We Keep Coding

How do I know why a certain Jar was added to my project?

Is there a way to enter a single jar name to maven and get the full path of jars that added it to my project?

The best thing that you can do is using the mvn dependency:tree command.
It doesn't display the full path of jars that pulled the dependencies.
Instead, it displays the dependency tree for the current Maven project.
You could so know for each resolved dependency the Maven module/dependency that pulled that.
Make the mapping between a dependency identified by the trio groupId-artifactId-version and your local repository should be so very simple.
Here is an example with a project that among other things has jmh as dependency :
[INFO] --- maven-dependency-plugin:2.8:tree (default-cli) # map-benchmark ---
[INFO] davidxxx:map-benchmark:jar:1.0
[INFO] +- junit:junit:jar:4.7:test
[INFO] +- org.openjdk.jmh:jmh-core:jar:1.19:compile
[INFO] | +- net.sf.jopt-simple:jopt-simple:jar:4.6:compile
[INFO] | \- org.apache.commons:commons-math3:jar:3.2:compile
[INFO] \- org.openjdk.jmh:jmh-generator-annprocess:jar:1.19:compile
You can see for example that junit is not a transitive dependency as it pulled by the current project itself.
But you could also see that commons-math3 is a transitive dependency pulled by jopt-simple itself pulled by jmh-core.
The dependency:tree goal can also be used to filter only specific dependencies.
mvn dependency:tree -Dincludes=org.apache.commons:commons-math3
or (note : without prefix if we don't need to specify the groupId) :
mvn dependency:tree -Dincludes=:commons-math3
will output :
[INFO] --- maven-dependency-plugin:2.8:tree (default-cli) # map-benchmark ---
[INFO] davidxxx:map-benchmark:jar:1.0
[INFO] \- org.openjdk.jmh:jmh-core:jar:1.19:compile
[INFO] \- org.apache.commons:commons-math3:jar:3.2:compile
[INFO] ------------------------------------------------------------------------
This plugin can help to solve conflicts.
Here is a relevant example from the documentation.
For example, to find out why Commons Collections 2.0 is being used by
the Maven Dependency Plugin, we can execute the following in the
project's directory:
mvn dependency:tree -Dverbose -Dincludes=commons-collections
The verbose flag instructs the dependency tree to display conflicting
dependencies that were omitted from the resolved dependency tree. In
this case, the goal outputs:
[INFO] [dependency:tree]
[INFO] org.apache.maven.plugins:maven-dependency-plugin:maven-plugin:2.0-alpha-5-SNAPSHOT
[INFO] +- org.apache.maven.reporting:maven-reporting-impl:jar:2.0.4:compile
[INFO] | \- commons-validator:commons-validator:jar:1.2.0:compile
[INFO] | \- commons-digester:commons-digester:jar:1.6:compile
[INFO] | \- (commons-collections:commons-collections:jar:2.1:compile - omitted for conflict with 2.0)
[INFO] \- org.apache.maven.doxia:doxia-site-renderer:jar:1.0-alpha-8:compile
[INFO] \- org.codehaus.plexus:plexus-velocity:jar:1.1.3:compile
[INFO] \- commons-collections:commons-collections:jar:2.0:compile

Check
https://maven.apache.org/plugins/maven-dependency-plugin/examples/filtering-the-dependency-tree.html
You can search for an specific artifact using this maven command:
mvn dependency:tree -Dincludes=DESIRED-groupId:DESIRED-artifactId
Also, if you use eclipse and the m2eclipse plugin (http://m2eclipse.sonatype.org) then there is a graphical version of dependency tree which will help you to filter it by jar name. See: https://books.sonatype.com/m2eclipse-book/reference/dependencies-sect-analyze-depend.html
There should be similar features in other IDEs

