BOM is not usable with spring-boot-starter-parent

[MelleD]

Version

6.1.0

What happened?

When adding apache-jena-libs or 'jena-bom' to a Maven paren tom project , the Spring version is overriden ,y apache shiro import.
This makes the current BOM/parent setup effectively unusable in any project that needs to control its own Spring version.

Steps to Reproduce:

Create a maven project and import

<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">

   <modelVersion>4.0.0</modelVersion>

   <parent>
      <groupId>org.springframework.boot</groupId>
      <artifactId>spring-boot-starter-parent</artifactId>
      <version>4.1.0</version>
   </parent>
   <dependencyManagement>
      <dependencies>
       <dependency>
               <groupId>org.apache.jena</groupId>
               <artifactId>jena-bom</artifactId>
               <version>${jena.version}</version>
               <type>pom</type>
            <scope>import</scope>
         </dependency>

Run mvn dependency:tree or mvn help:effective-pom.

and see that spring web ist 5.x.x instead of 7.x.x

Relevant output and stacktrace

Are you interested in making a pull request?

No response

[rvesse]

Please can you provide an actual working pom.xml that reproduces this problem?

I've attempted to tidy up your example like so:

<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">

   <modelVersion>4.0.0</modelVersion>
   <groupId>test</groupId>
   <artifactId>test</artifactId>
   <version>0.0.1-SNAPSHOT</version>
   <parent>
      <groupId>org.springframework.boot</groupId>
      <artifactId>spring-boot-starter-parent</artifactId>
      <version>4.1.0</version>
   </parent>
   <properties>
	   <jena.version>6.1.0</jena.version>
   </properties>
    <dependencies>
       <dependency>
               <groupId>org.apache.jena</groupId>
               <artifactId>jena-bom</artifactId>
               <version>${jena.version}</version>
               <type>pom</type>
            <scope>import</scope>
    </dependency>
  </dependencies>
</project>

But a mvn dependency:tree doesn't show what you are describing so this example is not sufficiently complete for us to investigate properly:

[INFO] -----------------------------< test:test >------------------------------
[INFO] Building test 0.0.1-SNAPSHOT
[INFO]   from pom.xml
[INFO] --------------------------------[ jar ]---------------------------------
[INFO] 
[INFO] --- dependency:3.10.0:tree (default-cli) @ test ---
[INFO] test:test:jar:0.0.1-SNAPSHOT
[INFO] \- org.apache.jena:jena-bom:pom:6.1.0:import
[INFO] ------------------------------------------------------------------------
[INFO] BUILD SUCCESS
[INFO] ------------------------------------------------------------------------
[INFO] Total time:  0.703 s
[INFO] Finished at: 2026-07-30T14:12:26+01:00
[INFO] ------------------------------------------------------------------------

And a mvn help:effective-pom shows Spring Web 7.x being used:

$ mvn help:effective-pom | grep -A 2 spring-web
        <artifactId>brave-instrumentation-spring-web</artifactId>
        <version>6.3.1</version>
      </dependency>
--
        <artifactId>brave-instrumentation-spring-webmvc</artifactId>
        <version>6.3.1</version>
      </dependency>
--
        <artifactId>spring-web</artifactId>
        <version>7.0.8</version>
      </dependency>
--
        <artifactId>spring-webflux</artifactId>
        <version>7.0.8</version>
      </dependency>
--
        <artifactId>spring-webmvc</artifactId>
        <version>7.0.8</version>
      </dependency>
--
        <artifactId>spring-websocket</artifactId>
        <version>7.0.8</version>
      </dependency>

---

Have you tried using <exclusions> in your pom.xml to exclude the conflicting artefacts?

It should be possible to workaround this problem on your end, it's not uncommon to have to exclude transitive dependencies to force your desired versions to be used over those provided by a dependency

[MelleD]

Thanks for the quick answer:

Have you tried using in your pom.xml to exclude the conflicting artefacts?

