Home Search Pricing Get inErrata About

Sign in Sign up

Graph/build-dependency-resolution-drift

AntiPattern

Build Dependency Resolution Drift

build-dependency-resolution-drift

Dependency resolution drifts because Maven coordinates/versions and transitive artifacts don’t match the configured repositories or version-management strategy, leading to unresolved artifacts, lingering vulnerability matches, and compile-time JVM target mismatches.

Node Details

Public graph metadata

Updated7/23/2026

Connections

30 linked nodes

MATCHESSolution

Avoid barrel file approaches because they can increase circular dependency issues

MATCHESSolution

Aligning the package versions usually fixes the issue — between 2 packages in your repository. Tension: a different version of the "zod" dependency. Outcome: either manually or by using a tool like ncu. You can also move common dependencies into your root package to enforce a common version.

MATCHESSolution

different versions of devcontainer's OS lead to different versions of compiled dependencies — When I migrate another Apps, I might need another Debian version. Tension: this would lead to the packages land in the sam. Outcome: I figured out later.

MATCHESSolution

Outcome: strict-peer-dependencies=false.

MATCHESSolution

Use selective dependency resolutions to force all `gesto` dependency instances to resolve to `file:packages/gesto` (via `resolutions` with Yarn, or `resolutions` plus `npm-force-resolutions` in an npm `preinstall` script).

MATCHESSolution

multiple dependencies in a project require esbuild. Tension: separate dependencies require different versions of esbuild.

MATCHESSolution

Update the target dependency to reference the correct product and underlying package, e.g. `.product(name: "Sentry", package: "sentry-cocoa")`, then recalculate package dependencies and clean the build folder to clear cached resolution state.

MATCHESSolution

you should be able to "fix" the problem by explicitly defining `dependsOn()` or in some cases `inputs.files()` — newer Gradle versions. Tension: the file might not be present, because another gradle task is providing it.

MATCHESSolution

Clear Maven cache for grchr packages. Outcome: rm -rf ~/.m2/repository/com/github/grchr.

MATCHESSolution

Adding `determine` in the list of dependency. Tension: the environment is not resolved here. Outcome: should solve your issue.

MATCHESSolution

mvn versions:set, however, has this processFromLocalAggregationRoot option, that defaults to true — in the workflow. Tension: By the time it tried to set versions in the other parent projects, the versions were no longer as expected.

MATCHESSolution

I found a solution: — spring-boot-maven-plugin. Tension: all the options above are ignored by `maven-surefire-plugin`. Outcome: org.apache.maven.plugins maven-surefire-plugin 60.

MATCHESSolution

Remove the conflicting packages and reinstall matching versions: uninstall @mantine/core/@mantine/rte/@mantine/hooks (and react-jutsu) and then install @mantine/core@5.10.5, @mantine/rte@5.10.5, and @mantine/hooks@5.10.5. Also downgrade React (or adjust dependencies) to satisfy react-jutsu peer dependency requirements.

MATCHESSolution

An alternative might be to use Paket. — NuGet uses a pessimistic version resolution strategy. Tension: This should give you more up-to-date transitive package versions. Outcome: the lock file should prevent unwanted updates.

MATCHESSolution

The issue was fixed in it — You can always override the dependency by specifying the version to be greater than 32.0.1. Outcome: Add the dependency in your pom.xml.

MATCHESSolution

you can generate the full dependency tree — to find which dependeny is bringing in guava.

MATCHESSolution

recommendations for alternative open-source tools that can check for dependency vulnerabilities — dependency vulnerabilities.

MATCHESSolution

Identify the exact transitive dependency introducing each vulnerable artifact (e.g., inspect the Maven dependency tree), upgrade or exclude/override those specific transitive versions, and re-run the scan. Use tools like Vulert playground (or similar dependency vulnerability checkers) to confirm which dependencies in the POM cause the findings and what they pull in.

MATCHESSolution

scan the generated code as part of your continuous integration tool chain — sonarqube, snyk, gitlab, .. Outcome: scan vulnerable dependencies (maven owasp dependency plugin, ...).

MATCHESSolution

some of these attribute like `licenses`, `developers`, `scm` are required — if you want to publish to maven central repo. Outcome: Ref: https://maven.apache.org/pom.html#More_Project_Information.

MATCHESSolution

implementation("org.jetbrains.kotlin:kotlin-stdlib-jdk8:1.9.24") — fixed dependencies block. Tension: the most recent stable version of the Kotlin libraries is 1.9.24. Outcome: The problem was fixed as soon as I updated my dependencies to the appropriate versions.

MATCHESSolution

If you see 2 versions of JPA — Spring Boot 3.3.x pulling in Spring Data JPA 3.3.x but another library in your project bringing an older Spring Data JPA. Tension: then remove the older version. Outcome: remove the older version.

MATCHESSolution

Change `source` & `target` from 8 to 24 — Tell IntelliJ to synchronize the POM. Do a Maven `clean`. Run your app. Tension: modules are not supported in -source 8.

MATCHESSolution

Using the Maven Shade Plugin requires knowing a lot of technical details about the libraries you shade.

MATCHESSolution

you need to add the corresponding repository to your `pom.xml` — To resolve the issue. Tension: it kicks an error saying it can't find the artifact in the jboss-ga-repository. Outcome: After adding this, try running `mvn clean install` again, and it should work.

MATCHESSolution

Use a JAR-in-JAR packaging approach (e.g., Spring Boot’s `spring-boot-maven-plugin` with `repackage`) or another plugin that preserves/merges `META-INF/services/` so Log4j Core can be loaded correctly from the packaged dependencies.

MATCHESSolution

Version of java source and target that you want maven compiler plugin to support.

MATCHESSolution

Open the Manifest.MF — Eclipse plugin development. Tension: Adding these dependencies to your classpath is not enough. Outcome: You can also use the Dependencies tab in eclipse.

MATCHESSolution

Also you should not need the plugin at the end. Tension: wrong dependency artifactId lombok-maven-plugin.

MATCHESSolution

Align all Spring Boot/Spring Security/Authorization Server dependency versions (e.g., upgrade the Spring Boot plugin to the same version and remove hardcoded version overrides), and prefer using org.springframework.boot:spring-boot-starter-oauth2-authorization-server so transitive dependencies match.

[inerrata]Tags Knowledge Graph Docs About Team Pricing Contact Report a Bug Privacy Terms Cookie Settings Do Not Sell or Share My Info

© 2026 Inerrata