Changed resolution strategy in 4.0

[seregamorph]

Affected version

4.0.0-rc-6

Bug description

Consider a simple pom (additional repo needed: https://packages.confluent.io/maven/):

    <dependencyManagement>
        <dependencies>
            <dependency>
                <groupId>org.springframework.boot</groupId>
                <artifactId>spring-boot-dependencies</artifactId>
                <version>4.1.0</version>
                <type>pom</type>
                <scope>import</scope>
            </dependency>
        </dependencies>
    </dependencyManagement>
    <dependencies>
        <dependency>
            <groupId>io.confluent</groupId>
            <artifactId>kafka-schema-registry-client</artifactId>
            <version>7.5.12</version>
        </dependency>
    </dependencies>

Note: spring-boot-dependencies declare org.apache.kafka:kafka-clients as 4.2.1, overriding io.confluent:kafka-schema-registry-client dependency

In Maven 3 the dependency tree of kafka-schema-registry-client is:

[INFO] \- io.confluent:kafka-schema-registry-client:jar:7.5.12:compile
[INFO]    +- org.yaml:snakeyaml:jar:2.6:compile
[INFO]    +- org.apache.kafka:kafka-clients:jar:4.2.1:compile
[INFO]    |  +- com.github.luben:zstd-jni:jar:1.5.6-10:runtime
[INFO]    |  +- at.yawk.lz4:lz4-java:jar:1.10.1:runtime
[INFO]    |  +- org.xerial.snappy:snappy-java:jar:1.1.10.7:runtime
[INFO]    |  \- org.slf4j:slf4j-api:jar:2.0.18:compile

snappy-java is 1.1.10.7, version taken from org.apache.kafka:kafka-clients:4.2.1 as declared in kafka-clients pom

In Maven 4 the dependency tree is different:

[INFO] \- io.confluent:kafka-schema-registry-client:jar:7.5.12:compile
[INFO]    +- org.yaml:snakeyaml:jar:2.6:compile
[INFO]    +- org.apache.kafka:kafka-clients:jar:4.2.1:compile
[INFO]    |  +- com.github.luben:zstd-jni:jar:1.5.6-10:runtime
[INFO]    |  +- at.yawk.lz4:lz4-java:jar:1.10.1:runtime
[INFO]    |  +- org.xerial.snappy:snappy-java:jar:1.1.10.5:runtime
[INFO]    |  \- org.slf4j:slf4j-api:jar:2.0.18:compile

the org.xerial.snappy:snappy-java is 1.1.10.5, as declared in io.confluent:kafka-schema-registry-client parent pom io.confluent:common-parent:7.5.12 dependencyManagement.

So, the question: is it a bug, or on purpose?

[elharo]

sounds like a bug to me, but maybe I'm forgetting something

[cstamas]

@seregamorph Resolver 2 features "transitive dep manager", that is:

• used by default in Maven 4, controlled by this https://github.com/apache/maven/blob/maven-4.0.x/api/maven-api-core/src/main/java/org/apache/maven/api/Constants.java#L425-L437
• not used by default in Maven 3.10, controlled by this: https://github.com/apache/maven/blob/maven-3.10.x/maven-core/src/main/java/org/apache/maven/internal/aether/DefaultRepositorySystemSessionFactory.java#L131-L142

Basically same property, but defaults are true and false respectively in Maven 4 vs Maven 3.10. Try to toggle them, and please try to achieve same output with 3.10 as well.

As if in both enabled (or disabled), output should be same (w/ disabled, same as is in 3.9.16).

[elharo]

This is a deliberate behavioral change in Maven 4, not a bug. The behavior in Maven 3 was a known limitation in its dependency resolution mechanism, which Maven 4 corrects.

Maven 3 Behavior (The Flaw)

In Maven 3, dependencyManagement is only applied if it is declared in the root project or imported via a BOM directly into the root project. Maven 3 completely ignores dependencyManagement sections found in transitive dependencies or their parents.

Because the root POM's BOM (spring-boot-dependencies) does not dictate a version for snappy-java, Maven 3 ignores the dependencyManagement in io.confluent:common-parent. It falls back to standard nearest-definition resolution, pulling snappy-java:1.1.10.7 directly from the kafka-clients POM.

Maven 4 Behavior (The Correction)

Maven 4 introduces Transitive Dependency Management. The Maven Resolver now accumulates dependencyManagement constraints as it traverses the dependency graph and applies them to sub-trees.

