Upgrade to Pro
— share decks privately, control downloads, hide ads and more …
Speaker Deck
Features
Speaker Deck
PRO
Sign in
Sign up for free
Search
Search
Dependency management for Java applications 202...
Search
sullis
September 11, 2025
Programming
0
16
Dependency management for Java applications 2025-09-11
Community Over Code 2025
Minneapolis Minnesota
September 11 2025
sullis
September 11, 2025
Tweet
Share
More Decks by sullis
See All by sullis
S3 NYC Iceberg meetup 2025-07-10
sullis
0
43
Amazon S3 Chicago 2025-06-04
sullis
0
110
Amazon S3 Boston 2025-05-07
sullis
0
61
Netty ConFoo Montreal 2025-02-27
sullis
0
110
GitHub Actions ConFoo Montreal 2025-02-26
sullis
0
73
Netty Portland Java User Group 2025-02-18
sullis
0
16
Amazon S3 NYJavaSIG 2024-12-12
sullis
0
190
Amazon S3 - Portland Java User Group 2024-09-17
sullis
0
120
Netty - Montreal Java User Group 2024-05-21
sullis
0
180
Other Decks in Programming
See All in Programming
スキーマ駆動で、Zod OpenAPI Honoによる、API開発するために、Hono Takibiというライブラリを作っている
nakita628
0
320
Pythonに漸進的に型をつける
nealle
1
120
Claude Agent SDK を使ってみよう
hyshu
0
1.4k
AkarengaLT vol.38
hashimoto_kei
1
120
Webサーバーサイド言語としてのRustについて
kouyuume
1
4.8k
Leading Effective Engineering Teams in the AI Era
addyosmani
7
600
フロントエンド開発のためのブラウザ組み込みAI入門
masashi
7
3.5k
One Enishi After Another
snoozer05
PRO
0
150
モテるデスク環境
mozumasu
3
1.3k
Go言語の特性を活かした公式MCP SDKの設計
hond0413
2
500
SwiftDataを使って10万件のデータを読み書きする
akidon0000
0
240
TFLintカスタムプラグインで始める Terraformコード品質管理
bells17
2
360
Featured
See All Featured
Side Projects
sachag
455
43k
The Cult of Friendly URLs
andyhume
79
6.6k
The World Runs on Bad Software
bkeepers
PRO
72
11k
Unsuck your backbone
ammeep
671
58k
Mobile First: as difficult as doing things right
swwweet
225
10k
Bash Introduction
62gerente
615
210k
Designing Experiences People Love
moore
142
24k
Why You Should Never Use an ORM
jnunemaker
PRO
59
9.6k
Code Review Best Practice
trishagee
72
19k
CSS Pre-Processors: Stylus, Less & Sass
bermonpainter
359
30k
Intergalactic Javascript Robots from Outer Space
tanoku
272
27k
Thoughts on Productivity
jonyablonski
70
4.9k
Transcript
Sean Sullivan Community Over Code September 2025 Dependency Management for
Java applications
About me Portland Oregon Java since 1996 open source contributor
Outdated libraries on your production classpath What is the worst
that could happen?
None
2017 US House committee Equifax CEO US Rep Greg Walden
2017 US House committee US Rep Greg Walden “the Apache
Struts software which contained the vulnerability that led to this breach was running on the Equifax system”
Java development
Java dependency conflicts
Gradle blog November 2019 “The larger the project and its
dependency graph, the harder it is to maintain”
“Dependency issues can cause many problems” Gradle blog November 2019
“If you are lucky, you would get a compile time
error” Gradle blog November 2019
“it is common to only see problems occurring when executing
tests or even at production runtime” Gradle blog November 2019
NoClassDefFoundError ClassNotFoundException
NoSuchMethodError UnsatisfiedLinkError
Let’s talk about dependency resolution
dependencies { implementation(“foo:liba:1.5.2”) implementation(“foo:libz:0.2.1”) implementation(“com.google.guava:guava:28.2”) }
liba 1.5.2 app 1.0.0 libz 0.2.1 guava 19.0 guava 33.4.8
guava 28.2
liba 1.5.2 app 1.0.0 libz 0.2.1 guava 19.0 guava 33.4.8
guava 28.2
Maven: “nearest wins” Gradle: “highest version wins” guava 28.2 guava
33.4.8
Jake Wharton - March 2024 https://jakewharton.com/nonsensical-maven-is-still-a-gradle-problem/
“Maven’s dependency resolution strategy is objectively bonkers” Jake Wharton -
March 2024 https://jakewharton.com/nonsensical-maven-is-still-a-gradle-problem/
Java classpath
what Java libraries do you have in production right now?
do you have outdated libraries in production?
do you have SNAPSHOT libraries in production?