Eclipse uses wrong maven dependency in launch configuration

I'm working on a project that uses Maven for dependency / building / whatever (project life cycle management or sth), and I'm using Eclipse to develop and test.
The project uses Vert.x (latest) and I'm trying to use Hazelcast for some cluster management, but I encountered a bug with the Hazelcast version that Vert.x declares as a dependency (3.6.3) and the solution apparently is to upgrade to a more recent version.
I've added an updated Hazelcast dependency in my pom.xml as such:
<dependency>
<groupId>com.hazelcast</groupId>
<artifactId>hazelcast</artifactId>
<version>[3.7,)</version>
</dependency>
And maven indeed updates the dependency (actually Eclipse called maven to update as soon as I save the pom.xml file - pretty neat), and so I get the dependency tree:
$ mvn dependency:tree
[INFO] Scanning for projects...
[INFO]
[INFO] ------------------------------------------------------------------------
[INFO] Building project 3.8.4
[INFO] ------------------------------------------------------------------------
[WARNING] The POM for jfree:jfreechart:jar:1.0.8 is missing, no dependency information available
[INFO]
[INFO] --- maven-dependency-plugin:2.8:tree (default-cli) # project ---
[INFO] my.group:project:jar:3.8.4
[INFO] +- some.private.dep ...
[INFO] | +- org.junit:junit4-engine:jar:5.0.0-ALPHA:compile (version selected from constraint [4,))
[INFO] | | \- org.junit:junit-engine-api:jar:5.0.0-ALPHA:compile
[INFO] | | +- org.junit:junit-commons:jar:5.0.0-ALPHA:compile
[INFO] | | \- org.opentest4j:opentest4j:jar:1.0.0-ALPHA:compile
[INFO] | +- io.vertx:vertx-hazelcast:jar:3.3.3:compile (version selected from constraint [3.0.0,))
[INFO] | \- io.vertx:vertx-web:jar:3.4.0.Beta1:compile (version selected from constraint [3.0.0,))
[INFO] | \- io.vertx:vertx-auth-common:jar:3.4.0.Beta1:compile
[INFO] +- io.vertx:vertx-core:jar:3.4.0.Beta1:compile
[INFO] | +- io.netty:netty-common:jar:4.1.8.Final:compile
[INFO] | +- io.netty:netty-buffer:jar:4.1.8.Final:compile
[INFO] | +- io.netty:netty-transport:jar:4.1.8.Final:compile
[INFO] | +- io.netty:netty-handler:jar:4.1.8.Final:compile
[INFO] | | \- io.netty:netty-codec:jar:4.1.8.Final:compile
[INFO] | +- io.netty:netty-handler-proxy:jar:4.1.8.Final:compile
[INFO] | | \- io.netty:netty-codec-socks:jar:4.1.8.Final:compile
[INFO] | +- io.netty:netty-codec-http:jar:4.1.8.Final:compile
[INFO] | +- io.netty:netty-codec-http2:jar:4.1.8.Final:compile
[INFO] | +- io.netty:netty-resolver:jar:4.1.8.Final:compile
[INFO] | \- io.netty:netty-resolver-dns:jar:4.1.8.Final:compile
[INFO] | \- io.netty:netty-codec-dns:jar:4.1.8.Final:compile
[INFO] +- junit:junit:jar:4.12:test
...
[INFO] +- com.hazelcast:hazelcast:jar:3.8-EA:compile
[INFO] \- org.slf4j:slf4j-jdk14:jar:1.7.22:compile
[INFO] ------------------------------------------------------------------------
[INFO] BUILD SUCCESS