When Maven 4 resolves the dependencies for kafka-schema-registry-client, it incorporates the dependencyManagement constraints inherited from io.confluent:common-parent (snappy-java:1.1.10.5). This constraint is passed down to kafka-schema-registry-client's subgraph. When evaluating kafka-clients, the accumulated transitive management constraint overrides the 1.1.10.7 version declared in the kafka-clients POM.

To restore the Maven 3 resolution output in Maven 4, you must explicitly declare snappy-java:1.1.10.7 in the root POM's dependencyManagement block. Root-level constraints will override transitive constraints in both versions.

[cstamas]

I would still like to have @seregamorph confirm this.

[cstamas]

FYI, my output:

[cstamas@angeleyes ~]$ mvn toolbox:gav-tree-dd -Dgav=io.confluent:kafka-schema-registry-client:7.5.12 -Dscope=compile -DextraRepositories=confluent::https://packages.confluent.io/maven
[INFO] Loaded 23369 auto-discovered prefixes for remote repository central (prefixes-central.txt)
[INFO] Loaded 23369 auto-discovered prefixes for remote repository central (prefixes-central.txt)
[INFO] Mimir 0.12.0 session created with DaemonNode (basedir=/home/cstamas/.mimir; daemonPID=119383; daemonVersion=0.12.0)
[INFO] Scanning for projects...
[INFO] Loaded 74 auto-discovered prefixes for remote repository apache.snapshots (prefixes-apache.snapshots.txt)
[INFO] 
[INFO] ------------------< org.apache.maven:standalone-pom >-------------------
[INFO] Building Maven Stub Project (No POM) 1
[INFO] --------------------------------[ pom ]---------------------------------
[INFO] 
[INFO] --- toolbox:0.15.15:gav-tree-dd (default-cli) @ standalone-pom ---
[INFO] org.example:some-project:jar:1.0.0 (origin: central,confluent)
[INFO] ╰─io.confluent:kafka-schema-registry-client:jar:7.5.12 [compile] (origin: central,confluent)
[INFO]   ├─org.yaml:snakeyaml:jar:2.0 [compile] (origin: central,confluent,jitpack.io)
[INFO]   ├─org.apache.kafka:kafka-clients:jar:7.5.12-ccs [compile] (exclusions applied: [org.slf4j:slf4j-log4j12:*:*]) (origin: central,confluent,jitpack.io)
[INFO]   │ ├─com.github.luben:zstd-jni:jar:1.5.5-1 [runtime] (origin: central,confluent,jitpack.io)
[INFO]   │ ├─org.lz4:lz4-java:jar:1.8.0 [runtime] (origin: central,confluent,jitpack.io)
[INFO]   │ ├─org.xerial.snappy:snappy-java:jar:1.1.10.5 [runtime] (origin: central,confluent,jitpack.io)
[INFO]   │ ╰─org.slf4j:slf4j-api:jar:1.7.36 [compile] (origin: central,confluent,jitpack.io)
[INFO]   ├─org.apache.avro:avro:jar:1.11.4 [compile] (origin: central,confluent,jitpack.io)
[INFO]   │ ╰─com.fasterxml.jackson.core:jackson-core:jar:2.14.3 [compile] (origin: central,confluent,jitpack.io,apache.snapshots)
[INFO]   ├─org.apache.commons:commons-compress:jar:1.26.1 [compile] (origin: central,confluent,jitpack.io)
[INFO]   │ ├─commons-codec:commons-codec:jar:1.16.1 [compile] (origin: central,confluent,jitpack.io,apache.snapshots)
[INFO]   │ ├─commons-io:commons-io:jar:2.15.1 [compile] (origin: central,confluent,jitpack.io,apache.snapshots)
[INFO]   │ ╰─org.apache.commons:commons-lang3:jar:3.14.0 [compile] (origin: central,confluent,jitpack.io,apache.snapshots)
[INFO]   ├─com.fasterxml.jackson.core:jackson-databind:jar:2.16.0 [compile] (origin: central,confluent,jitpack.io)
[INFO]   │ ╰─com.fasterxml.jackson.core:jackson-annotations:jar:2.16.0 [compile] (origin: central,confluent,jitpack.io,sonatype-nexus-snapshots)
[INFO]   ├─io.swagger.core.v3:swagger-annotations:jar:2.1.10 [compile] (origin: central,confluent,jitpack.io)
[INFO]   ├─com.google.guava:guava:jar:32.0.1-jre [compile] (origin: central,confluent,jitpack.io)
[INFO]   │ ├─com.google.guava:failureaccess:jar:1.0.1 [compile] (origin: central,confluent,jitpack.io)
[INFO]   │ ├─com.google.guava:listenablefuture:jar:9999.0-empty-to-avoid-conflict-with-guava [compile] (origin: central,confluent,jitpack.io)
[INFO]   │ ├─com.google.code.findbugs:jsr305:jar:3.0.2 [compile] (origin: central,confluent,jitpack.io)
[INFO]   │ ├─org.checkerframework:checker-qual:jar:3.33.0 [compile] (origin: central,confluent,jitpack.io)
[INFO]   │ ├─com.google.errorprone:error_prone_annotations:jar:2.18.0 [compile] (origin: central,confluent,jitpack.io)
[INFO]   │ ╰─com.google.j2objc:j2objc-annotations:jar:2.8 [compile] (origin: central,confluent,jitpack.io)
[INFO]   ╰─io.confluent:common-utils:jar:7.5.12 [compile] (origin: central,confluent,jitpack.io)
[INFO] ------------------------------------------------------------------------
[INFO] BUILD SUCCESS
[INFO] ------------------------------------------------------------------------
[INFO] Total time:  0.336 s
[INFO] Finished at: 2026-07-31T16:29:09+02:00
[INFO] ------------------------------------------------------------------------
[INFO] Mimir session closed (RETRIEVED=0 CACHED=0)
[cstamas@angeleyes ~]$ 

