# How to Analyze Jenkins Dependencies in pom.xml: A Complete Maven Guide

> Learn to analyze Jenkins dependencies in pom.xml using Maven commands inspect BOMs and review Enforcer rules Get a complete guide for your Jenkins project.

- Repository: [Jenkins/jenkins](https://github.com/jenkinsci/jenkins)
- Tags: how-to-guide
- Published: 2026-07-30

---

**You can analyze Jenkins dependencies by running `mvn dependency:tree` on specific modules, inspecting the imported BOM in [`core/pom.xml`](https://github.com/jenkinsci/jenkins/blob/main/core/pom.xml), and reviewing Enforcer rules that ban conflicting artifacts.**

The Jenkins project (`jenkinsci/jenkins`) is a multi-module Maven project where dependency management is centralized through a parent POM and a Bill of Materials (BOM). Understanding how to analyze these dependencies is essential for maintaining version consistency and avoiding classpath conflicts in the Jenkins ecosystem. This guide walks through the specific Maven commands and POM files that control dependency resolution across the entire codebase.

## Understanding the Jenkins POM Hierarchy

Jenkins organizes its dependencies across three critical POM locations that work together to enforce consistency.

### Parent POM Configuration

The root [`jenkins/pom.xml`](https://github.com/jenkinsci/jenkins/blob/main/jenkins/pom.xml) serves as the parent for all modules, defining global properties like `${revision}${changelist}`, repository definitions, and plugin management (lines 52-61). It declares the list of modules and establishes the foundation that child POMs inherit.

### Core Module Dependency Management

The [`core/pom.xml`](https://github.com/jenkinsci/jenkins/blob/main/core/pom.xml) file contains the most critical dependency configurations for analyzing Jenkins dependencies. It imports the **Jenkins BOM** (`jenkins-bom`) via the `dependencyManagement` section (lines 48-66) to pin versions of every transitive library:

```xml
<dependency>
  <groupId>org.jenkins-ci.main</groupId>
  <artifactId>jenkins-bom</artifactId>
  <version>${project.version}</version>
  <type>pom</type>
  <scope>import</scope>
</dependency>

```

This BOM ensures that all modules use identical versions of shared libraries, preventing "jar hell" across the multi-module build.

### Enforcer Rules and Banned Artifacts

Jenkins uses the Maven Enforcer plugin in [`core/pom.xml`](https://github.com/jenkinsci/jenkins/blob/main/core/pom.xml) (lines 84-126) to maintain dependency hygiene. The configuration explicitly bans known problematic libraries—such as older Jackson versions, `commons-httpclient`, and `javax.activation`—that create classpath conflicts. Any attempt to introduce these artifacts fails the build immediately.

## How to Analyze the Dependency Tree

### Generate Dependency Trees with Maven

To view the resolved dependencies for a specific module, run the dependency tree command from the repository root:

```bash
mvn -pl core dependency:tree

```

Filter for Jenkins-specific artifacts to simplify output:

```bash
mvn -pl core dependency:tree -Dincludes=org.jenkins-ci*

```

The `-pl core` flag limits analysis to the core module, while `-Dincludes` narrows results to artifacts in the `org.jenkins-ci` group.

### Inspect the Bill of Materials (BOM)

The `jenkins-bom` is defined in [`bom/pom.xml`](https://github.com/jenkinsci/jenkins/blob/main/bom/pom.xml) and imported in [`core/pom.xml`](https://github.com/jenkinsci/jenkins/blob/main/core/pom.xml). This BOM centralizes version management for all transitive dependencies. When analyzing dependency conflicts, check this file to see the exact versions Jenkins enforces across modules.

### Detect Unused and Missing Dependencies

Run the analyze goal to identify dependency issues:

```bash
mvn -pl core dependency:analyze

```

This reports:

- **Unused declared dependencies** that can be safely removed
- **Undeclared used dependencies** that must be explicitly added to the POM

### Check for Banned Dependencies

Review the Enforcer plugin configuration in [`core/pom.xml`](https://github.com/jenkinsci/jenkins/blob/main/core/pom.xml) (lines 84-126) to see the complete list of banned artifacts. This validation ensures that prohibited libraries never enter the dependency tree, protecting the build from known conflicts.

## Advanced Dependency Analysis Techniques

### Cross-Module Verification

Because Jenkins uses a reactor build, you can analyze dependencies across all modules simultaneously:

```bash
mvn dependency:tree -Dverbose -Dincludes=org.jenkins-ci

```

This command reveals inter-module dependencies such as `jenkins-core` ↔ `remoting` and `jenkins-core` ↔ `cli`, showing how the modular architecture connects.