[INFO] ------------------------------------------------------------------------
[INFO] Total time: 2.785 s
[INFO] Finished at: 2017-02-06T09:52:46+02:00
[INFO] Final Memory: 25M/435M
[INFO] ------------------------------------------------------------------------
When I run mvn package to create the shaded Jar, I get the correct version of Hazelcast.
The problem is that if I create an Eclipse launch configuration for running the project or its unit tests, it inserts both the old version of Hazelcast as well as the new version of Hazelcase into the classpath - here's an example command line from a unit test being run:
/usr/lib/jvm/java-8-openjdk-amd64/bin/java -agentlib:jdwp=transport=dt_socket,suspend=y,address=localhost:33123 -ea -Dfile.encoding=UTF-8
-classpath ...:
$HOME/.m2/repository/io/vertx/vertx-hazelcast/3.3.3/vertx-hazelcast-3.3.3.jar:
$HOME/.m2/repository/com/hazelcast/hazelcast/3.6.3/hazelcast-3.6.3.jar:
...
$HOME/.m2/repository/com/hazelcast/hazelcast/3.8-EA/hazelcast-3.8-EA.jar:
...
-version 3 -port 38387 -testLoaderClass org.eclipse.jdt.internal.junit4.runner.JUnit4TestLoader
-loaderpluginname org.eclipse.jdt.junit4.runtime
-classNames my.group.project.SomeTest
Now because both versions are loaded into the classpath, the first one (the older) "wins" and I get the bug instead of getting the newer fixed version.
The launch configuration "Classpath" tab looks very standard:
+ Bootstrap Entries
\- JRE System Library
+ User Enties
\- project
\- Maven Dependencies
And the "Maven Dependencies" "folder" in the "Project Explorer" view shows only the newer Hazelcast version.
What is going on?
Update:
As per the discussion in the comments, I added exclusions to the pom.xml file to prevent vertx-hazelcast from adding the old hazelcast dependency. Because vertx-hazelcast is loaded from yet another (private) dependency, the new setup is a bit more involved and looks like this:
<dependency>
<groupId>some.private</groupId>
<artifactId>dependency</artifactId>
<version>[1.3,)</version>
<exclusions>
<exclusion>
<groupId>io.vertx</groupId>
<artifactId>vertx-hazelcast</artifactId>
</exclusion>
</exclusions>
</dependency>
<dependency>
<groupId>io.vertx</groupId>
<artifactId>vertx-core</artifactId>
<version>[3.0.0,)</version>
</dependency>
<dependency>
<groupId>com.hazelcast</groupId>
<artifactId>hazelcast</artifactId>
<version>[3.7,)</version>
</dependency>
<dependency>
<groupId>io.vertx</groupId>
<artifactId>vertx-hazelcast</artifactId>
<version>[3.0.0,)</version>
<exclusions>
<exclusion>
<groupId>com.hazelcast</groupId>
<artifactId>hazelcast</artifactId>
</exclusion>
</exclusions>
</dependency>
I then removed the old launch configuration and recreated it (by right clicking the JUnit test case and choosing "Debug as Junit") - But that does not change the Eclipse behavior - some jars in the classpath have moved around a bit, but the result is still that vertx-hazelcast and its hazelcast-3.6.3.jar dependency are loaded before hazelcast-3.8.jar.

