Maven

Maven is a build automation and project management tool primarily for Java projects.

Dependency management, standardized build lifecycle, and reproducible project structure.

Project Object Model file (pom.xml) describing project metadata and build configuration.

It defines coordinates, dependencies, plugins, profiles, and lifecycle behavior.

groupId, artifactId, version (GAV) uniquely identifying artifacts.

Organization or domain-based namespace for project artifacts.

Module/library name within group.

Artifact release identifier (e.g., 1.0.0).

Artifact type produced by build (jar, war, pom, etc.).

jar if unspecified.

Ordered sequence of build phases executed to build/test/package/deploy software.

clean, default (build), site.

Named step in lifecycle (compile, test, package, verify, install, deploy…).

Specific task executed by a plugin (e.g., compiler:compile).

Phase is lifecycle step; goals are plugin tasks bound to phases.

Runs clean lifecycle, removing previous build output (target directory).

Compiles main source code.

Runs tests (usually unit tests) in test phase.

Packages compiled code into distributable artifact (jar/war).

Runs checks/verification after packaging (integration with QA gates/plugins).

Installs built artifact into local Maven repository.

Publishes artifact to remote repository for team/shared usage.

Local cache/store of artifacts, usually under ~/.m2/repository.

Server-hosted artifact repository (Maven Central, Nexus, Artifactory, etc.).

Default public repository hosting open-source Maven artifacts.

External artifact required by project.

Inside <dependencies> section in pom.xml.

Defines classpath visibility and transitivity behavior.

compile, provided, runtime, test, system, import.

Available in all classpaths and transitive by default.

Needed for compile/test but expected from runtime container (not packaged transitively as runtime).

Not needed at compile time, required at runtime/test runtime.

Only available during test compilation/execution.

Dependency brought indirectly by another dependency.

Reduce manual declaration burden.

Version conflicts and hidden classpath surprises.

Multiple versions of same artifact appear in dependency graph.

“Nearest definition” in dependency tree wins.

Use mvn dependency:tree.

Prevent specific transitive artifact from being included.

Central section controlling dependency versions without direct inclusion.

Management defines versions/rules; dependencies actually include artifacts.

POM inherited by child project for shared configuration.

Consistency and reduced duplication across modules/projects.

Aggregator project building multiple modules together.

Usually pom packaging.

src/main/java, src/test/java, src/main/resources, etc.

Convention over configuration; plugin defaults work seamlessly.

Extension component adding build functionality.

compiler, surefire, failsafe, jar, resources, clean, install, deploy.

Runs unit tests in test phase.

Runs integration tests, typically in integration-test/verify phases.

Faster feedback and clearer pipeline stages.

User/global Maven runtime configuration (repos, mirrors, credentials, profiles).

No; use settings.xml/CI secret management.

Copy-pasting huge plugin config without understanding lifecycle impact.

Using dynamic/snapshot dependencies in production releases carelessly.

Pin plugin/dependency versions explicitly.

Run clean verify on every pull request.

Keep POM minimal, explicit, and convention-aligned.

Bill of Materials POM centralizing compatible dependency versions.

Use dependencyManagement with scope import and type pom.

Version alignment and fewer dependency conflicts.

Fully resolved POM after inheritance, profiles, and defaults.

mvn help:effective-pom.

Resolved settings after global/user/profile interpolation.

mvn help:effective-settings.

Conditional configuration activated by property/JDK/OS/file/explicit flag.

Environment-specific behavior (dev/ci/release) without duplicating POMs.

-P flag, properties, OS, JDK version, file presence.

Encoding business logic and excessive complexity in profiles.

Centralized plugin versions/config inherited by children.

Management defines defaults; plugins section binds executions.

Avoid non-reproducible builds due to plugin version drift.

Project-local wrapper scripts ensuring consistent Maven version usage.

Eliminates “works on my Maven version” problems.

Mutable development version ending with -SNAPSHOT.

Snapshot can change; release should be immutable.

Controls frequency of checking remote snapshot updates.

Defines behavior on artifact checksum mismatch (warn/fail).

Redirect repository requests through specified mirror (e.g., internal proxy).

Caching, access control, proxying, and artifact governance.

Ensuring consistent single versions across transitive graph.

Maven Enforcer rules and BOM management.

Plugin enforcing project/build rules (Java version, banned deps, convergence, etc.).

Same source produces same artifact bytes/metadata (as much as possible).

Timestamps, plugin drift, generated file ordering, environment differences.

Produces simplified consumer POM for publication/use cases.

Helps inspect/update dependency/plugin versions.

Maven selecting one artifact version among conflicts.

Declare direct dependency or manage version in dependencyManagement.

Dependency not transitively inherited by default consumers.

Extra artifact variant label (sources, javadoc, tests, native variants).

Additional artifact produced in build besides main packaging.

Creates uber/fat jar and can relocate packages.

Shade focuses class relocation/uber jars; assembly builds custom distributions.

