Problem resolving correct lib with maven: version managed from

Question

I am using Google Guava in my project.

I am explicitly specifying this version of a lib in one of downstream libraries:

<dependency>
    <groupId>com.google.guava</groupId>
    <artifactId>guava</artifactId>
    <version>19.0</version>
</dependency>

But when I use my lib in the project, it brings the wrong version of Guava:

[INFO] |  +- com.google.guava:guava:jar:28.2-android:compile
[INFO] |  |  +- com.google.guava:failureaccess:jar:1.0.1:compile
[INFO] |  |  +- com.google.guava:listenablefuture:jar:9999.0-empty-to-avoid-conflict-with-guava:compile
[INFO] |  |  +- com.google.code.findbugs:jsr305:jar:3.0.2:compile

I ran maven dependency:tree in verbose mode and I see:

[DEBUG]       com.google.guava:guava:jar:28.2-android:compile (version managed from 19.0)
[DEBUG]          com.google.guava:failureaccess:jar:1.0.1:compile
[DEBUG]          com.google.guava:listenablefuture:jar:9999.0-empty-to-avoid-conflict-with-guava:compile
[DEBUG]          com.google.code.findbugs:jsr305:jar:3.0.2:compile
[DEBUG]          org.checkerframework:checker-compat-qual:jar:2.5.5:compile
[DEBUG]          com.google.errorprone:error_prone_annotations:jar:2.3.4:compile

What does version managed from mean? I do not have anywhere in my project version 28.2-android. How is it resolving to it?

Answer 1

The expression "version managed from" means that the version number was set in <dependencyManagement>.

This is often done in parent POMs. It can be specified directly, or also by a so-called BOM that is loaded with <scope>import</scope>.