title: dependency management with maven
body: <p>I have lately become a big fan of Maven for controlling the build cycle for my application.  However I've encountered some rough edges with Maven's dependency management.  I'm wondering if these are limitations of the tool and paradigm, necessary evils of dependancy management, or if I"m just using the tool incorrectly.  </p>
  
  <ol>
  <li><p>First is the matter of transitive dependencies.  As I understand it, if you provide a dependency, Maven will in turn find any dependencies of that dependency.  That is great, but for many of my dependencies, this has not worked.  For example, including Hibernate in my project:</p>
  
  <pre><code>&lt;dependency&gt;
      &lt;groupId&gt;org.hibernate&lt;/groupId&gt;
      &lt;artifactId&gt;hibernate-core&lt;/artifactId&gt;
      &lt;version&gt;3.3.2.GA&lt;/version&gt;
  &lt;/dependency&gt;
  </code></pre>
  
  <p>Results in a missing dependency of slf4j.  I need to manually add this dependency which I assumed would be Maven's job.  The same goes for Spring.  If I add Spring-MVC as a dependency, shouldn't all of the basic servlet dependencies be added for me (because Spring-MVC would need this stuff)?  I'm referring to the servlet, jsp, jstl libraries.  </p></li>
  <li><p>Second is the management of repositories.  Maven comes shipped with a default main repository, but I've found that in many cases this repository is not up to date. For example, ifyou want spring3, you have to manually add the springsource repository, and if you want hibernate 3.5+ you have to add the jboss repository.  It seems to defeat the point of automatic dependency management when you have to hunt down the correct repositories yourself.  This hunting soon gets complicated.  For example to add Spring3, you may want the spring release repo, the spring externals repo and the spring milestone repo.  </p></li>
  <li><p>Closely related to number 2 is ensuring you have the correct version of an artifact.  I have been burned several times by including the wrong versions of dependent artifacts for a given artifact.  For example the wrong version of the servlet/jsp/jstl apis for spring3, or the wrong version of persistence / annotation apis for hibernate.  The repositories are filled with many versions, some with confusing names like productx-3.ga, productx-3-rc1, productx-3-SNAPSHOT, productx-3-cr, product-3-beta, etc.  Some of these are obvious (rc= release candidate), but it can be confusing trying to determine the order of these versions.  </p></li>
  <li><p>Finally, the issue of the type a dependency.  I probably just don't understand this well enough, but many repo artifacts are of type "pom" not "jar".  Several times i have added a dependency jar to my project only to find out at build time that the repo jar does not actually exist (example is org.hibernate ejb3-persistence in the jboss repo).  </p></li>
  </ol>
  
  <p>With some experimenting, I can usually get a build to work, but is dependency management in general this complicated?  I still prefer this approach to manually adding jar files to my project, but I would be interested to learn how to improve my maven dependency management skills. </p>