Maven Dependency Management is importing wrong version

Question

I am cloning project to import a 7.13 version dependency as depicted here. As you can see, the camunda-webapp: 7.11.0 (managed from 7.13.0) is creeping in. This is causing some ClassNotFoundExceptions since I need camunda-webapp: 7.13.0 which IS happening correctly in a diff project I dont own. I did a lot of digging and exclusions but I'm not able to figure out where is this whole 7.11.0 (managed from 7.13.0) is even coming from.

How can i force this project to use 7.13.0 throughout?

However, In another project importing 7.13 imports the transitive 7.13 correctly.

EDIT - Updating the POM here to triage the fix:

<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
  <modelVersion>4.0.0</modelVersion>
  <groupId>org.camunda.bpm.getstarted</groupId>
  <artifactId>camunda-ctil-cockpit</artifactId>
  <version>0.0.1-SNAPSHOT</version>

  <properties>
    <camunda.spring-boot.version>7.13.0</camunda.spring-boot.version>
    <spring-boot.version>2.3.9.RELEASE</spring-boot.version>
    <maven.compiler.source>1.8</maven.compiler.source>
    <maven.compiler.target>1.8</maven.compiler.target>
    <capitalone.camunda.plugin.version>1.5</capitalone.camunda.plugin.version>
  </properties>
  
  <dependencyManagement>
    <dependencies>
      <dependency>
        <groupId>org.springframework.boot</groupId>
        <artifactId>spring-boot-dependencies</artifactId>
        <version>${spring-boot.version}</version>
        <type>pom</type>
        <scope>import</scope>
      </dependency>
      <dependency>
        <groupId>com.capitalone.camunda.plugins</groupId>
        <artifactId>plugin-dependencies</artifactId>
        <version>${capitalone.camunda.plugin.version}</version>
        <type>pom</type>
        <scope>import</scope>
      </dependency>
    </dependencies>

  </dependencyManagement>
  
  <dependencies>
    <dependency>
      <groupId>org.camunda.bpm.springboot</groupId>
      <artifactId>camunda-bpm-spring-boot-starter-webapp</artifactId>
      <version>${camunda.spring-boot.version}</version>
      <exclusions>
        <exclusion>
            <groupId>org.camunda.bpm.webapp</groupId>
            <artifactId>camunda-webapp-webjar</artifactId>
        </exclusion>
      </exclusions>
    </dependency>
    <dependency>
      <groupId>org.camunda.bpm.springboot</groupId>
      <artifactId>camunda-bpm-spring-boot-starter-rest</artifactId>
      <version>${camunda.spring-boot.version}</version>
    </dependency>
    <dependency>
      <groupId>mysql</groupId>
      <artifactId>mysql-connector-java</artifactId>
    </dependency>

    <dependency>
      <groupId>org.springframework.boot</groupId>
      <artifactId>spring-boot-starter-jdbc</artifactId>
    </dependency>

    <dependency>
      <groupId>com.sun.xml.bind</groupId>
      <artifactId>jaxb-impl</artifactId>
      <version>2.2.3</version>
    </dependency>
    <dependency>
      <groupId>com.capitalone.camunda.plugins</groupId>
      <artifactId>capitalone-uioverlay</artifactId>
      <exclusions>
        <exclusion>
            <groupId>org.camunda.bpm.webapp</groupId>
            <artifactId>camunda-webapp</artifactId>
        </exclusion>
      </exclusions>
    </dependency>
    <dependency>
      <groupId>com.capitalone.camunda.plugins</groupId>
      <artifactId>spring-plugin-commons</artifactId>
    </dependency>
    <dependency>
      <groupId>com.capitalone.camunda.plugins</groupId>
      <artifactId>custom-engine-types</artifactId>
      <exclusions>
        <exclusion>
            <groupId>org.camunda.bpm.webapp</groupId>
            <artifactId>camunda-webapp</artifactId>
        </exclusion>
      </exclusions>
    </dependency>
    <dependency>
      <groupId>com.capitalone.camunda.plugins</groupId>
      <artifactId>common-cockpit-extensions</artifactId>
      <exclusions>
        <exclusion>
            <groupId>org.camunda.bpm.webapp</groupId>
            <artifactId>camunda-webapp</artifactId>
        </exclusion>
      </exclusions>
    </dependency>
    <dependency>
      <groupId>org.camunda.bpm.identity</groupId>
      <artifactId>camunda-identity-ldap</artifactId>
    </dependency>
    <dependency>
      <groupId>org.springframework.security</groupId>
      <artifactId>spring-security-core</artifactId>
    </dependency>
    <dependency>
      <groupId>org.springframework.cloud</groupId>
      <artifactId>spring-cloud-starter-oauth2</artifactId>
    </dependency>
    <dependency>
      <groupId>org.projectlombok</groupId>
      <artifactId>lombok</artifactId>
      <version>1.18.2</version>
    </dependency>

    <dependency>
      <groupId>commons-lang</groupId>
      <artifactId>commons-lang</artifactId>
      <version>2.6</version>
    </dependency>

    <dependency>
      <groupId>com.h2database</groupId>
      <artifactId>h2</artifactId>
    </dependency>
  </dependencies>
  
   <build>
    <plugins>
      <plugin>
        <groupId>org.springframework.boot</groupId>
        <artifactId>spring-boot-maven-plugin</artifactId>
        <version>${spring-boot.version}</version>
        <configuration>
          <layout>ZIP</layout>
        </configuration>
        <executions>
          <execution>
            <goals>
              <goal>repackage</goal>
            </goals>
          </execution>
        </executions>
      </plugin>
    </plugins>
     <finalName>camunda-ctil-cockpit</finalName>
  </build>
  
</project>

However this results still in. As you can see 7.11 is still there. If I exclude 7.11 completely, the camunda-webapp.jar completely disappears. Was hoping 7.13 would get popped in. Also camunda-webapp-webjar is completely removed, comparing to the screenshots above:

Answer 1

First change the property value of

<camunda.spring-boot.version>3.2.0</camunda.spring-boot.version>

to 7.13.0 See eg https://start.camunda.com/

If the issue persists the the plugin jars define their own versions, not driven by the BOM:

You shared the main project POM including the engine and webapps, but the unwanted dependency is coming in as a dependency of your custom com.capitalone.* jars, as the screenshot of the dependency tree shows. camunda-webapp:7.11.0 is a dependency which is pulled in by

1)
<dependency>
      <groupId>com.capitalone.camunda.plugins</groupId>
      <artifactId>capitalone-uioverlay</artifactId>
    </dependency>
2)  
    <dependency>
      <groupId>com.capitalone.camunda.plugins</groupId>
      <artifactId>custom-engine-types</artifactId>
    </dependency>
3)
    <dependency>
      <groupId>com.capitalone.camunda.plugins</groupId>
      <artifactId>common-cockpit-extensions</artifactId>
    </dependency>

A) If possible update the POMs of those projects and run a mvn clean install on them

B) If you have no control over these projects then you can also add exclusions to the dependency tags listed above (as the jar is already included in the main project). However, this would mean your plugin jars running with another jar version than they have been compiled against. It is not a good practice and may cause issue if compatibility changed.

On a different note: "Please note that we updated the frontend plugin interface with Camunda Platform Runtime 7.14. Plugins written for Camunda Platform Runtime 7.13 and earlier might no longer work with Camunda Platform Runtime 7.14. Checkout the update guide for more details." https://docs.camunda.org/manual/latest/webapps/cockpit/extend/plugins/