为何dependencyManagement中重复依赖不继承？Maven场景验证

核心疑问 #

• 若在子POM的dependencyManagement中添加父POM已管控的重复dependency，依赖管理仅会识别最后一次声明，父POM中的声明会被忽略。是否存在不继承父POMdependencyManagement的场景？
• 子POM仅修改父POM已管控依赖的scope（或添加exclusions）但不指定版本时，Maven解析出的版本不符合预期：比如父POM管控了io.r2dbc:r2dbc-spi:0.9.1.RELEASE，子POM引用依赖org.jooq:jooq:3.16.9（其传递依赖io.r2dbc:r2dbc-spi:0.9.0.RELEASE），本应继承父POM的新版本，但实际解析为传递依赖的旧版本。

官方文档说明 #

根据Maven官方文档，dependencyManagement中的重复依赖属于重新声明，不会继承父POM的配置：

Finally, since d is specified in B's dependency management section, should d be a dependency (or transitive dependency) of a or c, version 1.0 will be chosen - again because dependency management takes precedence over dependency mediation and also because the current POM's declaration takes precedence over its parent's declaration.

（翻译：最后，由于d在B的依赖管理部分被声明，若d是a或c的依赖（或传递依赖），则会选择版本1.0——这是因为依赖管理优先于依赖调解，且当前POM的声明优先于其父POM的声明。）

示例POM文件 #

父POM #

<?xml version="1.0" encoding="UTF-8"?>
<project xmlns="http://maven.apache.org/POM/4.0.0"
         xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
    <modelVersion>4.0.0</modelVersion>

    <groupId>org.example</groupId>
    <artifactId>MavenParentTest</artifactId>
    <version>1.0-SNAPSHOT</version>
    <packaging>pom</packaging>

    <properties>
        <maven.compiler.source>17</maven.compiler.source>
        <maven.compiler.target>17</maven.compiler.target>
        <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
    </properties>

    <dependencyManagement>
        <dependencies>
            <dependency>
                <groupId>io.r2dbc</groupId>
                <artifactId>r2dbc-spi</artifactId>
                <version>0.9.1.RELEASE</version>
            </dependency>
            <dependency>
                <groupId>org.jooq</groupId>
                <artifactId>jooq</artifactId>
                <version>3.16.9</version>
            </dependency>
        </dependencies>
    </dependencyManagement>

    <build>
        <pluginManagement>
            <plugins>
                <plugin>
                    <groupId>org.apache.maven.plugins</groupId>
                    <artifactId>maven-dependency-plugin</artifactId>
                    <version>3.3.0</version> <!-- just to fix plugins version -->
                </plugin>
            </plugins>
        </pluginManagement>
    </build>

</project>

子POM #

<?xml version="1.0" encoding="UTF-8"?>
<project xmlns="http://maven.apache.org/POM/4.0.0"
         xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
    <modelVersion>4.0.0</modelVersion>

    <artifactId>MavenChildTest</artifactId>

    <parent>
        <groupId>org.example</groupId>
        <artifactId>MavenParentTest</artifactId>
        <version>1.0-SNAPSHOT</version>
    </parent>

    <dependencyManagement>
        <dependencies>
            <dependency>
                <groupId>io.r2dbc</groupId>
                <artifactId>r2dbc-spi</artifactId>
                <scope>runtime</scope>
            </dependency>
        </dependencies>
    </dependencyManagement>

    <dependencies>
        <dependency>
            <groupId>org.jooq</groupId>
            <artifactId>jooq</artifactId>
        </dependency>
    </dependencies>
</project>

执行命令及结果 #

执行命令：mvn dependency:tree -f child/pom.xml

输出结果：

[INFO] --- maven-dependency-plugin:3.3.0:tree (default-cli) @ MavenChildTest ---
[INFO] org.example:MavenChildTest:jar:1.0-SNAPSHOT
[INFO] \- org.jooq:jooq:jar:3.16.9:compile
[INFO]    +- io.r2dbc:r2dbc-spi:jar:0.9.0.RELEASE:runtime
[INFO]    |  \- org.reactivestreams:reactive-streams:jar:1.0.3:runtime
[INFO]    \- jakarta.xml.bind:jakarta.xml.bind-api:jar:3.0.0:compile
[INFO]       \- com.sun.activation:jakarta.activation:jar:2.0.0:compile

内容的提问来源于stack exchange，提问作者Paul