🎥 YouTube Video: Coming Soon – Subscribe to JavaiOS Channel

---

Maven Dependency Management: DependencyManagement vs Dependencies 📦

Mastering Maven dependency management is crucial for maintaining clean, efficient, and scalable microservice architectures. This guide covers the key differences between dependencyManagement and dependencies, best practices for multi-module projects, and common pitfalls to avoid.

---

🎯 Core Concepts Overview

Understanding the difference between Maven’s dependency management strategies is essential for building maintainable enterprise applications. The AdventureTube microservice architecture demonstrates these patterns in real-world usage.

---

🔧 Difference Between dependencyManagement and dependencies

Understanding dependencyManagement

dependencyManagement provides centralized version control without automatically including dependencies in your project.

• ✅ Manages only versions of dependencies
• ✅ Sub-modules must explicitly declare the dependency to use it
• ✅ Ensures version consistency across all modules
• ✅ Provides centralized control without forced inclusion

Understanding dependencies

dependencies directly adds dependencies to your project and all inheriting modules.

• ✅ Adds the dependency directly to the project
• ✅ Automatically includes dependencies in sub-modules
• ❌ Does not enforce a single version across modules
• ❌ Can lead to version conflicts in complex projects

📊 Comparison Matrix

Feature	dependencyManagement	dependencies
Purpose	Manages only versions	Adds dependencies to the project
Automatically Inherited?	❌ No – explicit declaration required	✅ Yes – automatic inheritance
Controls Version Consistency?	✅ Yes – enforces single version	❌ No – can have version conflicts
Best Use Case	Multi-module projects with selective dependency usage	Dependencies required by all sub-modules
Flexibility	High – modules choose what to include	Low – all modules get all dependencies

---

🏗️ Centralized Version Control for Multi-Module Projects

Why Centralize Dependency Versions?

Centralized dependency management provides multiple benefits for enterprise-scale applications:

• ✅ Ensures consistency across all sub-modules
• ✅ Prevents version conflicts when multiple sub-modules use the same dependencies
• ✅ Simplifies maintenance—update one place instead of multiple sub-modules
• ✅ Avoids redundant versions in sub-modules
• ✅ Reduces security vulnerabilities through consistent updates
• ✅ Improves build reliability and reproducibility

Implementation Pattern

📌 Parent POM (Centralized Version Management)

<dependencyManagement>     <dependencies>         <dependency>             <groupId>org.springframework.boot</groupId>             <artifactId>spring-boot-starter-web</artifactId>             <version>3.4.0</version>         </dependency>         <dependency>             <groupId>org.springframework.boot</groupId>             <artifactId>spring-boot-starter-security</artifactId>             <version>3.4.0</version>         </dependency>     </dependencies> </dependencyManagement> 

📌 Sub-Module POM (No Version Needed)

<dependencies>     <dependency>         <groupId>org.springframework.boot</groupId>         <artifactId>spring-boot-starter-web</artifactId>         <!-- Version inherited from parent dependencyManagement -->     </dependency> </dependencies> 

✅ Result: The sub-module inherits the version from the parent without needing to define it, ensuring consistency across all services.

---

🔧 Advanced Dependency Management Patterns

Optional Dependencies for Development Tools

Development tools should be marked as optional to prevent unnecessary inclusion in production builds.

❌ Incorrect Implementation

<dependency>     <groupId>org.springframework.boot</groupId>     <artifactId>spring-boot-devtools</artifactId> </dependency> 

🚨 Problems:

• All dependent microservices inherit spring-boot-devtools unnecessarily
• Can cause unexpected runtime behavior in production environments
• Increases deployment package size unnecessarily
• Potential security risks from development-only features

✅ Correct Implementation with Optional Flag

<dependency>     <groupId>org.springframework.boot</groupId>     <artifactId>spring-boot-devtools</artifactId>     <optional>true</optional>  <!-- ✅ Prevents transitive inheritance --> </dependency> 

✅ Benefits:

• config-service can use devtools for development
• Other modules won’t inherit it automatically
• Production deployments remain clean and optimized
• Explicit control over development tool usage

---

📋 Bill of Materials (BOM) Pattern

Using BOM for External Dependencies

Instead of manually managing versions, use a BOM (import scope) to handle compatible versions automatically.

📌 Spring Boot BOM Implementation

<dependencyManagement>     <dependencies>         <dependency>             <groupId>org.springframework.boot</groupId>             <artifactId>spring-boot-dependencies</artifactId>             <version>3.4.0</version>             <scope>import</scope>             <type>pom</type>         </dependency>     </dependencies> </dependencyManagement> 

📌 Custom BOM for Your Organization

<dependencyManagement>     <dependencies>         <dependency>             <groupId>com.adventuretube</groupId>             <artifactId>adventuretube-bom</artifactId>             <version>1.0.0</version>             <scope>import</scope>             <type>pom</type>         </dependency>     </dependencies> </dependencyManagement> 

✅ Advantages of BOM Pattern:

• All related dependencies use compatible versions
• Reduces version conflict complexity
• Simplifies dependency management across teams
• Enables consistent technology stack adoption

---

🔧 Properties-Based Version Management

Using Properties for Version Variables

Store versions in properties for easier maintenance and consistency.