### Export Dependency Graphs

Configure the Maven Dependency plugin in [`core/pom.xml`](https://github.com/jenkinsci/jenkins/blob/main/core/pom.xml) to generate textual graph files for visualization:

```xml
<plugin>
  <groupId>org.apache.maven.plugins</groupId>
  <artifactId>maven-dependency-plugin</artifactId>
  <version>3.8.0</version>
  <executions>
    <execution>
      <id>graph</id>
      <goals><goal>tree</goal></goals>
      <phase>verify</phase>
      <configuration>
        <outputFile>${project.build.directory}/dependency-graph.txt</outputFile>
      </configuration>
    </execution>
  </executions>
</plugin>

```

After running `mvn verify -DskipTests`, convert the output for visualization tools:

```bash
cat core/target/dependency-graph.txt | dot -Tpng -o deps.png

```

## Key Files for Dependency Analysis

Understanding these specific files is essential when you analyze Jenkins dependencies:

- **[`pom.xml`](https://github.com/jenkinsci/jenkins/blob/main/pom.xml)** (root): Declares modules, properties (lines 52-61), and plugin management that cascades to all children.
- **[`core/pom.xml`](https://github.com/jenkinsci/jenkins/blob/main/core/pom.xml)**: Contains the BOM import (lines 48-66), actual dependency declarations (lines 67-140), and Enforcer rules (lines 84-126) that shape the entire dependency set.
- **[`bom/pom.xml`](https://github.com/jenkinsci/jenkins/blob/main/bom/pom.xml)**: Defines the Bill-of-Materials that pins versions for every transitive library used across the project.
- **[`war/pom.xml`](https://github.com/jenkinsci/jenkins/blob/main/war/pom.xml)**: Shows how the assembled `jenkins.war` bundles resolved dependencies for deployment.
- **[`test/pom.xml`](https://github.com/jenkinsci/jenkins/blob/main/test/pom.xml)**: Contains test-scope dependencies crucial for analyzing the full test classpath.

## Summary

- **Use `mvn dependency:tree`** with `-pl` to analyze specific modules like `core` or `war`, filtering with `-Dincludes` for Jenkins artifacts.
- **Check [`core/pom.xml`](https://github.com/jenkinsci/jenkins/blob/main/core/pom.xml)** for the BOM import (lines 48-66) that centralizes version management and Enforcer rules (lines 84-126) that ban conflicting libraries.
- **Run `mvn dependency:analyze`** to identify unused declarations and missing dependencies that could cause runtime errors.
- **Review [`bom/pom.xml`](https://github.com/jenkinsci/jenkins/blob/main/bom/pom.xml)** to understand version pinning across the entire multi-module project.
- **Execute reactor-wide analysis** using `mvn dependency:tree` without the `-pl` flag to see inter-module dependencies.

## Frequently Asked Questions

### How do I find which version of a specific library Jenkins uses?

Check the `dependencyManagement` section in [`core/pom.xml`](https://github.com/jenkinsci/jenkins/blob/main/core/pom.xml) (lines 48-66) where the Jenkins BOM is imported, or examine [`bom/pom.xml`](https://github.com/jenkinsci/jenkins/blob/main/bom/pom.xml) directly. The BOM pins versions for all transitive dependencies, ensuring consistency across modules. You can also run `mvn -pl core dependency:tree -Dincludes=<groupId>` to see the resolved version in the specific module.

### Why does Jenkins ban certain dependencies in the Enforcer plugin?

Jenkins bans libraries like older Jackson versions, `commons-httpclient`, and `javax.activation` in [`core/pom.xml`](https://github.com/jenkinsci/jenkins/blob/main/core/pom.xml) (lines 84-126) because they cause known classpath conflicts or security vulnerabilities. The Enforcer plugin configuration prevents developers from accidentally introducing these problematic artifacts during dependency resolution.

### What is the difference between the parent POM and the BOM in Jenkins?

The **parent POM** ([`jenkins/pom.xml`](https://github.com/jenkinsci/jenkins/blob/main/jenkins/pom.xml)) defines build configuration, plugin versions, and module structure that all children inherit. The **BOM** ([`bom/pom.xml`](https://github.com/jenkinsci/jenkins/blob/main/bom/pom.xml)) is imported via `dependencyManagement` in [`core/pom.xml`](https://github.com/jenkinsci/jenkins/blob/main/core/pom.xml) and only manages dependency versions without affecting build configuration. The BOM ensures version consistency while the parent POM controls the build lifecycle.

### How can I check if my changes introduced any unused dependencies?

Run `mvn dependency:analyze` on the specific module you modified. This goal examines the compiled classes against the POM declarations, reporting any dependencies declared but not used in the code. Remove these unused declarations to reduce the WAR size and simplify the dependency tree.