Clojure Q&A - Recent questions tagged maven

Concurrency bug in tools.deps use of Aether/Maven libs?

Tue, 21 Jul 2026 18:08:46 +0000

Occasionally, I've been seeing this error:

[org.eclipse.aether.internal.impl.DefaultTrackingFileManager] [] {} Failed to read tracking file '/home/sean/.m2/repository/org/apache/maven/maven/3.8.8/_remote.repositories' java.nio.channels.ClosedChannelException

which leads to

Expected HashMap$TreeNode, but was given HashMap$Node, at java.util.HashMap$TreeNode/moveRootToFront (HashMap.java:2020) - runtime error (unexpected type).

And the only solution seems to be to blow away part of the ~/.m2/repository and use -Sforce to recompute/redownload.

Any idea what might cause this sort of error? (Windows/WSL2, Ubuntu 20.04, all the very latest CLI/Clojure etc). See Slack thread for more discussion: https://clojurians.slack.com/archives/C6QH853H8/p1784653752175769

More of the stacktrace:
`
at java.base/sun.nio.ch.FileChannelImpl.ensureOpen(FileChannelImpl.java:169)

    at java.base/sun.nio.ch.FileChannelImpl.lock(FileChannelImpl.java:1676)
    at org.eclipse.aether.internal.impl.DefaultTrackingFileManager.fileLock(DefaultTrackingFileManager.java:171)
    at org.eclipse.aether.internal.impl.DefaultTrackingFileManager.read(DefaultTrackingFileManager.java:65)
    at org.eclipse.aether.internal.impl.EnhancedLocalRepositoryManager.readRepos(EnhancedLocalRepositoryManager.java:220)
    at org.eclipse.aether.internal.impl.EnhancedLocalRepositoryManager.checkFind(EnhancedLocalRepositoryManager.java:151)
    at org.eclipse.aether.internal.impl.EnhancedLocalRepositoryManager.find(EnhancedLocalRepositoryManager.java:128)
    at org.eclipse.aether.internal.impl.DefaultArtifactResolver.resolve(DefaultArtifactResolver.java:360)
    at org.eclipse.aether.internal.impl.DefaultArtifactResolver.resolveArtifacts(DefaultArtifactResolver.java:261)
    at org.eclipse.aether.internal.impl.DefaultArtifactResolver.resolveArtifact(DefaultArtifactResolver.java:243)
    at org.apache.maven.repository.internal.DefaultModelResolver.resolveModel(DefaultModelResolver.java:158)
    at org.apache.maven.repository.internal.DefaultModelResolver.resolveModel(DefaultModelResolver.java:204)
    at org.apache.maven.model.building.DefaultModelBuilder.readParentExternally(DefaultModelBuilder.java:1035)
    at org.apache.maven.model.building.DefaultModelBuilder.readParent(DefaultModelBuilder.java:827)
    at org.apache.maven.model.building.DefaultModelBuilder.build(DefaultModelBuilder.java:336)
    at org.apache.maven.model.building.DefaultModelBuilder.build(DefaultModelBuilder.java:248)
    at org.apache.maven.repository.internal.DefaultArtifactDescriptorReader.loadPom(DefaultArtifactDescriptorReader.java:293)
    at org.apache.maven.repository.internal.DefaultArtifactDescriptorReader.readArtifactDescriptor(DefaultArtifactDescriptorReader.java:183)
    at org.eclipse.aether.internal.impl.DefaultRepositorySystem.readArtifactDescriptor(DefaultRepositorySystem.java:269)
    at clojure.tools.deps.extensions.maven$read_descriptor.invokeStatic(maven.clj:117)
    at clojure.tools.deps.extensions.maven$read_descriptor.invoke(maven.clj:108)
    at clojure.tools.deps.extensions.maven$eval61086$fn__61087.invoke(maven.clj:148)

How to access non-jar artifacts (aar, zip) downloaded via tools.deps in build.clj?