📌 Properties Definition

<properties>     <spring.boot.version>3.4.0</spring.boot.version>     <jjwt.version>0.12.3</jjwt.version>     <testcontainers.version>1.19.3</testcontainers.version>     <maven.compiler.source>21</maven.compiler.source>     <maven.compiler.target>21</maven.compiler.target> </properties> 

📌 Properties Usage in Dependencies

<dependencyManagement>     <dependencies>         <dependency>             <groupId>io.jsonwebtoken</groupId>             <artifactId>jjwt-api</artifactId>             <version>${jjwt.version}</version>         </dependency>         <dependency>             <groupId>org.testcontainers</groupId>             <artifactId>junit-jupiter</artifactId>             <version>${testcontainers.version}</version>         </dependency>     </dependencies> </dependencyManagement> 

✅ Benefits of Properties-Based Management:

• Update one place to change versions across all modules
• Easy to identify and track version upgrades
• Supports automated dependency update tools
• Clear visibility of technology stack versions

---

⚠️ Scope Management Best Practices

Runtime vs Compile Scope Considerations

Using incorrect dependency scopes can lead to bloated applications and unnecessary complexity.

Common Scope Issues

• Increased Application Size 📦 – Unnecessary libraries get included in builds
• Unnecessary Classpath Pollution ⚠️ – Other modules may depend on unneeded libraries
• Security Risks 🔒 – More dependencies increase the attack surface
• Harder Upgrades & Conflicts 🔄 – Version mismatches become more likely
• Longer Build Times ⏳ – More dependencies slow down compilation

📌 JWT Dependencies: Correct Scope Usage

<dependency>     <groupId>io.jsonwebtoken</groupId>     <artifactId>jjwt-api</artifactId>     <!-- No scope needed - used at compile-time for interfaces --> </dependency> <dependency>     <groupId>io.jsonwebtoken</groupId>     <artifactId>jjwt-impl</artifactId>     <scope>runtime</scope> <!-- ✅ Implementation only needed at runtime --> </dependency> <dependency>     <groupId>io.jsonwebtoken</groupId>     <artifactId>jjwt-jackson</artifactId>     <scope>runtime</scope> <!-- ✅ JSON serialization only needed at runtime --> </dependency> 

Understanding Scope Strategy

Dependency	Scope	Reason
jjwt-api	compile (default)	Needed at compile-time for method definitions and interfaces
jjwt-impl	runtime	Implementation details only needed when application runs
jjwt-jackson	runtime	JSON parsing implementation only needed at runtime

✅ Benefits of Correct Scope Usage:

• Keeps build size small and compilation fast
• Prevents unnecessary dependencies from affecting other modules
• Clearer separation between compile-time and runtime concerns
• Easier dependency analysis and troubleshooting

---

🔒 Advanced Dependency Management Strategies

Dependency Exclusions

Sometimes you need to exclude transitive dependencies that conflict with your chosen versions.

<dependency>     <groupId>org.springframework.boot</groupId>     <artifactId>spring-boot-starter-web</artifactId>     <exclusions>         <exclusion>             <groupId>org.springframework.boot</groupId>             <artifactId>spring-boot-starter-tomcat</artifactId>         </exclusion>     </exclusions> </dependency> <dependency>     <groupId>org.springframework.boot</groupId>     <artifactId>spring-boot-starter-jetty</artifactId> </dependency> 

Platform BOM Usage

Use platform BOMs for consistent dependency management across different technology stacks.

<dependencyManagement>     <dependencies>         <dependency>             <groupId>org.springframework.cloud</groupId>             <artifactId>spring-cloud-dependencies</artifactId>             <version>2024.0.0</version>             <type>pom</type>             <scope>import</scope>         </dependency>     </dependencies> </dependencyManagement> 

---

✅ Dependency Management Best Practices Checklist

Project Structure ✅

• ✅ Use dependencyManagement in parent POM for version control
• ✅ Declare dependencies without versions in sub-modules
• ✅ Group related dependencies logically
• ✅ Maintain clear separation between API and implementation dependencies

Version Management ✅

• ✅ Use BOM imports for external dependency ecosystems
• ✅ Store custom versions in properties
• ✅ Regularly audit and update dependency versions
• ✅ Implement dependency vulnerability scanning

Scope Strategy ✅

• ✅ Use runtime scope for implementation-only dependencies
• ✅ Mark development tools as optional
• ✅ Use test scope for testing frameworks
• ✅ Avoid unnecessary compile scope usage

Maintenance ✅

• ✅ Document dependency upgrade strategies
• ✅ Implement automated dependency update workflows
• ✅ Maintain compatibility matrices for major upgrades
• ✅ Regular security audits of dependency versions

---

🎓 Key Takeaways

1. Centralized Version Control: Use dependencyManagement in parent POMs to ensure version consistency across all microservices
2. BOM Pattern Adoption: Leverage Spring Boot and other platform BOMs to reduce version management complexity
3. Scope Precision: Use appropriate dependency scopes to minimize build size and prevent unnecessary transitive dependencies
4. Optional Dependencies: Mark development and optional dependencies appropriately to prevent unwanted inheritance
5. Properties-Based Management: Use Maven properties for custom dependency versions to enable easy maintenance and updates

Effective dependency management is the foundation of scalable microservice architectures, enabling consistent builds, simplified maintenance, and reduced security vulnerabilities.

---

Part of the AdventureTube technical blog series supporting the JavaiOS YouTube channel.