Note This answer is a summary from discussion with the OP
It looks like vertex-hazelcast declares both compile and test scoped dependencies on hazelcast. These scopes are not transitive so it's my understanding that this version will be included in the classpath by design. #Echnalb suggestion to use an exclusion is the recommended way to resolve this.
As that hasn't worked, it could be an ancestor is also declaring a dependency which would also need to be excluded.
After looking through some other dependencies that were declared in vertex-hazelcast, I checked hazelcast-client to see if it also declared a dependency on the earlier version of hazelcast the assumption being that the ancestral dependency was being added to the classpath despite the exclusion from the parent.
It did include such a dependency:
<dependency>
<groupId>com.hazelcast</groupId>
<artifactId>hazelcast</artifactId>
<scope>test</scope>
<version>${project.parent.version}</version>
<classifier>tests</classifier>
</dependency>
I suggest(ed) adding an exclusion for hazelcast-client which seems to have solved the problem.
#Guss comments
Prior to the exclusion, running dependency:tree, hazelcast-client is
not listed at all
It is interesting that dependency:tree does not detect test scoped dependencies. Is there's a way to force it to switch scopes?

Class 'XXX/XXX/XXX ' is not accessible through the ClassLoader warning in Sonar analysis with Jenkins build and maven project

I know it's recurent question but I couldn't find a solution to my issue.
In JENKINS, I run a SONAR analysis after the build. When Soanar gets to Java bytecode scan... it displays : WARN - Class '.../.../.../...' is not accessible through the ClassLoader.
The scan is on a Maven project, and Sonar keeps displayin this message throw many other classes that uses Maven dependancies.
The Sonar analysis is using the SONAR-RUNNER.
I saw in many posts, that the issue could be fixed by adding sonar.librairies=/path/to/libraries/*jar in the sonar-project.properties but with Maven , dependancies are not grouped under one folder. Jar's are dispatched under different folders under the maven-repositories.
So how can I fix this issue to scan my code without these warnings ?
FYI :
Jenkins 1.555
Sonar 4.2
Sonar Runner 2.3
Java 1.7
Maven 3.04
Stack Trace :
09:23:55.605 INFO - Java bytecode scan...
09:23:55.646 WARN - Class 'org/springframework/context/ApplicationContext' is not accessible through the ClassLoader.
09:23:55.656 WARN - Class 'com/mongodb/MongoClient' is not accessible through the ClassLoader.
09:23:55.657 WARN - Class 'com/mongodb/DB' is not accessible through the ClassLoader.
09:23:55.661 WARN - Class 'org/springframework/context/ApplicationContext' is not accessible through the ClassLoader.
09:23:55.662 WARN - Class 'org/springframework/context/ApplicationContext' is not accessible through the ClassLoader.
...
09:23:55.749 WARN - Class 'org/apache/log4j/Logger' is not accessible through the ClassLoader.
09:23:55.773 INFO - Java bytecode scan done: 168 ms
Edit :
Running mvn dependency:tree in jenkins build :
[INFO] --- maven-dependency-plugin:2.1:tree (default-cli)
[INFO] +- org.springframework:spring-context:jar:4.0.3.RELEASE:compile
[INFO] | +- org.springframework:spring-aop:jar:4.0.3.RELEASE:compile
[INFO] | | \- aopalliance:aopalliance:jar:1.0:compile
[INFO] | +- org.springframework:spring-beans:jar:4.0.3.RELEASE:compile
[INFO] | +- org.springframework:spring-core:jar:4.0.3.RELEASE:compile
[INFO] | | \- commons-logging:commons-logging:jar:1.1.3:compile
[INFO] | \- org.springframework:spring-expression:jar:4.0.3.RELEASE:compile
[INFO] +- org.springframework:spring-webmvc:jar:4.0.3.RELEASE:compile
[INFO] | \- org.springframework:spring-web:jar:4.0.3.RELEASE:compile
[INFO] +- org.springframework:spring-test:jar:4.0.3.RELEASE:test
[INFO] +- org.apache.poi:poi:jar:3.9:compile
[INFO] | \- commons-codec:commons-codec:jar:1.5:compile
...
...
[INFO] +- org.mockito:mockito-all:jar:1.9.5:test
[INFO] +- com.jayway.jsonpath:json-path:jar:0.9.1:test
[INFO] | \- net.minidev:json-smart:jar:1.2:test
[INFO] +- org.hamcrest:hamcrest-all:jar:1.3:test
[INFO] \- junit:junit:jar:4.11:test (scope not updated to compile)
[INFO] ------------------------------------------------------------------------
[INFO] BUILD SUCCESS
[INFO] ------------------------------------------------------------------------
Thanks

Since Maven lists the missing classes, you're probably using the Jenkins plugin to run Sonar. I never used this plugin but my guess is that it doesn't know about Maven. Therefore, it can't create a classpath from the POM and the classes are really missing when it runs.
Try to run Sonar using the Maven goal: mvn sonar:sonar after configuring the Sonar plugin for Maven correctly.

