How to Analyze Jenkins Dependencies in pom.xml: A Complete Maven Guide

You can analyze Jenkins dependencies by running mvn dependency:tree on specific modules, inspecting the imported BOM in core/pom.xml, and reviewing Enforcer rules that ban conflicting artifacts.

The Jenkins project (jenkinsci/jenkins) is a multi-module Maven project where dependency management is centralized through a parent POM and a Bill of Materials (BOM). Understanding how to analyze these dependencies is essential for maintaining version consistency and avoiding classpath conflicts in the Jenkins ecosystem. This guide walks through the specific Maven commands and POM files that control dependency resolution across the entire codebase.

Understanding the Jenkins POM Hierarchy

Jenkins organizes its dependencies across three critical POM locations that work together to enforce consistency.

Parent POM Configuration

The root jenkins/pom.xml serves as the parent for all modules, defining global properties like ${revision}${changelist}, repository definitions, and plugin management (lines 52-61). It declares the list of modules and establishes the foundation that child POMs inherit.

Core Module Dependency Management

The core/pom.xml file contains the most critical dependency configurations for analyzing Jenkins dependencies. It imports the Jenkins BOM (jenkins-bom) via the dependencyManagement section (lines 48-66) to pin versions of every transitive library:

<dependency>
  <groupId>org.jenkins-ci.main</groupId>
  <artifactId>jenkins-bom</artifactId>
  <version>${project.version}</version>
  <type>pom</type>
  <scope>import</scope>
</dependency>

This BOM ensures that all modules use identical versions of shared libraries, preventing "jar hell" across the multi-module build.

Enforcer Rules and Banned Artifacts

Jenkins uses the Maven Enforcer plugin in core/pom.xml (lines 84-126) to maintain dependency hygiene. The configuration explicitly bans known problematic libraries—such as older Jackson versions, commons-httpclient, and javax.activation—that create classpath conflicts. Any attempt to introduce these artifacts fails the build immediately.

How to Analyze the Dependency Tree

Generate Dependency Trees with Maven

To view the resolved dependencies for a specific module, run the dependency tree command from the repository root:

mvn -pl core dependency:tree

Filter for Jenkins-specific artifacts to simplify output:

mvn -pl core dependency:tree -Dincludes=org.jenkins-ci*

The -pl core flag limits analysis to the core module, while -Dincludes narrows results to artifacts in the org.jenkins-ci group.

Inspect the Bill of Materials (BOM)

The jenkins-bom is defined in bom/pom.xml and imported in core/pom.xml. This BOM centralizes version management for all transitive dependencies. When analyzing dependency conflicts, check this file to see the exact versions Jenkins enforces across modules.

Detect Unused and Missing Dependencies

Run the analyze goal to identify dependency issues:

mvn -pl core dependency:analyze

This reports:

• Unused declared dependencies that can be safely removed
• Undeclared used dependencies that must be explicitly added to the POM

Check for Banned Dependencies

Review the Enforcer plugin configuration in core/pom.xml (lines 84-126) to see the complete list of banned artifacts. This validation ensures that prohibited libraries never enter the dependency tree, protecting the build from known conflicts.

Advanced Dependency Analysis Techniques

Cross-Module Verification

Because Jenkins uses a reactor build, you can analyze dependencies across all modules simultaneously:

mvn dependency:tree -Dverbose -Dincludes=org.jenkins-ci

This command reveals inter-module dependencies such as jenkins-core ↔ remoting and jenkins-core ↔ cli, showing how the modular architecture connects.

Export Dependency Graphs

Configure the Maven Dependency plugin in core/pom.xml to generate textual graph files for visualization:

<plugin>
  <groupId>org.apache.maven.plugins</groupId>
  <artifactId>maven-dependency-plugin</artifactId>
  <version>3.8.0</version>
  <executions>
    <execution>
      <id>graph</id>
      <goals><goal>tree</goal></goals>
      <phase>verify</phase>
      <configuration>
        <outputFile>${project.build.directory}/dependency-graph.txt</outputFile>
      </configuration>
    </execution>
  </executions>
</plugin>

After running mvn verify -DskipTests, convert the output for visualization tools:

cat core/target/dependency-graph.txt | dot -Tpng -o deps.png

Key Files for Dependency Analysis

Understanding these specific files is essential when you analyze Jenkins dependencies:

• pom.xml (root): Declares modules, properties (lines 52-61), and plugin management that cascades to all children.
• core/pom.xml: Contains the BOM import (lines 48-66), actual dependency declarations (lines 67-140), and Enforcer rules (lines 84-126) that shape the entire dependency set.
• bom/pom.xml: Defines the Bill-of-Materials that pins versions for every transitive library used across the project.
• war/pom.xml: Shows how the assembled jenkins.war bundles resolved dependencies for deployment.
• test/pom.xml: Contains test-scope dependencies crucial for analyzing the full test classpath.

Summary

• Use mvn dependency:tree with -pl to analyze specific modules like core or war, filtering with -Dincludes for Jenkins artifacts.
• Check core/pom.xml for the BOM import (lines 48-66) that centralizes version management and Enforcer rules (lines 84-126) that ban conflicting libraries.
• Run mvn dependency:analyze to identify unused declarations and missing dependencies that could cause runtime errors.
• Review bom/pom.xml to understand version pinning across the entire multi-module project.
• Execute reactor-wide analysis using mvn dependency:tree without the -pl flag to see inter-module dependencies.

Frequently Asked Questions

How do I find which version of a specific library Jenkins uses?

Check the dependencyManagement section in core/pom.xml (lines 48-66) where the Jenkins BOM is imported, or examine bom/pom.xml directly. The BOM pins versions for all transitive dependencies, ensuring consistency across modules. You can also run mvn -pl core dependency:tree -Dincludes=<groupId> to see the resolved version in the specific module.

Why does Jenkins ban certain dependencies in the Enforcer plugin?

Jenkins bans libraries like older Jackson versions, commons-httpclient, and javax.activation in core/pom.xml (lines 84-126) because they cause known classpath conflicts or security vulnerabilities. The Enforcer plugin configuration prevents developers from accidentally introducing these problematic artifacts during dependency resolution.

What is the difference between the parent POM and the BOM in Jenkins?

The parent POM (jenkins/pom.xml) defines build configuration, plugin versions, and module structure that all children inherit. The BOM (bom/pom.xml) is imported via dependencyManagement in core/pom.xml and only manages dependency versions without affecting build configuration. The BOM ensures version consistency while the parent POM controls the build lifecycle.

How can I check if my changes introduced any unused dependencies?

Run mvn dependency:analyze on the specific module you modified. This goal examines the compiled classes against the POM declarations, reporting any dependencies declared but not used in the code. Remove these unused declarations to reduce the WAR size and simplify the dependency tree.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}