[cstamas]

And with transitive depMgt:

[cstamas@angeleyes ~]$ mvn toolbox:gav-tree-dd -Dgav=io.confluent:kafka-schema-registry-client:7.5.12 -Dscope=compile -DextraRepositories=confluent::https://packages.confluent.io/maven -Dmaven.resolver.dependencyManagerTransitivity
[INFO] Loaded 23369 auto-discovered prefixes for remote repository central (prefixes-central.txt)
[INFO] Loaded 23369 auto-discovered prefixes for remote repository central (prefixes-central.txt)
[INFO] Mimir 0.12.0 session created with DaemonNode (basedir=/home/cstamas/.mimir; daemonPID=119383; daemonVersion=0.12.0)
[INFO] Scanning for projects...
[INFO] Loaded 74 auto-discovered prefixes for remote repository apache.snapshots (prefixes-apache.snapshots.txt)
[INFO] 
[INFO] ------------------< org.apache.maven:standalone-pom >-------------------
[INFO] Building Maven Stub Project (No POM) 1
[INFO] --------------------------------[ pom ]---------------------------------
[INFO] 
[INFO] --- toolbox:0.15.15:gav-tree-dd (default-cli) @ standalone-pom ---
[INFO] org.example:some-project:jar:1.0.0 (origin: central,confluent)
[INFO] ╰─io.confluent:kafka-schema-registry-client:jar:7.5.12 [compile] (origin: central,confluent)
[INFO]   ├─org.yaml:snakeyaml:jar:2.0 [compile] (origin: central,confluent,jitpack.io)
[INFO]   ├─org.apache.kafka:kafka-clients:jar:7.5.12-ccs [compile] (managed exclusions applied: [org.slf4j:slf4j-log4j12:*:*]) (exclusions applied: [org.slf4j:slf4j-log4j12:*:*]) (origin: central,confluent,jitpack.io)
[INFO]   │ ├─com.github.luben:zstd-jni:jar:1.5.5-1 [runtime] (origin: central,confluent,jitpack.io)
[INFO]   │ ├─org.lz4:lz4-java:jar:1.8.0 [runtime] (origin: central,confluent,jitpack.io)
[INFO]   │ ├─org.xerial.snappy:snappy-java:jar:1.1.10.5 [runtime] (origin: central,confluent,jitpack.io)
[INFO]   │ ╰─org.slf4j:slf4j-api:jar:1.7.36 [compile] (origin: central,confluent,jitpack.io)
[INFO]   ├─org.apache.avro:avro:jar:1.11.4 [compile] (origin: central,confluent,jitpack.io)
[INFO]   │ ╰─com.fasterxml.jackson.core:jackson-core:jar:2.16.0 [compile] (managed version from 2.14.3) (origin: central,confluent,jitpack.io,apache.snapshots)
[INFO]   ├─org.apache.commons:commons-compress:jar:1.26.1 [compile] (origin: central,confluent,jitpack.io)
[INFO]   │ ├─commons-codec:commons-codec:jar:1.16.1 [compile] (origin: central,confluent,jitpack.io,apache.snapshots)
[INFO]   │ ├─commons-io:commons-io:jar:2.16.0 [compile] (managed version from 2.15.1) (origin: central,confluent,jitpack.io,apache.snapshots)
[INFO]   │ ╰─org.apache.commons:commons-lang3:jar:3.18.0 [compile] (managed version from 3.14.0) (origin: central,confluent,jitpack.io,apache.snapshots)
[INFO]   ├─com.fasterxml.jackson.core:jackson-databind:jar:2.16.0 [compile] (origin: central,confluent,jitpack.io)