The type javax.validation.Payload cannot be resolved. It is indirectly referenced from required .class files

I am using eclipse to try to run a simple project here. When I typed contents in eclipse, it says: The type javax.validation.Payload cannot be resolved. It is indirectly referenced from required .class files. In the example shown there, he used maven and in my practice I haven't.
I also have maven plugin in eclipse m2e-wtp latest and kepler version of eclipse. I tried many websites, such as this one. Here he used command window and used some commands, but when I tried in my pc, it didn't work. I think maven needs to set in my environment variable. That means I have to install maven in my c:/programfiles or any.
Is there a way to run the commands in eclipse(naive)? can some one give me a link to build sample maven project using m2e eclipse?

I downloaded the application, and it ran fine on my computer.
All I did was unzip and type:
mvn clean tomcat:run-war
I think you might be missing a transitive dependency (which Maven will automatically download), ensure you have all of these on your eclipse classpath:
$ mvn dependency:tree
[INFO] Scanning for projects...
[INFO]
[INFO] ------------------------------------------------------------------------
[INFO] Building SpringMVC Maven Webapp 1.0-SNAPSHOT
[INFO] ------------------------------------------------------------------------
[INFO]
[INFO] --- maven-dependency-plugin:2.1:tree (default-cli) # SpringMVC ---
[INFO] com.mkyong.common:SpringMVC:war:1.0-SNAPSHOT
[INFO] +- org.springframework:spring-core:jar:3.0.5.RELEASE:compile
[INFO] | +- org.springframework:spring-asm:jar:3.0.5.RELEASE:compile
[INFO] | \- commons-logging:commons-logging:jar:1.1.1:compile
[INFO] +- org.springframework:spring-web:jar:3.0.5.RELEASE:compile
[INFO] | +- aopalliance:aopalliance:jar:1.0:compile
[INFO] | +- org.springframework:spring-beans:jar:3.0.5.RELEASE:compile
[INFO] | \- org.springframework:spring-context:jar:3.0.5.RELEASE:compile
[INFO] | \- org.springframework:spring-aop:jar:3.0.5.RELEASE:compile
[INFO] +- org.springframework:spring-webmvc:jar:3.0.5.RELEASE:compile
[INFO] | +- org.springframework:spring-context-support:jar:3.0.5.RELEASE:compile
[INFO] | \- org.springframework:spring-expression:jar:3.0.5.RELEASE:compile
[INFO] \- org.hibernate:hibernate-validator:jar:4.2.0.Final:compile
[INFO] +- javax.validation:validation-api:jar:1.0.0.GA:compile
[INFO] \- org.slf4j:slf4j-api:jar:1.6.1:compile
[INFO] ------------------------------------------------------------------------
[INFO] BUILD SUCCESS
[INFO] ------------------------------------------------------------------------
[INFO] Total time: 2.132s
[INFO] Finished at: Wed Sep 04 22:07:24 CDT 2013
[INFO] Final Memory: 6M/15M
[INFO] ------------------------------------------------------------------------
My guess is this jar:
javax.validation:validation-api:jar:1.0.0.GA:compile

