用Maven定位和解决依赖冲突

一、依赖冲突的常见表现

二、定位冲突依赖的4种方法

2.1 使用Maven命令分析依赖树

# 查看完整依赖树
mvn dependency:tree

# 过滤指定依赖（示例查找guava）
mvn dependency:tree -Dincludes=com.google.guava:guava

示例输出

[INFO] com.example:my-project:jar:1.0.0
[INFO] +- com.moduleA:moduleA:jar:2.0:compile
[INFO] |  \- com.google.guava:guava:jar:30.0-jre:compile
[INFO] \- com.moduleB:moduleB:jar:3.1:compile
[INFO]    \- com.google.guava:guava:jar:31.0.1-jre:compile

2.2 使用IDE可视化工具

• IntelliJ IDEA：右键pom.xml > Maven > Show Dependencies
• Eclipse：右键项目 > Maven > Show Dependencies

2.3 使用Maven Enforcer插件

<build>
    <plugins>
        <plugin>
            <groupId>org.apache.maven.plugins</groupId>
            <artifactId>maven-enforcer-plugin</artifactId>
            <version>3.0.0</version>
            <executions>
                <execution>
                    <id>enforce</id>
                    <goals>
                        <goal>enforce</goal>
                    </goals>
                    <configuration>
                        <rules>
                            <dependencyConvergence/>
                        </rules>
                    </configuration>
                </execution>
            </executions>
        </plugin>
    </plugins>
</build>

冲突时输出

Dependency convergence error for com.google.guava:guava:31.0.1-jre paths to dependency are:
+-com.example:my-project:1.0.0
  +-com.moduleA:moduleA:2.0
    +-com.google.guava:guava:30.0-jre
  and
+-com.example:my-project:1.0.0
  +-com.moduleB:moduleB:3.1
    +-com.google.guava:guava:31.0.1-jre

2.4 运行时分析

public class DependencyChecker {
    public static void main(String[] args) {
        System.out.println("Guava版本: " + 
            com.google.common.base.Strings.class.getPackage()
                .getImplementationVersion());
    }
}

三、解决依赖冲突的5种方案

3.1 排除特定传递依赖

<dependency>
    <groupId>com.moduleB</groupId>
    <artifactId>moduleB</artifactId>
    <version>3.1</version>
    <exclusions>
        <exclusion>
            <groupId>com.google.guava</groupId>
            <artifactId>guava</artifactId>
        </exclusion>
    </exclusions>
</dependency>

3.2 统一指定版本（推荐）

<properties>
    <guava.version>31.0.1-jre</guava.version>
</properties>

<dependencies>
    <dependency>
        <groupId>com.google.guava</groupId>
        <artifactId>guava</artifactId>
        <version>${guava.version}</version>
    </dependency>
</dependencies>

3.3 使用dependencyManagement

<dependencyManagement>
    <dependencies>
        <dependency>
            <groupId>com.google.guava</groupId>
            <artifactId>guava</artifactId>
            <version>31.0.1-jre</version>
        </dependency>
    </dependencies>
</dependencyManagement>

3.4 强制指定版本

<build>
    <plugins>
        <plugin>
            <groupId>org.apache.maven.plugins</groupId>
            <artifactId>maven-surefire-plugin</artifactId>
            <configuration>
                <argLine>-Dguava.version=31.0.1-jre</argLine>
            </configuration>
        </plugin>
    </plugins>
</build>

3.5 重构依赖结构

<!-- 将共同依赖提升到父POM -->
<dependencies>
    <dependency>
        <groupId>com.google.guava</groupId>
        <artifactId>guava</artifactId>
        <version>31.0.1-jre</version>
    </dependency>
</dependencies>

四、实战案例：解决Log4j冲突

初始依赖配置

<dependencies>
    <dependency>
        <groupId>org.apache.hadoop</groupId>
        <artifactId>hadoop-common</artifactId>
        <version>3.3.1</version>
    </dependency>
    
    <dependency>
        <groupId>org.springframework.boot</groupId>
        <artifactId>spring-boot-starter-web</artifactId>
        <version>2.6.3</version>
    </dependency>
</dependencies>

冲突分析

mvn dependency:tree -Dincludes=org.apache.logging.log4j

输出显示

+- org.apache.hadoop:hadoop-common:3.3.1
|  \- org.apache.logging.log4j:log4j-slf4j-impl:2.14.1
\- org.springframework.boot:spring-boot-starter-web:2.6.3
   \- org.springframework.boot:spring-boot-starter-logging:2.6.3
      \- org.apache.logging.log4j:log4j-to-slf4j:2.17.1

解决方案

<dependency>
    <groupId>org.apache.hadoop</groupId>
    <artifactId>hadoop-common</artifactId>
    <version>3.3.1</version>
    <exclusions>
        <exclusion>
            <groupId>org.apache.logging.log4j</groupId>
            <artifactId>log4j-slf4j-impl</artifactId>
        </exclusion>
    </exclusions>
</dependency>

<dependency>
    <groupId>org.apache.logging.log4j</groupId>
    <artifactId>log4j-core</artifactId>
    <version>2.17.1</version>
</dependency>

五、预防依赖冲突的最佳实践

5.1 定期执行依赖检查

mvn versions:display-dependency-updates

5.2 使用BOM统一版本

<dependencyManagement>
    <dependencies>
        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-dependencies</artifactId>
            <version>2.6.3</version>
            <type>pom</type>
            <scope>import</scope>
        </dependency>
    </dependencies>
</dependencyManagement>

5.3 分层管理依赖

project-root
├── pom.xml            # 父POM管理公共配置
├── service-module     # 业务模块
└── web-module         # Web模块

5.4 使用依赖分析工具

• Maven Dependency Analyzer
• JDepend

六、常见依赖冲突场景解决方案