Replacing placeholders in resource files during build.

Accidental modification/leakage of binary/sensitive content.

Selects configured JDK/toolchain independent from runtime JAVA_HOME.

Consistent cross-JDK builds in CI/dev.

Maven building modules together in dependency-aware order.

Use reactor flags like -pl and -am.

Build selected module and dependents (affected downstream modules).

-T for multithreaded module build.

Plugins/tests must be thread-safe; ordering assumptions may break.

Core Maven is not fully incremental like some newer build tools.

Module boundaries, test splitting, cache/proxy, parallelism, plugin tuning.

Surefire in test phase; failsafe in integration-test + verify.

Ensures integration test failures fail build properly.

Code coverage measurement/reporting.

Chasing percentage metrics without meaningful assertions.

Generates project reports/documentation site.

Many teams use external docs/CI dashboards, but it remains useful.

Cryptographically signing artifacts for integrity/trust.

Automates version bump/tag/release flow (opinions vary on usage).

Complexity and SCM workflow mismatch; prefer explicit CI release scripts.

Using properties (e.g., revision) to inject versions in pipelines.

Primarily repository cache/proxy; remote build cache support varies by tooling.

Huge parent POM mixing unrelated concerns for every module.

Layered parents/BOMs with clear scope and ownership.

Analyze dependencies/plugins for known vulnerabilities/licenses.

Build plugins execute code and can introduce supply-chain risk.

Ensure dependency licenses meet organization policy.

Team can explain classpath, lifecycle bindings, and dependency graph decisions.

effective-pom -> dependency tree -> plugin execution debug -> CI env parity.

Debug logging mode for detailed troubleshooting.

Forces update checks for snapshots/releases metadata.

Build using local repository only without remote access.

Builds should be deterministic, policy-checked, and environment-consistent.

Standardize parent/BOM/plugin governance and keep modules cohesive.

Organization-wide control of dependencies, plugins, repos, and release policies.

Curated parent enforcing approved plugin/dependency defaults and quality gates.

Central BOMs per tech stack aligned with tested compatibility matrix.

Explicitly permit trusted artifacts and block risky/unapproved ones.

Indirect dependencies can introduce vulnerabilities unexpectedly.

SBOM generation, continuous scanning, and strict upgrade cadence.

Machine-readable dependency inventory produced during build/release.

Compliance, incident response, and supply-chain transparency.

Traceability of who built artifact, from which source, with what tools.

Signed commits/tags, signed artifacts, immutable CI, attestations.

Build isolated from undeclared external influences for reproducibility/security.

Plugins/dependencies often fetched from remote repos unless mirrored/pinned.

Internal mirrored repos, locked versions, controlled toolchains, offline-capable CI steps.

Promote same artifact binary across environments instead of rebuilding.

Rebuilds can produce drift and invalidate prior test assurances.

Large reactor size and cross-module coupling slow feedback.

Clear module boundaries, selective builds, parallel CI partitioning.

Run only impacted module tests/builds based on dependency graph changes.

Erodes trust and blocks reliable release automation.

Detection, quarantine with SLA, root-cause fix ownership.

Optimize repository manager throughput, TTLs, and storage cleanup.

Prevents corrupted/tampered artifacts entering builds.

Malicious artifact with similar coordinates/version hijacks resolution path.

Use internal repos/mirrors strictly and control external resolution.

Compromised plugin can execute arbitrary build-time code.

Pin versions, approve sources, scan/sign artifacts, restrict network/permissions in CI.

Configure archiver/jar settings for deterministic file metadata.

Mismatched compiler/source/target settings break runtime compatibility.

maven-compiler-plugin + enforcer + toolchains.

JAR containing version-specific classes for different Java runtimes.

Flexibility vs increased build/test complexity.

Semantic versioning + compatibility checks + automated release notes.

Binary/source compatibility checks in CI before release.

Not native like some tools; approximated via BOM/enforcer/fixed versions.

Coordinated version set across many modules/services on regular cadence.

Coordination overhead and delayed independent delivery.

Integrating non-JVM assets/tools while preserving deterministic lifecycle.

Consistent build environment across dev/CI platforms.

Cache warm-up and I/O overhead if not optimized.

Repository manager outage can block builds/deploys organization-wide.

Backups, geo-replication, mirror failover, cache seeding.

Unbounded parent POM inheritance with opaque plugin side effects.

Explicit minimal conventions + strong automated policy enforcement.

Builds must be deterministic, test-gated, and reproducible on demand.

Trust nothing by default: verify dependencies, plugins, and artifacts continuously.

Optimize feedback loops via module design, selective CI, and cache strategy.

Central standards with team autonomy through well-defined extension points.

Continuously observe build health: duration, flake rate, failure taxonomy.

Align module boundaries with domain boundaries to reduce build coupling.

Maven excellence is disciplined dependency governance plus fast, reproducible delivery.