Wed, 24 Dec 2025 08:55:46 +0000

I want to access an aar/zip artifact in build.clj that's already downloaded via deps.edn:

{:deps
 {com.newrelic.agent.android/android-agent {:local/root "build/jars/android-agent.jar"
                                            :doc        "extracted from aar"}
  com.newrelic.agent.java/newrelic-api     {:local/root "build/jars/newrelic-api.jar"
                                            :doc        "extracted from newrelic-java.zip"}}
 :aliases
 {:build {:deps       {io.github.clojure/tools.build            {:mvn/version "0.10.11"}
                       com.newrelic.agent.java/newrelic-java    {:mvn/version "8.25.1"
                                                                 :extension   "zip"}
                       com.newrelic.agent.android/android-agent {:mvn/version "7.6.14"
                                                                 :extension   "aar"}}
          :ns-default build}}}

In build.clj I need to unpack this zip and extract a jar from it.
And I don't have to hardcode .m2 paths or duplicate the version.

How can it be done?

See https://github.com/clojure/tools.deps/blob/46661e929ab702d0ee532188edb58d06b39cef6c/src/main/clojure/clojure/tools/deps/extensions/maven.clj#L172

How can I ensure that a private Maven coordinate cannot be shadowed in a public repository?

Wed, 16 Oct 2024 11:08:07 +0000

Given a deps.edn file with a :mvn/repos entry for a private Maven repository and a dependency on a Maven coordinate that lives in that repository, how can I mitigate the risk of that coordinate getting shadowed / hijacked in one of the default public repositories?

Possible solutions:

Allow pinning a Maven dependency to a particular repository
Allow declaring priority order of Maven repositories (in the example scenario, the private repository would then get the highest priority and always be checked before the other ones)
Allow pinning a Maven dependency to a particular signing key and require it be signed (but looks like tools.deps currently doesn't support verifying signed artifacts?)

Improve error message for tools.deps when m2 permissions do not allow write

Mon, 29 Jan 2024 15:34:07 +0000

I've encountered this error and it took a while to figure out.

For some reason downloading eclipse artifacts was failing.
It was very frustrating.
I found the issue - to be caused by wrong permissions for directories under $HOME/.m2/repository.

Downloading deps failed to write any files to local Maven repo and that triggered a fail in deps resolving for my project.
The error was related to FileNotFound - and not "I can't write to this directory" .
It was more confusing since I had some dependencies in that directory (probably from an previous download).

I suspect the directory permissions where changed by mounting the local maven repo inside a docker container.

I reported this on slack and created this question as suggested by Alex Miller.
He mentioned this might be caused by maven libraries and out of control of tools.deps.

IMO I find it strange that maven libs don't error out when trying to create the local file and we get an exception when trying to read the file by tools.deps.

Steps to reproduce:

rm -rf ~/.m2/repository/org/eclipse 
mkdir -p ~/.m2/repository/org/eclipse/
chown root:root ~/.m2/repository/org/eclipse
clojure -Sdeps '{:deps {info.sunng/ring-jetty9-adapter {:mvn/version "0.22.0"}}}'

