How Maven Resolves Transitive Dependencies from Repositories
Publication Date:
Updated:
INFORMATION > How Maven Resolves Transitive Dependencies from Repositories
Bottom line: Maven does not discover arbitrary JARs by filename. It resolves declared coordinates, downloads the artifact POM, follows that POM's dependencies, applies scope and optional rules, and uses dependency mediation when multiple paths request different versions.
What you'll learn
- How local, central, mirror, and private repositories participate in resolution.
- Why a dependency's POM—not the JAR itself—describes most transitive requirements.
- How to inspect the effective graph before overriding a version.
Who this is for: Maven users who want to understand where downloaded artifacts come from and why extra libraries appear.
2026 context: The older Apache POI coordinates below remain useful as a historical example, not a version recommendation. Use current supported dependencies, trusted HTTPS repositories, checksum/signature controls where available, and a dependency update policy.
Overview
Maven downloads JAR files from remote repositories. This section explains the resolution process.
For a broader introduction, start with What is Maven and what does Maven manage?
Table of Contents
1. How Maven resolves JAR dependencies
After a dependency is declared in pom.xml, Maven resolves its coordinates to an artifact, reads its POM, and follows applicable transitive dependencies.
1-1. Declaring coordinates in pom.xml
A dependency declaration identifies an artifact by groupId, artifactId, and version. This historical example requests Apache POI 3.17, a library for Microsoft Office document formats:
<dependency>
<groupId>org.apache.poi</groupId>
<artifactId>poi</artifactId>
<version>3.17</version>
</dependency>
Maven resolves these coordinates against configured repositories, downloads the POI artifact and POM, and then resolves dependencies described by that POM.
1-2. Remote and local repositories
The following diagram illustrates the repository flow.
Unless settings or a mirror override it, Maven searches Maven Central. The Maven repository documentation explains local, remote, and plugin repositories.
Downloaded artifacts are cached in the local repository, normally %USERPROFILE%\.m2\repository on Windows or ~/.m2/repository on Unix-like systems. Maven can still contact a remote repository for metadata and snapshot updates according to repository policy.
A project can declare another repository as shown below, although organization-wide mirrors and credentials usually belong in settings.xml. Only trusted HTTPS repositories should be used.
<repositories>
<repository>
<id>sonatype-nexus-snapshots</id>
<name>Sonatype Nexus Snapshots</name>
<url>https://oss.sonatype.org/content/repositories/snapshots</url>
<releases>
<enabled>false</enabled>
</releases>
<snapshots>
</snapshots>
</repository>
</repositories>
1-3. Resolving transitive dependencies
The repository directory for POI 3.17 contains both poi-3.17.jar and poi-3.17.pom. That POM declares a dependency on commons-collections4:4.1.
Maven reads artifact POMs recursively to construct a dependency graph. It then applies scopes, exclusions, optional dependencies, and version mediation to determine the effective classpath. Use mvn dependency:tree to inspect the resolved result.
2. Conclusion
Maven resolves declared coordinates from repositories and uses each artifact's POM to discover transitive dependencies. The JAR contains executable classes and resources; dependency metadata normally comes from the accompanying POM.
Official references
■INFORMATION
■PROFILE
■CONTACT