[INFO]   │ ╰─com.fasterxml.jackson.core:jackson-annotations:jar:2.16.0 [compile] (origin: central,confluent,jitpack.io,sonatype-nexus-snapshots)
[INFO]   ├─io.swagger.core.v3:swagger-annotations:jar:2.1.10 [compile] (origin: central,confluent,jitpack.io)
[INFO]   ├─com.google.guava:guava:jar:32.0.1-jre [compile] (origin: central,confluent,jitpack.io)
[INFO]   │ ├─com.google.guava:failureaccess:jar:1.0.1 [compile] (origin: central,confluent,jitpack.io)
[INFO]   │ ├─com.google.guava:listenablefuture:jar:9999.0-empty-to-avoid-conflict-with-guava [compile] (origin: central,confluent,jitpack.io)
[INFO]   │ ├─com.google.code.findbugs:jsr305:jar:3.0.2 [compile] (origin: central,confluent,jitpack.io)
[INFO]   │ ├─org.checkerframework:checker-qual:jar:3.33.0 [compile] (origin: central,confluent,jitpack.io)
[INFO]   │ ├─com.google.errorprone:error_prone_annotations:jar:2.18.0 [compile] (origin: central,confluent,jitpack.io)
[INFO]   │ ╰─com.google.j2objc:j2objc-annotations:jar:2.8 [compile] (origin: central,confluent,jitpack.io)
[INFO]   ╰─io.confluent:common-utils:jar:7.5.12 [compile] (origin: central,confluent,jitpack.io)
[INFO] ------------------------------------------------------------------------
[INFO] BUILD SUCCESS
[INFO] ------------------------------------------------------------------------
[INFO] Total time:  0.685 s
[INFO] Finished at: 2026-07-31T16:31:25+02:00
[INFO] ------------------------------------------------------------------------
[INFO] Mimir session closed (RETRIEVED=0 CACHED=0)
[cstamas@angeleyes ~]$ 

[seregamorph]

This is a deliberate behavioral change in Maven 4, not a bug. The behavior in Maven 3 was a known limitation in its dependency resolution mechanism, which Maven 4 corrects.

That's actually the answer the fully satisfies me. For the given dependency it's indeed possible to simply declare the version in the parent pom. Other dependency trees were not affected (at least I do not see it).

Thanks for the fast answers @cstamas @elharo 🙏

[cstamas]

Here is a command to play with:

mvn toolbox:gav-tree-dd -DextraRepositories=confluent::https://packages.confluent.io/maven -Dgav=io.confluent:kafka-schema-registry-client:7.5.12 -Dboms=org.springframework.boot:spring-boot-dependencies:4.1.0 -Dmaven.resolver.dependencyManagerTransitivity=true

And just toggle true and false using Maven 3.10 (or 4, but count in for opposite defaults).

So what happens, kafka-schema-registry-client manages snappy to 1.1.10.5, see:

 mvn toolbox:gav-dm-list -DextraRepositories=confluent::https://packages.confluent.io/maven -Dgav=io.confluent:kafka-schema-registry-client:7.5.12

But, in Maven 3.9-, as kafka-schema-registry-client is not root level dep, the management is ignored. Not so with transitive.

[seregamorph]

Confirming: if I specify -Dmaven.resolver.dependencyManagerTransitivity=false in the build parameters, I get the old Maven 3.x behavior! Thanks