Exception

clojure -Sdeps '{:deps {info.sunng/ring-jetty9-adapter {:mvn/version "0.22.0"}}}'
Warning: failed to load the S3TransporterFactory class
Warning: failed to load the S3TransporterFactory class
Warning: failed to load the S3TransporterFactory class
Warning: failed to load the S3TransporterFactory class
SLF4J: Failed to load class "org.slf4j.impl.StaticLoggerBinder".
SLF4J: Defaulting to no-operation (NOP) logger implementation
SLF4J: See http://www.slf4j.org/codes.html#StaticLoggerBinder for further details.
Warning: failed to load the S3TransporterFactory class
Warning: failed to load the S3TransporterFactory class
Warning: failed to load the S3TransporterFactory class
Warning: failed to load the S3TransporterFactory class
Error building classpath. Failed to read artifact descriptor for org.eclipse.jetty.websocket:websocket-servlet:jar:11.0.15
org.eclipse.aether.resolution.ArtifactDescriptorException: Failed to read artifact descriptor for org.eclipse.jetty.websocket:websocket-servlet:jar:11.0.15
    at org.apache.maven.repository.internal.DefaultArtifactDescriptorReader.loadPom(Unknown Source)
    at org.apache.maven.repository.internal.DefaultArtifactDescriptorReader.readArtifactDescriptor(Unknown Source)
    at org.eclipse.aether.internal.impl.DefaultRepositorySystem.readArtifactDescriptor(Unknown Source)
    at clojure.tools.deps.extensions.maven$read_descriptor.invokeStatic(maven.clj:115)
    at clojure.tools.deps.extensions.maven$read_descriptor.invoke(maven.clj:106)
    at clojure.tools.deps.extensions.maven$fn__825.invokeStatic(maven.clj:146)
    at clojure.tools.deps.extensions.maven$fn__825.invoke(maven.clj:143)
    at clojure.lang.MultiFn.invoke(MultiFn.java:244)
    at clojure.tools.deps$expand_deps$children_task__463$fn__465$fn__466.invoke(deps.clj:407)
    at clojure.lang.AFn.applyToHelper(AFn.java:152)
    at clojure.lang.AFn.applyTo(AFn.java:144)
    at clojure.core$apply.invokeStatic(core.clj:667)
    at clojure.core$with_bindings_STAR_.invokeStatic(core.clj:1990)
    at clojure.core$with_bindings_STAR_.doInvoke(core.clj:1990)
    at clojure.lang.RestFn.invoke(RestFn.java:425)
    at clojure.lang.AFn.applyToHelper(AFn.java:156)
    at clojure.lang.RestFn.applyTo(RestFn.java:132)
    at clojure.core$apply.invokeStatic(core.clj:671)
    at clojure.core$bound_fn_STAR_$fn__7194.doInvoke(core.clj:2020)
    at clojure.lang.RestFn.invoke(RestFn.java:397)
    at clojure.lang.AFn.call(AFn.java:18)
    at java.base/java.util.concurrent.FutureTask.run(FutureTask.java:317)
    at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1144)
    at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:642)
    at java.base/java.lang.Thread.run(Thread.java:1583)
Caused by: org.eclipse.aether.resolution.ArtifactResolutionException: Could not transfer artifact org.eclipse.jetty.websocket:websocket-servlet:pom:11.0.15 from/to central (https://repo1.maven.org/maven2/): /home/ieugen/.m2/repository/org/eclipse/jetty/websocket/websocket-servlet/11.0.15/websocket-servlet-11.0.15.pom.part.lock (No such file or directory)
    at org.eclipse.aether.internal.impl.DefaultArtifactResolver.resolve(Unknown Source)
    at org.eclipse.aether.internal.impl.DefaultArtifactResolver.resolveArtifacts(Unknown Source)
    at org.eclipse.aether.internal.impl.DefaultArtifactResolver.resolveArtifact(Unknown Source)
    ... 25 more
Caused by: org.eclipse.aether.transfer.ArtifactTransferException: Could not transfer artifact org.eclipse.jetty.websocket:websocket-servlet:pom:11.0.15 from/to central (https://repo1.maven.org/maven2/): /home/ieugen/.m2/repository/org/eclipse/jetty/websocket/websocket-servlet/11.0.15/websocket-servlet-11.0.15.pom.part.lock (No such file or directory)
    at org.eclipse.aether.connector.basic.ArtifactTransportListener.transferFailed(Unknown Source)
    at org.eclipse.aether.connector.basic.BasicRepositoryConnector$TaskRunner.run(Unknown Source)
    at org.eclipse.aether.util.concurrency.RunnableErrorForwarder$1.run(Unknown Source)
    at org.eclipse.aether.connector.basic.BasicRepositoryConnector$DirectExecutor.execute(Unknown Source)
    at org.eclipse.aether.connector.basic.BasicRepositoryConnector.get(Unknown Source)
    at org.eclipse.aether.internal.impl.DefaultArtifactResolver.performDownloads(Unknown Source)
    ... 28 more
Caused by: java.io.FileNotFoundException: /home/ieugen/.m2/repository/org/eclipse/jetty/websocket/websocket-servlet/11.0.15/websocket-servlet-11.0.15.pom.part.lock (No such file or directory)

