Why does "mvn dependency:tree" list one version, but "mvn clean install" try to download another version?

Question

I've got a Maven (3.2.5) project which is failing due to a missing dependency. The relevant part of the mvn clean install output:

[ERROR] Failed to execute goal org.apache.maven.plugins:maven-assembly-plugin:2.2-beta-5:single (package-jar-with-dependencies) on project splitter: Failed to create assembly: Failed to resolve dependencies for project: groupId1:splitter:jar:2.12.3: Missing:
[ERROR] ----------
[ERROR] 1) groupId2:location-service:jar:2.12.3

However, mvn depdency:tree claims that the 2.12.3 version is not necessary:

[INFO] --- maven-dependency-plugin:2.8:tree (default-cli) @ splitter ---
[INFO] groupId1:splitter:jar:2.12.3
[INFO] +- groupId2:location-service:jar:2.12.1:compile

There is no other location-service dependency listed.

The pom.xml explicitly calls out the 2.12.1 dependency:

<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd>
    <parent>
        <groupId>groupId2</groupId>
        <artifactId>artifactId</artifactId>
        <version>2.12.0</version>
    </parent>
    ...
    <groupId>groupId1</groupId>
    <artifactId>splitter</artifactId>
    <packaging>jar</packaging>
    <version>2.12.3</version>
    <name>splitter</name>
    <url>http://maven.apache.org</url>
    ...
    <dependencies>
        <dependency>
            <groupId>groupId2</groupId>
            <artifactId>location-service</artifactId>
            <version>2.12.1</version>
        </dependency>
        ...

Interestingly, the parent pom.xml is not available in this directory structure (the person that created the SVN branch branched a portion of the repository that didn't include the parent pom.xml). However, Maven does not complain about it missing, so it's getting it from my~/.m2/repository directory.

Answer 1

Sorry reputation seekers, yet again I found the solution to my question while composing it. But it's complicated enough to go ahead and post the question and answer, in case anyone else runs into a similar problem.

The problem turned out to be that the parent pom.xml in my ~/.m2/repository directory set the location-service dependency to ${project.version}. Apparently this was enough for the maven-assembly-plugin to want to download it, despite the explicit dependency in the module pom.xml. This is a bug in maven-assembly-plugin:2.2-beta-5. Neither the module nor the parent pom.xml name an explicit version of the maven-assembly-plugin. I haven't the foggiest idea why maven is selecting the 2.2-beta-5 version to download, as it isn't even close to the latest version. mvn dependency:tree -Dverbose doesn't even mention maven-assembly-plugin. Explicitly using maven-assembly-plugin:2.5.5 solves the problem.