Maven Dependancy Refereing old Poi Version

I am using Apache Poi version 3.8 in my POM. But it is still downloading poi-3.2 along with poi-3.8 as (may be) due to some internal dependency. The strange behavior for me is My project using poi-3.2 when even I have mentioned 3.8 version in POM. I have Googled a lot for the same, but found myself unlucky.
Here is my POM entry :
<dependency>
<groupId>org.apache.poi</groupId>
<artifactId>poi</artifactId>
<version>3.8</version>
<type>jar</type>
</dependency>
I have checked the poi jar my project using in classpath by the code:
ClassLoader classloader =
org.apache.poi.poifs.filesystem.POIFSFileSystem.class.getClassLoader();
URL res = classloader.getResource(
"org/apache/poi/poifs/filesystem/POIFSFileSystem.class");
String path = res.getPath();
System.out.println("Core POI came from " + path);
This prints :
Core POI came from file:/D:/Software/Softwares/apache-tomcat-6.0.33/webapps/scd-web/WEB-INF/lib/poi-3.2.jar!/org/apache/poi/poifs/filesystem/POIFSFileSystem.class
There is a poi-3.8.jar in same folder but classpath picking up 3.2.
My question is :
What should I do to so that My project uses poi-3.8.jar instead of poi-3.2.jar.
Many Thanks !!
Edited:
Output of mvn dependency:tree
[INFO] Building SCD-common [INFO] task-segment: [dependency:tree]
[INFO]
------------------------------------------------------------------------
[WARNING] While downloading xmlbeans:xmlbeans:2.3.0 This artifact has been relocated to org.apache.xmlbeans:xmlbeans:2.3.0.
[INFO] [dependency:tree] [INFO] com.idc:scd-common:jar:4.2.0.5
[INFO] +- org.springframework:spring-webmvc:jar:2.5.6:compile
[INFO] | +- commons-logging:commons-logging:jar:1.1.1:compile
[INFO] | +- org.springframework:spring-beans:jar:2.5.6:compile
[INFO] | +- org.springframework:spring-context-support:jar:2.5.6:compile
[INFO] | \- org.springframework:spring-web:jar:2.5.6:compile
[INFO] +- com.idc.worldwide.keystones:service-single-signon-dynamo-api:jar:1.0:compile
[INFO] +- com.idc.worldwide.keystones:service-single-signon-dynamo-database-impl:jar:1.0.3:compile
[INFO] | +- org.apache:commons-dbcp:jar:1.2.2:compile
[INFO] | +- org.apache:commons-pool:jar:1.4:compile
[INFO] | \- com.idc.worldwide.webchannel:sage-core:jar:3.2.0.001:compile
[INFO] | +- com.idc.webchannel.legacy.sage-dependencies:aspose-slides:jar:1. 0:compile
[INFO] | +- com.servlets:cos:jar:09May2002:compile
[INFO] | +- com.sun:jai_codec:jar:1.1.3:compile
[INFO] | +- com.sun:jai_core:jar:1.1.3:compile
[INFO] | +- com.verity:k2:jar:5.00.3177.0:compile
[INFO] | +- org.apache:poi:jar:3.2:compile
[INFO] | +- org.apache:poi_contrib:jar:3.2:compile
[INFO] | +- org.apache:poi_scratchpad:jar:3.2:compile
[INFO] | \- org.springframework:spring:jar:2.5.6:compile
[INFO] +- org.springframework:spring-core:jar:3.0.5.RELEASE:compile
[INFO] | \- org.springframework:spring-asm:jar:3.0.5.RELEASE:compile
[INFO] +- org.springframework:spring-aop:jar:3.0.5.RELEASE:compile

There are various mvn command to help solving this issue:
mvn dependency:analyze-dep-mgt
will print details about dependency resolving.
mvn dependency:tree
will print the dependency tree (very helpful to see dependencies of your dependencies)
mvn help:effective-pom
will print the pom resulting from the merge of your pom hierarchy.
If you don't find any references to poi-3.2 with maven, you can take a look at your classpath in your IDE. Do you add any jar by-passing maven ?
Editing your question with the result of those commands can be useful for us to help you.

Looks like
org.apache:poi:jar:3.2
is a compile dependency of
com.idc.worldwide.keystones:service-single-signon-dynamo-database-impl
(although I think you may have cut something)
and
org.apache.poi:poi:jar:3.8
is not a dependency (it's not in the dependency tree).
Make sure your <dependency> entry is within the <dependencies> tag.

Run
mvn dependency:tree
to check which library has a transitive dependency to poi 3.2. You can then exclude it in your pom.
<dependency>
<groupId>sample.group</groupId>
<artifactId>sample-artifactB</artifactId>
<version>1</version>
<exclusions>
<groupId>org.apache.poi</groupId>
<artifactId>poi</artifactId>
</exclusion>
</exclusions>
</dependency>

Maybe you are mixing normal dependency with plugin dependency, see here (not too fitting answer).
Use dependency management in the root POM if you have child projects.