Microservice app:1.5.2 sharedlib:1.8.3 swagger-annotations:2.2.31-SNAPSHOT
📍 hundreds of libraries on the runtime classpath 📍 open
source libraries + internal libraries 📍 Java, Kotlin, Scala Modern Java applications
“Let’s add one more Java library ” Java library
None
Dependency Hell
Dependency Hell is a common problem
Dependency Hell @ gilt.com (2015)
Dependency Hell @ Netflix (2017)
Gradle’s optimistic dependency resolution may inadvertently upgrade dependencies, causing compatibility
issues.
Taming dependency hell
Pin dependency to a specific version?
configurations.all { resolutionStrategy { force 'com.example:foobar:0.9.2' } }
Mike McGarr Netflix, 2017
Google JLBP “Google Best Practices for Java Libraries are rules
that minimize problems for consumers of interconnected Java libraries“ jlbp.dev
JLBP-1 Minimize Dependencies “Scrutinize all dependency additions”
JLBP-1 Minimize Dependency Scope “When you do add a dependency,
keep it scoped as narrowly as possible”
JLBP-1 “Prefer JDK classes where available” “For any given functionality,
pick exactly one library”
JLBP-1 Separate the tool classpath from the product classpath
JLBP-11 Keep dependencies up to date
JLBP-11 “Release no later than 6 weeks after any of
your dependencies releases a higher version”
JLBP-11 “Staying up to date is also important to ensure
that security fixes are rolled out promptly”
JLBP-15 Publish a BOM for multi-module projects
JLBP-16 Ensure upper version alignment of dependencies for consumers
JLBP-16 “The version of each dependency added to the classpath
should the highest version in the dependency tree”
Common problems with Java dependencies
Compilation failure [ERROR] bad class file: /Users/skywalker/.m2/repository/org/apache/iceberg/iceberg-api/1.9. 2/iceberg-api-1.9.2.jar(org/apache/iceberg/IcebergBuild.class) [ERROR] class
file has wrong version 55.0, should be 52.0
class file has wrong version 61.0, should be 52.0
Dependency misalignment jackson-databind:2.19.2 jackson-core:2.19.0
Scala sadness jackson-module-scala_2.12-2.19.2.jar jackson-module-scala_2.13-2.19.2.jar 🚩 what if both of these
jars are on the classpath? 🚩
🔵 dependencyConvergence 🔵 requireUpperBoundDeps 🔵 banDuplicateClasses Maven Enforcer plugin
Gradle Enforcer plugin
Gradle Enforcer plugin ✅ DependencyConvergence
Let’s talk about OpenRewrite
OpenRewrite recipes 🟢 AddDependency 🟢 RemoveDependency 🟢 ChangeDependency 🟢 UpgradeDependencyVersion
Final thoughts
🟢 Build often 🟢 Release often 🟢 Ownership 🟢 consider
OpenRewrite for complex migrations
Questions?
The End
Bonus
Let’s talk about Netty
Netty dependencies 🔵 some Netty artifacts are platform dependent 🔵
use artifact classifiers
Example: artifact <classifier> Linux x86
Linux ARM 64 Example: artifact <classifier>
Devnexus 2021 Taming Java Dependencies @ Google Stephanie Wang
JConf 2022 : Dependency management Roberto Perez Alcolea
David Handermann [ exceptionfactory.com ]
Let’s talk about JCenter
JCenter repository end-of-life
None
“At the end of the sunset, all JCenter requests will
automatically be redirected to Maven Central and served from there.”
Forcing gradle to check for updated versions ./gradlew build --refresh-dependencies
None
None