In tools.deps, get the source of dependencies without downloading

Thu, 09 Nov 2023 17:01:03 +0000

When using the tools.deps API, I would like to resolve dependencies without downloading all of the jars, and I would like the return value to tell me the original URL of the dependency, rather than the path on disk.

The reason is I use bazel + https://github.com/griffinbank/rules_clojure, and if I have the URL, I can immutably cache artifacts in bazel, and have that cache be shared with all other developers at work.

Support of Maven Password Encryption in tools.deps

Mon, 25 Sep 2023 12:09:30 +0000

Hello,

When I try to use Maven Password Encryption, dependency resolution fails with 401 HTTP error code because tools.deps sends encrypted password from settings.xml without decryption. I used the following scenario:
1. Create settings.xml and settings-security.xml with encrypted master and server passwords according to the Maven guide.
2. Add the repository from settings.xml to deps.edn according to Maven authenticated repos guide
3. Ensure that ~/.m2/repository doesn't have some Maven dependency from deps.edn
4. Create pom.xml with the same list of dependencies as those that are in deps.edn
5. Run clj -X:deps tree. The command fails with 401 HTTP error code
6. Run mvn dependency:tree. The command resolves and downloads all dependencies
7. Remove some dependencies from ~/.m2/repository
8. In settings.xml replace encoded server password by plain text server password
9. Run clj -X:deps tree. The command resolves and downloads all dependencies

I've looked to sources of tools.deps and it looks like there is no support of such passwords, but it can be the case that I was looking in wrong places.

Could you please help me to understand - am I using incorrect configuration in deps.edn, or tools.deps doesn't support encrypted Maven passwords?

Programmatically connect dependencies to the maven repos that provide them

Fri, 11 Nov 2022 20:38:29 +0000

As a Clojure developer,
I want to be able to link project dependencies to the maven repos that provide them
so that a) tools that work with dependencies (e.g. nvd-clojure, clj-watson) have more first-hand information to work with, b) I can easily find out custom maven repos that are no longer used and c) get a better understanding in general of what my project is composed of.

Workaround

clj -Sdeps '{:mvn/local-repo "tmp"}' -Stree uses a custom local maven repo to force a redownload of the jars and provides a way to do the above by looking at the messages (e.g. Downloading: org/clojure/clojure/1.11.1/clojure-1.11.1.pom from central), so it can be ok in some cases.

Would you consider simplifying this process by providing a way to get that information as data? I would love to have it in clj -X:deps tree :format :edn for instance.

Support `:mvn/repos` inside an alias

Tue, 08 Nov 2022 19:08:24 +0000

This is similar to https://ask.clojure.org/index.php/11711/set-mvn-local-repo-via-alias, sorry if I should have just added a note there instead of opening another question.

:mvn/repos does not seem to work inside of an alias either -- only at the top level of deps.edn. If this is intentional, it would be a nicer experience if CLI logged some sort of ":mvn/repos is not supported inside of aliases" warning on launch.

t.d.a does not support mvn versions starting with letters.

Thu, 17 Feb 2022 18:17:22 +0000

When I try to download all version of com.google.javascript/closure-compiler-unshaded t.d.a returns nil, digging in the problem I saw that this line is being responsible to the problem since it’s only matching versions starting with number and all the versions of com.google.javascript/closure-compiler-unshaded starts with a letter v.
Is it supposed to work like that or is it a bug?

The executed command was the following.

clj -X:deps find-versions :lib com.google.javascript/closure-compiler-unshaded