# Core Jenkins Dependencies Listed in pom.xml: Complete Technical Guide

> Discover core Jenkins dependencies in pom.xml. Explore jenkins-core, remoting, Guava, Stapler, and Pipeline APIs. Get the complete technical guide.

- Repository: [Jenkins/jenkins](https://github.com/jenkinsci/jenkins)
- Tags: internals
- Published: 2026-07-30

---

**The [`pom.xml`](https://github.com/jenkinsci/jenkins/blob/main/pom.xml) in the jenkinsci/jenkins repository declares core dependencies including `jenkins-core`, `remoting`, Apache Commons utilities (Lang3, Collections4, IO), Google Guava, the Stapler web framework, and Pipeline APIs (`workflow-api`, `workflow-step-api`), with all versions centrally managed via the Jenkins BOM.**

Jenkins is an open-source automation server built with Maven, and its foundational libraries are defined in the top-level [`pom.xml`](https://github.com/jenkinsci/jenkins/blob/main/pom.xml) located at the repository root. These core Jenkins dependencies provide the runtime essentials, from the web UI framework to the agent communication protocol that enables distributed builds across the architecture.

## Where Core Dependencies Are Declared

Dependency management in Jenkins follows a hierarchical Maven structure, with version control centralized to ensure consistency across modules.

### Top-Level Project Object Model

The primary [`pom.xml`](https://github.com/jenkinsci/jenkins/blob/main/pom.xml) file at the repository root defines the `<dependencies>` section that lists libraries required for the Jenkins core runtime. This file imports the **Bill of Materials (BOM)** to manage versions centrally.

According to the Jenkins source code, the BOM is imported in the `<dependencyManagement>` section:

- **BOM import**: [`pom.xml – Dependency Management`](https://github.com/jenkinsci/jenkins/blob/master/pom.xml#L71-L84)

### The Bill of Materials (BOM)

The [`bom/pom.xml`](https://github.com/jenkinsci/jenkins/blob/main/bom/pom.xml) file acts as the single source of truth for dependency versions. Rather than declaring versions in individual modules, the top-level POM imports this BOM, which specifies compatible versions for all core libraries and plugins.

## Key Categories of Core Dependencies

The dependencies declared in the top-level [`pom.xml`](https://github.com/jenkinsci/jenkins/blob/main/pom.xml) and managed by the BOM fall into several functional categories essential for Jenkins operation.

### Jenkins Core Modules

These modules constitute the server itself:

- **`org.jenkins-ci.main:jenkins-core`** — Contains the bulk of Jenkins' server implementation, including the job model, security layer, and UI rendering.
- **`org.jenkins-ci.remoting:remoting`** — Handles the agent-to-master communication protocol for distributed builds.
- **`org.jenkins-ci.main:jenkins-war`** — Packages Jenkins as an executable WAR file for deployment.

### Apache Commons Utilities

Jenkins relies heavily on Apache Commons for cross-cutting utilities:

- **`org.apache.commons:commons-lang3`** — Provides `StringUtils`, `ObjectUtils`, and other fundamental utilities.
- **`org.apache.commons:commons-collections4`** — Supplies extended collection data structures and algorithms.
- **`org.apache.commons:commons-io`** — Handles file I/O operations, stream copying, and utility methods.
- **`org.apache.commons:commons-text`** — Offers text manipulation utilities including HTML and CSV escaping.

### Web Framework and UI

The Jenkins user interface depends on specific frameworks:

- **`org.kohsuke:stapler`** — The web framework that binds URL routing to Java methods and renders Jelly views.
- **`org.codehaus.groovy:groovy-all`** — Provides Groovy scripting support for pipeline definitions and extensions.
- **`org.jvnet.localizer:localizer`** — Enables internationalization (i18n) of UI strings across the application.

### Pipeline and Security

Pipeline functionality and script security are provided by:

- **`org.jenkins-ci.main:workflow-api`** — Core API for Pipeline orchestration and execution.
- **`org.jenkins-ci.main:workflow-step-api`** — Defines the extension point for creating pipeline steps.
- **`org.jenkins-ci.main:script-security`** — Sandboxes Groovy scripts to prevent malicious code execution.
- **`com.google.guava:guava`** — Supplies caching, immutable collections, and concurrency utilities used by the security layer.

### Plugin Infrastructure

Core dependencies also include libraries for plugin functionality:

- **`org.jenkins-ci.plugins:matrix-project`** — Enables matrix-based job configurations.
- **`org.jenkins-ci.plugins:mailer`** — Provides email notification capabilities.
- **`org.jenkins-ci.plugins:metrics`** — Supplies instrumentation for runtime monitoring.
- **`org.jenkins-ci.plugins:git`** and **`org.eclipse.jgit:org.eclipse.jgit`** — Support Git source code management operations.

