jar:1.5.10.RELEASE:compile
[INFO]    +- org.apache.logging.log4j:log4j-slf4j-impl:jar:2.7:compile
[INFO]    +- org.apache.logging.log4j:log4j-api:jar:2.7:compile
[INFO]    +- org.apache.logging.log4j:log4j-core:jar:2.7:compile
[INFO]    +- org.slf4j:jcl-over-slf4j:jar:1.7.25:compile
[INFO]    \- org.slf4j:jul-to-slf4j:jar:1.7.25:compile

Spring's starters bring in a lot of dependencies, which is helpful for ensuring you get the correct version, but the cost is that you may have plenty of dependencies you don't actually need.

Your two choices for excluding dependencies are restricting scope, or manually excluding it using dependency exclusions.

In the case of a test framework, you'd typically annotate it as test scope.

<dependency>
    <groupId>org.springframework.boot</groupId>
    <artifactId>spring-boot-starter-test</artifactId>
    <version>1.4.2.RELEASE</version>
    <scope>test</scope>
</dependency>

Alternatively if you want to exclude one of its dependencies, ie if it is an older version, or you have legacy code that requires an older version, you can use exclusions and manually provide the library your project requires. This is also useful for just shrinking down the starter packages which may bring in things you don't need, For example, I have never heard of the skyscreamer jsonassert test library, and if I didn't have to test json, I would possibly exclude it because I really don't need to handle that part.

<dependency>
    <groupId>org.springframework.cloud</groupId>
    <artifactId>spring-cloud-starter-config</artifactId>
    <exclusions>
        <exclusion>
            <groupId>org.bouncycastle</groupId>
            <artifactId>bcprov-jdk15on</artifactId>
        </exclusion>
    </exclusions>
</dependency>
<dependency>
    <groupId>org.bouncycastle</groupId>
    <artifactId>bcprov-jdk16</artifactId>
</dependency>