Java Dependency management
Where builds actually break, and where most supply-chain risk enters a Java project.
3 concepts · 9 interview questions
What this topic covers
Every concept in dependency management, and the questions each one gets asked as. Where a question links, it has a full write-up.
Transitive dependencies and conflicts
Your dependencies have dependencies, and two of them will want different versions of the same library. The build tool picks one, by a rule worth knowing.
- Two libraries need different versions of the same dependency. What happens?
- How do you find out why a dependency is on your classpath?
- What is NoSuchMethodError telling you?
Versions and upgrades
Semantic versioning is a promise the ecosystem keeps unevenly. Version ranges make builds non-reproducible in exchange for automatic patches.
- Should you use version ranges or pinned versions?
- How do you keep dependencies current without breaking things?
- What does a reproducible build require?
Known vulnerabilities
Most reported vulnerabilities in a Java service are in its dependencies. Finding them is automated; deciding which ones matter is not.
- How do you know whether your dependencies have known CVEs?
- A scanner reports a critical CVE in a transitive dependency. What now?
- What is an SBOM for?