### Testing and Development

The test scope dependencies ensure code quality:

- **`org.jenkins-ci.main:jenkins-test-harness`** — Utilities for unit and integration testing of Jenkins core.
- **`org.junit.jupiter:junit-jupiter-api`** — JUnit 5 testing framework.
- **`org.mockito:mockito-core`** — Mocking library for isolated test cases.
- **`org.hamcrest:hamcrest-all`** — Matcher library for assertions.

## Inspecting Dependency Declarations

You can view the complete list of dependencies in the top-level POM. The concrete declarations appear under the `<dependencies>` tag:

- **Core dependencies**: [`pom.xml – Dependencies`](https://github.com/jenkinsci/jenkins/blob/master/pom.xml#L1276-L1360)

Additional module-specific dependencies are defined in:
- [`core/pom.xml`](https://github.com/jenkinsci/jenkins/blob/main/core/pom.xml) — Dependencies specific to the Jenkins core module.
- [`war/pom.xml`](https://github.com/jenkinsci/jenkins/blob/main/war/pom.xml) — Dependencies for WAR packaging and the executable artifact.

## Practical Usage Examples

The following Java examples demonstrate how these dependencies are utilized within the Jenkins codebase.

Accessing security permissions using `jenkins-core`:

```java
import hudson.security.Permission;
import hudson.model.User;

public class PermissionChecker {
    public boolean hasReadPermission(User user) {
        // Uses jenkins-core security libraries
        return user.hasPermission(Permission.READ);
    }
}

```

Utilizing Google Guava for validation:

```java
import com.google.common.base.Preconditions;

public class JobValidator {
    public void validateJobName(String name) {
        // Uses Guava from the core classpath
        Preconditions.checkArgument(
            name != null && !name.isEmpty(),
            "Job name must not be empty"
        );
    }
}

```

## Summary

- **Core Modules**: The `jenkins-core` and `remoting` dependencies provide the server runtime and agent communication.
- **Utility Libraries**: Apache Commons (Lang3, Collections4, IO, Text) and Google Guava supply essential programming utilities.
- **Web Stack**: The Stapler framework and Groovy runtime support the Jenkins web UI and pipeline scripting.
- **Version Management**: All versions are controlled centrally via the BOM ([`bom/pom.xml`](https://github.com/jenkinsci/jenkins/blob/main/bom/pom.xml)) imported in the top-level [`pom.xml`](https://github.com/jenkinsci/jenkins/blob/main/pom.xml).
- **Testing**: The `jenkins-test-harness`, JUnit 5, and Mockito enable comprehensive test coverage.

## Frequently Asked Questions

### What is the Jenkins BOM and why does it manage dependency versions?

The **Bill of Materials (BOM)** is a special POM ([`bom/pom.xml`](https://github.com/jenkinsci/jenkins/blob/main/bom/pom.xml)) that defines versions for all core dependencies and plugins. It ensures that every Jenkins module uses compatible library versions, preventing classpath conflicts and simplifying maintenance. The top-level [`pom.xml`](https://github.com/jenkinsci/jenkins/blob/main/pom.xml) imports this BOM in its `<dependencyManagement>` section, allowing sub-modules to declare dependencies without specifying versions.

### How do I check the exact version of a specific Jenkins dependency?

Inspect the [`bom/pom.xml`](https://github.com/jenkinsci/jenkins/blob/main/bom/pom.xml) file in the repository root. This file contains the `<dependencyManagement>` section where versions are explicitly declared. For example, to find the Guava version, search for `com.google.guava:guava` within [`bom/pom.xml`](https://github.com/jenkinsci/jenkins/blob/main/bom/pom.xml). Alternatively, check the effective POM by running `mvn help:effective-pom` from the project root.

### Are Jenkins plugin dependencies declared in the same pom.xml as core dependencies?

No, individual plugin dependencies are declared in their respective plugin directories under `plugins/`. However, the top-level [`pom.xml`](https://github.com/jenkinsci/jenkins/blob/main/pom.xml) and BOM define the **core framework dependencies** that plugins inherit, such as `workflow-api` and `script-security`. Plugin-specific dependencies are managed in the plugin's own [`pom.xml`](https://github.com/jenkinsci/jenkins/blob/main/pom.xml) file, which inherits from the Jenkins parent POM.

### What is the difference between `jenkins-core` and `jenkins-war` dependencies?

**`jenkins-core`** is the module containing the actual Jenkins application code, including the model for jobs, builds, and the security realm. **`jenkins-war`** is the packaging module that assembles `jenkins-core` and its dependencies into a deployable WAR file suitable for application servers like Tomcat or Jetty. When running Jenkins standalone, you execute the WAR artifact, which embeds the core module.