Thats in maven 3.x.x not possible on scope import for poms. See example here: https://stackoverflow.com/questions/39276024/import-dependency-management-with-exclusion

Maybe your example missing the pom type

<?xml version="1.0" encoding="UTF-8"?>
<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">

   <modelVersion>4.0.0</modelVersion>

   <parent>
      <groupId>org.springframework.boot</groupId>
      <artifactId>spring-boot-starter-parent</artifactId>
      <version>4.1.0</version>
   </parent>

   <groupId>test</groupId>
   <artifactId>test</artifactId>
   <version>DEV-SNAPSHOT</version>
   <packaging>pom</packaging>
   
   <properties>
         <jena.version>6.1.0</jena.version>
   </properties>

   <dependencyManagement>
      <dependencies>
         <!-- Jena -->
         <dependency>
               <groupId>org.apache.jena</groupId>
               <artifactId>jena-bom</artifactId>
               <version>${jena.version}</version>
               <type>pom</type>
            <scope>import</scope>
         </dependency>
      </dependencies>
   </dependencyManagement>
</project>

I see this on the effective pom

If am going to this file https://github.com/apache/jena/blob/main/pom.xml

I see the same result, when

When I remove

      <dependency>
        <groupId>org.apache.shiro</groupId>
        <artifactId>shiro-bom</artifactId>
        <version>${ver.shiro}</version>
        <scope>import</scope>
        <type>pom</type>
      </dependency>

all is fine

[MelleD]

Here is an MRE https://github.com/MelleD/jena-test

mvn help:effective-pom | grep -A 2 spring-web

--
          <artifactId>spring-websocket</artifactId>
          <version>7.0.8</version>
        </dependency>
--
          <artifactId>spring-web</artifactId>
          <version>5.3.39</version>
          <exclusions>
--
          <artifactId>spring-webmvc</artifactId>
          <version>5.3.39</version>
          <exclusions>
--
          <artifactId>brave-instrumentation-spring-web</artifactId>
          <version>6.3.1</version>
        </dependency>
--

[afs]

I'm not seeing where this is in you example:

      <dependency>
        <groupId>org.apache.shiro</groupId>
        <artifactId>shiro-bom</artifactId>
        <version>${ver.shiro}</version>
        <scope>import</scope>
        <type>pom</type>
      </dependency>

jena-bom by itself doesn't pull in any dependencies.
That happens when you use a jena dependency.

jena-bom does not mention shiro.
shiro is a dependency in Fuseki.

Which Jena artifacts do you want to use? That's where to control exclusions.

So it sound like the maven resolve algorithm is making a choice you don't want. That is controlled by the exclusions on jar artifacts.

[MelleD]

Jena bom has Jena as parent and in this parent there is shiro. Checkout my MRE there you see the example you don’t need an deps to Jena you have just to import Jena bom and your classpath is broken because the parent of Jena import boms.

Try every dep you want you cannot exclude the spring dependencies see also my link from stackoverflow. If you find an solution push it to my repo ;)

[afs]

I didn't have a problem with your example. What should I be seeing?

mvn help:effective-pom | grep -A 2 spring-web -- I get 12 matches, not 4.

Which Jena artifacts do you want to use?

Apache Maven 3.9.16

[MelleD]

And which spring version is included in your effective Pom?
You can try Jena query builder with spring-web

[Aklakan]

I opened the PR #4114 with a proposed solution. Please check whether this solves your issue. Just install (mvn install) jena-bom which now includes the flatten-maven-plugin and see if using this new jena-bom pom.xml works as intended. The plugin creates a .flattened-pom.xml (note the leading dot that might make the file hidden) that replaces the original pom.xml.

[afs]

@MelleD,

Which Jena artifacts do you want to use?

I'm guessing that you aren't using Fuseki artifacts.

[afs]

If it is just shiro-bom - Shiro has spring connection so it might well only be shiro-bom - then not using shiro-bom but just using ver.shiro is a possibility. There are only two Shiro dependencies.

And, maybe, push the jetty BOM's into the Fuseki parent. While jena-fuseki-core is jakarta-servlet-only, jena-fuseki-main and Fuseki servers are Jetty dependent.