Java: How to Remove Unused Dependencies from a Maven pom.xml

The Maven Dependency Plugin will help, especially the dependency:analyze goal:

dependency:analyze analyzes the dependencies of this project and determines which are: used and declared; used and undeclared; unused and declared.

Another thing that might help to do some cleanup is the Dependency Convergence report from the Maven Project Info Reports Plugin.

Let's use maven-depedency-plugin to find obvious (and easy) stuff to fix:

1. Duplicated Dependencies

mvn dependency:analyze-duplicate

Just remove what's duplicated and that's it.

2. Used and declared; used and undeclared; unused and declared

mvn dependency:analyze

This will take a while and may warn you about a lot of depedency errors.

You will be able to remove dependencies that are not used anymore and add dependencies that are directly used.

Beware: This might show some false-positives.

Bring the big guns

1. Multiple versions of the same depedency

This is the harder, as maven doesn't have a plugin to find them easily.

So, I used a little bit of bash trickery to do the job for me:

mvn dependency:list -Dsort=true |
  grep "^\[INFO\]    " |
  awk '{print $2}' |
  cut -f1-4 -d: |
  sort |
  uniq |
  cut -f1-3 -d: |
  uniq -c |
  grep -v '^ *1 '

Line-by-line, explained version:

mvn dependency:list -Dsort=true | # list all deps
  grep "^\[INFO\]    " |          # grep for the deps list only
  awk '{print $2}' |              # remove the INFO prefix
  cut -f1-4 -d: |                 # removes the dep scope
  sort |                          # sort (duh)
  uniq |                          # remove duplicates
  cut -f1-3 -d: |                 # removes the version
  uniq -c |                       # count line groups
  grep -v '^ *1 '                 # grep groups that repeat

You'll end up with a list like this:

2 com.foo:foo-modules-commons:jar
    3 com.fasterxml.jackson.core:jackson-annotations:jar
    3 com.fasterxml.jackson.core:jackson-core:jar
    2 com.fasterxml.jackson.core:jackson-databind:jar
    2 com.squareup.okio:okio:jar
    2 commons-collections:commons-collections:jar
    2 commons-fileupload:commons-fileupload:jar
    2 joda-time:joda-time:jar
    2 org.mapstruct:mapstruct:jar

Now, for each of these deps, you'll have to run:

mvn dependency:tree -Dincludes=DEP

as in

mvn dependency:tree -Dincludes=org.mapstruct:mapstruct

This will show you all the places this dependency is being used, so all you need to do is fix it.

2. Duplicated Classes

This is something that I have seen a lot in Apache Commons libraries.

As far as I know, the easiest way to find these problems is by using Jboss' Tattletale Maven Plugin.

While the plugin seems to be abandoned, it still works. Just add it to your parent pom and run it to get the reports.

These kind of problems may require manually removing .class files from jars, excluding dependencies or, sometimes, just ignoring some of them.

Preventive actions

Act when the everything went to shit already usually is harder than avoiding small mistakes.

So, my tips are:

• Give more attention to it in code reviews;
• Run maven-dependency-plugin and tattletale-maven in the build for every pull request to block problematic changes;
• You can tweak the script to find dependencies with multiple versions to exit 1 in thoses cases, and just add it to the build too.

That's it. Hope it helps!

Reference:

• CarlosBecker.com - Maven Depdency Analyze
• StackOverflow - Remove Unused Depedency

Maven Depedency Scope

Maven dependency scope attribute is used to specify the visibility of a dependency, relative to the different lifecycle phases (build, test, runtime etc). Maven provides six scopes i.e. compile, provided, runtime, test, system, and import.

Table of Contents

1. Compile Scope
2. Provided Scope
3. Runtime Scope
4. Test Scope
5. System Scope
6. Import Scope
7. Transitivity Resolution

Maven dependency scope – compile

This is maven default scope. Dependencies with compile scope are needed to build, test, and run the project.

Scope compile is to be required in most of the cases to resolve the import statements into your java classes sourcecode.

<dependencies>     <dependency>         <groupId>log4j</groupId>         <artifactId>log4j</artifactId>         <version>1.2.14</version>         <!-- You can ommit this because it is default -->         <scope>compile</scope>     </dependency> </dependencies>

Maven dependency scope – provided

Maven dependency scope provided is used during build and test the project. They are also required to run, but should not exported, because the dependency will be provided by the runtime, for instance, by servlet container or application server.

<dependency>     <groupId>javax.servlet</groupId>     <artifactId>servlet-api</artifactId>     <version>3.0.1</version>     <scope>provided</scope> </dependency>

Maven dependency scope – runtime

Dependencies with maven dependency scope runtime are not needed to build, but are part of the classpath to test and run the project.

<dependency>     <groupId>com.thoughtworks.xstream</groupId>     <artifactId>xstream</artifactId>     <version>1.4.4</version>     <scope>runtime</scope>  </dependency>

Maven dependency scope – test

Dependencies with maven dependency scope test are not needed to build and run the project. They are needed to compile and run the unit tests.

<dependency>     <groupId>junit</groupId>     <artifactId>junit</artifactId>     <version>4.12</version>     <scope>test</scope> </dependency>

Maven dependency scope – system

Dependencies with system are similar to ones with scope provided. The only difference is system dependencies are not retrieved from remote repository. They are present under project’s subdirectory and are referred from there. See external dependency for more detail.

<dependency>   <groupId>extDependency</groupId>   <artifactId>extDependency</artifactId>   <scope>system</scope>   <version>1.0</version>   <systemPath>${basedir}\war\WEB-INF\lib\extDependency.jar</systemPath> </dependency>

Maven dependency scope – import

import scope is only supported on a dependency of type pom in the dependencyManagement section. It indicates the dependency to be replaced with the effective list of dependencies in the specified POM’s dependencyManagement section.

<dependencyManagement>     <dependencies>         <dependency>             <groupId>other.pom.group.id</groupId>             <artifactId>other-pom-artifact-id</artifactId>             <version>SNAPSHOT</version>             <scope>import</scope>             <type>pom</type>         </dependency>       </dependencies> </dependencyManagement>

Maven dependency transitivity resolution

When you include a maven dependency and it has it’s own other dependencies (i.e. transitive dependencies) then you may want to be clear about the scope of these transitive dependencies as well.

Let’s understand about maven transitive dependencies with a simple table. In this table, if a dependency is set to the scope in the left column, transitive dependencies at top row will result in a dependency with the scope listed at their intersection.

Dependency	compile	provided	runtime	test
compile	compile	–	runtime	–
provided	provided	–	provided	–
runtime	runtime	–	runtime	–
test	test	–	test	–

Drop me your questions in comments section.

Happy Learning!!

Reference:

• HowToDoInJava.com - Maven Depedency Scope